frida笔记

frida-ps

命令行工具，用来列出进程，在跟远程系统交互的时候很有用。

将frida通过USB或者WiFi列出正在运行的进程

$ frida-ps -U

列出正在运行的应用

$ frida-ps -Ua

续

列出安装的应用

$ frida-ps -Uai

太长只能复制输出了

[~]$ frida-ps -Uai                                                                            [14:09:24]
  PID  Name                                    Identifier
-----  --------------------------------------  -----------------------------------------
  969  Android System                          android
 5408  Calendar                                com.google.android.calendar
 4991  Calendar Storage                        com.android.providers.calendar
21208  Chrome                                  com.android.chrome
 4907  Download Manager                        com.android.providers.downloads
 5143  Email                                   com.google.android.email
 5256  Gallery                                 com.google.android.gallery3d
 5094  Gmail                                   com.google.android.gm
 2905  Google                                  com.google.android.googlequicksearchbox
 1278  Google Account Manager                  com.google.android.gsf.login
 1399  Google Backup Transport                 com.google.android.backuptransport
 1278  Google Contacts Sync                    com.google.android.syncadapters.contacts
21221  Google Partner Setup                    com.google.android.partnersetup
 5314  Google Play Music                       com.google.android.music
 2540  Google Play Store                       com.android.vending
 1278  Google Play services                    com.google.android.gms
 1278  Google Services Framework               com.google.android.gsf
 1160  Hacker's Keyboard                       org.pocketworkstation.pckeyboard
 4907  Media Storage                           com.android.providers.media
 4287  Mobike                                  com.mobike.mobikeapp
 1230  Nfc Service                             com.android.nfc
 1206  Phone                                   com.android.phone
 1206  Phone/Messaging Storage                 com.android.providers.telephony
 1488  QQ                                      com.tencent.mobileqq
 1206  SIM Toolkit                             com.android.stk
 3160  Settings                                com.android.settings
  969  Settings Storage                        com.android.providers.settings
 2018  SnapTube                                com.snaptube.premium
14615  SuperSU                                 eu.chainfire.supersu
 1054  System UI                               com.android.systemui
 1212  Update Device                           com.redbend.vdmc
22674  WeChat                                  com.tencent.mm
 1054  com.android.keyguard                    com.android.keyguard
21298  com.android.providers.partnerbookmarks  com.android.providers.partnerbookmarks
 2526  com.qualcomm.qcrilmsgtunnel             com.qualcomm.qcrilmsgtunnel
 3605  zANTI                                   com.zimperium.zanti
 2096  微信电话本                                   com.tencent.pb
 1351  百度云                                     com.baidu.netdisk
 4069  网易有道词典                                  com.youdao.dict
    -  Basic Daydreams                         com.android.dreams.basic
    -  BlueNMEA                                name.kellermann.max.bluenmea
    -  Bluetooth Share                         com.android.bluetooth
    -  BusyBox Free                            stericson.busybox
    -  CCTF                                    com.example.cctf
    -  Calculator                              com.android.calculator2
    -  Camera                                  com.google.android.GoogleCamera
    -  Cell Broadcasts                         com.android.cellbroadcastreceiver
    -  Certificate Installer                   com.android.certinstaller
    -  Clock                                   com.google.android.deskclock
    -  ConfigUpdater                           com.google.android.configupdater
    -  Contacts                                com.android.contacts
    -  Contacts Storage                        com.android.providers.contacts
    -  Cool Market                             com.coolapk.market
    -  Documents                               com.android.documentsui
    -  Downloads                               com.android.providers.downloads.ui
    -  DriveDroid                              com.softwarebakery.drivedroid
    -  Earth                                   com.google.earth
    -  Exchange Services                       com.google.android.exchange
    -  External Storage                        com.android.externalstorage
    -  Firefox                                 org.mozilla.firefox
    -  Fused Location                          com.android.location.fused
    -  Gboard                                  com.google.android.inputmethod.latin
    -  Google Dialer                           com.google.android.dialer
    -  Google Hindi Input                      com.google.android.apps.inputmethod.hindi
    -  Google Now Launcher                     com.google.android.launcher
    -  Google One Time Init                    com.google.android.onetimeinitializer
    -  Google Play Movies & TV                 com.google.android.videos
    -  Google Text-to-speech Engine            com.google.android.tts
    -  HTML Viewer                             com.android.htmlviewer
    -  Input Devices                           com.android.inputdevices
    -  Key Chain                               com.android.keychain
    -  Live Wallpaper Picker                   com.android.wallpaper.livepicker
    -  MainActivity                            com.metasploit.stage
    -  Maps                                    com.google.android.apps.maps
    -  Market Feedback Agent                   com.google.android.feedback
    -  Messenger                               com.google.android.apps.messaging
    -  MusicFX                                 com.android.musicfx
    -  NetHunter Android                       com.offsec.nethunter
    -  News & Weather                          com.google.android.apps.genie.geniewidget
    -  PacProcessor                            com.android.pacprocessor
    -  Package Access Helper                   com.android.defcontainer
    -  Package installer                       com.android.packageinstaller
    -  ProxyHandler                            com.android.proxyhandler
    -  R.E.管理器                                 com.speedsoftware.rootexplorer
    -  RF Analyzer                             com.mantz_it.rfanalyzer
    -  Service Programu                        com.lge.SprintHiddenMenu
    -  Setup Wizard                            com.google.android.setupwizard
    -  Shadowsocks                             com.github.shadowsocks
    -  Shell                                   com.android.shell
    -  Street View                             com.google.android.street
    -  Sun Beam                                com.android.phasebeamorange
    -  TWRP Manager                            com.jmz.soft.twrpmanager
    -  Tags                                    com.google.android.tag
    -  TalkBack                                com.google.android.marvin.talkback
    -  Terminal Emulator                       jackpal.androidterm
    -  Twitter                                 com.twitter.android
    -  USB Keyboard                            remote.hid.keyboard.client
    -  User Dictionary                         com.android.providers.userdictionary
    -  VpnDialogs                              com.android.vpndialogs
    -  Wallet                                  com.google.android.apps.walletnfcrel
    -  Wifi Connecter                          com.farproc.wifi.connecter
    -  Xposed Installer                        de.robv.android.xposed.installer
    -  YouTube                                 com.google.android.youtube
    -  adbWireless                             siir.es.adbWireless
    -  androidVNC                              android.androidVNC
    -  com.android.backupconfirm               com.android.backupconfirm
    -  com.android.browser.provider            com.android.browser.provider
    -  com.android.sharedstoragebackup         com.android.sharedstoragebackup
    -  com.android.wallpapercropper            com.android.wallpapercropper
    -  com.lge.update                          com.lge.update
    -  com.qualcomm.shutdownlistner            com.qualcomm.shutdownlistner
    -  com.qualcomm.timeservice                com.qualcomm.timeservice
    -  iWnn IME                                jp.co.omronsoft.iwnnime.ml
    -  iWnnIME Keyboard (White)                jp.co.omronsoft.iwnnime.ml.kbd.white
    -  哔哩哔哩动画                                  tv.danmaku.bili
    -  微控工具模块                                  com.easy.wtool
    -  微控群发示例                                  com.easy.wtool.demo.batchmsgs

frida-trace

frida-trace是一个用来动态trace函数调用的工具。

DEMO

cp /bin/cat /tmp/cat
/tmp/cat

然后在另一个终端用frida。

In [5]: import frida

In [6]: session = frida.attach("cat")

In [7]: print [x.name for x in session.enumerate_modules()]
[u'cat', u'libSystem.B.dylib', u'libcache.dylib', u'libcommonCrypto.dylib', u'libcompiler_rt.dylib', u'libcopyfile.dylib', u'libcorecrypto.dylib', u'libdispatch.dylib', u'libdyld.dylib', u'libkeymgr.dylib', u'liblaunch.dylib', u'libmacho.dylib', u'libquarantine.dylib', u'libremovefile.dylib', u'libsystem_asl.dylib', u'libsystem_blocks.dylib', u'libsystem_c.dylib', u'libsystem_configuration.dylib', u'libsystem_coreservices.dylib', u'libsystem_coretls.dylib', u'libsystem_dnssd.dylib', u'libsystem_info.dylib', u'libsystem_kernel.dylib', u'libsystem_m.dylib', u'libsystem_malloc.dylib', u'libsystem_network.dylib', u'libsystem_networkextension.dylib', u'libsystem_notify.dylib', u'libsystem_platform.dylib', u'libsystem_pthread.dylib', u'libsystem_sandbox.dylib', u'libsystem_secinit.dylib', u'libsystem_symptoms.dylib', u'libsystem_trace.dylib', u'libunwind.dylib', u'libxpc.dylib', u'libobjc.A.dylib', u'libc++abi.dylib', u'libc++.1.dylib']