frida 常见数据类型转换

1.map转string

用frida打印map对象会输出，这样一点都不方便查看。

map: [object Object]

第一种转换方式：

function mapToString(hash_map) {
   	var result = "";
    var keyset = hash_map.keySet();
    var it = keyset.iterator();
    while (it.hasNext()) {
        var keystr = it.next().toString();
        var valuestr = hash_map.get(keystr).toString();
        result += keystr +"="+valuestr+"&";
    }
    return result.substring(0, result.length - 1);
  }

应用:

function main() {
  Java.perform(function () {

        function mapToString(hash_map) {
            var result = "";
            var keyset = hash_map.keySet();
            var it = keyset.iterator();
            while (it.hasNext()) {
                var keystr = it.next().toString();
                var valuestr = hash_map.get(keystr).toString();
                result += keystr +"="+valuestr+"&";
            }
            return result.substring(0, result.length - 1);
          }

        var KeyInfo = Java.use("com.vip.vcsp.KeyInfo");
        KeyInfo["gs"].implementation = function (context, map, str, z) {
            console.log("↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓");
            console.log('gs is called');
            console.log('context: ' + context);
            console.log('map: ' + map);
            console.log('map_string: ' + mapToString(map));
            console.log('str: ' + str);
            console.log('z: ' + z);
            var ret = this.gs(context, map, str, z);
            console.log('gs ret value is ' + ret);
            console.log("↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑");
            return ret;
        };
    });
}

setImmediate(main);

运行下：

第二种转换方式：

使用强制类型转换

Java.cast(sortedMap,map)

代码举例：

let LibBili = Java.use("com.bilibili.nativelibrary.LibBili");
LibBili["s"].implementation = function (sortedMap) {
    console.log("↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓");
    console.log(`LibBili.s is called: sortedMap=${sortedMap}`);
    var map = Java.use("java.util.TreeMap")
    var dict = Java.cast(sortedMap,map)
    console.log('传入的对象====>',dict)
    let result = this["s"](sortedMap);
    console.log(`LibBili.s result=${result}`);
    console.log("↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑");
    return result;
  };

2. bytes转string

当输出参数是bytes类型时，也会打印出 [object Object]，这样也很不方便阅览。

第一种：

转换代码：

function bytesToString(arr) {
    var str = '';
    arr = new Uint8Array(arr);
    for (var i in arr) {
        str += String.fromCharCode(arr[i]);
    }
    return str;
}

应用:

Java.perform(function() {
    function bytesToString(arr) {
        var str = '';
        arr = new Uint8Array(arr);
        for (var i in arr) {
            str += String.fromCharCode(arr[i]);
        }
        return str;
    }

      var NativeApi = Java.use("com.weibo.xvideo.NativeApi");
      NativeApi["s"].implementation = function (bArr, z) {
        console.log('s方法被调用:' + ', ' + 'bArr: ' + bArr + ', ' + 'z: ' + z);
         console.log("bytes转String-入参1:" + bytesToString(bArr));
        var ret = this.s(bArr, z);
        console.log('s ret value is ' + ret);
        return ret;
      };
});

运行下：

第二种

Java.perform(function(){
    var NativeHttp = Java.use("xmx.tap.http.NativeHttp");
    NativeHttp["getSign"].implementation = function (context, bArr) {
        console.log("↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓");
        console.log('getSign is called');
        console.log('context: ' + context);
        console.log('bArr: ' + bArr);
        var java_string = Java.use("java.lang.String");
        console.log('bArr: ' + java_string.$new(bArr));

        var ret = this.getSign(context, bArr);
        console.log('getSign ret value is ' + ret);
        console.log("↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑");
    return ret;
};

看看效果：

3.string转bytes

转换代码：

  function stringToBytes(str) {
      var javaString = Java.use('java.lang.String');
      return javaString.$new(str).getBytes();
  }

应用：

Java.perform(function() {

  function stringToBytes(str) {
      var javaString = Java.use('java.lang.String');
      return javaString.$new(str).getBytes();
  }

  var NativeApi = Java.use("com.weibo.xvideo.NativeApi");

  var arg1 = "aid=01A-khBWIm48A079Pz_DMW6PyZR8uyTumcCNm4e8awxyC2ANU.&cfrom=28B5295010&cuid=5999578300&noncestr=46274W9279Hr1X49A5X058z7ZVz024&platform=ANDROID&timestamp=1621437643609&ua=Xiaomi-MIX2S__oasis__3.5.8__Android__Android10&version=3.5.8&vid=1019013594003&wm=20004_90024";
  var arg2 = false;
  
  var ret = NativeApi.$new().s(stringToBytes(arg1), arg2);
  console.log("ret:"+ret);
});

其他的，遇到了再补充完整。