打开objection:
C:\Users\Administrator\Downloads>objection -g com.tencent.mobileqq explore
Using USB device `AOSP on angler`
Agent injected and responds ok!
_ _ _ _
___| |_|_|___ ___| |_|_|___ ___
| . | . | | -_| _| _| | . | |
|___|___| |___|___|_| |_|___|_|_|
|___|(object)inject(ion) v1.8.4
Runtime Mobile Exploration
by: @leonjza from @sensepost
[tab] for command suggestions
com.tencent.mobileqq on (Android: 6.0.1) [usb] #
添加某个函数断点,并输出调用栈,入参和出参:
com.tencent.mobileqq on (Android: 6.0.1) [usb] # android hooking watch class_method com.android.okhttp.internal.http.Ht
tpEngine.hasBody --dump-args --dump-backtrace --dump-return
(agent) Attempting to watch class com.android.okhttp.internal.http.HttpEngine and method hasBody.
(agent) Hooking com.android.okhttp.internal.http.HttpEngine.hasBody(com.android.okhttp.Response)
(agent) Registering job 65vnl7pd22. Type: watch-method for: com.android.okhttp.internal.http.HttpEngine.hasBody
com.tencent.mobileqq on (Android: 6.0.1) [usb] #
查看某个类中所有函数的调用:
com.tencent.mobileqq on (Android: 6.0.1) [usb] # android hooking watch class com.tencent.mobileqq.highway.segment.HwReq
uest
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.checkCacheIp(com.tencent.mobileqq.highway.segment.HwResponse, com.tencent.mobileqq.highway.transaction.Transaction)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.dumpBaseInfo()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getExtendInfo()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getHwSeq()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getLoginSigHead()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getPriority()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getRequestBody()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getSegmentHead()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getTicket()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.hasRequestBody()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onCancle()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onError(int)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onResponse(com.tencent.mobileqq.highway.segment.RequestWorker, com.tencent.mobileqq.highway.segment.HwResponse)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onResponse(com.tencent.mobileqq.highway.segment.RequestWorker, com.tencent.mobileqq.highway.segment.HwResponse, com.tencent.mobileqq.highway.segment.HwRequest)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onRetry(int)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onSendBegin()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onSendEnd()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.setHwSeq(int)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.updateStaus(int)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.intToIP(int)
(agent) Registering job zgp81je8b9o. Type: watch-class for: com.tencent.mobileqq.highway.segment.HwRequest
com.tencent.mobileqq on (Android: 6.0.1) [usb] #
查看当前任务:
com.tencent.mobileqq on (Android: 6.0.1) [usb] # jobs list
Job ID Hooks Type
----------- ------- ---------------------------------------------------------------------
65vnl7pd22 1 watch-method for: com.android.okhttp.internal.http.HttpEngine.hasBody
zgp81je8b9o 20 watch-class for: com.tencent.mobileqq.highway.segment.HwRequest
com.tencent.mobileqq on (Android: 6.0.1) [usb] #
关闭某个断点:
com.tencent.mobileqq on (Android: 6.0.1) [usb] # jobs kill 65vnl7pd22
这里的job号,不仅可以通过jobs list获得,每次hook住之后,最左边也会携带,如下:
(agent) [iqbhfw0ezd] Called com.tencent.mobileqq.highway.segment.HwRequest.intToIP(int)
(agent) [iqbhfw0ezd] Called com.tencent.mobileqq.highway.segment.HwRequest.getHwSeq()
(agent) [iqbhfw0ezd] Called com.tencent.mobileqq.highway.segment.HwRequest.getHwSeq()
暂时就用到这些,以后再补