41 lines
1.5 KiB
Python
41 lines
1.5 KiB
Python
from __future__ import annotations
|
|
|
|
import unittest
|
|
|
|
from core.ksse_deobf import decode_ksse_string_blob, pack_le_values
|
|
|
|
|
|
class KsseStringDeobfuscationTests(unittest.TestCase):
|
|
def test_decodes_ro_product_model_constant(self) -> None:
|
|
blob = pack_le_values(
|
|
(0x6EBC302C577D0010, 8),
|
|
(0x586F51467422379A, 8),
|
|
(0xBC97, 2),
|
|
)
|
|
self.assertEqual(decode_ksse_string_blob(blob), b"ro.product.model")
|
|
|
|
def test_decodes_sdcard_documents_constant(self) -> None:
|
|
# uStack_88 is overlapped by uStack_81 in Ghidra's stack view, so only
|
|
# the first 7 bytes from that qword are part of this encoded blob.
|
|
blob = (
|
|
pack_le_values((0x73AF23664B200011, 8))
|
|
+ pack_le_values((0x006D490B6F056D9A, 8))[:7]
|
|
+ pack_le_values((0xADA49C59, 4))
|
|
)
|
|
self.assertEqual(decode_ksse_string_blob(blob), b"/sdcard/Documents")
|
|
|
|
def test_decodes_long_global_constant_prefix(self) -> None:
|
|
blob = bytes.fromhex(
|
|
"50003f093073fa34c8757939297e4378b7969ecf6e5fbfabe471bb51bfe2748f"
|
|
"bce08686b93afc4b70b39ccecc20925fb3672c75dd03182a46946d9c50c4b96"
|
|
"1b18e5ad1639266a3857466100ca243fcd063"
|
|
)
|
|
decoded = decode_ksse_string_blob(blob)
|
|
self.assertTrue(decoded.startswith(b"0123456789ABCDEF@/.Android_@KUAISHOU@"))
|
|
self.assertIn(b"@DFP@", decoded)
|
|
self.assertTrue(decoded.endswith(b"@NEBULA"))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|