init

2026-08-04 05:00:42 +08:00
commit ea0be57180
304 changed files with 18921 additions and 0 deletions
@@ -0,0 +1,59 @@
+# sync/ — Deployment 配置与业务模块
+
+对应 lab 目录：`coruna-lab/sync/`（线上 Deployment host 的 `/sync/*`，HAR 中为 `www.zm7f7s0m9jf8wtrbd.info`）。  
+内容来自 `coruna-online` 抓包/离线恢复；职责摘自  
+[`CORUNA_COMPLETE_DATAFLOW_REPORT.md`](../../coruna-online/docs/CORUNA_COMPLETE_DATAFLOW_REPORT.md)  
+与 [`PAYLOAD_INVENTORY.md`](../../coruna-online/evidence/cases/2026-08-02-coruna-all-26/PAYLOAD_INVENTORY.md)。
+
+扩展名 `.js/.css/.html/.ts` 只是 HTTP 伪装；`daily.html` 与各模块响应均为 **Coruna 混淆头 + 密码 7z**，解包后为 Mach-O dylib（或配置 JSON）。
+
+拉取顺序：type-0x01 经 Deployment DGA 选中主机 → `GET /sync/daily.html` → 按配置再拉下列模块（本机按需，不一定 26 个全下）。
+
+---
+
+## 配置
+
+| 文件 | 作用 | `coruna-online` 来源 |
+|---|---|---|
+| `daily.html` | 加密 netconfig：给出 26 项 URL（含 `[HOST_PLACEHOLDER]`）、size、sha256；客户端用当前 Deployment host rebase | `evidence/cases/2026-08-02-coruna-har/responses/har-36_6b5f8ad2….body` |
+
+明文配置副本（未放本目录）：  
+`coruna-online/evidence/cases/2026-08-02-coruna-all-26/configs/bae5299f….json`
+
+---
+
+## 26 个模块
+
+| # | `/sync/` 文件 | 解包名 | 目标 | 作用 |
+|---:|---|---|---|---|
+| 1 | `erupt_flee.js` | `tmp.dylib` | **core** | 配置/DGA、下载校验、模块存储、选择性注入、热更新、心跳；扫描 Photos 与 Apple Notes |
+| 2 | `swap-ritual.ts` | `webclip.dylib` | SpringBoard | `/link/config/list`、`/link/config/icon`，创建/更新 WebClip 与图标 |
+| 3 | `short_thing.js` | `whatsapp_notnotify.dylib` | SpringBoard | WhatsApp 登录/账户类通知抑制辅助 |
+| 4 | `aware_retreat.css` | `MarqueeLabel.dylib` | BitKeep `com.bitkeep.os` | 读 bitkeep.db / Flutter auth；提取助记词、私钥、地址与资产 |
+| 5 | `wash_indicate.js` | `ReachabilitySwift.dylib` | Bitpie | 观察 BIP39 生成；读 `bcoins.sqlite`；上报助记词/地址/余额 |
+| 6 | `entry-praise.htm` | `BranchDeepLinker.dylib` | Coin98 | 读 RN/MMKV `walletCacheRedux`；解析 chain/address/mnemonic/privateKey/balance |
+| 7 | `card_alcohol.htm` | `IQKeyboardRetainer.dylib` | Coinbase Wallet | Hook 存助记词；读 SQLite `main.wallet` |
+| 8 | `curious-tuna.ts` | `LottieAnimation.dylib` | Exodus | 读 RN AsyncStorage / bridge；解析 wallet/mnemonic/资产 |
+| 9 | `valve-okay.htm` | `MasonryConstraint.dylib` | imToken | Hook 密码输入；解密 `walletsV2`；上报钱包/助记词（HAR 已证实） |
+| 10 | `squirrel-chuckle.css` | `AmplitudeSession.dylib` | Krystal | 读 wallets / Keychain；资产 JSON |
+| 11 | `range_hockey.ts` | `CocoaLumberjack.dylib` | MetaMask | Hook 密码；读 persistStore；AES 解 `data.mnemonic` |
+| 12 | `exact_unveil.html` | `SAMKeychainStore.dylib` | MyTonWallet | WKWebView 截获 passcode；解 `mnemonicEncrypted` |
+| 13 | `cradle-barely.html` | `RealmDatabase.dylib` | Phantom | 读 MMKV；观察 `mnemonicFromEntropy:`；账户/余额 |
+| 14 | `enough_lend.ts` | `MixpanelAnalytics.dylib` | Ronin | 观察 wallet/portfolio；上报地址/余额 |
+| 15 | `page_human.css` | `AdjustEventTracker.dylib` | Solflare | 读 Flutter vault；passcode / seedPhrase / accounts |
+| 16 | `mouse_announce.js` | `ChameleonFramework.dylib` | Global Wallet | Hook JSON；捕获 mnemonic/privateKey 等（HAR 已证实私钥） |
+| 17 | `canal_sugar.htm` | `SwiftyJSONParser.dylib` | Tonhub | 解密 secret/mnemonic；取地址/余额 |
+| 18 | `left-case.css` | `PINRemoteImage.dylib` | Tonkeeper | 读 `mnemonics_vault_` 等；解助记词 |
+| 19 | `diagram-ship.css` | `YYImageDecoder.dylib` | TronLink | Hook 密码；读 keystore/SQLite；解地址/余额 |
+| 20 | `shrimp-artefact.htm` | `AppsFlyerConversion.dylib` | Trust Wallet | Realm/keystore；提取助记词与资产 |
+| 21 | `fresh_sausage.js` | `TPKeyboardAvoiding.dylib` | Uniswap | 读 mnemonic keychain / portfolio |
+| 22 | `win_wife.css` | `MBProgressOverlay.dylib` | OKX | Hook backup seed VM；读 wallet SQL（配置中常 `active:false`） |
+| 23 | `future-destroy.htm` | `libCoreSymbolicationHelper.dylib` | SpringBoard | 注入代理 / Helion IPC；与 core 协作 |
+| 24 | `chunk_hen.ts` | `libAggregateDictionaryClient.dylib` | WhatsApp | 截获消息/媒体元数据并上报 |
+| 25 | `candy_ketchup.html` | `WeChat.dylib` | 微信 | 本地 OCR/QR/敏感词/BIP39；命中后经 C2 上传 |
+| 26 | `horror-monster.ts` | `libDataAccessServices.dylib` | `imagent` | Hook SMS/iMessage；profile 与事件上报 |
+
+原始 wire 文件来源目录：  
+`coruna-online/evidence/cases/2026-08-02-coruna-all-26/downloads/raw/`  
+解包 dylib：  
+`…/downloads/extracted/<sha256>/`