frida-java层常用模板

1、HOOK普通方法

import frida, sys
jscode =""" 
Java.perform(function () {
   var utils = Java.use('com.renren.mobile.utils.RSA');//Java.use('类名')    			    utils.D.implementation    D为方法名   
    utils.D.implementation = function (a, b,c) {
        console.log("Hook Start..."); 		send(arguments[0]);  //打印方法第一个参数 用send（a）也行
        send(arguments[1]);   //打印方法第二个参数 用send（b）也行
        send(arguments[2]);   //打印方法第三个参数 用send（c）也行
       // var num=arguments[0]+arguments[1]; 		//send(num);
    } }); 
"""


def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.renren.mobile.android')  //apk包名 
script= process.create_script(jscode) 
script.on("message", message) script.load() 
sys.stdin.read()

“HOOK构造方法 ”

import frida, sys
jscode = """ 
Java.perform(function () { 	
var money = Java.use('com.qiang.fridaapp.Money');
    money.$init.implementation = function (a, b) {
        console.log("Hook Start..."); 	
        send(arguments[0]); 		
        send(arguments[1]);
        send("Success!"); 		
        return this.$init(10000, "美元");
    } }); 
"""


def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qiang.fridaapp') 
script= process.create_script(jscode) 
script.on("message", message) script.load() 
sys.stdin.read() 

JAVA层HOOK重载方法

 import frida 
 import sys
 jscode =""" 
 Java.perform(function () {
    var utils = Java.use('com.qiang.fridaapp.Utils');
    utils.test.overload("int").implementation = function (a) {
        console.log("Hook Start...");
        send(arguments[0]);
        return "helloworld";
    } }); 
"""

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qiang.fridaapp')
script = process.create_script(jscode) script.on("message", message) 
script.load() 
sys.stdin.read()

HOOK构造对象参数

jscode = """ 
Java.perform(function () { 	
var utils = Java.use('com.qiang.fridaapp.Utils'); 	
var money = Java.use('com.qiang.fridaapp.Money');
utils.test.overload().implementation = function () {
        //send("Hook Start..."); 		
        var mon = money.$new(2000,'港币'); 		
        //send(mon.getInfo()); 		
        return this.test(800);
    } }); 
"""

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qiang.fridaapp')
 script= process.create_script(jscode) 
 script.on("message", message) 
 script.load() 
 sys.stdin.read()

HOOK修改对象属性

import frida import sys
jscode = """ 
Java.perform(function () {
    var utils = Java.use('com.qiang.fridaapp.Utils');
    var money = Java.use('com.qiang.fridaapp.Money');
    var clazz = Java.use('java.lang.Class');
    
    utils.test.overload().implementation = function () {
        send("Hook Start...");
       
        var mon = money.$new(200,"RMB");
        send(mon.getInfo());
        
        var num= Java.cast(mon.getClass(),clazz).getDeclaredField('num');
        num.setAccessible(true);
       
        num.setInt(mon, 2000);
        send(mon.getInfo());
       
        return this.test();
    } }); 
"""

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qiang.fridaapp') 
script = process.create_script(jscode) script.on("message", message) 
script.load() 
sys.stdin.read()

HOOK匿名内部类

# -*- coding: utf-8 -*-

import frida import sys

 jscode = """
 Java.perform(function () {
    var login = Java.use('com.qiang.helloworld.LoginActivity$1');
    login.onClick.implementation = function (a) {
        send("Hook Start...");
        send("helloworld!");
    } }); 
"""

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qiang.helloworld') 
script = process.create_script(jscode) 
script.on("message", message) 
script.load() 
sys.stdin.read()

HOOK 打印堆栈信息

import frida import sys
jscode = """ 
Java.perform(function () {
    var login = Java.use('com.qiang.helloworld.LoginActivity$1');

    login.onClick.implementation = function (a) {
        send("Hook Start...");
        printStack();
    }
    
    function printStack(){
        var threadef = Java.use('java.lang.Thread');
        var threadinstance = threadef.$new();
        var stack = threadinstance.currentThread().getStackTrace();
        for(var i = 0;i<stack.length;i++){
            send("stack:" + stack[i].toString());
        }
    } }); 
"""

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qiang.helloworld') 
script = process.create_script(jscode) 
script.on("message", message) 
script.load() 
sys.stdin.read()

HOOK字符串转字节数组

import frida import sys
jscode = """ 
Java.perform(function () {
    var login = Java.use('com.qianyu.helloworld.LoginActivity$1');
    login.onClick.implementation = function (a) {
        send("Hook Start...");
        var bytes=stringToBytes("hello world!")
        send(bytes); 
    }
    function stringToBytes(str) {  
        var ch, st, re = []; 
        for(var i = 0; i < str.length; i++ ) { 
            ch = str.charCodeAt(i);  
            st = [];                 
            do{  
                st.push( ch & 0xFF );  
                ch = ch >> 8;          
            }    
            while(ch);  
            re = re.concat(st.reverse()); 
        }  
        return re;  
    }  }); 
 """

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qiang.helloworld') 
script = process.create_script(jscode) 
script.on("message", message) 
script.load() 
sys.stdin.read() 

字节数组转字符串

# -*- coding: utf-8 -*-
import frida import sys
jscode = """ 
Java.perform(function () {
    var login = Java.use('com.qiang.helloworld.LoginActivity$1');
    login.onClick.implementation = function (a) {
        send("Hook Start...");
        var bytes=stringToBytes("hello world!")
        send(bytes); 
        var str=byteToString(bytes)
        send(str);
    }
    
    function stringToBytes(str) {  
        var ch, st, re = []; 
        for(var i = 0; i < str.length; i++ ) { 
            ch = str.charCodeAt(i);  
            st = [];                 
            do{  
                st.push( ch & 0xFF );  
                ch = ch >> 8;          
            }    
            while(ch);  
            re = re.concat(st.reverse()); 
        }  
        return re;  
    } 
    
    function byteToString(arr){  
        if(typeof arr === 'string'){  
            return arr;  
        }  
        var str='',  
        _arr = arr;  
        for(var i=0; i<_arr.length; i++) {  
            var one =_arr[i].toString(2), v=one.match(/^1+?(?=0)/);  
            if(v && one.length == 8){  
                var bytesLength = v[0].length;  
                var store = _arr[i].toString(2).slice(7 - bytesLength);  
                for(var st=1; st < bytesLength; st++) {  
                    store+=_arr[st + i].toString(2).slice(2);  
                }  
                str+=String.fromCharCode(parseInt(store, 2));  
                i+=bytesLength-1;  
            } else {  
                str+=String.fromCharCode(_arr[i]);  
            }  
        }  
        return str;  
    } }); 
"""

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.qiang.helloworld') 
script = process.create_script(jscode) 
script.on("message", message) 
script.load() 
sys.stdin.read()

Java层hook复杂参数

# -*- coding: utf-8 -*-

import frida import sys
jscode = """ 
Java.perform(function () {
    var md5 = Java.use('com.renren.mobile.utils.Md5');
    md5.toMD5.implementation = function (a) {
        console.log("================================"); 
        //printStack();
        send(a);
        var res = this.toMD5(a);
        send(res);
        return res;
    }
    
    var info=Java.use('com.renren.mobile.android.service.ServiceProvider');
    info.a.overload('java.lang.String', 'java.lang.String', 'int', 'java.lang.String', 'java.lang.String',  'android.content.Context', 'com.renren.mobile.android.loginfree.LoginStatusListener').implementation
= function(str1,str2,i,str3,str4,context,loginStatus){
       console.log("================================"); 
       //printStack();
       send("=>"+str1);
       send("=>"+str2);
       send("=>"+i);
       send("=>"+str3);
       send("=>"+str4);
       send("=>"+context);
       send("=>"+loginStatus);
    }
    
    function printStack(){
        var threadef = Java.use('java.lang.Thread');
        var threadinstance = threadef.$new();
        var stack = threadinstance.currentThread().getStackTrace();
        for(var i = 0;i<stack.length;i++){
            send("stack:" + stack[i].toString());
        }
    } }); 
"""

def message(message, data):
    if message["type"] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.renren.mobile.android')
script = process.create_script(jscode) 
script.on("message", message) 
script.load() 
sys.stdin.read()

微信公众号：安卓逆向菜鸟修炼记