Category Archives

18 Articles

Solve Xposed module list become empty on Android 6.0 Marshmallow

0   9063 转为繁体

中文版本

Recently I found module list in Xposed become empty after I upgrade my Nexus5 to 6.0.1 (M4B30Z, Dec 2016). And all the modules are not activating. So I open logcat and see the following:

Rovo89 said on a xda post that this file should be created if any module is activated. But somehow it didn’t do so on my Nexus5. So I create one myself and set correct permission (0644) and uid (you can run the Xposed Installer app and check the uid through ps |grep xposed). Then I reboot and check logcat again:

Looks like it’s still not working.

Then I realise that Android started to set SELinux to enforce from Lollipop (5.0) so this should be the problem. (We can use dmesg|grep audit to check if the problem really related to SELinux. ) I compared a random file under /data/data to the file we just created:

So all we need to do is to change this conf/modules.list to u:object_r:app_data_file:s0:c512,c768 as well

restorecon is a applet shipped with toybox, we can also use chcon to manually set SELinux context.

解决Android 6.0 Marshmallow中Xposed的模块列表为空

4   21521 转为繁体

English Version

升级Nexus5 到6.0.1 (M4B30Z, Dec 2016)之后,Xposed的模块列表变成空的了,所有的模块也都失效了。没有xposed,怎么种庄稼。于是我打开logcat看了一眼。

rovo89在xda的QA帖中说一般情况下这个文件会在启用任意一个模块后创建。然而现在它并没有被创建。于是我去建了一个,然后chmod 644以及chown到应用到uid(可以通过启动应用之后ps|grep xposed查看uid,形如u0_a??),重启了一下,再瞄了一眼logcat。

好像哪里不对

想起来Android从萝莉棒开始SELinux就是enforce了,所以大概是这个问题。(我们可以通过dmesg|grep audit来查看被SELinux过滤的各种奇怪操作。)于是看了一下默认的文件context和我们刚创建的文件的context:

那么我们把这个conf/modules.list也改成u:object_r:app_data_file:s0:c512,c768这个context好了

restorecon是toybox中带的一个applet,我们也可以用chcon来手动更改context。

白猫Project/白猫プロジェクト 作死

11   61989 转为繁体

这货貌似是卖萌黑猫根本不是续作

我开始想不加壳就算了,java不混淆就算了,加密的so一模一样的是来坑爹的吧www MD5都一样的摔

后来我发现被坑了

原来那一段AES密钥不是给游戏通信用的233

然后我就发现了原来不是这样的2333

但是终究还是搞定了23333

CryptoPrefs

用于加密userHash和登陆token,保存在key=md5(‘Account’)的shared_prefs中;AES-128-CBC, ZerosPadding

Cipher

除首次进入游戏外,以后登陆都是用userHash做key;AES-256-CBC, PKCS7

好好好可以作死了

←Click me

附:ARM F5之后的getKeySpec伪代码,证明之前的猜想是正确的 Read More