求助各位大佬分析这个锁机病毒。。

晨弟弟 发表于 2019-8-16 11:29

本帖最后由晨弟弟于 2019-8-16 21:07 编辑

弟弟手机被锁机软件锁了，，代码里有USB锁，fastboot还连接不上电脑。。求大佬破解这个病毒。https://pan.baidu.com/s/1unWtwadl8D8rEHgdWS62kA 提取码:xe6j

晨弟弟 发表于 2019-8-16 21:11

这啥，看不懂

.class public Lcom/shimeng/shell/恢复正常;
.super Ljava/lang/Object;
.source "恢复正常.java"

# static fields
.field private static final END:Ljava/lang/String; = "\n"

.field private static final EXIT:Ljava/lang/String; = "exit"

.field private static final SH:Ljava/lang/String; = "sh"

.field private static final SU:Ljava/lang/String; = "su"

# direct methods
.method public constructor <init>()V
.locals 3

.prologue
.line 44
move-object v0, p0

move-object v2, v0

invoke-direct {v2}, Ljava/lang/Object;-><init>()V

return-void
.end method

.method public static shell([Ljava/lang/String;Z)Z
.locals 14
.parameter
.parameter

.prologue
.line 14
move-object v0, p0

move v1, p1

move v9, v1

if-eqz v9, :cond_1

:try_start_0
const-string v9, "su"

:goto_0
move-object v2, v9

.line 15
invoke-static {}, Ljava/lang/Runtime;->getRuntime()Ljava/lang/Runtime;

move-result-object v9

move-object v10, v2

invoke-virtual {v9, v10}, Ljava/lang/Runtime;->exec(Ljava/lang/String;)Ljava/lang/Process;

move-result-object v9

move-object v3, v9

.line 16
const/4 v9, 0x0

check-cast v9, Ljava/io/DataOutputStream;

move-object v4, v9

.line 17
new-instance v9, Ljava/io/DataOutputStream;

move-object v13, v9

move-object v9, v13

move-object v10, v13

move-object v11, v3

invoke-virtual {v11}, Ljava/lang/Process;->getOutputStream()Ljava/io/OutputStream;

move-result-object v11

invoke-direct {v10, v11}, Ljava/io/DataOutputStream;-><init>(Ljava/io/OutputStream;)V

move-object v4, v9

.line 18
move-object v9, v0

move-object v5, v9

const/4 v9, 0x0

move v6, v9

.line 28
:goto_1
move v9, v6

move-object v10, v5

array-length v10, v10

if-lt v9, v10, :cond_2

.line 30
move-object v9, v4

new-instance v10, Ljava/lang/StringBuffer;

move-object v13, v10

move-object v10, v13

move-object v11, v13

invoke-direct {v11}, Ljava/lang/StringBuffer;-><init>()V

const-string v11, "exit"

invoke-virtual {v10, v11}, Ljava/lang/StringBuffer;->append(Ljava/lang/String;)Ljava/lang/StringBuffer;

move-result-object v10

const-string v11, "\n"

invoke-virtual {v10, v11}, Ljava/lang/StringBuffer;->append(Ljava/lang/String;)Ljava/lang/StringBuffer;

move-result-object v10

invoke-virtual {v10}, Ljava/lang/StringBuffer;->toString()Ljava/lang/String;

move-result-object v10

invoke-virtual {v9, v10}, Ljava/io/DataOutputStream;->writeBytes(Ljava/lang/String;)V

.line 31
move-object v9, v4

invoke-virtual {v9}, Ljava/io/DataOutputStream;->flush()V

.line 32
move-object v9, v4

if-eqz v9, :cond_0

.line 34
move-object v9, v4

invoke-virtual {v9}, Ljava/io/DataOutputStream;->close()V

.line 36
:cond_0
move-object v9, v3

invoke-virtual {v9}, Ljava/lang/Process;->waitFor()I

move-result v9

.line 37
const/4 v9, 0x1

move v0, v9

.line 42
:goto_2
return v0

.line 14
:cond_1
const-string v9, "sh"

goto :goto_0

.line 18
:cond_2
move-object v9, v5

move v10, v6

aget-object v9, v9, v10

move-object v7, v9

.line 20
move-object v9, v7

if-nez v9, :cond_3

.line 28
:goto_3
add-int/lit8 v6, v6, 0x1

goto :goto_1

.line 25
:cond_3
move-object v9, v4

move-object v10, v7

invoke-virtual {v10}, Ljava/lang/String;->getBytes()[B

move-result-object v10

invoke-virtual {v9, v10}, Ljava/io/DataOutputStream;->write([B)V

.line 26
move-object v9, v4

sget-object v10, Lcom/shimeng/shell/恢复正常;->END:Ljava/lang/String;

invoke-virtual {v10}, Ljava/lang/String;->getBytes()[B

move-result-object v10

invoke-virtual {v9, v10}, Ljava/io/DataOutputStream;->write([B)V

.line 28
move-object v9, v4

invoke-virtual {v9}, Ljava/io/DataOutputStream;->flush()V
:try_end_0
.catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0

goto :goto_3

.line 37
:catch_0
move-exception v9

move-object v2, v9

.line 42
const/4 v9, 0x0

move v0, v9

goto :goto_2
.end method

hongge 发表于 2019-8-16 11:53

你是不是root了，那你就用三方rec，进入三方rec里面，挂载system的目录，找到这个病毒文件，删除了。最好用这个方法！
或者可以尝试一下直接在三方rec里面，格式化掉这个system分区，然后再刷机。这个方法我不确定会不会导致出其他问题，，不是很建议使用。

晨弟弟 发表于 2019-8-16 11:30

伪装成的GG修改器，写在系统目录的，双清也不管用

hongge 发表于 2019-8-16 11:57

应该有刷三方rec吧，都root了，进三方rec看看能不能删除病毒apk吧，一般都会有装吧？还有，，吸取教训，尽量别开挂了{:301_999:}

晨弟弟 发表于 2019-8-16 12:37

hongge 发表于 2019-8-16 11:57
应该有刷三方rec吧，都root了，进三方rec看看能不能删除病毒apk吧，一般都会有装吧？还有，，吸取教训，尽 ...

没有，，更新过系统twrp就掉了，，小米的，，

晨弟弟 发表于 2019-8-16 15:52

一直等待救援

甘愿堕落 发表于 2019-8-16 19:17

奇兔刷机试试

晨弟弟 发表于 2019-8-16 21:06

求大神分析这个锁机病毒

锁机样本https://pan.baidu.com/s/1UmC9h29Kwv4vLc4zv_DwSg 提取码:13ex

晨弟弟 发表于 2019-8-22 18:05

没人吗。。

页: [1] 2

吾爱破解 - 52pojie.cn's Archiver

求助各位大佬分析这个锁机病毒。。

求大神分析这个锁机病毒