基于python-frida注入脚本

启动脚本前要先启动Frida server
端口转发默认启动 默认端口

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time : 2021-04-19 22:38
# @Author : Nuonuo
# @Site : 
# @File : run.py
# @Software: PyCharm
import os
import frida, sys


jscode = """
Java.perform(function() {
    send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
    send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
    send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
    send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
    send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")

function tongsha(){
    var secretKeySpec = Java.use('javax.crypto.spec.SecretKeySpec');
    secretKeySpec.$init.overload('[B','java.lang.String').implementation = function (a,b) {
        var result = this.$init(a, b);
        console.log("======================================");
        console.log("算法名：" + b + "|Dec密钥:" + ByteToString(a));
        console.log("算法名：" + b + "|Hex密钥:" +BytesToHex(a));
        return result;
    }
    var mac = Java.use('javax.crypto.Mac');
    mac.getInstance.overload('java.lang.String').implementation = function (a) {
        var result = this.getInstance(a);
        console.log("======================================");
        console.log("算法名：" + a);
        return result;
    }
    mac.update.overload('[B').implementation = function (a) {
        this.update(a);
        console.log("======================================");
        console.log("update:" + ByteToString(a))
    }
    mac.update.overload('[B','int','int').implementation = function (a,b,c) {
        this.update(a,b,c)
        console.log("======================================");
        console.log("update:" + ByteToString(a) + "|" + b + "|" + c);
    }
    mac.doFinal.overload().implementation = function () {
        var result = this.doFinal();
        console.log("======================================");
        console.log("doFinal结果:" + BytesToHex(result));
        console.log("doFinal结果:" +BytesToBase64(result));
        return result;
    }
    mac.doFinal.overload('[B').implementation = function (a) {
        var result = this.doFinal(a);
        console.log("======================================");
        console.log("doFinal参数:" + ByteToString(a));
        console.log("doFinal结果:" + BytesToHex(result));
        console.log("doFinal结果:" + BytesToBase64(result));
        return result;
    }
        var md = Java.use('java.security.MessageDigest');
    md.getInstance.overload('java.lang.String','java.lang.String').implementation = function (a,b) {
        console.log("======================================");
        console.log("算法名：" + a);
        return this.getInstance(a, b);
    }
    md.getInstance.overload('java.lang.String').implementation = function (a) {
        console.log("======================================");
        console.log("算法名：" + a);
        return this.getInstance(a);
    }
    md.update.overload('[B').implementation = function (a) {
        console.log("======================================");
        console.log("update:" + ByteToString(a))
        return this.update(a);
    }
    md.update.overload('[B','int','int').implementation = function (a,b,c) {
        console.log("======================================");
        console.log("update:" + ByteToString(a) + "|" + b + "|" + c);
        return this.update(a,b,c);
    }
    md.digest.overload().implem