laoshu666/hermes-seagull/seagull-reverse

# Frida hook 模板
import frida
import sys
def on_message(message, data):
    print(f"[{message['type']}] {message.get('payload', '')}")
session = frida.attach("target_process")
script = session.create_script("""
Interceptor.attach(ptr("0x12345678"), {
    onEnter: function(args) {
        console.log("Called with:", args[0], args[1]);
    },
    onLeave: function(retval) {
        console.log("Return:", retval);
    }
});
""")
script.on('message', on_message)
script.load()
sys.stdin.read()

def custom_checksum(data):
    """从逆向中恢复的校验算法"""
    result = 0x5A5A5A5A
    for byte in data:
        result = ((result << 3) | (result >> 29)) & 0xFFFFFFFF
        result ^= byte
        result = (result * 0x01234567) & 0xFFFFFFFF
    return result
# 验证
test_data = b"test"
expected = 0x12345678  # 从样本中提取
assert custom_checksum(test_data) == expected

import pefile
pe = pefile.PE("target.exe")
# 找到 license check 跳转
# 原始: 0x1000: 74 12  (jz +0x12)
# 修改: 0x1000: EB 12  (jmp +0x12)
offset = 0x1000
pe.set_bytes_at_rva(offset, b'\xEB')
pe.write("target_patched.exe")
print(f"Patched at RVA 0x{offset:X}")

import struct
class ProtocolMessage:
    def __init__(self, data):
        # 假设协议：4字节魔数 + 2字节长度 + 2字节类型 + payload
        self.magic = struct.unpack('>I', data[0:4])[0]
        self.length = struct.unpack('>H', data[4:6])[0]
        self.msg_type = struct.unpack('>H', data[6:8])[0]
        self.payload = data[8:8+self.length]
    
    def __repr__(self):
        return f"Msg(magic=0x{self.magic:X}, type={self.msg_type}, len={self.length})"
# 解析
msg = ProtocolMessage(captured_packet)
print(msg)

# 基本信息
file binary
strings binary | grep -i "password\|key\|license"
checksec --file=binary
 
# 反汇编
objdump -d binary
radare2 -A binary -c 'pdf @ main'
 
# 动态跟踪
ltrace ./binary
strace -e trace=open,read,write ./binary
 
# Frida
frida -U -f com.example.app -l hook.js

# 基本信息
Get-FileHash binary.exe -Algorithm SHA256
sigcheck.exe -a binary.exe
 
# 反汇编（需要工具）
& "C:\Program Files\IDA\idat64.exe" -A binary.exe
 
# 调试
& "C:\Program Files\x64dbg\x64dbg.exe" binary.exe
 
# Frida（Windows 进程）
frida.exe -p <PID> -l hook.js

请提供二进制文件，或用以下命令采集：
Linux: sha256sum binary && file binary && strings binary > strings.txt
Windows: Get-FileHash binary.exe; Get-Content binary.exe -Encoding Byte | Format-Hex > hex.txt

#!/usr/bin/env python3
"""
Crackme solver - 从逆向中恢复的密钥生成算法
Hash: abc123...
Platform: Linux x64
Protection: None
"""
def generate_serial(username):
    """从 sub_401234 逆向恢复的序列号生成"""
    # 算法：username 每个字符 ASCII * 0x1337，累加，取模 0x1000000
    result = 0
    for char in username:
        result += ord(char) * 0x1337
    result %= 0x1000000
    return f"{result:06X}"
# 验证
test_user = "admin"
serial = generate_serial(test_user)
print(f"Username: {test_user}")
print(f"Serial: {serial}")
# 对比二进制内置检查
# ./crackme admin 3D91E2  # 应该输出 "Correct!"