eybisi

#!/usr/bin/python
from androguard.misc import *
import sys
from Crypto.Cipher import ARC4
from androguard.core.androconf import show_logging
import logging
from base64 import b64decode

show_logging(level=logging.FATAL)

eybisi

import frida
import sys
#inds isng  llg w. e  HthitheoftheAh,urnolik inefe  yo blrhot in owace
#abcdefghijklmnopqrstuvwxyz., ABCDEFGHIJKLMNOPQRSTUVWXYZ
#abcdefghilnorstuwy.,AH   
session = frida.attach("magic")
script = session.create_script("""
pool2 = ['e ',' H','is','no','of',' g','bl','ow','ur',' w','in','yo'] 
pool3 = ["ds ","hot","the",' yo',"ace","thi",'Ah,',' in',' bl','lik']
pool = 'abcdefghilnorstuwy.,AH '

eybisi

import ghidra.app.script.GhidraScript
import exceptions
from ghidra.program.model.address import AddressOutOfBoundsException
from ghidra.program.model.symbol import SourceType


def xor_block(faddr,saddr,size):

	
	first_block = getBytes(toAddr(faddr),size).tolist()

eybisi

var unlinkPtr = Module.findExportByName(null, 'unlink');
// remove bypass
Interceptor.replace(unlinkPtr, new NativeCallback( function (a){
     console.log("[+] Unlink : " +  Memory.readUtf8String(ptr(a)))

}, 'int', ['pointer']));

var timePtr = Module.findExportByName(null, 'time');
// time bypass
Interceptor.replace(timePtr, new NativeCallback( function (){

eybisi

#/usr/bin/python
#python checkgp.py list.txt
import requests
import sys

f = open(sys.argv[1])
r = f.readlines()
for i in r:
    try:
        req = requests.get("https://play.google.com/store/apps/details?id="+i)

eybisi

Java.perform(function() {

    var ThreadDef = Java.use('java.lang.Thread');
    var ThreadObj = ThreadDef.$new();

    var dalvik = Java.use("android.telephony.TelephonyManager") 
    dalvik.getSimOperator.overload().implementation = function(){
        console.log("[+] sim operator Catched -> ")
        stackTrace()
        return "302"

eybisi

//frida -U -f appinventor.ai_turkprogrammerman.rubiko -l ninja.js --no-pause
Java.perform(function() {

    var f = Java.use("appinventor.ai_turkprogrammerman.rubiko.Screen1$frame")
    f.apply0.implementation = function(a){
        //send(a.selector)
        return this.apply0(a)

    }
    var f2 = Java.use("com.tiziano1960.cryptoextension.cryptoextension")

eybisi

import sys
from Crypto.Cipher import ARC4
import base64

f = open(sys.argv[1],"r")

r = f.readlines()
for l in r:
    c = ARC4.new(l[:12].encode("utf8"))
    h = base64.b64decode(l[12:-1]).decode("utf-8")

eybisi

#get apks from server? wget -np -e robots=off -m site.com/apk/folder/
#Place all apks in the same dir as py file or change os.listdir parameter
#you can get del.js from my repo https://github.com/eybisi/fridaScripts/blob/master/del.js
import os
from androguard.core.bytecodes import apk
import frida
import time
device = frida.get_usb_device()
files = [f for f in os.listdir("./")]
for f in files:

eybisi

var DEBUG = false
console.log('Starting ..')

const YourCountry = 'Americans'
const HACKS = ['Cost','BuildTime','Armor','income','speed','firepower']

function processCountry(rawCountry: NativePointer) {
    
    
  const buffer = rawCountry.readByteArray(0x1A9);