启动脚本前要先启动Frida server
端口转发默认启动 默认端口
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time : 2021-04-19 22:38
# @Author : Nuonuo
# @Site :
# @File : run.py
# @Software: PyCharm
import os
import frida, sys
jscode = """
Java.perform(function() {
send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
send("注入frida成功!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
function tongsha(){
var secretKeySpec = Java.use('javax.crypto.spec.SecretKeySpec');
secretKeySpec.$init.overload('[B','java.lang.String').implementation = function (a,b) {
var result = this.$init(a, b);
console.log("======================================");
console.log("算法名:" + b + "|Dec密钥:" + ByteToString(a));
console.log("算法名:" + b + "|Hex密钥:" +BytesToHex(a));
return result;
}
var mac = Java.use('javax.crypto.Mac');
mac.getInstance.overload('java.lang.String').implementation = function (a) {
var result = this.getInstance(a);
console.log("======================================");
console.log("算法名:" + a);
return result;
}
mac.update.overload('[B').implementation = function (a) {
this.update(a);
console.log("======================================");
console.log("update:" + ByteToString(a))
}
mac.update.overload('[B','int','int').implementation = function (a,b,c) {
this.update(a,b,c)
console.log("======================================");
console.log("update:" + ByteToString(a) + "|" + b + "|" + c);
}
mac.doFinal.overload().implementation = function () {
var result = this.doFinal();
console.log("======================================");
console.log("doFinal结果:" + BytesToHex(result));
console.log("doFinal结果:" +BytesToBase64(result));
return result;
}
mac.doFinal.overload('[B').implementation = function (a) {
var result = this.doFinal(a);
console.log("======================================");
console.log("doFinal参数:" + ByteToString(a));
console.log("doFinal结果:" + BytesToHex(result));
console.log("doFinal结果:" + BytesToBase64(result));
return result;
}
var md = Java.use('java.security.MessageDigest');
md.getInstance.overload('java.lang.String','java.lang.String').implementation = function (a,b) {
console.log("======================================");
console.log("算法名:" + a);
return this.getInstance(a, b);
}
md.getInstance.overload('java.lang.String').implementation = function (a) {
console.log("======================================");
console.log("算法名:" + a);
return this.getInstance(a);
}
md.update.overload('[B').implementation = function (a) {
console.log("======================================");
console.log("update:" + ByteToString(a))
return this.update(a);
}
md.update.overload('[B','int','int').implementation = function (a,b,c) {
console.log("======================================");
console.log("update:" + ByteToString(a) + "|" + b + "|" + c);
return this.update(a,b,c);
}
md.digest.overload().implem