Frida例子
使用Frida尝试hook,做第一个示例代码。代码来源:r0ysue/AndroidFridaBeginnersBook
由于设备要解锁bootloader需要一台专门android设备,暂且使用genymotion模拟器进行测试(保证frida-server具有root权限)。
HelloWorld
将 hello_world.js 代码注入到本地android项目上的 onCreate() 方法。
$ frida -U -l hello_world.js [process_name]
js文件内容如下。
setTimeout(function(){
Java.perform(function(){
console.log("hello world!");
});
});
执行结果:
____
/ _ | Frida 15.1.24 - A world-class dynamic instrumentation toolkit
| (_| |
> _ | Commands:
/_/ |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://frida.re/docs/home/
. . . .
. . . . Connected to Google Nexus 5X (id=192.168.56.101:5555)
Attaching...
hello world!
[Google Nexus 5X::android.process.media ]->
成功打印出 hello world!
结果。
创建的demo
- 创建一个Demo程序,运行到虚拟机上。
- 针对MainActivity上两个按钮的click事件,进行hook。
- 使用上述同样的命令将js文件注入到进程上。
$ frida -U -l '1_mt.js' com.ruixi.android
但遇到错误提示。
____
/ _ | Frida 15.1.24 - A world-class dynamic instrumentation toolkit
| (_| |
> _ | Commands:
/_/ |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://frida.re/docs/home/
. . . .
. . . . Connected to Google Nexus 5X (id=192.168.56.101:5555)
Failed to spawn: unable to find process with name 'com.ruixi.android'
遇到这样的我问题,可以考虑使用另一个命令。
$ frida -U -f com.ruixi.android -l '1_mt.js' --no-pause
____
/ _ | Frida 15.1.24 - A world-class dynamic instrumentation toolkit
| (_| |
> _ | Commands:
/_/ |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://frida.re/docs/home/
. . . .
. . . . Connected to Google Nexus 5X (id=192.168.56.101:5555)
Spawning `com.ruixi.android`...
Script loaded successfully
Spawned `com.ruixi.android`. Resuming main thread!
[Google Nexus 5X::com.ruixi.android ]-> Inside java perform function
Java.Use.Successfully!