add frida script and key_func_trait for qq on version 9.9.17-31363 (64bit)
add frida script and key_func_trait for qq on version 9.9.17-31363 (64bit)
procedure:
0. find the key_function_addr
1. close qq and open qq, stop at login UI
2. python pkey_get\pcqq_get_key.py
3. pkey will show as below
logs:
14252 1
['C:\\Program Files (x86)\\Tencent\\QQNT\\QQ.exe']
QQ pid is: 14252
104493056 0
[*] wrapper.node pattern FOUND!!
[*] 41 56 56 57 53 48 83 ec 28 44 89 ce 4c 89 c7 49 89 d6 48 89 cb 48 8d 15 17 d3 65 01 b9 08 00 00
[*] [{'address': '0x7ffc75fe5c70', 'size': 32}]
[*] 0x7ffc75fe5c70
Bytecode at 0x7ffc75fe5c70:
Bytecode: 41 56 56 57 53 48 83 ec 28 44 89 ce 4c 89 c7 49 104493056 0
[*] wrapper.node pattern FOUND!!
[*] 41 56 56 57 53 48 83 ec 28 31 f6 48 85 d2 74 2d 8b 59 30 85 db 7e 26 48 89 d7 4c 8b 71 28 31 f6
[*] [{'address': '0x7ffc75fe55b0', 'size': 32}]
[*] 0x7ffc75fe55b0
Bytecode at 0x7ffc75fe55b0:
Bytecode: 41 56 56 57 53 48 83 ec 28 31 f6 48 85 d2 74 2d hooked.
Memory at 0x1b2f1cee730 (16 bytes as chars): @y.___pkey______
Memory at 0x1b2f1cee6e0 (16 bytes as chars): @y.___pkey______
...
Memory at 0x1b314ec2050 (16 bytes as chars): @y.___pkey______
Memory at 0x1b314ec2010 (16 bytes as chars): @y.___pkey______
合并状态:未合并 4 条评论