FridaManager + AndroidAsync + frida ruc 远程调用

qq_1548357515

已于 2022-11-28 18:16:08 修改

阅读量826

点赞数

分类专栏： python 文章标签： python javascript android

于 2022-11-28 18:14:21 首次发布

本文链接：https://blog.csdn.net/qq_33239778/article/details/128084468

版权

python 专栏收录该内容

22 篇文章 0 订阅

订阅专栏

参考文章及资源下载

先下载 androidAsync.dex，然后adb push 到手机 /data/local/tmp 路径下
复制下方脚本，然后改成自己要编写的脚本就行了
启动 FridaManager.apk 设置好js 就好了

function Log(info) {
    Java.perform(function () {
        var LogClass = Java.use("android.util.Log");
        LogClass.e("FridaManager", info);
    })
}

function main() {
    function map_list(args) {
        var array = Java.use("java.util.ArrayList");
        var arrayList = array.$new();
        arrayList.add(args);
        return arrayList;
    }

    // 加载 dex 文件
    Java.openClassFile('/data/local/tmp/androidAsync.dex').load();

    const HttpServerRequestCallback = Java.use('com.koushikdutta.async.http.server.HttpServerRequestCallback');

    // 构建一个默认请求
    const RequestTestCallback = Java.registerClass({
        name: "RequestTestCallback",
        implements: [HttpServerRequestCallback],
        methods: {
            onRequest: function (request, response) {
                // 主动调用代码直接写这里
                response.send(JSON.stringify({
                    "code": 0,
                    "message": " 服务已经注册成功, 默认端口8181"
                }));
            }
        }
    });

    // 实现搜索接口主动调用
    const dy_Xg = Java.registerClass({
        name: "dy_Xg ",
        implements: [HttpServerRequestCallback],
        methods: {
            onRequest: function (request, response) {
                // 获取post 传递的参数
                var requestJsonData = request.getBody().get();
                const str_url = JSON.parse(requestJsonData)['url'];
                const str_stub = JSON.parse(requestJsonData)['stub'];
                const ua = JSON.parse(requestJsonData)['ua'];
                // 主动调用
                const xgs = Java.use('com.bytedance.frameworks.baselib.network.http.NetworkParams').$new();
                var HashMap = Java.use('java.util.HashMap');
                var hm = HashMap.$new();
                hm.put("x-ss-stub", map_list(str_stub));
                hm.put("user-agent", map_list(ua));
                var xglist = xgs.tryAddSecurityFactor(str_url, hm);
                var FastJson = Java.use('com.alibaba.fastjson.JSON');
                var result = FastJson.toJSONString(xglist);
                Log("xg " + result)
                // 主动调用代码直接写这里
                response.send(result);
            }
        }
    });

    try {
        const AsyncHttpServer = Java.use('com.koushikdutta.async.http.server.AsyncHttpServer');
        const androidAsync = AsyncHttpServer.$new();
        const prot = 8181
        // 新增路由
        androidAsync.get('/', RequestTestCallback.$new());
        androidAsync.post("/get_xg", dy_Xg.$new());
        androidAsync.listen(prot);
        Log('注册服务成功, 端口为 ===> ' + prot);

    } catch (e) {
        Log('注册服务失败!!!, e:' + e);
    }
}

Log("开始");
Java.perform(function () {
    // 开关函数
    var bRunServer = 0;
    Log("start hook");
    var NetworkParams = Java.use("com.bytedance.frameworks.baselib.network.http.NetworkParams");
    NetworkParams.tryAddSecurityFactor.implementation = function (a, b) {
        if (bRunServer == 0) {
            Log("开始设置开关函数");
            bRunServer = 1;
            main();
        }
        var result = this.tryAddSecurityFactor(a, b);
        return result;
    }
});