|
一、hook android app的对象方法
//创建的类对象即我们要hook的方法所在的类的类名,具体类名根据实际需求填写
var parametersTestClass = Java.use("com.example.parameterstest.ParametersTest");
调用对象方法
//创建完类对象中,即可通过类对象调用对象的方法,如下所
parametersTestClass.multiply.implementation = function(val1,val2){ //在这里我们可以做一些hook操作,比如打印参数 var result = this.multiply(val1,val2); //在这里我们可以做一些hook操作,比如打印返回值 return result;}
如果我们调用的对象方法有其他重载方法时,则需要通过overload指定具体参数类型,否则会报如下错误。当然错误中也提供了具体的参数类型,可通过错误信息提取我们需要的参数类型进行hook即可
{'type': 'error', 'description': "Error: multiply(): has more than one overload, use .overload(<signature>) to choose from:
.overload('long', 'long')
.overload('short', 'short')
.overload('int', 'int')
.overload('byte', 'byte')
.overload('float', 'float')
.overload('double', 'double')", 'stack': "Error: multiply(): has more than one overload, use .overload(<signature>) to choose from:
.overload('long', 'long')
.overload('short', 'short')
.overload('int', 'int')
.overload('byte', 'byte')
.overload('float', 'float')
.overload('double', 'double')
at pe (frida/node_modules/frida-java-bridge/lib/class-factory.js:549)
at ve (frida/node_modules/frida-java-bridge/lib/class-factory.js:538)
at frida/node_modules/frida-java-bridge/lib/class-factory.js:911
at /script1.js:11
at frida/node_modules/frida-java-bridge/lib/vm.js:11
at frida/node_modules/frida-java-bridge/index.js:392
at frida/node_modules/frida-java-bridge/index.js:377
at we (frida/node_modules/frida-java-bridge/lib/class-factory.js:598)
at frida/node_modules/frida-java-bridge/lib/class-factory.js:581", 'fileName': 'frida/node_modules/frida-java-bridge/lib/class-factory.js', 'lineNumber': 549, 'columnNumber': 1}
二、类方法重载时指定具体参数(overload)
当方法重载时,则我们需要通过如下方式进行hook(在overload方法中指定参数类型)
parametersTestClass.multiply.overload('int','int').implementation = function(val1,val2){
//在这里我们可以做一些hook操作,比如打印参数 var result = this.multiply(val1,val2); //在这里我们可以做一些hook操作,比如打印返回值 return result; }
如下列出了大部分的参数类型(Java中参数类型对应JS脚本中参数类型)
Java Type (Java中参数类型) int byte short long float double char <Object>(比如String、List) int[] byte[] short[] long[] float[] double[] char[] <Object>[](比如String[])
Frida Type (frida脚本中参数类型) int byte short long float double char <package>.<Object>(比如java.lang.String、java.util.List) [I [B [S [J [F [D [C L<package>.<Object>; (比如 [Ljava.lang.String;)当参数是某个类对象时,则需要在overload中填写其完整包名路径+类名即可,跟上面的<Object>(比如String、List)一样,如下所示
parametersTestClass.display.overload("com.example.parameterstest.ParametersTest").implementation = function (val1){
this.display(val1);}
|
|