对某嵌入式设备声波配网的研究

import librosa
from pydub import AudioSegment
import matplotlib.pyplot as plt
import numpy as np
input_file = './声波配网信息.m4a'
output_file = './声波配网信息.wav'

# 将M4A文件转换为WAV格式
audio = AudioSegment.from_file(input_file, format='m4a')
audio.export(output_file, format='wav')

audio_path = './声波配网信息.wav'
audio_data, sample_rate = librosa.load(audio_path)

spectrogram = librosa.stft(audio_data)

plt.figure(figsize=(12, 8))
plt.title('Spectrogram')
plt.xlabel('Time')
plt.ylabel('Frequency')
plt.imshow(librosa.amplitude_to_db(abs(spectrogram), ref=np.max),
           origin='lower', aspect='auto', cmap='coolwarm')
plt.colorbar(format='%+2.0f dB')
plt.tight_layout()
plt.show()

# 使用librosa进行频谱分析，并将能量值转换为分贝单位
spectrogram = librosa.amplitude_to_db(librosa.stft(audio_data), ref=np.max)

# 设置阈值，只记录强度大于-10dB的频率
threshold = -10

# 初始化空的频率数组
frequencies = []

# 遍历每个时间帧
for i in range(spectrogram.shape[1]):
    # 获取当前时间帧的能量值
    frame = spectrogram[:, i]
    # 获取强度大于阈值的频率索引
    freq_indices = np.where(frame > threshold)[0]
    # 将符合条件的频率添加到频率数组中
    frequencies.extend(freq_indices)

# 去除重复的频率，并按升序排列
frequencies = sorted(set(frequencies))

print(frequencies)

frida-dexdump -FU

type0:全是数字(1111)
type1:前面是小写后面是数字（aa11）
type2:前面是除数字外的base64后面全是数字的(_A11)
type3:含有非base64的(@#$%)
type4:前面全是数字然后出现不是数字的base64的(11_a)
type5:全是小写(aaaa)
type6:只要是由base64组成的(a-_b)
type7:全是大写(AAAA)

function hook_java(){
    
    Java.perform(function(){
        
        Java.use("voice.encoder.DataEncoder").encodeSSIDWiFi.implementation = function(ssid,wifi){
            console.log("java hooked");
            console.log(ssid);
            console.log(wifi);
            var enc = this.encodeSSIDWiFi(ssid,wifi);
            return enc;
        }
        Java.use("voice.encoder.DataEncoder").encodeData.implementation = function(a1,a2,a3){
            //console.log("encode hooked");
            let str = String.fromCharCode.apply(null, a1);
            console.log("string before encode:"+str);
            var enc = this.encodeData(a1,a2,a3);
            return enc;
        }
        
        Java.use("voice.encoder.VoicePlayer").play.overload('java.lang.String', 'int', 'int').implementation = function(a1,a2,a3){
            //console.log("play hooked");
            console.log("string after encode:"+a1);
            //console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
            this.play(a1,a2,a3);
            return;
        }   
    });
}
hook_java();