1、HOOK普通方法
import frida, sys
jscode ="""
Java.perform(function () {
var utils = Java.use('com.renren.mobile.utils.RSA');//Java.use('类名') utils.D.implementation D为方法名
utils.D.implementation = function (a, b,c) {
console.log("Hook Start..."); send(arguments[0]); //打印方法第一个参数 用send(a)也行
send(arguments[1]); //打印方法第二个参数 用send(b)也行
send(arguments[2]); //打印方法第三个参数 用send(c)也行
// var num=arguments[0]+arguments[1]; //send(num);
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.renren.mobile.android') //apk包名
script= process.create_script(jscode)
script.on("message", message) script.load()
sys.stdin.read()
“HOOK构造方法 ”
import frida, sys
jscode = """
Java.perform(function () {
var money = Java.use('com.qiang.fridaapp.Money');
money.$init.implementation = function (a, b) {
console.log("Hook Start...");
send(arguments[0]);
send(arguments[1]);
send("Success!");
return this.$init(10000, "美元");
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.qiang.fridaapp')
script= process.create_script(jscode)
script.on("message", message) script.load()
sys.stdin.read()
JAVA层HOOK重载方法
import frida
import sys
jscode ="""
Java.perform(function () {
var utils = Java.use('com.qiang.fridaapp.Utils');
utils.test.overload("int").implementation = function (a) {
console.log("Hook Start...");
send(arguments[0]);
return "helloworld";
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.qiang.fridaapp')
script = process.create_script(jscode) script.on("message", message)
script.load()
sys.stdin.read()
HOOK构造对象参数
jscode = """
Java.perform(function () {
var utils = Java.use('com.qiang.fridaapp.Utils');
var money = Java.use('com.qiang.fridaapp.Money');
utils.test.overload().implementation = function () {
//send("Hook Start...");
var mon = money.$new(2000,'港币');
//send(mon.getInfo());
return this.test(800);
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.qiang.fridaapp')
script= process.create_script(jscode)
script.on("message", message)
script.load()
sys.stdin.read()
HOOK修改对象属性
import frida import sys
jscode = """
Java.perform(function () {
var utils = Java.use('com.qiang.fridaapp.Utils');
var money = Java.use('com.qiang.fridaapp.Money');
var clazz = Java.use('java.lang.Class');
utils.test.overload().implementation = function () {
send("Hook Start...");
var mon = money.$new(200,"RMB");
send(mon.getInfo());
var num= Java.cast(mon.getClass(),clazz).getDeclaredField('num');
num.setAccessible(true);
num.setInt(mon, 2000);
send(mon.getInfo());
return this.test();
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.qiang.fridaapp')
script = process.create_script(jscode) script.on("message", message)
script.load()
sys.stdin.read()
HOOK匿名内部类
# -*- coding: utf-8 -*-
import frida import sys
jscode = """
Java.perform(function () {
var login = Java.use('com.qiang.helloworld.LoginActivity$1');
login.onClick.implementation = function (a) {
send("Hook Start...");
send("helloworld!");
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.qiang.helloworld')
script = process.create_script(jscode)
script.on("message", message)
script.load()
sys.stdin.read()
HOOK 打印堆栈信息
import frida import sys
jscode = """
Java.perform(function () {
var login = Java.use('com.qiang.helloworld.LoginActivity$1');
login.onClick.implementation = function (a) {
send("Hook Start...");
printStack();
}
function printStack(){
var threadef = Java.use('java.lang.Thread');
var threadinstance = threadef.$new();
var stack = threadinstance.currentThread().getStackTrace();
for(var i = 0;i<stack.length;i++){
send("stack:" + stack[i].toString());
}
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.qiang.helloworld')
script = process.create_script(jscode)
script.on("message", message)
script.load()
sys.stdin.read()
HOOK字符串转字节数组
import frida import sys
jscode = """
Java.perform(function () {
var login = Java.use('com.qianyu.helloworld.LoginActivity$1');
login.onClick.implementation = function (a) {
send("Hook Start...");
var bytes=stringToBytes("hello world!")
send(bytes);
}
function stringToBytes(str) {
var ch, st, re = [];
for(var i = 0; i < str.length; i++ ) {
ch = str.charCodeAt(i);
st = [];
do{
st.push( ch & 0xFF );
ch = ch >> 8;
}
while(ch);
re = re.concat(st.reverse());
}
return re;
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.qiang.helloworld')
script = process.create_script(jscode)
script.on("message", message)
script.load()
sys.stdin.read()
字节数组转字符串
# -*- coding: utf-8 -*-
import frida import sys
jscode = """
Java.perform(function () {
var login = Java.use('com.qiang.helloworld.LoginActivity$1');
login.onClick.implementation = function (a) {
send("Hook Start...");
var bytes=stringToBytes("hello world!")
send(bytes);
var str=byteToString(bytes)
send(str);
}
function stringToBytes(str) {
var ch, st, re = [];
for(var i = 0; i < str.length; i++ ) {
ch = str.charCodeAt(i);
st = [];
do{
st.push( ch & 0xFF );
ch = ch >> 8;
}
while(ch);
re = re.concat(st.reverse());
}
return re;
}
function byteToString(arr){
if(typeof arr === 'string'){
return arr;
}
var str='',
_arr = arr;
for(var i=0; i<_arr.length; i++) {
var one =_arr[i].toString(2), v=one.match(/^1+?(?=0)/);
if(v && one.length == 8){
var bytesLength = v[0].length;
var store = _arr[i].toString(2).slice(7 - bytesLength);
for(var st=1; st < bytesLength; st++) {
store+=_arr[st + i].toString(2).slice(2);
}
str+=String.fromCharCode(parseInt(store, 2));
i+=bytesLength-1;
} else {
str+=String.fromCharCode(_arr[i]);
}
}
return str;
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.qiang.helloworld')
script = process.create_script(jscode)
script.on("message", message)
script.load()
sys.stdin.read()
Java层hook复杂参数
# -*- coding: utf-8 -*-
import frida import sys
jscode = """
Java.perform(function () {
var md5 = Java.use('com.renren.mobile.utils.Md5');
md5.toMD5.implementation = function (a) {
console.log("================================");
//printStack();
send(a);
var res = this.toMD5(a);
send(res);
return res;
}
var info=Java.use('com.renren.mobile.android.service.ServiceProvider');
info.a.overload('java.lang.String', 'java.lang.String', 'int', 'java.lang.String', 'java.lang.String', 'android.content.Context', 'com.renren.mobile.android.loginfree.LoginStatusListener').implementation
= function(str1,str2,i,str3,str4,context,loginStatus){
console.log("================================");
//printStack();
send("=>"+str1);
send("=>"+str2);
send("=>"+i);
send("=>"+str3);
send("=>"+str4);
send("=>"+context);
send("=>"+loginStatus);
}
function printStack(){
var threadef = Java.use('java.lang.Thread');
var threadinstance = threadef.$new();
var stack = threadinstance.currentThread().getStackTrace();
for(var i = 0;i<stack.length;i++){
send("stack:" + stack[i].toString());
}
} });
"""
def message(message, data):
if message["type"] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
process = frida.get_remote_device().attach('com.renren.mobile.android')
script = process.create_script(jscode)
script.on("message", message)
script.load()
sys.stdin.read()
微信公众号:安卓逆向菜鸟修炼记