Frida逆向与自动化:Objection环境、自动化分析和插件
安卓逆向交流QQ群: 348355266
文章目录
1. objection与frida版本匹配安装
1. 一般情况下的安装
pip install objection
2. 指定版本安装
frida:https://github.com/frida/frida/releases
此时设定我们要安装frida == 14.1.2 以及对应的objection
pip install frida == 14.1.2
至于frida-tools 和 objection 我们选择Released相近的即可.
比如此时的frida 14.1.2 Released 是 Dec 2, 2020 ( https://pypi.org/project/frida/)
那么我们去看看frida-tools (https://pypi.org/project/frida-tools/#history)
最近的一个是 Dec 1,2020。 那么我们就使用
pip install frida-tools == 9.0.1
objection同理, 最新的是 Aug13,2020
pip install objection == 1.9.6
2. objection 连接非标准端口
我们先在命令行输入objection
看看.
Usage: objection [OPTIONS] COMMAND [ARGS]...
_ _ _ _
___| |_|_|___ ___| |_|_|___ ___
| . | . | | -_| _| _| | . | |
|___|___| |___|___|_| |_|___|_|_|
|___|(object)inject(ion)
Runtime Mobile Exploration
by: @leonjza from @sensepost
By default, communications will happen over USB, unless the --network
option is provided.
// 默认采用USB连接方式, 但我们可以选择网络连接
Options:
// 使用网络连接
-N, --network Connect using a network connection instead of USB.
[default: False]
// 指定host
-h, --host TEXT [default: 127.0.0.1]
// 指定port
-p, --port INTEGER [default: 27042]
-ah, --api-host TEXT [default: 127.0.0.1]
-ap, --api-port INTEGER [default: 8888]
-g, --gadget TEXT Name of the Frida Gadget/Process to connect to.
[default: Gadget]
-S, --serial TEXT A device serial to connect to.
// 进入调试模式
-d, --debug Enable debug mode with verbose output. (Includes
agent source map in stack traces)
--help Show this message and exit.
Commands:
api Start the objection API server in headless mode.
device-type Get information about an attached device.
explore Start the objection exploration REPL.
patchapk Patch an APK with the frida-gadget.so.
patchipa Patch an IPA with the FridaGadget dylib.
run Run a single objection command.
version Prints the current version and exists.
1. Frida指定端口启动
指定端口8888启动frida
./frida-server -l 0.0.0.0:8888
2. objection 指定端口连接
连接主机为 192.168.1.30
端口为8888
的frida-server
objection -N -h 192.168.1.30 -p 8888 -g com.android.settings explore
3. 简单体验
root@kali:~/Desktop/android-studio/bin# objection -N -h 192.168.1.30 -p 8888 -g com.android.settings explore
Using networked device @`192.168.1.30:8888`
Agent injected and responds ok!
_ _ _ _
___| |_|_|___ ___| |_|_|___ ___
| . | . | | -_| _| _| | . | |
|___|___| |___|___|_| |_|___|_|_|
|___|(object)inject(ion) v1.9.6
Runtime Mobile Exploration
by: @leonjza from @sensepost
[tab] for command suggestions
com.android.settings on (google: 8.1.0) [net] # frida
-------------------- -----------
Frida Version 12.11.17
Process Architecture arm64
Process Platform linux
Debugger Attached False
Script Runtime DUK
Script Filename /script1.js
Frida Heap Size 13.5 MiB
-------------------- -----------
com.android.settings on (google: 8.1.0) [net] # env
Name Path
---------------------- -----------------------------------------------------------
cacheDirectory /data/user_de/0/com.android.settings/cache
codeCacheDirectory /data/user_de/0/com.android.settings/code_cache
externalCacheDirectory /storage/emulated/0/Android/data/com.android.settings/cache
filesDirectory /data/user_de/0/com.android.settings/files
obbDir /storage/emulated/0/Android/obb/com.android.settings
packageCodePath /system/priv-app/SettingsGoogle/SettingsGoogle.apk
3. objection 内存漫游、hook、trace
实用FRIDA进阶:内存漫游、hook anywhere、抓包 : https://www.anquanke.com/post/id/197657
1. 内存漫游
Frida
只是提供了各种API
供我们调用,在此基础之上可以实现具体的功能,比如禁用证书绑定之类的脚本,就是使用Frida
的各种API
来组合编写而成。于是有大佬将各种常见、常用的功能整合进一个工具,供我们直接在命令行中使用,这个工具便是objection
。
objection
功能强大,命令众多,而且不用写一行代码,便可实现诸如内存搜索、类和模块搜索、方法hook
打印参数返回值调用栈等常用功能,是一个非常方便的,逆向必备、内存漫游神器。objection
的界面及命令如下图所示。
1. 获取基本信息
首先介绍几个基本操作:
键入命令之后,回车执行;
- help:不知道当前命令的效果是什么,在当前命令前加help比如,help env,回车之后会出现当前命令的解释信息;
- 按空格:不知道输入什么就按空格,会有提示出来,上下选择之后再按空格选中,又会有新的提示出来;
- jobs:作业系统很好用,建议一定要掌握,可以同时运行多项(hook)作业; 我们以安卓内置应用“设置”为例,来示范一下基本的用法。
在手机上启动frida-server,并且点击启动“设置”图标,手机进入设置的界面,首先查看一下“设置”应用的包名。
# frida-ps -U|grep -i setting
7107 com.android.settings
13370 com.google.android.settings.intelligence
再使用objection注入“设置”应用。
# objection -g com.android.settings explore
启动objection
之后,会出现提示它的logo
,这时候不知道输入啥命令的话,可以按下空格,有提示的命令及其功能出来;再按空格选中,又会有新的提示命令出来,这时候按回车就可以执行该命令,见下图执行的应用环境信息命令env
和frida-server
版本信息命令。
2. 提取内存信息
查看内存众加载的so库
,运行命令memory list modules
查看so库的导出(export)函数
,运行命令memory list exports libssl.so
,效果如下所示
将结果保存到json文件中
,结果太多,终端无法显示完整的时候, 可以把结果导出到json文件,然后用其他工具进行查看
# memory list exports libart.so --json /root/libart.json
Writing exports as json to /root/libart.json...
Wrote exports to: /root/libart.json
提取整个(或部分)内存
命令是memory dump all from_base
搜索整个内存
命令是memory search --string --offsets-only
3. 内存堆搜索与执行
在堆上搜索实例
我们查看AOSP源码关于设置里显示系统设置的部分,发现存在着DisplaySettings
类,可以在堆上搜索是否存在着该类的实例。首先在手机上点击进入“显示”
设置,然后运行以下命令,并得到相应的实例地址:
# android heap search instances com.android.settings.DisplaySettings
Class instance enumeration complete for com.android.settings.DisplaySettings
Hashcode Class toString()
---------- ------------------------------------ -----------------------------------------
45960675 com.android.settings.DisplaySettings DisplaySettings{2bd4de3 #0 id=0x7f0a01db}
调用实例的方法
查看源码得知com.android.settings.DisplaySettings
类有着getPreferenceScreenResId()
方法,这样就可以直接调用该实例的getPreferenceScreenResId()
方法,用excute命令。
# android heap execute 0x2526 getPreferenceScreenResId
Handle 45960675 is to class
com.android.settings.DisplaySettings
Executing method: getPreferenceScreenResId()
2132082743
可见结果被直接打印了出来。在实例上执行js
代码.
也可以在找到的实例上直接编写js
脚本,输入android heap evaluate 45960675
命令后,会进入一个迷你编辑器环境,输入console.log("evaluate result:"+clazz.getPreferenceScreenResId())
这串脚本,按ESC退出编辑器,然后按回车,即会开始执行这串脚本,输出结果。
# android heap evaluate 45960675
(The hashcode at `45960675` will be available as the `clazz` variable.)
console.log("evaluate result:"+clazz.getPreferenceScreenResId())
JavaScript capture complete. Evaluating...
Handle 45960675 is to class
com.android.settings.DisplaySettings
evaluate result:2132082743
这个功能其实非常厉害,可以即时编写、出结果、即时调试自己的代码,不用再编写→注入→操作→看结果→再调整,而是直接出结果。
4. 启动activity或service
直接启动activity
直接上代码,想要进入显示设置,可以在任意界面直接运行以下代码进入显示设置:
# android intent launch_activity com.android.settings.DisplaySettings
(agent) Starting activity com.android.settings.DisplaySettings...
(agent) Activity successfully asked to start.
查看当前可用的activity
可以使用android hooking list
命令来查看当前可用的activities
,然后使用上述命令进行调起。
#android hooking list activities
com.android.settings.ActivityPicker
com.android.settings.AirplaneModeVoiceActivity
com.android.settings.AllowBindAppWidgetActivity
com.android.settings.AppWidgetPickActivity
com.android.settings.BandMode
com.android.settings.ConfirmDeviceCredentialActivity
com.android.settings.CreateShortcut
com.android.settings.CredentialStorage
com.android.settings.CryptKeeper$FadeToBlack
com.android.settings.CryptKeeperConfirm$Blank
com.android.settings.DevelopmentSettings
com.android.settings.DeviceAdminAdd
com.android.settings.DeviceAdminSettings
com.android.settings.Display
com.android.settings.DisplaySettings
com.android.settings.EncryptionInterstitial
com.android.settings.FallbackHome
com.android.settings.HelpTrampoline
com.android.settings.LanguageSettings
com.android.settings.ManageApplications
com.android.settings.MonitoringCertInfoActivity
com.android.settings.RadioInfo
com.android.settings.RegulatoryInfoDisplayActivity
com.android.settings.RemoteBugreportActivity
com.android.settings.RunningServices
com.android.settings.SecuritySettings
com.android.settings.SetFullBackupPassword
com.android.settings.SetProfileOwner
com.android.settings.Settings
com.android.settings.Settings
com.android.settings.Settings$AccessibilityDaltonizerSettingsActivity
com.android.settings.Settings$AccessibilitySettingsActivity
com.android.settings.Settings$AccountSyncSettingsActivity
com.android.settings.Settings$AdvancedAppsActivity
com.android.settings.Settings$AllApplicationsActivity
com.android.settings.Settings$AmbientDisplayPickupSuggestionActivity
com.android.settings.Settings$AmbientDisplaySuggestionActivity
com.android.settings.Settings$AndroidBeamSettingsActivity
com.android.settings.Settings$ApnEditorActivity
com.android.settings.Settings$ApnSettingsActivity
com.android.settings.Settings$AppAndNotificationDashboardActivity
com.android.settings.Settings$AppDrawOverlaySettingsActivity
com.android.settings.Settings$AppMemoryUsageActivity
com.android.settings.Settings$AppNotificationSettingsActivity
com.android.settings.Settings$AppPictureInPictureSettingsActivity
com.android.settings.Settings$AppWriteSettingsActivity
com.android.settings.Settings$AssistGestureSettingsActivity
com.android.settings.Settings$AutomaticStorageManagerSettingsActivity
com.android.settings.Settings$AvailableVirtualKeyboardActivity
com.android.settings.Settings$BatterySaverSettingsActivity
com.android.settings.Settings$BluetoothSettingsActivity
com.android.settings.Settings$CaptioningSettingsActivity
com.android.settings.Settings$ChannelNotificationSettingsActivity
com.android.settings.Settings$ChooseAccountActivity
com.android.settings.Settings$ConfigureNotificationSettingsActivity
com.android.settings.Settings$ConfigureWifiSettingsActivity
com.android.settings.Settings$ConnectedDeviceDashboardActivity
com.android.settings.Settings$CryptKeeperSettingsActivity
com.android.settings.Settings$DataUsageSummaryActivity
com.android.settings.Settings$DateTimeSettingsActivity
com.android.settings.Settings$DevelopmentSettingsActivity
com.android.settings.Settings$DeviceAdminSettingsActivity
com.android.settings.Settings$DeviceInfoSettingsActivity
com.android.settings.Settings$DisplaySettingsActivity
com.android.settings.Settings$DoubleTapPowerSuggestionActivity
com.android.settings.Settings$DoubleTwistSuggestionActivity
com.android.settings.Settings$DreamSettingsActivity
com.android.settings.Settings$EnterprisePrivacySettingsActivity
com.android.settings.Settings$FactoryResetActivity
com.android.settings.Settings$FingerprintEnrollSuggestionActivity
com.android.settings.Settings$HighPowerApplicationsActivity
com.android.settings.Settings$IccLockSettingsActivity
com.android.settings.Settings$ImeiInformationActivity
com.android.settings.Settings$KeyboardLayoutPickerActivity
com.android.settings.Settings$LanguageAndInputSettingsActivity
com.android.settings.Settings$LegacySupportActivity
com.android.settings.Settings$LocalePickerActivity
com.android.settings.Settings$LocationSettingsActivity
com.android.settings.Settings$ManageAppExternalSourcesActivity
com.android.settings.Settings$ManageApplicationsActivity
com.android.settings.Settings$ManageAssistActivity
com.android.settings.Settings$ManageDomainUrlsActivity
com.android.settings.Settings$ManageExternalSourcesActivity
com.android.settings.Settings$ManagedProfileSettingsActivity
com.android.settings.Settings$MemorySettingsActivity
com.android.settings.Settings$MobileDataUsageListActivity
com.android.settings.Settings$NetworkDashboardActivity
com.android.settings.Settings$NightDisplaySettingsActivity
com.android.settings.Settings$NightDisplaySuggestionActivity
com.android.settings.Settings$NotificationAccessSettingsActivity
com.android.settings.Settings$NotificationAppListActivity
com.android.settings.Settings$NotificationStationActivity
com.android.settings.Settings$OverlaySettingsActivity
com.android.settings.Settings$PaymentSettingsActivity
com.android.settings.Settings$PhysicalKeyboardActivity
com.android.settings.Settings$PictureInPictureSettingsActivity
com.android.settings.Settings$PowerUsageSummaryActivity
com.android.settings.Settings$PrintJobSettingsActivity
com.android.settings.Settings$PrintSettingsActivity
com.android.settings.Settings$PrivacySettingsActivity
com.android.settings.Settings$PrivateVolumeForgetActivity
com.android.settings.Settings$PrivateVolumeSettingsActivity
com.android.settings.Settings$PublicVolumeSettingsActivity
com.android.settings.Settings$RunningServicesActivity
com.android.settings.Settings$SavedAccessPointsSettingsActivity
com.android.settings.Settings$ScreenLockSuggestionActivity
com.android.settings.Settings$SecuritySettingsActivity
com.android.settings.Settings$SimStatusActivity
com.android.settings.Settings$SoundSettingsActivity
com.android.settings.Settings$SpecialAccessSettingsActivity
com.android.settings.Settings$SpellCheckersSettingsActivity
com.android.settings.Settings$StatusActivity
com.android.settings.Settings$StorageDashboardActivity
com.android.settings.Settings$StorageUseActivity
com.android.settings.Settings$SwipeToNotificationSuggestionActivity
com.android.settings.Settings$SystemDashboardActivity
com.android.settings.Settings$TestingSettingsActivity
com.android.settings.Settings$TetherSettingsActivity
com.android.settings.Settings$TextToSpeechSettingsActivity
com.android.settings.Settings$TrustedCredentialsSettingsActivity
com.android.settings.Settings$UsageAccessSettingsActivity
com.android.settings.Settings$UserAndAccountDashboardActivity
com.android.settings.Settings$UserDictionarySettingsActivity
com.android.settings.Settings$UserSettingsActivity
com.android.settings.Settings$VpnSettingsActivity
com.android.settings.Settings$VrListenersSettingsActivity
com.android.settings.Settings$WallpaperSettingsActivity
com.android.settings.Settings$WebViewAppPickerActivity
com.android.settings.Settings$WifiAPITestActivity
com.android.settings.Settings$WifiCallingSettingsActivity
com.android.settings.Settings$WifiCallingSuggestionActivity
com.android.settings.Settings$WifiDisplaySettingsActivity
com.android.settings.Settings$WifiInfoActivity
com.android.settings.Settings$WifiP2pSettingsActivity
com.android.settings.Settings$WifiSettingsActivity
com.android.settings.Settings$WriteSettingsActivity
com.android.settings.Settings$ZenAccessSettingsActivity
com.android.settings.Settings$ZenModeEventRuleSettingsActivity
com.android.settings.Settings$ZenModeExternalRuleSettingsActivity
com.android.settings.Settings$ZenModePrioritySettingsActivity
com.android.settings.Settings$ZenModeScheduleRuleSettingsActivity
com.android.settings.Settings$ZenModeSettingsActivity
com.android.settings.Settings$ZenModeVisualInterruptionSettingsActivity
com.android.settings.SettingsLicenseActivity
com.android.settings.SetupEncryptionInterstitial
com.android.settings.ShowAdminSupportDetailsDialog
com.android.settings.SmsDefaultDialog
com.android.settings.SoundSettings
com.android.settings.SubSettings
com.android.settings.TetherProvisioningActivity
com.android.settings.TetherSettings
com.android.settings.UsageStatsActivity
com.android.settings.UsbSettings
com.android.settings.UserDictionarySettings
com.android.settings.WebViewImplementation
com.android.settings.accessibility.AccessibilitySettingsForSetupWizardActivity
com.android.settings.accounts.AddAccountSettings
com.android.settings.applications.InstalledAppDetails
com.android.settings.applications.InstalledAppDetailsTop
com.android.settings.applications.ManageApplications
com.android.settings.applications.StorageUse
com.android.settings.applications.autofill.AutofillPickerActivity
com.android.settings.applications.autofill.AutofillPickerTrampolineActivity
com.android.settings.backup.BackupSettingsActivity
com.android.settings.bluetooth.BluetoothPairingDialog
com.android.settings.bluetooth.BluetoothPermissionActivity
com.android.settings.bluetooth.BluetoothSettings
com.android.settings.bluetooth.DevicePickerActivity
com.android.settings.bluetooth.RequestPermissionActivity
com.android.settings.bluetooth.RequestPermissionHelperActivity
com.android.settings.datausage.AppDataUsageActivity
com.android.settings.development.AppPicker
com.android.settings.development.DevelopmentSettingsDisabledActivity
com.android.settings.deviceinfo.StorageWizardFormatConfirm
com.android.settings.deviceinfo.StorageWizardFormatProgress
com.android.settings.deviceinfo.StorageWizardInit
com.android.settings.deviceinfo.StorageWizardMigrate
com.android.settings.deviceinfo.StorageWizardMigrateConfirm
com.android.settings.deviceinfo.StorageWizardMigrateProgress
com.android.settings.deviceinfo.StorageWizardMoveConfirm
com.android.settings.deviceinfo.StorageWizardMoveProgress
com.android.settings.deviceinfo.StorageWizardReady
com.android.settings.deviceinfo.UsbModeChooserActivity
com.android.settings.fingerprint.FingerprintEnrollEnrolling
com.android.settings.fingerprint.FingerprintEnrollFindSensor
com.android.settings.fingerprint.FingerprintEnrollFinish
com.android.settings.fingerprint.FingerprintEnrollIntroduction
com.android.settings.fingerprint.FingerprintSettings
com.android.settings.fingerprint.FingerprintSuggestionActivity
com.android.settings.fingerprint.SetupFingerprintEnrollEnrolling
com.android.settings.fingerprint.SetupFingerprintEnrollFindSensor
com.android.settings.fingerprint.SetupFingerprintEnrollFinish
com.android.settings.fingerprint.SetupFingerprintEnrollIntroduction
com.android.settings.fuelgauge.BatterySaverModeVoiceActivity
com.android.settings.fuelgauge.PowerUsageSummary
com.android.settings.fuelgauge.RequestIgnoreBatteryOptimizations
com.android.settings.inputmethod.InputMethodAndSubtypeEnablerActivity
com.android.settings.inputmethod.UserDictionaryAddWordActivity
com.android.settings.nfc.HowItWorks
com.android.settings.nfc.PaymentDefaultDialog
com.android.settings.notification.NotificationAccessConfirmationActivity
com.android.settings.notification.RedactionInterstitial
com.android.settings.notification.RedactionSettingsStandalone
com.android.settings.notification.ZenModeVoiceActivity
com.android.settings.password.ChooseLockGeneric
com.android.settings.password.ChooseLockGeneric$InternalActivity
com.android.settings.password.ChooseLockPassword
com.android.settings.password.ChooseLockPattern
com.android.settings.password.ConfirmDeviceCredentialActivity
com.android.settings.password.ConfirmDeviceCredentialActivity$InternalActivity
com.android.settings.password.ConfirmLockPassword
com.android.settings.password.ConfirmLockPassword$InternalActivity
com.android.settings.password.ConfirmLockPattern
com.android.settings.password.ConfirmLockPattern$InternalActivity
com.android.settings.password.SetNewPasswordActivity
com.android.settings.password.SetupChooseLockGeneric
com.android.settings.password.SetupChooseLockPassword
com.android.settings.password.SetupChooseLockPattern
com.android.settings.qstile.DevelopmentTileConfigActivity
com.android.settings.search.SearchActivity
com.android.settings.sim.SimDialogActivity
com.android.settings.sim.SimPreferenceDialog
com.android.settings.support.NewDeviceIntroSuggestionActivity
com.android.settings.support.SupportDashboardActivity
com.android.settings.wallpaper.WallpaperSuggestionActivity
com.android.settings.wifi.RequestToggleWiFiActivity
com.android.settings.wifi.WifiConfigInfo
com.android.settings.wifi.WifiDialogActivity
com.android.settings.wifi.WifiNoInternetDialog
com.android.settings.wifi.WifiPickerActivity
com.android.settings.wifi.WifiScanModeActivity
com.android.settings.wifi.WifiSettings
com.android.settings.wifi.WifiStatusTest
com.google.android.libraries.hats20.SurveyPromptActivity
com.google.android.settings.backup.BackupSuggestionActivity
com.google.android.settings.external.ExternalSettingsTrampoline
com.google.android.settings.gestures.AssistGestureSuggestion
com.google.android.settings.gestures.assist.AssistGestureTrainingEnrollingActivity
com.google.android.settings.gestures.assist.AssistGestureTrainingFinishedActivity
com.google.android.settings.gestures.assist.AssistGestureTrainingIntroActivity
com.google.android.settings.gestures.assist.bubble.AssistGestureBubbleActivity
Found 241 classes
直接启动service
也可以先使用android hooking list services
查看可供开启的服务,然后使用android intent launch_service com.android.settings.bluetooth.BluetoothPairingService
命令来开启服务。
2. Frida hook anywhere
1. objection (hook)
查找包含某些关键词的类
命令是android hooking search classes 关键字
# android hooking search classes displaysettings
com.android.settings.DisplaySettings
com.android.settings.DisplaySettings$1
com.android.settings.Settings$DisplaySettingsActivity
com.android.settings.Settings$NightDisplaySettingsActivity
com.android.settings.Settings$WifiDisplaySettingsActivity
com.android.settings.display.NightDisplaySettings
com.android.settings.wfd.WifiDisplaySettings
Found 7 classes
通过类名遍历类中所有方法
命令是android hooking watch class com.android.settings.DisplaySettings
# android hooking watch class com.android.settings.DisplaySettings
(agent) Hooking com.android.settings.DisplaySettings.-wrap0(android.content.Context, com.android.settingslib.core.lifecycle.Lifecycle)
(agent) Hooking com.android.settings.DisplaySettings.buildPreferenceControllers(android.content.Context, com.android.settingslib.core.lifecycle.Lifecycle)
(agent) Hooking com.android.settings.DisplaySettings.getHelpResource()
(agent) Hooking com.android.settings.DisplaySettings.getLogTag()
(agent) Hooking com.android.settings.DisplaySettings.getMetricsCategory()
(agent) Hooking com.android.settings.DisplaySettings.getPreferenceControllers(android.content.Context)
(agent) Hooking com.android.settings.DisplaySettings.getPreferenceScreenResId()
(agent) Hooking com.android.settings.DisplaySettings.onAttach(android.content.Context)
(agent) Registering job 8528686833285. Type: watch-class for: com.android.settings.DisplaySettings
com.android.settings on (google: 8.1.0) [usb] # (agent) [8528686833285] Called com.android.settings.DisplaySettings.getMetricsCategory()
(agent) [8528686833285] Called com.android.settings.DisplaySettings.getMetricsCategory()
(agent) [8528686833285] Called com.android.settings.DisplaySettings.getMetricsCategory()
通过完整的方法命打印参数
命令是android hooking watch class_method com.android.settings.DisplaySettings.getPreferenceScreenResI d --dump-args --dump-return
其中 下面三个参数是可选参数
· --dump-args
打印参数
· --dump-return
打印返回值
· --dump-backtrace
打印堆栈
# android hooking watch class_method com.android.settings.DisplaySettings.getPreferenceScreenResId --dump-args --dump-return
(agent) [8179527189977] Called com.android.settings.DisplaySettings.getPreferenceScreenResId()
(agent) [8179527189977] Return Value: 2132082743
2. objection (内存漫游)
列出内存中所有的类
# android hooking list classes
sun.util.logging.LoggingSupport
sun.util.logging.LoggingSupport$1
sun.util.logging.LoggingSupport$2
sun.util.logging.PlatformLogger
sun.util.logging.PlatformLogger$1
sun.util.logging.PlatformLogger$JavaLoggerProxy
sun.util.logging.PlatformLogger$Level
sun.util.logging.PlatformLogger$LoggerProxy
void
Found 11885 classes
内存中搜索所有的类
在内存中所有已加载的类中搜索包含特定关键词的类。
# android hooking search classes display
[Landroid.hardware.display.WifiDisplay;
[Landroid.icu.impl.ICUCurrencyDisplayInfoProvider$ICUCurrencyDisplayInfo$CurrencySink$EntrypointTable;
[Landroid.icu.impl.LocaleDisplayNamesImpl$CapitalizationContextUsage;
[Landroid.icu.impl.LocaleDisplayNamesImpl$DataTableType;
[Landroid.icu.number.NumberFormatter$DecimalSeparatorDisplay;
[Landroid.icu.number.NumberFormatter$SignDisplay;
[Landroid.icu.text.DisplayContext$Type;
[Landroid.icu.text.DisplayContext;
[Landroid.icu.text.LocaleDisplayNames$DialectHandling;
[Landroid.view.Display$Mode;
[Landroid.view.Display;
android.app.Vr2dDisplayProperties
android.hardware.display.AmbientBrightnessDayStats
android.hardware.display.AmbientBrightnessDayStats$1
android.hardware.display.BrightnessChangeEvent
com.android.settings.wfd.WifiDisplaySettings$SummaryProvider
com.android.settings.wfd.WifiDisplaySettings$SummaryProvider$1
com.android.settingslib.display.BrightnessUtils
com.android.settingslib.display.DisplayDensityUtils
com.google.android.gles_jni.EGLDisplayImpl
javax.microedition.khronos.egl.EGLDisplay
Found 144 classes
内存中搜索所有的方法
在内存中所有已加载的类的方法中搜索包含特定关键词的方法,上文中可以发现,内存中已加载的类就已经高达11885个了,那么他们的方法一定是类的个数的数倍,整个过程会相当庞大和耗时
# android hooking search methods display
列出类的所有方法
当搜索到了比较关心的类之后,就可以直接查看它有哪些方法,比如我们想要查看com.android.settings.DisplaySettings类有哪些方法:
# android hooking list class_methods com.android.settings.DisplaySettings
private static java.util.List<com.android.settingslib.core.AbstractPreferenceController> com.android.settings.DisplaySettings.buildPreferenceControllers(android.content.Context,com.android.settingslib.core.lifecycle.Lifecycle)
protected int com.android.settings.DisplaySettings.getPreferenceScreenResId()
protected java.lang.String com.android.settings.DisplaySettings.getLogTag()
protected java.util.List<com.android.settingslib.core.AbstractPreferenceController> com.android.settings.DisplaySettings.createPreferenceControllers(android.content.Context)
public int com.android.settings.DisplaySettings.getHelpResource()
public int com.android.settings.DisplaySettings.getMetricsCategory()
static java.util.List com.android.settings.DisplaySettings.access$000(android.content.Context,com.android.settingslib.core.lifecycle.Lifecycle)
Found 7 method(s)
直接生成hook代码
上文中在列出类的方法时,还直接把参数也提供了,也就是说我们可以直接动手写hook
了,既然上述写hook的
要素已经全部都有了,objection
这个“自动化”工具,当然可以直接生成代码。
# android hooking generate simple com.android.settings.DisplaySettings
Java.perform(function() {
var clazz = Java.use('com.android.settings.DisplaySettings');
clazz.getHelpResource.implementation = function() {
//
return clazz.getHelpResource.apply(this, arguments);
}
});
Java.perform(function() {
var clazz = Java.use('com.android.settings.DisplaySettings');
clazz.getLogTag.implementation = function() {
//
return clazz.getLogTag.apply(this, arguments);
}
});
Java.perform(function() {
var clazz = Java.use('com.android.settings.DisplaySettings');
clazz.getPreferenceScreenResId.implementation = function() {
//
return clazz.getPreferenceScreenResId.apply(this, arguments);
}
});
生成的代码大部分要素都有了,只是参数貌似没有填上,还是需要我们后续补充一些,看来还是无法做到完美。