ITADN

add frida script and key_func_trait for qq on version 9.9.17-31363 (64bit)

#56Pull Requestheshanu3d 创建于 2025-03-06
H
heshanu3dcommented
add frida script and key_func_trait for qq on version 9.9.17-31363 (64bit) procedure: 0. find the key_function_addr 1. close qq and open qq, stop at login UI 2. python pkey_get\pcqq_get_key.py 3. pkey will show as below logs: 14252 1 ['C:\\Program Files (x86)\\Tencent\\QQNT\\QQ.exe'] QQ pid is: 14252 104493056 0 [*] wrapper.node pattern FOUND!! [*] 41 56 56 57 53 48 83 ec 28 44 89 ce 4c 89 c7 49 89 d6 48 89 cb 48 8d 15 17 d3 65 01 b9 08 00 00 [*] [{'address': '0x7ffc75fe5c70', 'size': 32}] [*] 0x7ffc75fe5c70 Bytecode at 0x7ffc75fe5c70: Bytecode: 41 56 56 57 53 48 83 ec 28 44 89 ce 4c 89 c7 49 104493056 0 [*] wrapper.node pattern FOUND!! [*] 41 56 56 57 53 48 83 ec 28 31 f6 48 85 d2 74 2d 8b 59 30 85 db 7e 26 48 89 d7 4c 8b 71 28 31 f6 [*] [{'address': '0x7ffc75fe55b0', 'size': 32}] [*] 0x7ffc75fe55b0 Bytecode at 0x7ffc75fe55b0: Bytecode: 41 56 56 57 53 48 83 ec 28 31 f6 48 85 d2 74 2d hooked. Memory at 0x1b2f1cee730 (16 bytes as chars): @y.___pkey______ Memory at 0x1b2f1cee6e0 (16 bytes as chars): @y.___pkey______ ... Memory at 0x1b314ec2050 (16 bytes as chars): @y.___pkey______ Memory at 0x1b314ec2010 (16 bytes as chars): @y.___pkey______
合并状态:未合并 4 条评论