接上
Js Frida 脚本
Clipboard.js
// 文件名: Clipboard.js
/**
* Clipboard - 剪贴板隐私防护
* ==========================================
* 依赖模块 (DLL):
* - user32: Windows 用户界面核心模块，提供窗口管理、剪贴板交互等 GUI 支持功能。
*
* 挂载函数 (API):
* - OpenClipboard: 打开并锁定剪贴板。通过拦截该操作，判断调用进程是否为当前激活的窗口。
* - GetClipboardData: 实际读取剪贴板的存储数据。配合按键状态，拦截非人为操作的恶意读取。
* - GetForegroundWindow / GetWindowThreadProcessId: 用于验证发起读取的进程是否处于前台显示状态。
* - GetAsyncKeyState: 用于物理按键（如 Ctrl，Shift，鼠标左右键等）的真实性校验。
* ==========================================
*/
(function () {
var fileName = "Clipboard";
var myName = "";
var ptrNULL = ptr("0");
var getNow = function () {
var d = new Date();
var pad = function (n) { return (n < 10 ? '0' : '') + n; };
return d.getFullYear() + "/" + pad(d.getMonth() + 1) + "/" + pad(d.getDate()) + " " +
pad(d.getHours()) + ":" + pad(d.getMinutes()) + ":" + pad(d.getSeconds());
};
var logger = function (action, moduleName, api, detail) {
if (myName === "") {
try {
var modules = Process.enumerateModules();
myName = (modules && modules.length > 0) ? modules[0].name : "Unknown";
} catch (e) { myName = "Unknown"; }
}
var parts = [myName, Process.id, fileName, action];
if (moduleName) parts.push(moduleName);
if (api) parts.push(api);
if (detail) parts.push(detail);
parts.push(getNow());
send(parts.join("|"));
};
logger("开始加载");
var TARGET_MODULE = "user32";
var isHooked = false;
var pdwPid = Memory.alloc(4);
var VK_LBUTTON = 0x01;
var VK_RBUTTON = 0x02;
var VK_SHIFT = 0x10;
var VK_CONTROL = 0x11;
var GetForegroundWindow = null;
var GetWindowThreadProcessId = null;
var GetAsyncKeyState = null;
function doHook(mod) {
if (isHooked) return;
try {
var pOpen = mod.findExportByName("OpenClipboard");
var pGetData = mod.findExportByName("GetClipboardData");
var pGetFW = mod.findExportByName("GetForegroundWindow");
var pGetPID = mod.findExportByName("GetWindowThreadProcessId");
var pGetAsyncKeyState = mod.findExportByName("GetAsyncKeyState");
if (pOpen && pGetData && pGetFW && pGetPID && pGetAsyncKeyState) {
try {
GetForegroundWindow = new NativeFunction(pGetFW, 'pointer', []);
GetWindowThreadProcessId = new NativeFunction(pGetPID, 'uint32', ['pointer', 'pointer']);
GetAsyncKeyState = new NativeFunction(pGetAsyncKeyState, 'int16', ['int']);
} catch (e) {
logger("失败/异常", TARGET_MODULE, "NativeFunction_Init", e.message);
return;
}
function isHumanOperating() {
try {
if (!GetAsyncKeyState) return false;
var ctrl = GetAsyncKeyState(VK_CONTROL) & 0x8000;
var shift = GetAsyncKeyState(VK_SHIFT) & 0x8000;
var lbtn = GetAsyncKeyState(VK_LBUTTON) & 0x8000;
var rbtn = GetAsyncKeyState(VK_RBUTTON) & 0x8000;
return (ctrl !== 0 || shift !== 0 || lbtn !== 0 || rbtn !== 0);
} catch (e) { return false; }
}
Interceptor.attach(pOpen, {
onEnter: function (args) {
try {
this.hwnd = args[0];
} catch (e) { }
},
onLeave: function (retval) {
try {
if (retval.toInt32() === 0) return;
if (this.hwnd && !this.hwnd.isNull()) {
if (GetForegroundWindow && GetWindowThreadProcessId) {
var hForeground = GetForegroundWindow();
GetWindowThreadProcessId(hForeground || ptrNULL, pdwPid);
if (pdwPid.readU32() !== Process.id) {
if (retval.replace) {
retval.replace(ptrNULL);
logger("拦截触发", TARGET_MODULE, "OpenClipboard", "后台读取");
}
}
}
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, TARGET_MODULE, "OpenClipboard", e.message);
}
}
});
Interceptor.attach(pGetData, {
onLeave: function (retval) {
try {
if (retval.isNull()) return;
if (!isHumanOperating()) {
if (retval.replace) {
retval.replace(ptrNULL);
logger("拦截触发", TARGET_MODULE, "GetClipboardData", "非人为读取");
}
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, TARGET_MODULE, "GetClipboardData", e.message);
}
}
});
isHooked = true;
logger("模块加载", TARGET_MODULE, "OpenClipboard", "Ready");
}
} catch (e) {
logger("失败/异常", TARGET_MODULE, "HookInit", e.message);
}
}
setInterval(function () {
try {
var mod = Process.findModuleByName("user32.dll") || Process.findModuleByName("user32");
if (mod) doHook(mod);
} catch (e) { }
}, 100);
logger("加载完成");
})();
NetworkPrivacy.js
// 文件名: NetworkPrivacy.js
/**
* NetworkPrivacy - 网络隐私防护 (增强版)
* ========================================== * 依赖模块 (DLL):
* - iphlpapi: IP 助手 API，用于获取网卡列表、MAC 地址、路由表及 ARP 缓存。
* - ws2_32: Windows Socket 2 核心模块，用于底层通信、套接字控制及 DNS/主机名解析。
* - winhttp: Windows HTTP 服务模块，用于查询系统全局代理及 IE 代理配置。
* - advapi32: 高级服务 API 模块，此处用于拦截对注册表网卡驱动硬件信息的枚举。
*
* 挂载函数 (API):
* - GetAdaptersAddresses / GetAdaptersInfo: 获取网卡物理信息。拦截以防止设备指纹收集。
* - GetIpNetTable / GetTcpTable / GetIpForwardTable 等: 获取网络状态、ARP 表、路由表。拦截以防止内网环境嗅探。
* - WSAIoctl: 底层套接字控制，拦截以阻断获取底层网络接口列表。
* - gethostbyname / getaddrinfo / GetAddrInfoW: DNS 与主机名解析。拦截以防止泄露本机名或进行内网反向探测。
* - WinHttpGetIEProxyConfigForCurrentUser: 获取当前用户代理配置。拦截以隐藏 v2rayN/Clash 等代理软件存在。
* - RegQueryValueExW: 注册表键值查询。拦截对网卡驱动描述的读取，防止通过注册表识别虚拟网卡 (TAP/TUN)。
* - IcmpSendEcho: ICMP 回显请求。拦截以防止程序主动 Ping 扫描内网存活主机。
* ==========================================
*/
(function () {
var fileName = "NetworkPrivacy";
var myName = "";
var ptrNULL = ptr("0");
var getNow = function () {
var d = new Date();
var pad = function (n) { return (n < 10 ? '0' : '') + n; };
return d.getFullYear() + "/" + pad(d.getMonth() + 1) + "/" + pad(d.getDate()) + " " +
pad(d.getHours()) + ":" + pad(d.getMinutes()) + ":" + pad(d.getSeconds());
};
var logger = function (action, moduleName, api, detail) {
if (myName === "") {
try {
var modules = Process.enumerateModules();
myName = (modules && modules.length > 0) ? modules[0].name : "Unknown";
} catch (e) { myName = "Unknown"; }
}
var parts = [myName, Process.id, fileName, action];
if (moduleName) parts.push(moduleName);
if (api) parts.push(api);
if (detail) parts.push(detail);
parts.push(getNow());
send(parts.join("|"));
};
logger("开始加载");
var ERROR_SUCCESS = 0;
var ERROR_NO_DATA = 232;
var ERROR_FILE_NOT_FOUND = 2;
var hookedModules = {};
function applyHooks(mod) {
var modName = mod.name.toLowerCase().replace(".dll", "");
if (hookedModules[modName]) return;
try {
// --- 1. IPHLPAPI 模块: 网卡、路由、ARP 与 ICMP --- if (modName === "iphlpapi") {
var pGAA = mod.findExportByName("GetAdaptersAddresses");
if (pGAA) {
Interceptor.attach(pGAA, {
onLeave: function (retval) {
try {
if (retval.toInt32() == ERROR_SUCCESS) {
if (retval.replace) {
retval.replace(ptr(ERROR_NO_DATA));
logger("拦截触发", modName, "GetAdaptersAddresses", "网卡地址枚举");
}
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, modName, "GetAdaptersAddresses", e.message);
}
}
});
}
var pGAI = mod.findExportByName("GetAdaptersInfo");
if (pGAI) {
Interceptor.attach(pGAI, {
onLeave: function (retval) {
try {
if (retval.toInt32() == ERROR_SUCCESS) {
if (retval.replace) {
retval.replace(ptr(ERROR_NO_DATA));
logger("拦截触发", modName, "GetAdaptersInfo", "系统网卡枚举");
}
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, modName, "GetAdaptersInfo", e.message);
}
}
});
}
["GetIpNetTable", "GetIpNetTable2", "GetIpAddrTable", "GetIpForwardTable", "GetIpForwardTable2", "GetBestRoute", "GetTcpTable", "GetUdpTable"].forEach(function (fname) {
var pFunc = mod.findExportByName(fname);
if (pFunc) {
Interceptor.attach(pFunc, {
onLeave: function (rv) {
try {
if (rv.toInt32() == 0) {
if (rv.replace) {
rv.replace(ptr(ERROR_NO_DATA));
logger("拦截触发", modName, fname, "网络状态枚举");
}
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, modName, fname, e.message);
}
}
});
}
});
["IcmpSendEcho", "IcmpSendEcho2", "IcmpSendEcho2Ex"].forEach(function (fname) {
var pIcmp = mod.findExportByName(fname);
if (pIcmp) {
Interceptor.attach(pIcmp, {
onLeave: function (retval) {
try {
if (retval.toInt32() !== 0 && retval.replace) {
retval.replace(ptr(0));
logger("拦截触发", modName, fname, "阻断 ICMP Ping 探测");
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, modName, fname, e.message);
}
}
});
}
});
logger("模块加载", modName, "NetworkTables/ICMP", "Ready");
}
// --- 2. WS2_32 模块: 套接字控制与 DNS 探测 --- if (modName === "ws2_32") {
var pIoctl = mod.findExportByName("WSAIoctl");
if (pIoctl) {
Interceptor.attach(pIoctl, {
onEnter: function (args) {
try {
var controlCode = args[1].toInt32();
if (controlCode == 0x4004747F || controlCode == 0x48007416) {
this.isBlocked = true;
}
} catch (e) { }
},
onLeave: function (retval) {
try {
if (this.isBlocked && retval.replace) {
retval.replace(ptr(-1));
logger("拦截触发", modName, "WSAIoctl", "接口列表枚举");
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, modName, "WSAIoctl", e.message);
}
}
});
}
["gethostbyname", "gethostbyaddr", "getaddrinfo", "GetAddrInfoW"].forEach(function (fname) {
var pDNS = mod.findExportByName(fname);
if (pDNS) {
Interceptor.attach(pDNS, {
onEnter: function (args) {
try {
this.isBlocked = false;
this.target = "";
if (fname === "GetAddrInfoW") {
this.target = args[0].readUtf16String();
} else if (fname === "gethostbyname" || fname === "getaddrinfo") {
this.target = args[0].readUtf8String();
} else if (fname === "gethostbyaddr") {
this.target = "Reverse_IP_Lookup";
this.isBlocked = true;
}
if (this.target && !this.isBlocked) {
var targetLower = this.target.toLowerCase();
// 拦截逻辑：
// 1. 排除 localhost/回环
// 2. 拦截不含 '.' 且不含 ':' 的目标 (判定为本机名或内网主机名)
// 3. 拦截常见的内网私有网段正向探测
if (targetLower === "localhost" || targetLower === "127.0.0.1" || targetLower === "::1") {
this.isBlocked = false;
} else if (targetLower.indexOf(".") === -1 && targetLower.indexOf(":") === -1) {
this.isBlocked = true;
} else if (targetLower.startsWith("192.168.") || targetLower.startsWith("10.") || targetLower.startsWith("172.")) {
this.isBlocked = true;
}
}
} catch (e) { }
},
onLeave: function (retval) {
try {
if (this.isBlocked && retval.replace) {
if (fname === "gethostbyname" || fname === "gethostbyaddr") {
if (!retval.isNull()) {
retval.replace(ptr(0));
logger("拦截触发", modName, fname, "内网/本机名探测 (" + this.target + ")");
}
} else {
if (retval.toInt32() === 0) {
retval.replace(ptr(11001));
logger("拦截触发", modName, fname, "内网/本机名探测 (" + this.target + ")");
}
}
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, modName, fname, e.message);
}
}
});
}
});
logger("模块加载", modName, "DNS/WSAIoctl", "Ready");
}
// --- 3. WINHTTP 模块: 系统代理隐私 --- if (modName === "winhttp") {
var pGetProxy = mod.findExportByName("WinHttpGetIEProxyConfigForCurrentUser");
if (pGetProxy) {
Interceptor.attach(pGetProxy, {
onLeave: function (retval) {
try {
// 如果返回 TRUE (非0)，代表获取到了代理配置
if (retval.toInt32() !== 0 && retval.replace) {
retval.replace(ptr(0)); // 强制返回 FALSE，模拟无代理环境
logger("拦截触发", modName, "WinHttpGetIEProxyConfigForCurrentUser", "隐藏系统代理配置");
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, modName, "WinHttpGetIEProxyConfigForCurrentUser", e.message);
}
}
});
}
logger("模块加载", modName, "ProxyPrivacy", "Ready");
}
// --- 4. ADVAPI32 模块: 注册表网卡特征屏蔽 --- if (modName === "advapi32") {
var pRegQuery = mod.findExportByName("RegQueryValueExW");
if (pRegQuery) {
Interceptor.attach(pRegQuery, {
onEnter: function (args) {
try {
this.isBlocked = false;
var pValueName = args[1];
if (!pValueName.isNull()) {
var valueName = pValueName.readUtf16String().toLowerCase();
// 拦截对网卡驱动描述、组件ID、供应商名称的读取，防止通过注册表识别虚拟网卡
if (valueName === "driverdesc" || valueName === "componentid" || valueName === "providername" || valueName === "devicedesc") {
this.isBlocked = true;
}
}
} catch (e) { }
},
onLeave: function (retval) {
try {
if (this.isBlocked && retval.toInt32() === ERROR_SUCCESS && retval.replace) {
retval.replace(ptr(ERROR_FILE_NOT_FOUND));
logger("拦截触发", modName, "RegQueryValueExW", "屏蔽注册表网卡特征读取");
}
} catch (e) {
var tag = (e.message.indexOf("not a function") !== -1) ? "环境失效" : "拦截异常";
logger(tag, modName, "RegQueryValueExW", e.message);
}
}
});
}
logger("模块加载", modName, "RegistryPrivacy", "Ready");
}
hookedModules[modName] = true;
} catch (e) {
logger("失败/异常", modName, "HookInit", e.message);
}
}
setInterval(function () {
try {
["iphlpapi.dll", "ws2_32.dll", "winhttp.dll", "advapi32.dll"].forEach(function (name) {
var mod = Process.findModuleByName(name);
if (mod) applyHooks(mod);
});
} catch (e) { }
}, 100);
logger("加载完成");
})();
风险警告：HIPS 及策略组的必要性
