frida hook手法收集
1、frida打印hook函数的返回值
Java.perform(function () {
var cls = Java.use("com.tencent.mm.sdk.platformtools.w");
cls.w.overload("java.lang.String","java.lang.String").implementation=function(p1,p2){
var req = this.w(p1,p2);
console.log(req);
return req;
};
});
2、hook重载函数
cls.loadUrl.overload("java.lang.String").implementation = function(param)……
cls.loadUrl.overload("java.lang.String","java.util.Map").implementation= ...
3、打印java函数的调用栈
var Exc = Java.use("java.lang.Exception");
var Log = Java.use("android.util.Log");
xxxx.implementation = function(param){
var e = Exc.$new("");
var log = Log.$new();
console.log(log.getStackTraceString(e));
};
4、打印native函数调用栈
console.log("begin====");
var libavmp = Module.findBaseAddress("libsgavmpso-6.4.20.so");
var func = ptr(parseInt(libavmp)+0x1ea);
console.log("libavmp base: "+libavmp);
console.log("function base: "+func);
Interceptor.attach(func, {
onEnter: function(args) {
console.log(Thread.backtrace(this.context,Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join(" "));
},
onLeave:function(retval){
console.log("retval: "+retval);
}
});
5、dump内存
var data = Memory.readByteArray(ptr(0x824a9000), 159744);
console.log({type: 'dumpdata' }, data);
6、Hook Android IMEI
Java.perform(function () {
var TM = Java.use("android.telephony.TelephonyManager");
console.log("hook start...");
TM.getSimSerialNumber.overload().implementation = function () {
console.log("Called - getSimSerialNumber(String)");
var temp = this.getSimSerialNumber();
console.log(temp);
return "123456789";
};
TM.getDeviceId.overload().implementation = function () {
console.log("Called - deviceID()");
var temp = this.getDeviceId();
console.log(temp);
return "867979021642856";
};
});
7、Hook Android webview http请求
主要针对以下webview中的以下函数：
- loadUrl(String url)
- loadUrl(String url, Map<String, String> additionalHttpHeaders)
- loadData(String data, String mimeType, String encoding)
- loadDataWithBaseURL(String baseUrl, String data, String mimeType, String encoding, String historyUrl)
- postUrl(String url, byte[] postData)
Java.perform(function () {
var cls = Java.use("android.webkit.WebView");
console.log("class start:------------------");
cls.loadUrl.overload("java.lang.String").implementation = function(param){
console.log("loadUrl hooked "+param);
this.loadUrl("file:///sdcard/1.html");
};
cls.loadUrl.overload("java.lang.String","java.util.Map").implementation = function(p1,p2){
console.log("loadUrl2 hooked"+p1 + p2);
this.loadUrl("file:///sdcard/1.html",null);
};
cls.loadDataWithBaseURL.implementation = function(p1,p2,p3,p4,p5){
console.log("loadDataWithBaseURL hooked"+p1 + p2);
this.loadDataWithBaseURL("file:///sdcard/1.html",null,null,null,null);
};
cls.postUrl.implementation = function(p1,p2){
console.log("postUrl hooked"+p1);
this.postUrl("file:///sdcard/1.html",null);
};
});
8、获取context
var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
var context = currentApplication.getApplicationContext();
9、创建bundle对象
var bundle = Bundle.$new();
//调用实例方法需要使用call
Bundle.putString.call(bundle,'key1','value1')
//也可以指定具体的参数类型
//Bundle.putString.overload('java.lang.String','java.lang.String').call(bundle,'key1','value1')
this.getIntent().putExtra('testBundle',bundle)
//activity.getIntent().getBundleExtra("testBundle");
var outB = this.getIntent().getBundleExtra('testBundle')
console.log(outB);
10、hook对象
//读取实例对象的属性值，对于得到的对象，需要使用Java.cast()方法转换后才可以使用
// PackageInfo packageInfo = getPackageManager().getPackageInfo(getPackageName(),0);
// String pkg = packageInfo.packageName;
var t = this.getPackageManager().getPackageInfo(this.getPackageName(),0);
var packageInfo = Java.cast(t.$handle, PackageInfo);
var pkg = packageInfo.packageName.value
console.log(pkg)
11、导出rpc函数并被任意调用
rdev = frida.get_remote_device()
session = rdev.attach("com.eg.android.AlipayGphone")
jscode="""
rpc.exports = {
myfunc: function(aa,bb,cc){
Java.perform(function () {
try{
classf = Java.use('com.alipay.android.phone.wallet.sharetoken.service.f');
var result = classf.a(aa,bb,cc);//a为static函数
//f = Hrida.$new(); 非static函数需要new一个实例
console.log("myfunc result: "+result);
return result.toString()
}catch(e){
console.log(e)
}
});
//return result
}
}
"""
script = session.create_script(jscode)
script.on("message", my_message_handler)
script.load()
command = ""
while 1 == 1:
command = raw_input("Exit: 9999 0: default others: zhikouling")
if command == "9999":
break
else:
a = "b54578ff9d5fcbf6"
b = None
c = "快来吱付寳"
script.exports.myfunc(a,b,c)
12、hook构造函数
obj.$init.implementation = function (){
}
13、枚举所有加载的类
Java.enumerateLoadedClasses({
onMatch: function(classname){
if (classname.indexOf("XmlPullParser")>-1){
console.log(classname);
}
},
onComplete: function (){
}
});
页:
[1]