Skip to content

Instantly share code, notes, and snippets.

@acuifex
Last active April 20, 2023 11:24
Show Gist options
  • Save acuifex/1b80ac3490381801c79f9ea20ab763f4 to your computer and use it in GitHub Desktop.
Save acuifex/1b80ac3490381801c79f9ea20ab763f4 to your computer and use it in GitHub Desktop.
steam shared secret dump script
# https://novanoir.moe/blog/2022/11/20/%E3%80%90ROOT%20Android%E3%80%91Steam%203.0%20%E5%AF%BC%E5%87%BA%E4%BB%A4%E7%89%8C%E7%9A%84%E6%95%B0%E7%A7%8D%E6%96%B9%E6%B3%95/
import json
import frida
import sys
package = "com.valvesoftware.android.steam.community"
cmd = """
'use strict;'
if (Java.available) {
Java.perform(function() {
//Cipher stuff
const Cipher = Java.use('javax.crypto.Cipher');
Cipher.doFinal.overload('[B').implementation = function (input) {
var result = this.doFinal.overload('[B').call(this, input);
send(result);
}
}
)}
"""
def parse_hook(cmd_):
print('<li> Parsing hook...')
script = session.create_script(cmd_)
script.on('message', on_message)
script.load()
def on_message(message, _):
try:
if message:
if message['type'] == 'send':
result = "".join(chr(i) for i in message['payload'])
print(json.dumps(json.loads(result), indent=2, ensure_ascii=False))
except Exception as e:
print(e)
if __name__ == '__main__':
try:
print('</li><li> Spawning ' + package)
pid = frida.get_usb_device().spawn(package)
session = frida.get_usb_device().attach(pid)
parse_hook(cmd)
frida.get_usb_device().resume(pid)
print('')
sys.stdin.read()
except KeyboardInterrupt:
sys.exit(0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment