This commit is contained in:
5ec1cff
2024-07-18 12:48:45 +08:00
parent f14f79e90c
commit 979c51009c
3 changed files with 12 additions and 11 deletions

View File

@@ -60,7 +60,6 @@ fi
. "$TMPDIR/verify.sh"
extract "$ZIPFILE" 'customize.sh' "$TMPDIR/.vunzip"
extract "$ZIPFILE" 'verify.sh' "$TMPDIR/.vunzip"
extract "$ZIPFILE" 'target.txt' "$TMPDIR"
ui_print "- Extracting module files"
extract "$ZIPFILE" 'module.prop' "$MODPATH"
@@ -68,7 +67,8 @@ extract "$ZIPFILE" 'post-fs-data.sh' "$MODPATH"
extract "$ZIPFILE" 'service.sh' "$MODPATH"
extract "$ZIPFILE" 'service.apk' "$MODPATH"
extract "$ZIPFILE" 'sepolicy.rule' "$MODPATH"
chmod +x "$MODPATH/daemon"
extract "$ZIPFILE" 'daemon' "$MODPATH"
chmod 755 "$MODPATH/daemon"
mkdir "$MODPATH/zygisk"
@@ -90,12 +90,12 @@ mv "$MODPATH/libinject.so" "$MODPATH/inject"
chmod 755 "$MODPATH/inject"
CONFIG_DIR=/data/adb/tricky_store
if [ ! -d $CONFIG_DIR ]; then
if [ ! -d "$CONFIG_DIR" ]; then
ui_print "- Creating configuration directory"
mkdir -p $CONFIG_DIR
if [ ! -f $CONFIG_DIR/target.txt ]; then
mkdir -p "$CONFIG_DIR"
if [ ! -f "$CONFIG_DIR/target.txt" ]; then
ui_print "- Adding default scope"
extract "$ZIPFILE" 'daemon' "$MODPATH"
mv "$TMPDIR/target.txt"
extract "$ZIPFILE" 'target.txt' "$TMPDIR"
mv "$TMPDIR/target.txt" "$CONFIG_DIR/target.txt"
fi
fi

View File

@@ -42,7 +42,7 @@ object KeystoreInterceptor : BinderInterceptor() {
val response =
SecurityLevelInterceptor.getKeyResponse(callingUid, descriptor.alias)
?: return@runCatching
Logger.i("use generated key $callingUid ${descriptor.alias}")
Logger.i("generate key for uid=$callingUid alias=${descriptor.alias}")
val p = Parcel.obtain()
p.writeNoException()
p.writeTypedObject(response, 0)
@@ -75,6 +75,7 @@ object KeystoreInterceptor : BinderInterceptor() {
if (chain != null) {
val newChain = CertHack.hackCertificateChain(chain)
Utils.putCertificateChain(response, newChain)
Logger.i("hacked cert of uid=$callingUid")
p.writeNoException()
p.writeTypedObject(response, 0)
return OverrideReply(0, p)
@@ -92,13 +93,13 @@ object KeystoreInterceptor : BinderInterceptor() {
private var injected = false
fun tryRunKeystoreInterceptor(): Boolean {
Logger.i("trying to register keystore interceptor ...")
Logger.i("trying to register keystore interceptor ($triedCount) ...")
val b = ServiceManager.getService("android.system.keystore2.IKeystoreService/default") ?: return false
val bd = getBinderBackdoor(b)
if (bd == null) {
// no binder hook, try inject
if (triedCount >= 3) {
Logger.e("inject tried but still has no backdoor, exit")
Logger.e("tried injection but still has no backdoor, exit")
exitProcess(1)
}
if (!injected) {

View File

@@ -18,7 +18,7 @@ open class BinderInterceptor : Binder() {
val reply = Parcel.obtain()
try {
if (!b.transact(0xdeadbeef.toInt(), data, reply, 0)) {
Logger.e("remote return false!")
Logger.d("remote return false!")
return null
}
Logger.d("remote return true!")