frida 如何Hook app启动阶段的方法

【frida逆向开发】如何Hook app启动阶段的方法_信息安全交流QQ群：704033610-CSDN博客如何Hook app启动阶段的方法onCreate启动阶段即app没有完全启动起来。正常在hook一个app之前，要将app运行起来才可以进行hook，但是有些时候我们hook的方法是在app启动阶段执行的，该方法在启动阶段执行一次之后在不会执行。我们知道只有在该方法执行的时候才能hook到。那么现在两者冲突了正常hook要在app完全启动之后；该方法只在app启动阶段运行一次；例如：onCreate方法在app启动阶段首先执行该方法(画界面)，且执行一次之后不会在执行。Hook脚本：https://blog.csdn.net/weixin_44032232/article/details/109632309?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522163426296016780261931340%2522%252C%2522scm%2522%253A%252220140713.130102334..%2522%257D&request_id=163426296016780261931340&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~baidu_landing_v2~default-1-109632309.pc_search_result_hbase_insert&utm_term=%E5%A6%82%E4%BD%95Hook+app%E5%90%AF%E5%8A%A8%E9%98%B6%E6%AE%B5%E7%9A%84%E6%96%B9%E6%B3%95参考上面的文章，但是代码在最新的frida15.2上面总是报错，

{'type': 'error', 'description': 'Error: VM::AttachCurrentThread failed: -1', 'stack': 'Error: VM::AttachCurrentThread failed: -1\n    
at o (frida/node_modules/frida-java-bridge/lib/result.js:4)\n    
at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:25)\n    
at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:14)\n    
at Xe (frida/node_modules/frida-java-bridge/lib/android.js:499)\n    
at Ie (frida/node_modules/frida-java-bridge/lib/android.js:195)\n    
at Ce (frida/node_modules/frida-java-bridge/lib/android.js:16)\n    
at _tryInitialize (frida/node_modules/frida-java-bridge/index.js:17)\n    
at g (frida/node_modules/frida-java-bridge/index.js:9)\n    
at <anonymous> (frida/node_modules/frida-java-bridge/index.js:317)\n    
at call (native)\n    
at o (/_java.js)\n    
at <anonymous> (/_java.js)\n    
at <anonymous> (frida/runtime/java.js:1)\n    
at call (native)\n    
at o (/_java.js)\n    
at r (/_java.js)\n    
at <eval> (frida/runtime/java.js:3)\n    
at _loadJava (native)\n    
at get (frida/runtime/core.js:125)\n    
at <eval> (/script1.js:11)', 'fileName': 'frida/node_modules/frida-java-bridge/lib/result.js', 'lineNumber': 4, 'columnNumber': 1}

重新搞了一下，在原来 

Java.perform(function()
    {  
        var MainActivity = Java.use("com.rom.cpptest.MainActivity"); // 类的加载路径

        MainActivity.onCreate.overload('android.os.Bundle').implementation = function(str){   
            send("success1");
            this.onCreate(str);
            send("success2 "+str);
        };
    });   

再包裹一下

function hook_OnCreate()
{
    Java.perform(function()
    {
        var MainActivity = Java.use("com.rom.cpptest.MainActivity"); // 类的加载路径

        MainActivity.onCreate.overload('android.os.Bundle').implementation = function(str){
            send("success1");
            this.onCreate(str);
            send("success2 "+str);
        };
    });
}
setImmediate(hook_OnCreate);

整体代码如下，就可以运行了

import frida  # 导入frida模块
import sys  # 导入sys模块

jscode = """ 
function hook_OnCreate()
{
    Java.perform(function()
    {  
        var MainActivity = Java.use("com.rom.cpptest.MainActivity"); // 类的加载路径
    
        MainActivity.onCreate.overload('android.os.Bundle').implementation = function(str){   
            send("success1");
            this.onCreate(str);
            send("success2 "+str);
        };
    });  
}
setImmediate(hook_OnCreate);
"""
def on_message(message, data):  # js中执行send函数后要回调的函数
    if message["type"] == "send":
        print("[*] {0}".format(message["payload"]))
    else:
        print(message)


device = frida.get_usb_device()
pid = device.spawn(['com.rom.cpptest'])  # app包名
process = device.attach(pid)  # 加载进程号
script = process.create_script(jscode)  # 创建js脚本
script.on('message', on_message)  # 加载回调函数，也就是js中执行send函数规定要执行的python函数
script.load()  # 加载脚本
device.resume(pid)  # 重启app
sys.stdin.read()

svc_call_demo: 演示使用svc 调用openat和 libc下的openat的区别用于检测硬件的篡改信息https://gitee.com/sunyuzhe114/svc_call_demo

备注：该方法适用于android12以下的机器，高了不好用了