能力值：
( LV2，RANK：10 )
|
-
-
2 楼
d6bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6K6k6h3y4#2M7X3W2@1P5g2)9J5k6i4c8W2L8X3y4W2L8Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8X3c8W2P5q4)9J5k6i4m8Z5M7q4)9J5c8X3!0H3k6h3&6K6L8%4g2J5j5$3g2Q4x3V1k6V1k6i4c8S2K9h3I4Q4x3V1j5I4y4#2)9J5y4X3&6T1M7%4m8Q4x3@1u0Q4x3U0k6F1j5Y4y4H3i4K6y4n7i4@1f1^5i4@1u0r3i4K6V1&6i4@1f1@1i4@1t1^5i4@1q4m8i4@1f1$3i4K6W2n7i4@1t1@1i4@1f1$3i4K6V1$3i4@1t1&6i4@1f1@1i4@1u0q4i4@1u0r3
|
能力值：
( LV13，RANK：240 )
|
-
-
5 楼
iwang王大军
88eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6K6k6h3y4#2M7X3W2@1P5g2)9J5k6i4c8W2L8X3y4W2L8Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8X3c8W2P5q4)9J5k6i4m8Z5M7q4)9J5c8X3!0H3k6h3&6K6L8%4g2J5j5$3g2Q4x3V1k6V1k6i4c8S2K9h3I4Q4x3V1j5I4y4H3`.`. 这个更方便[em_1]
有部分加壳的没法用。
|
能力值：
( LV2，RANK：10 )
|
-
-
7 楼
mprop有源码啊，就不能先搜下吗
9e2K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6K6k6h3q4J5j5$3S2Q4x3@1k6#2N6r3j5^5i4K6y4p5i4K6t1#2c8e0u0Q4x3U0f1&6b7#2)9J5y4e0V1K6i4K6t1$3j5h3#2H3i4K6y4n7M7g2)9K6c8r3#2H3M7X3!0H3i4K6t1$3j5h3#2H3i4K6y4n7N6s2W2H3k6g2)9K6c8l9`.`.
|
能力值：
( LV2，RANK：10 )
|
-
-
8 楼
mprop有源码啊，就不能先搜下吗
b98K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6K6k6h3q4J5j5$3S2Q4x3@1k6#2N6r3j5^5i4K6y4p5i4K6t1#2c8e0u0Q4x3U0f1&6b7#2)9J5y4e0V1K6i4K6t1$3j5h3#2H3i4K6y4n7M7g2)9K6c8r3#2H3M7X3!0H3i4K6t1$3j5h3#2H3i4K6y4n7N6s2W2H3k6g2)9K6c8l9`.`.
|
能力值：
( LV13，RANK：240 )
|
-
-
9 楼
ucantseeme
mprop有源码啊，就不能先搜下吗
39aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6K6k6h3q4J5j5$3S2Q4x3@1k6#2N6r3j5^5i4K6y4p5i4K6t1#2c8e0u0Q4x3U0f1&6b7#2)9J5y4e0V1K6i4K6t1$3j5h3#2H3i4K6y4n7M7g2)9K6c8r3#2H3M7X3!0H3i4K6t1$3j5h3#2H3i4K6y4n7N6s2W2H3k6g2)9K6c8l9`.`.
那要麻烦你把源码找出来，那里面都是BIN文件。
|
能力值：
( LV4，RANK：50 )
|
-
-
10 楼
大佬，mprop作者在帖子下面的回复中发出了源码
/**
* Copyright (C) 2018 netsniffer
* mprop v1.0, 2017/01/19
* https://bbs.pediy.com/thread-215311.htm
*/
#include <unistd.h>
#include <ctype.h>
#include <stdio.h>
#include <errno.h>
#include <memory.h>
#include <string.h>
#include <sys/ptrace.h>
#include <sys/system_properties.h>
#define PROP_NAME_MAX 32
#define PROP_VALUE_MAX 92
static void dump_hex(const char* buf, int len)
{
const uint8_t *data = (const uint8_t*)buf;
int i;
char ascii_buf[17];
ascii_buf[16] = '\0';
for (i = 0; i < len; i++) {
int val = data[i];
int off = i % 16;
if (off == 0)
printf("%08x ", i);
printf("%02x ", val);
ascii_buf[off] = isprint(val) ? val : '.';
if (off == 15)
printf(" %-16s\n", ascii_buf);
}
i %= 16;
if (i) {
ascii_buf[i] = '\0';
while (i++ < 16)
printf(" ");
printf(" %-16s\n", ascii_buf);
}
}
#define ORI_INST 0x2e6f72
#define HACK_INST 0x2e6f73
int main(int argc, char **argv)
{
FILE *fp;
int m, rc;
int patch_count;
unsigned long maps, mape, addr, mlen;
unsigned long real_val, real_vaddr;
char perms[5];
char line[512];
char *buffer, *ro;
char* name = NULL, *value = NULL;
uint32_t tmp;
uint32_t dest_inst = ORI_INST;
uint32_t mod_inst = HACK_INST;
int restore = 0, verbose = 0;
for (m = 1; m < argc; m++) {
if (argv[m] == NULL)
continue;
if (argv[m][0] != '-') {
break;
}
if (argv[m][1] == 'r') {
restore = 1;
dest_inst = HACK_INST;
mod_inst = ORI_INST;
} else if (argv[m][1] == 'v') {
verbose = 1;
}
}
if (restore) {
fprintf(stderr, "restore ...\n");
}
else {
if (argc - m >= 2) {
// fprintf(stderr, "Usage: %s [-r] [-v] [prop_name] [prop_value]\n"
// "e.g.: %s ro.debuggable 1\n", argv[0], argv[0]);
name = argv[m];
value = argv[m+1];
}
fprintf(stderr, "start hacking ...\n");
}
fp = fopen("/proc/1/maps", "r");
if (!fp) {
perror("!! fopen ");
return 1;
}
// 00008000-000cb000 r-xp 00000000 00:01 6999 /init
memset(line, 0, sizeof(line));
while (fgets(line, sizeof(line), fp)) {
int main_exe = (strstr(line, "/init") != NULL) ? 1 : 0;
if (main_exe) {
rc = sscanf(line, "%lx-%lx %4s ", &maps, &mape, perms);
if (rc < 3) {
perror("!! sscanf ");
return 1;
}
if (perms[0] == 'r' && perms[1] == '-' && perms[2] == 'x' && perms[3] == 'p') {
break;
}
}
}
fclose(fp);
fprintf(stderr, "target mapped area: 0x%lx-0x%lx\n", maps, mape);
mlen = mape - maps;
buffer = (char *) calloc(1, mlen + 16);
if (!buffer) {
perror("!! malloc ");
return 1;
}
rc = ptrace(PTRACE_ATTACH, 1, 0, 0);
if (rc < 0) {
perror("!! ptrace ");
return rc;
}
for (addr = maps; addr < mape; addr += 4) {
tmp = ptrace(PTRACE_PEEKTEXT, 1, (void *) addr, 0);
*((uint32_t*)(buffer + addr - maps)) = tmp;
}
if (verbose) {
dump_hex(buffer, mlen);
}
for (m = 0; m < mlen; ++m) {
if (dest_inst == *(uint32_t*)(buffer+m)) { // 72 6F 2E 00 == ro.\0
break;
}
}
if (m >= mlen) {
fprintf(stderr, ">> inject position not found, may be already patched!\n");
}
else {
real_vaddr = maps + m;
real_val = *(uint32_t*)(buffer+m);
fprintf(stderr, ">> patching at: 0x%lx [0x%lx -> 0x%08x]\n", real_vaddr, real_val, mod_inst);
tmp = mod_inst;
rc = ptrace(PTRACE_POKETEXT, 1, (void *)real_vaddr, (void*)tmp);
if (rc < 0) {
perror("!! patching failed ");
}
tmp = ptrace(PTRACE_PEEKTEXT, 1, (void *)real_vaddr, 0);
fprintf(stderr, ">> %s reread: [0x%lx] => 0x%08x\n", restore ? "restored!" : "patched!", real_vaddr, tmp);
}
free(buffer);
rc = ptrace(PTRACE_DETACH, 1, 0, 0);
if (!restore && (name && value && name[0] != 0)) {
char propbuf[PROP_VALUE_MAX];
fprintf(stderr, "-- setprop: [%s] = [%s]\n", name, value);
__system_property_set(name, value);
usleep(400000);
__system_property_get(name, propbuf);
fprintf(stderr, "++ getprop: [%s] = [%s]\n", name, propbuf);
}
return rc;
}
|
能力值：
( LV2，RANK：10 )
|
-
-
13 楼
iwang王大军
e7fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6K6k6h3y4#2M7X3W2@1P5g2)9J5k6i4c8W2L8X3y4W2L8Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8X3c8W2P5q4)9J5k6i4m8Z5M7q4)9J5c8X3!0H3k6h3&6K6L8%4g2J5j5$3g2Q4x3V1k6V1k6i4c8S2K9h3I4Q4x3V1j5I4y4H3`.`. 这个更方便[em_1]
试了，这个方法有效。
|
