init

README.md

@@ -0,0 +1,4 @@
+# 钉钉打卡定位模拟脚本(Frida)+Agent模块
+
+* 通过模拟基站信息+GPS信息+WiFi模块信息+周边WiFi信息来模拟钉钉定位
+* 源码级分析编写,钉钉可信度达到最高(可通过极速打卡)

agent/.gitignore

@@ -0,0 +1,15 @@
+*.iml
+.gradle
+/local.properties
+/.idea/caches
+/.idea/libraries
+/.idea/modules.xml
+/.idea/workspace.xml
+/.idea/navEditor.xml
+/.idea/assetWizardSettings.xml
+.DS_Store
+/build
+/captures
+.externalNativeBuild
+.cxx
+local.properties

agent/.idea/.gitignore

@@ -0,0 +1,3 @@
+# Default ignored files
+/shelf/
+/workspace.xml

agent/.idea/compiler.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="CompilerConfiguration">
+    <bytecodeTargetLevel target="11" />
+  </component>
+</project>

agent/.idea/gradle.xml

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="GradleMigrationSettings" migrationVersion="1" />
+  <component name="GradleSettings">
+    <option name="linkedExternalProjectsSettings">
+      <GradleProjectSettings>
+        <option name="delegatedBuild" value="false" />
+        <option name="testRunner" value="GRADLE" />
+        <option name="distributionType" value="DEFAULT_WRAPPED" />
+        <option name="externalProjectPath" value="$PROJECT_DIR$" />
+        <option name="modules">
+          <set>
+            <option value="$PROJECT_DIR$" />
+            <option value="$PROJECT_DIR$/app" />
+          </set>
+        </option>
+        <option name="resolveModulePerSourceSet" value="false" />
+      </GradleProjectSettings>
+    </option>
+  </component>
+</project>

agent/.idea/misc.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectRootManager" version="2" languageLevel="JDK_11" default="true" project-jdk-name="Android Studio default JDK" project-jdk-type="JavaSDK">
+    <output url="file://$PROJECT_DIR$/build/classes" />
+  </component>
+  <component name="ProjectType">
+    <option name="id" value="Android" />
+  </component>
+</project>

agent/app/.gitignore

@@ -0,0 +1 @@
+/build

agent/app/build.gradle

@@ -0,0 +1,38 @@
+plugins {
+    id 'com.android.application'
+}
+
+android {
+    compileSdk 31
+
+    defaultConfig {
+        applicationId "run.evan.dd"
+        minSdk 29
+        targetSdk 31
+        versionCode 1
+        versionName "1.0"
+
+        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
+    }
+
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+        }
+    }
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_1_8
+        targetCompatibility JavaVersion.VERSION_1_8
+    }
+}
+
+dependencies {
+
+    implementation 'androidx.appcompat:appcompat:1.4.1'
+    implementation 'com.google.android.material:material:1.5.0'
+    testImplementation 'junit:junit:4.13.2'
+    androidTestImplementation 'androidx.test.ext:junit:1.1.3'
+    androidTestImplementation 'androidx.test.espresso:espresso-core:3.4.0'
+    implementation 'com.alibaba:fastjson:1.2.80'
+}

agent/app/proguard-rules.pro

@@ -0,0 +1,21 @@
+# Add project specific ProGuard rules here.
+# You can control the set of applied configuration files using the
+# proguardFiles setting in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile

agent/app/src/androidTest/java/run/evan/dd/ExampleInstrumentedTest.java

@@ -0,0 +1,26 @@
+package run.evan.dd;
+
+import android.content.Context;
+
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import static org.junit.Assert.*;
+
+/**
+ * Instrumented test, which will execute on an Android device.
+ *
+ * @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
+ */
+@RunWith(AndroidJUnit4.class)
+public class ExampleInstrumentedTest {
+    @Test
+    public void useAppContext() {
+        // Context of the app under test.
+        Context appContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+        assertEquals("run.evan.dd", appContext.getPackageName());
+    }
+}

agent/app/src/main/AndroidManifest.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="run.evan.dd">
+
+    <application
+        android:allowBackup="true"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.Dd" />
+
+</manifest>

agent/app/src/main/java/run/evan/dd/DdHelper.java

@@ -0,0 +1,195 @@
+package run.evan.dd;
+
+import android.content.Context;
+import android.location.Location;
+import android.net.wifi.ScanResult;
+import android.os.Parcel;
+import android.telephony.CellInfo;
+import android.telephony.CellInfoCdma;
+import android.telephony.CellInfoGsm;
+import android.telephony.CellInfoLte;
+import android.telephony.CellInfoNr;
+import android.telephony.CellInfoTdscdma;
+import android.telephony.CellInfoWcdma;
+import android.widget.Toast;
+
+import com.alibaba.fastjson.JSON;
+import com.alibaba.fastjson.TypeReference;
+
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.math.BigDecimal;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Random;
+
+public class DdHelper {
+
+    static Random rnd = new Random();
+
+
+    static {
+        rnd.setSeed(System.currentTimeMillis());
+    }
+
+
+    public static int getScale(double val){
+        BigDecimal bigDecimal = new BigDecimal(String.valueOf(val));
+        return bigDecimal.scale();
+    }
+
+    public static double parseDouble(String str){
+        return Double.parseDouble(str) ;
+    }
+
+    public static double randLatLon(String str) {
+        BigDecimal b = new BigDecimal(str);
+        BigDecimal add = b.add(new BigDecimal(String.valueOf("0.000011121")).multiply(BigDecimal.valueOf(rnd.nextInt(10) + 1)));
+        return Double.parseDouble(add.toString()) ;
+    }
+
+    public static void saveCellInfo(List<CellInfo> cellInfos, String path) {
+        String s = convertCellInfo(cellInfos);
+        writeFile(s.getBytes(), path);
+    }
+
+    public static List<CellInfo> readCellInfo(String path) {
+        List<CellInfo> cellInfos = parseCellInfo(new String(readFile(path)));
+        return cellInfos;
+    }
+
+
+    public static void saveScanResult(List<ScanResult> scanResults, String path) {
+        String s = convertScanResult(scanResults);
+        writeFile(s.getBytes(), path);
+    }
+
+    public static List<ScanResult> readScanResult(String path) {
+        List<ScanResult> scanResults = parseScanResult(new String(readFile(path)));
+        return scanResults;
+    }
+
+    public static String convertCellInfo(List<CellInfo> cellInfos) {
+        List<Tuple> outData = new ArrayList<>();
+        for (CellInfo cellInfo : cellInfos) {
+            Tuple t = new Tuple();
+            Parcel parcel = Parcel.obtain();
+            cellInfo.writeToParcel(parcel, 0);
+            byte[] marshall = parcel.marshall();
+            parcel.recycle();
+            t.setClassName(cellInfo.getClass().getName());
+            t.setData(marshall);
+            outData.add(t);
+        }
+        return JSON.toJSONString(outData);
+    }
+
+    public static List<CellInfo> parseCellInfo(String json) {
+        List<CellInfo> result = new ArrayList<>();
+        List<Tuple> tuples = JSON.parseObject(json, new TypeReference<List<Tuple>>() {
+        });
+        for (Tuple tuple : tuples) {
+            Parcel p = Parcel.obtain();
+            p.unmarshall(tuple.getData(), 0, tuple.getData().length);
+            p.setDataPosition(0);
+
+            switch (tuple.getClassName()) {
+                case "android.telephony.CellInfoNr":
+                    result.add(CellInfoNr.CREATOR.createFromParcel(p));
+                    break;
+                case "android.telephony.CellInfoLte":
+                    result.add(CellInfoLte.CREATOR.createFromParcel(p));
+                    break;
+                case "android.telephony.CellInfoWcdma":
+                    result.add(CellInfoWcdma.CREATOR.createFromParcel(p));
+                    break;
+                case "android.telephony.CellInfoCdma":
+                    result.add(CellInfoCdma.CREATOR.createFromParcel(p));
+                    break;
+                case "android.telephony.CellInfoTdscdma":
+                    result.add(CellInfoTdscdma.CREATOR.createFromParcel(p));
+                    break;
+                case "android.telephony.CellInfoGsm":
+                    result.add(CellInfoGsm.CREATOR.createFromParcel(p));
+                    break;
+            }
+            p.recycle();
+
+        }
+        return result;
+    }
+
+    public static String convertScanResult(List<ScanResult> scanResults) {
+        List<Tuple> outData = new ArrayList<>();
+        for (ScanResult scanResult : scanResults) {
+            Tuple t = new Tuple();
+            Parcel parcel = Parcel.obtain();
+            scanResult.writeToParcel(parcel, 0);
+            byte[] marshall = parcel.marshall();
+            parcel.recycle();
+            t.setClassName(scanResult.getClass().getName());
+            t.setData(marshall);
+            outData.add(t);
+        }
+        return JSON.toJSONString(outData);
+    }
+
+    public static List<ScanResult> parseScanResult(String json) {
+        List<ScanResult> result = new ArrayList<>();
+        List<Tuple> tuples = JSON.parseObject(json, new TypeReference<List<Tuple>>() {
+        });
+        for (Tuple tuple : tuples) {
+            Parcel p = Parcel.obtain();
+            p.unmarshall(tuple.getData(), 0, tuple.getData().length);
+            p.setDataPosition(0);
+            result.add(ScanResult.CREATOR.createFromParcel(p));
+            p.recycle();
+        }
+        return result;
+    }
+
+
+    public static void writeFile(byte[] data, String filePath) {
+        try (FileOutputStream fileOutputStream = new FileOutputStream(filePath)) {
+            fileOutputStream.write(data);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public static void writeFileString(String str, String filePath) {
+        writeFile(str.getBytes(), filePath);
+    }
+
+    public static byte[] readFile(String filePath) {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        try (FileInputStream fileInputStream = new FileInputStream(filePath)) {
+            byte[] b = new byte[1024];
+            int n;
+            while ((n = fileInputStream.read(b)) != -1) {
+                out.write(b, 0, n);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        return out.toByteArray();
+    }
+
+    public static String readFileString(String filePath) {
+        return new String(readFile(filePath));
+    }
+
+    public static void isDirExist(String str) {
+        File file = new File(str);
+        if (!file.exists()) {
+            file.mkdirs();
+        }
+    }
+
+    public static void toast(Context ctx, String str) {
+        Toast.makeText(ctx, str, Toast.LENGTH_SHORT).show();
+    }
+
+}

agent/app/src/main/java/run/evan/dd/Tuple.java

@@ -0,0 +1,24 @@
+package run.evan.dd;
+
+public class Tuple {
+
+    private String className;
+
+    private byte[] data;
+
+    public String getClassName() {
+        return className;
+    }
+
+    public void setClassName(String className) {
+        this.className = className;
+    }
+
+    public byte[] getData() {
+        return data;
+    }
+
+    public void setData(byte[] data) {
+        this.data = data;
+    }
+}

agent/app/src/main/res/drawable-v24/ic_launcher_foreground.xml

@@ -0,0 +1,30 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:aapt="http://schemas.android.com/aapt"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+    <path android:pathData="M31,63.928c0,0 6.4,-11 12.1,-13.1c7.2,-2.6 26,-1.4 26,-1.4l38.1,38.1L107,108.928l-32,-1L31,63.928z">
+        <aapt:attr name="android:fillColor">
+            <gradient
+                android:endX="85.84757"
+                android:endY="92.4963"
+                android:startX="42.9492"
+                android:startY="49.59793"
+                android:type="linear">
+                <item
+                    android:color="#44000000"
+                    android:offset="0.0" />
+                <item
+                    android:color="#00000000"
+                    android:offset="1.0" />
+            </gradient>
+        </aapt:attr>
+    </path>
+    <path
+        android:fillColor="#FFFFFF"
+        android:fillType="nonZero"
+        android:pathData="M65.3,45.828l3.8,-6.6c0.2,-0.4 0.1,-0.9 -0.3,-1.1c-0.4,-0.2 -0.9,-0.1 -1.1,0.3l-3.9,6.7c-6.3,-2.8 -13.4,-2.8 -19.7,0l-3.9,-6.7c-0.2,-0.4 -0.7,-0.5 -1.1,-0.3C38.8,38.328 38.7,38.828 38.9,39.228l3.8,6.6C36.2,49.428 31.7,56.028 31,63.928h46C76.3,56.028 71.8,49.428 65.3,45.828zM43.4,57.328c-0.8,0 -1.5,-0.5 -1.8,-1.2c-0.3,-0.7 -0.1,-1.5 0.4,-2.1c0.5,-0.5 1.4,-0.7 2.1,-0.4c0.7,0.3 1.2,1 1.2,1.8C45.3,56.528 44.5,57.328 43.4,57.328L43.4,57.328zM64.6,57.328c-0.8,0 -1.5,-0.5 -1.8,-1.2s-0.1,-1.5 0.4,-2.1c0.5,-0.5 1.4,-0.7 2.1,-0.4c0.7,0.3 1.2,1 1.2,1.8C66.5,56.528 65.6,57.328 64.6,57.328L64.6,57.328z"
+        android:strokeWidth="1"
+        android:strokeColor="#00000000" />
+</vector>

agent/app/src/main/res/drawable/ic_launcher_background.xml

@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+    <path
+        android:fillColor="#3DDC84"
+        android:pathData="M0,0h108v108h-108z" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M9,0L9,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,0L19,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M29,0L29,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M39,0L39,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M49,0L49,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M59,0L59,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M69,0L69,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M79,0L79,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M89,0L89,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M99,0L99,108"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,9L108,9"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,19L108,19"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,29L108,29"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,39L108,39"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,49L108,49"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,59L108,59"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,69L108,69"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,79L108,79"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,89L108,89"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,99L108,99"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,29L89,29"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,39L89,39"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,49L89,49"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,59L89,59"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,69L89,69"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,79L89,79"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M29,19L29,89"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M39,19L39,89"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M49,19L49,89"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M59,19L59,89"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M69,19L69,89"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M79,19L79,89"
+        android:strokeWidth="0.8"
+        android:strokeColor="#33FFFFFF" />
+</vector>

agent/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@drawable/ic_launcher_background" />
+    <foreground android:drawable="@drawable/ic_launcher_foreground" />
+</adaptive-icon>

agent/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@drawable/ic_launcher_background" />
+    <foreground android:drawable="@drawable/ic_launcher_foreground" />
+</adaptive-icon>

agent/app/src/main/res/values-night/themes.xml

@@ -0,0 +1,16 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Theme.Dd" parent="Theme.MaterialComponents.DayNight.DarkActionBar">
+        <!-- Primary brand color. -->
+        <item name="colorPrimary">@color/purple_200</item>
+        <item name="colorPrimaryVariant">@color/purple_700</item>
+        <item name="colorOnPrimary">@color/black</item>
+        <!-- Secondary brand color. -->
+        <item name="colorSecondary">@color/teal_200</item>
+        <item name="colorSecondaryVariant">@color/teal_200</item>
+        <item name="colorOnSecondary">@color/black</item>
+        <!-- Status bar color. -->
+        <item name="android:statusBarColor" tools:targetApi="l">?attr/colorPrimaryVariant</item>
+        <!-- Customize your theme here. -->
+    </style>
+</resources>

agent/app/src/main/res/values/colors.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="purple_200">#FFBB86FC</color>
+    <color name="purple_500">#FF6200EE</color>
+    <color name="purple_700">#FF3700B3</color>
+    <color name="teal_200">#FF03DAC5</color>
+    <color name="teal_700">#FF018786</color>
+    <color name="black">#FF000000</color>
+    <color name="white">#FFFFFFFF</color>
+</resources>

agent/app/src/main/res/values/strings.xml

@@ -0,0 +1,3 @@
+<resources>
+    <string name="app_name">dd</string>
+</resources>

agent/app/src/main/res/values/themes.xml

@@ -0,0 +1,16 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Theme.Dd" parent="Theme.MaterialComponents.DayNight.DarkActionBar">
+        <!-- Primary brand color. -->
+        <item name="colorPrimary">@color/purple_500</item>
+        <item name="colorPrimaryVariant">@color/purple_700</item>
+        <item name="colorOnPrimary">@color/white</item>
+        <!-- Secondary brand color. -->
+        <item name="colorSecondary">@color/teal_200</item>
+        <item name="colorSecondaryVariant">@color/teal_700</item>
+        <item name="colorOnSecondary">@color/black</item>
+        <!-- Status bar color. -->
+        <item name="android:statusBarColor" tools:targetApi="l">?attr/colorPrimaryVariant</item>
+        <!-- Customize your theme here. -->
+    </style>
+</resources>

agent/app/src/test/java/run/evan/dd/ExampleUnitTest.java

@@ -0,0 +1,17 @@
+package run.evan.dd;
+
+import org.junit.Test;
+
+import static org.junit.Assert.*;
+
+/**
+ * Example local unit test, which will execute on the development machine (host).
+ *
+ * @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
+ */
+public class ExampleUnitTest {
+    @Test
+    public void addition_isCorrect() {
+        assertEquals(4, 2 + 2);
+    }
+}

agent/build.gradle

@@ -0,0 +1,10 @@
+// Top-level build file where you can add configuration options common to all sub-projects/modules.
+plugins {
+    id 'com.android.application' version '7.1.2' apply false
+    id 'com.android.library' version '7.1.2' apply false
+}
+
+task clean(type: Delete) {
+    delete rootProject.buildDir
+}
+

agent/gradle.properties

@@ -0,0 +1,21 @@
+# Project-wide Gradle settings.
+# IDE (e.g. Android Studio) users:
+# Gradle settings configured through the IDE *will override*
+# any settings specified in this file.
+# For more details on how to configure your build environment visit
+# http://www.gradle.org/docs/current/userguide/build_environment.html
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
+# When configured, Gradle will run in incubating parallel mode.
+# This option should only be used with decoupled projects. More details, visit
+# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
+# org.gradle.parallel=true
+# AndroidX package structure to make it clearer which packages are bundled with the
+# Android operating system, and which are packaged with your app"s APK
+# https://developer.android.com/topic/libraries/support-library/androidx-rn
+android.useAndroidX=true
+# Enables namespacing of each library's R class so that its R class includes only the
+# resources declared in the library itself and none from the library's dependencies,
+# thereby reducing the size of the R class for that library
+android.nonTransitiveRClass=true

agent/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,6 @@
+#Tue Apr 19 11:23:21 CST 2022
+distributionBase=GRADLE_USER_HOME
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.2-bin.zip
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists
+zipStoreBase=GRADLE_USER_HOME

agent/gradlew

@@ -0,0 +1,185 @@
+#!/usr/bin/env sh
+
+#
+# Copyright 2015 the original author or authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+##
+##  Gradle start up script for UN*X
+##
+##############################################################################
+
+# Attempt to set APP_HOME
+# Resolve links: $0 may be a link
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
+done
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null
+
+APP_NAME="Gradle"
+APP_BASE_NAME=`basename "$0"`
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD="maximum"
+
+warn () {
+    echo "$*"
+}
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+}
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+  NONSTOP* )
+    nonstop=true
+    ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+        JAVACMD="$JAVA_HOME/bin/java"
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD="java"
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
+fi
+
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+
+    JAVACMD=`cygpath --unix "$JAVACMD"`
+
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
+    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=`expr $i + 1`
+    done
+    case $i in
+        0) set -- ;;
+        1) set -- "$args0" ;;
+        2) set -- "$args0" "$args1" ;;
+        3) set -- "$args0" "$args1" "$args2" ;;
+        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
+fi
+
+# Escape application args
+save () {
+    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+    echo " "
+}
+APP_ARGS=`save "$@"`
+
+# Collect all arguments for the java command, following the shell quoting and substitution rules
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+
+exec "$JAVACMD" "$@"

agent/gradlew.bat

@@ -0,0 +1,89 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%" == "" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%" == "" set DIRNAME=.
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if "%ERRORLEVEL%" == "0" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if "%ERRORLEVEL%"=="0" goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
+exit /b 1
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

agent/settings.gradle

@@ -0,0 +1,16 @@
+pluginManagement {
+    repositories {
+        gradlePluginPortal()
+        google()
+        mavenCentral()
+    }
+}
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+rootProject.name = "dd"
+include ':app'

dingding.js

@@ -0,0 +1,224 @@
+Java.perform(function () {
+    //const
+    const MODE_COLLECT = "collect";
+    const MODE_MOCK = "mock";
+
+    //Global Config
+    let rootDir = "/sdcard/Android/data/com.alibaba.android.rimet/dingding";
+    let mode = "";
+    let active = "";
+
+    //Library
+    Java.openClassFile(rootDir + "/help.dex").load();
+    let fastJson = Java.use("com.alibaba.fastjson.JSON");
+    let serializerFeature = Java.use("com.alibaba.fastjson.serializer.SerializerFeature");
+    let wifiInfoClass = Java.use("android.net.wifi.WifiInfo");
+    let ScanResultClass = Java.use("android.net.wifi.ScanResult")
+    let systemClock = Java.use("android.os.SystemClock");
+    let javaSystem = Java.use("java.lang.System");
+    let ddHelper = Java.use("run.evan.dd.DdHelper");
+    var context = Java.use('android.app.ActivityThread').currentApplication().getApplicationContext();
+
+    //Load Config
+
+    mode = ddHelper.readFileString(rootDir + "/mode");
+    active = ddHelper.readFileString(rootDir + "/active");
+    mode = mode.replace(/\n/, "");
+    active = active.replace(/\n/, "");
+    //debug ----------------------
+    //mode = "none";
+    //active = "suan";
+    //debug ----------------------
+
+    console.log("mode=" + mode);
+    console.log("active profile=" + active);
+    ddHelper.isDirExist(rootDir + "/" + active);
+    let serializerFeatures = [serializerFeature.WriteClassName.value];
+
+    Java.scheduleOnMainThread(function () {
+        ddHelper.toast(context, "增强功能: 模式=" + mode + ",激活配置=" + active);
+    });
+
+    // let e = Java.use("com.amap.api.col.3sl.d$a");
+    // e.handleMessage.overload("android.os.Message").implementation = function (message) {
+    //     this.handleMessage(message);
+    //     if (message.what.value == 1014) {
+    //         console.log(fastJson.toJSONString(message.getData()));
+    //     }
+    // };
+
+
+    // let geo = Java.use("com.alibaba.lightapp.runtime.plugin.device.Geolocation");
+    // geo.buildResultData.implementation = function (a, b) {
+    //     let ret = this.buildResultData(a, b);
+    //     console.log(fastJson.toJSONString(a));
+    //     return ret;
+    // };
+
+    // let encryptLoc = Java.use("com.autonavi.aps.amapapi.utils.i");
+    // encryptLoc.b.overload("com.amap.api.location.AMapLocation").implementation = function (aMapLocation) {
+    //     let ret = this.b(aMapLocation);
+    //     console.log("ELat=" +  aMapLocation.getLatitude() + ",ELon=" + aMapLocation.getLongitude());
+    //     return ret;
+    // };
+
+    // let g = Java.use("com.amap.api.col.3sl.g");
+    // g.a.overload("android.location.Location").implementation = function (location) {
+    //     console.log("A:" + this.C.value);
+    //     this.a(location);
+    // };
+
+
+    let loc = Java.use("com.amap.api.location.AMapLocation");
+    //Debug Check for detect mock
+    // loc.setMock.implementation = function (mock) {
+    //     if (mock === true) {
+    //         console.log("MOCK!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
+    //         //console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
+    //     }
+    // };
+    // loc.setErrorCode.implementation = function (err) {
+    //     if (err === 15) {
+    //         console.log("EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE");
+    //         //console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
+    //     }
+    // };
+    //
+    // loc.getLongitude.implementation = function () {
+    //     let ret = this.getLongitude();
+    //     console.log("ALON=" + ret);
+    //     return ret;
+    // };
+    // loc.getLatitude.implementation = function () {
+    //     let ret = this.getLatitude();
+    //     console.log("ALAT=" + ret);
+    //     return ret;
+    // };
+    //
+    // let location = Java.use("android.location.Location");
+    // location.getLongitude.implementation = function () {
+    //     let ret = this.getLongitude();
+    //     console.log("LON=" + ret);
+    //     return ret;
+    // };
+    // location.getLatitude.implementation = function () {
+    //     let ret = this.getLatitude();
+    //     console.log("LAT=" + ret);
+    //     return ret;
+    // };
+
+    // let gpsStatus = Java.use("com.amap.api.col.3sl.g$1");
+    // gpsStatus.onGpsStatusChanged.implementation = function (i) {
+    //     console.log("onGpsStatusChanged:" + i);
+    //     this.onGpsStatusChanged(i);
+    // };
+
+    // let utili = Java.use("com.autonavi.aps.amapapi.utils.i");
+    // utili.a.overload("android.location.Location", "int").implementation = function (location, i) {
+    //     let ret = this.a(location, i);
+    //     if (ret === true) {
+    //         console.log("Location=" + fastJson.toJSONString(location));
+    //     }
+    //     return ret;
+    // };
+
+
+    // loc.setLongitude.implementation = function (a) {
+    //     let ret = this.setLongitude(a);
+    //     console.log("setLongitude="+a);
+    //     console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
+    //     return ret;
+    // };
+
+    // let jw = Java.use("com.amap.api.col.3sl.jw");
+    // jw.c.overload("com.amap.api.col.3sl.jz").implementation = function (jzVar) {
+    //     console.log("req=" + fastJson.toJSONString(jzVar));
+    //     let ret = this.c(jzVar);
+    //     console.log("ret=" + fastJson.toJSONString(ret));
+    //     return ret;
+    // };
+
+
+    //debug ----------------------
+
+    if (mode === MODE_MOCK || mode === MODE_COLLECT) {
+
+        let locManager = Java.use("android.location.LocationManager$LocationListenerTransport");
+        locManager.acceptLocation.implementation = function (currentExecutor, location) {
+            if (mode == MODE_COLLECT) {
+                ddHelper.writeFileString(location.getLatitude().toString(), rootDir + "/" + active + "/lat")
+                ddHelper.writeFileString(location.getLongitude().toString(), rootDir + "/" + active + "/lon")
+            } else {
+                location.setLatitude(ddHelper.randLatLon(ddHelper.readFileString(rootDir + "/" + active + "/lat")));
+                location.setLongitude(ddHelper.randLatLon(ddHelper.readFileString(rootDir + "/" + active + "/lon")));
+            }
+            this.acceptLocation(currentExecutor, location);
+            console.log("lat=" + location.getLatitude() + ",lon=" + location.getLongitude());
+        };
+
+
+        let teleManager = Java.use("android.telephony.TelephonyManager");
+
+        teleManager.getAllCellInfo.implementation = function () {
+            try {
+                let path = rootDir + "/" + active + "/cellInfo.bin";
+                if (mode == MODE_MOCK) {
+                    let cellInfo = ddHelper.readCellInfo(path);
+                    return cellInfo;
+                } else {
+                    let ret = this.getAllCellInfo();
+                    ddHelper.saveCellInfo(ret, path);
+                    return ret;
+                }
+            } catch (e) {
+                console.log(e);
+            }
+        };
+
+        let CellInfoClass = Java.use("android.telephony.CellInfo");
+        CellInfoClass.getTimeStamp.implementation = function () {
+            return systemClock.elapsedRealtimeNanos();
+        };
+        CellInfoClass.getTimestampMillis.implementation = function () {
+            return systemClock.elapsedRealtime();
+        };
+
+        let wifi = Java.use("android.net.wifi.WifiManager");
+        wifi.getConnectionInfo.implementation = function () {
+            let path = rootDir + "/" + active + "/wifiConnection.json";
+            if (mode == MODE_MOCK) {
+                let wifiConnJson = ddHelper.readFileString(path);
+                let wifiConnInfo = fastJson.parseArray(wifiConnJson, wifiInfoClass.class);
+                return wifiConnInfo;
+            } else {
+                let ret = this.getConnectionInfo();
+                ddHelper.writeFileString(fastJson.toJSONString(ret, serializerFeatures), path)
+                return ret;
+            }
+        };
+        wifi.getScanResults.implementation = function () {
+
+            let path = rootDir + "/" + active + "/wifiNb.bin";
+            if (mode == MODE_MOCK) {
+                let parseScanResult = ddHelper.readScanResult(path);
+                if (parseScanResult != null) {
+                    for (var i = 0; i < parseScanResult.size(); i++) {
+                        var item = Java.cast(parseScanResult.get(i), ScanResultClass);
+                        item.timestamp.value = systemClock.elapsedRealtimeNanos();
+                        item.seen.value = javaSystem.currentTimeMillis();
+                    }
+                }
+                return parseScanResult;
+            } else {
+                let ret = this.getScanResults();
+                try {
+                    ddHelper.saveScanResult(ret, path);
+                    return ret;
+                } catch (e) {
+                    console.log(e);
+                }
+            }
+        };
+    }
+
+});