update patches for 16.1.10
This commit is contained in:
96
patches/frida-core/0007-Florida-update-python-script.patch
Normal file
96
patches/frida-core/0007-Florida-update-python-script.patch
Normal file
@@ -0,0 +1,96 @@
|
||||
From cface25f4bfff96704bd35678593286536b0ffff Mon Sep 17 00:00:00 2001
|
||||
From: Ylarod <me@ylarod.cn>
|
||||
Date: Tue, 18 Jul 2023 19:55:59 +0800
|
||||
Subject: [PATCH 7/9] Florida: update python script
|
||||
|
||||
---
|
||||
src/anti-anti-frida.py | 59 +++++++++++++++++++++++++++++-------------
|
||||
1 file changed, 41 insertions(+), 18 deletions(-)
|
||||
|
||||
diff --git a/src/anti-anti-frida.py b/src/anti-anti-frida.py
|
||||
index b4b8dca6..d1ce5f62 100644
|
||||
--- a/src/anti-anti-frida.py
|
||||
+++ b/src/anti-anti-frida.py
|
||||
@@ -2,36 +2,59 @@ import lief
|
||||
import sys
|
||||
import random
|
||||
import os
|
||||
-
|
||||
+
|
||||
+def log_color(msg):
|
||||
+ print(f"\033[1;31;40m{msg}\033[0m")
|
||||
+
|
||||
if __name__ == "__main__":
|
||||
input_file = sys.argv[1]
|
||||
- print(f"[*] Patch frida-agent: {input_file}")
|
||||
- random_name = "".join(random.sample("ABCDEFGHIJKLMNO", 5))
|
||||
- print(f"[*] Patch `frida` to `{random_name}``")
|
||||
-
|
||||
+ random_charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
|
||||
+ log_color(f"[*] Patch frida-agent: {input_file}")
|
||||
binary = lief.parse(input_file)
|
||||
-
|
||||
+
|
||||
if not binary:
|
||||
+ log_color(f"[*] Not elf, exit")
|
||||
exit()
|
||||
+
|
||||
+ random_name = "".join(random.sample(random_charset, 5))
|
||||
+ log_color(f"[*] Patch `frida` to `{random_name}`")
|
||||
|
||||
for symbol in binary.symbols:
|
||||
if symbol.name == "frida_agent_main":
|
||||
symbol.name = "main"
|
||||
-
|
||||
+
|
||||
if "frida" in symbol.name:
|
||||
symbol.name = symbol.name.replace("frida", random_name)
|
||||
-
|
||||
+
|
||||
if "FRIDA" in symbol.name:
|
||||
symbol.name = symbol.name.replace("FRIDA", random_name)
|
||||
-
|
||||
+
|
||||
+ all_patch_string = ["FridaScriptEngine", "GLib-GIO", "GDBusProxy", "GumScript"] # 字符串特征修改 尽量与源字符一样
|
||||
+ for section in binary.sections:
|
||||
+ if section.name != ".rodata":
|
||||
+ continue
|
||||
+ for patch_str in all_patch_string:
|
||||
+ addr_all = section.search_all(patch_str) # Patch 内存字符串
|
||||
+ for addr in addr_all:
|
||||
+ patch = [ord(n) for n in list(patch_str)[::-1]]
|
||||
+ log_color(f"[*] Patching section name={section.name} offset={hex(section.file_offset + addr)} orig:{patch_str} new:{''.join(list(patch_str)[::-1])}")
|
||||
+ binary.patch_address(section.file_offset + addr, patch)
|
||||
+
|
||||
binary.write(input_file)
|
||||
-
|
||||
- # gum-js-loop thread
|
||||
- random_name = "".join(random.sample("abcdefghijklmn", 11))
|
||||
- print(f"[*] Patch `gum-js-loop` to `{random_name}`")
|
||||
+
|
||||
+ # thread_gum_js_loop
|
||||
+ random_name = "".join(random.sample(random_charset, 11))
|
||||
+ log_color(f"[*] Patch `gum-js-loop` to `{random_name}`")
|
||||
os.system(f"sed -b -i s/gum-js-loop/{random_name}/g {input_file}")
|
||||
-
|
||||
- # gmain thread
|
||||
- random_name = "".join(random.sample("abcdefghijklmn", 5))
|
||||
- print(f"[*] Patch `gmain` to `{random_name}`")
|
||||
- os.system(f"sed -b -i s/gmain/{random_name}/g {input_file}")
|
||||
\ No newline at end of file
|
||||
+
|
||||
+ # thread_gmain
|
||||
+ random_name = "".join(random.sample(random_charset, 5))
|
||||
+ log_color(f"[*] Patch `gmain` to `{random_name}`")
|
||||
+ os.system(f"sed -b -i s/gmain/{random_name}/g {input_file}")
|
||||
+
|
||||
+ # thread_gdbus
|
||||
+ random_name = "".join(random.sample(random_charset, 5))
|
||||
+ log_color(f"[*] Patch `gdbus` to `{random_name}`")
|
||||
+ os.system(f"sed -b -i s/gdbus/{random_name}/g {input_file}")
|
||||
+
|
||||
+ log_color(f"[*] Patch Finish")
|
||||
\ No newline at end of file
|
||||
--
|
||||
2.39.3 (Apple Git-145)
|
||||
|
||||
Reference in New Issue
Block a user