求助各位大佬分析这个锁机病毒。。

晨弟弟

弟弟手机被锁机软件锁了，，代码里有USB锁，fastboot还连接不上电脑。。求大佬破解这个病毒。https://pan.baidu.com/s/1unWtwadl8D8rEHgdWS62kA 提取码:xe6j

晨弟弟

这啥，看不懂

[Java] 纯文本查看 复制代码

.class public Lcom/shimeng/shell/恢复正常;
.super Ljava/lang/Object;
.source "恢复正常.java"


# static fields
.field private static final END:Ljava/lang/String; = "\n"

.field private static final EXIT:Ljava/lang/String; = "exit"

.field private static final SH:Ljava/lang/String; = "sh"

.field private static final SU:Ljava/lang/String; = "su"


# direct methods
.method public constructor <init>()V
    .locals 3

    .prologue
    .line 44
    move-object v0, p0

    move-object v2, v0

    invoke-direct {v2}, Ljava/lang/Object;-><init>()V

    return-void
.end method

.method public static shell([Ljava/lang/String;Z)Z
    .locals 14
    .parameter
    .parameter

    .prologue
    .line 14
    move-object v0, p0

    move v1, p1

    move v9, v1

    if-eqz v9, :cond_1

    :try_start_0
    const-string v9, "su"

    :goto_0
    move-object v2, v9

    .line 15
    invoke-static {}, Ljava/lang/Runtime;->getRuntime()Ljava/lang/Runtime;

    move-result-object v9

    move-object v10, v2

    invoke-virtual {v9, v10}, Ljava/lang/Runtime;->exec(Ljava/lang/String;)Ljava/lang/Process;

    move-result-object v9

    move-object v3, v9

    .line 16
    const/4 v9, 0x0

    check-cast v9, Ljava/io/DataOutputStream;

    move-object v4, v9

    .line 17
    new-instance v9, Ljava/io/DataOutputStream;

    move-object v13, v9

    move-object v9, v13

    move-object v10, v13

    move-object v11, v3

    invoke-virtual {v11}, Ljava/lang/Process;->getOutputStream()Ljava/io/OutputStream;

    move-result-object v11

    invoke-direct {v10, v11}, Ljava/io/DataOutputStream;-><init>(Ljava/io/OutputStream;)V

    move-object v4, v9

    .line 18
    move-object v9, v0

    move-object v5, v9

    const/4 v9, 0x0

    move v6, v9

    .line 28
    :goto_1
    move v9, v6

    move-object v10, v5

    array-length v10, v10

    if-lt v9, v10, :cond_2

    .line 30
    move-object v9, v4

    new-instance v10, Ljava/lang/StringBuffer;

    move-object v13, v10

    move-object v10, v13

    move-object v11, v13

    invoke-direct {v11}, Ljava/lang/StringBuffer;-><init>()V

    const-string v11, "exit"

    invoke-virtual {v10, v11}, Ljava/lang/StringBuffer;->append(Ljava/lang/String;)Ljava/lang/StringBuffer;

    move-result-object v10

    const-string v11, "\n"

    invoke-virtual {v10, v11}, Ljava/lang/StringBuffer;->append(Ljava/lang/String;)Ljava/lang/StringBuffer;

    move-result-object v10

    invoke-virtual {v10}, Ljava/lang/StringBuffer;->toString()Ljava/lang/String;

    move-result-object v10

    invoke-virtual {v9, v10}, Ljava/io/DataOutputStream;->writeBytes(Ljava/lang/String;)V

    .line 31
    move-object v9, v4

    invoke-virtual {v9}, Ljava/io/DataOutputStream;->flush()V

    .line 32
    move-object v9, v4

    if-eqz v9, :cond_0

    .line 34
    move-object v9, v4

    invoke-virtual {v9}, Ljava/io/DataOutputStream;->close()V

    .line 36
    :cond_0
    move-object v9, v3

    invoke-virtual {v9}, Ljava/lang/Process;->waitFor()I

    move-result v9

    .line 37
    const/4 v9, 0x1

    move v0, v9

    .line 42
    :goto_2
    return v0

    .line 14
    :cond_1
    const-string v9, "sh"

    goto :goto_0

    .line 18
    :cond_2
    move-object v9, v5

    move v10, v6

    aget-object v9, v9, v10

    move-object v7, v9

    .line 20
    move-object v9, v7

    if-nez v9, :cond_3

    .line 28
    :goto_3
    add-int/lit8 v6, v6, 0x1

    goto :goto_1

    .line 25
    :cond_3
    move-object v9, v4

    move-object v10, v7

    invoke-virtual {v10}, Ljava/lang/String;->getBytes()[B

    move-result-object v10

    invoke-virtual {v9, v10}, Ljava/io/DataOutputStream;->write([B)V

    .line 26
    move-object v9, v4

    sget-object v10, Lcom/shimeng/shell/恢复正常;->END:Ljava/lang/String;

    invoke-virtual {v10}, Ljava/lang/String;->getBytes()[B

    move-result-object v10

    invoke-virtual {v9, v10}, Ljava/io/DataOutputStream;->write([B)V

    .line 28
    move-object v9, v4

    invoke-virtual {v9}, Ljava/io/DataOutputStream;->flush()V
    :try_end_0
    .catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0

    goto :goto_3

    .line 37
    :catch_0
    move-exception v9

    move-object v2, v9

    .line 42
    const/4 v9, 0x0

    move v0, v9

    goto :goto_2
.end method

hongge

你是不是root了，那你就用三方rec，进入三方rec里面，挂载system的目录，找到这个病毒文件，删除了。最好用这个方法！
或者可以尝试一下直接在三方rec里面，格式化掉这个system分区，然后再刷机。这个方法我不确定会不会导致出其他问题，，不是很建议使用。

晨弟弟

伪装成的GG修改器，写在系统目录的，双清也不管用

hongge

应该有刷三方rec吧，都root了，进三方rec看看能不能删除病毒apk吧，一般都会有装吧？还有，，吸取教训，尽量别开挂了

晨弟弟

hongge 发表于 2019-8-16 11:57
应该有刷三方rec吧，都root了，进三方rec看看能不能删除病毒apk吧，一般都会有装吧？还有，，吸取教训，尽 ...

没有，，更新过系统twrp就掉了，，小米的，，

晨弟弟

一直等待救援

甘愿堕落

奇兔刷机试试

晨弟弟

锁机样本https://pan.baidu.com/s/1UmC9h29Kwv4vLc4zv_DwSg 提取码:13ex

晨弟弟

没人吗。。