Skip to content

Instantly share code, notes, and snippets.

@rlaphoenix
Forked from xhlove/peacock.js
Created January 5, 2024 03:14
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rlaphoenix/76ef00701383d74503c2efb6d6e14cf5 to your computer and use it in GitHub Desktop.
Save rlaphoenix/76ef00701383d74503c2efb6d6e14cf5 to your computer and use it in GitHub Desktop.
peacock HMAC key frida hook script, use frida 14.2.18
function jhexdump(array) {
if(!array) return;
console.log("---------jhexdump start---------");
var ptr = Memory.alloc(array.length);
for(var i = 0; i < array.length; ++i)
Memory.writeS8(ptr.add(i), array[i]);
console.log(hexdump(ptr, {offset: 0, length: array.length, header: false, ansi: false}));
console.log("---------jhexdump end---------");
}
function java_hook(){
Java.perform(function(){
let HMACCls = Java.use("com.sky.sps.security.HMAC");
let SecurityUtilsCls = Java.use("com.sky.sps.utils.SecurityUtils");
let SecretKeySpecCls = Java.use("javax.crypto.spec.SecretKeySpec");
let MacCls = Java.use("javax.crypto.Mac");
HMACCls.calculate.overload('java.lang.String', 'boolean').implementation = function(text, flag){
console.log("---------enter calculate---------");
let ret = this.calculate(text, flag);
console.log(text, flag, ret);
jhexdump(ret);
return ret;
}
SecurityUtilsCls.createMD5Digest.overload('java.lang.String').implementation = function(text){
console.log("---------enter createMD5Digest---------");
let ret = this.createMD5Digest(text);
console.log(text, ret);
return ret;
}
SecretKeySpecCls.$init.overload('[B', 'java.lang.String').implementation = function(key, method){
console.log("---------enter SecretKeySpec init---------");
jhexdump(key);
let ret = this.$init(key, method);
console.log(key, method, ret);
return ret;
}
MacCls.doFinal.overload('[B').implementation = function(data){
console.log("---------enter SecretKeySpec init---------");
jhexdump(data);
let ret = this.doFinal(data);
console.log(data, ret);
return ret;
}
})
}
setImmediate(java_hook)
// frida 14.2.18
// frida -U -n com.peacocktv.peacockandroid -l peacock.js -o peacock.log
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment