video_extractor/frida_diag.py

#!/usr/bin/env python3
"""
Diagnostic: list all modules in the DRM service process and find RSA-related exports.
Run this first to see what functions are available for hooking.
"""
import frida, sys

JS = """
(function() {
    var results = [];
    var mods = Process.enumerateModules();
    send({type:'info', msg:'Total modules: ' + mods.length});

    mods.forEach(function(mod) {
        try {
            var exps = mod.enumerateExports();
            exps.forEach(function(e) {
                var n = e.name;
                if (n.indexOf('RSA') !== -1 || n.indexOf('rsa') !== -1 ||
                    n.indexOf('i2d') !== -1 || n.indexOf('ECDSA') !== -1 ||
                    n.indexOf('EVP_Sign') !== -1 || n.indexOf('EVP_DigestSign') !== -1) {
                    send({type:'export', mod: mod.name, name: e.name, addr: e.address.toString()});
                }
            });
        } catch(ex) {
            // module may not allow export enumeration
        }
    });

    send({type:'done'});
})();
"""

def on_message(msg, data):
    if msg['type'] == 'send':
        p = msg['payload']
        t = p.get('type')
        if t == 'info':
            print(p['msg'])
        elif t == 'export':
            print(f"  {p['mod']}!{p['name']} @ {p['addr']}")
        elif t == 'done':
            print('\nDone.')
            sys.exit(0)
    elif msg['type'] == 'error':
        print(f'[!] {msg["description"]}')
        if 'stack' in msg:
            print(f'    {msg["stack"]}')
    elif msg['type'] == 'log':
        print(f'    {msg["payload"]}')

target = 'android.hardware.drm@1.4-service.widevine'
print(f'Attaching to {target}...')
dev = frida.get_usb_device()
session = dev.attach(target)
script = session.create_script(JS)
script.on('message', on_message)
script.load()

import time
try:
    while True:
        time.sleep(1)
except KeyboardInterrupt:
    pass