本帖最后由 冥界3大法王 于 2018-12-15 22:45 编辑
原贴地址:https://www.52pojie.cn/thread-743758-1-1.html
Snap67.jpg (358.27 KB, 下载次数: 0)
2018-12-15 22:40 上传
看到没,敌人的情报全部暴露了 ~~
使用感受:简单,暴力美学!
InjectLog 为什么不是InjectLog1 InjectLog2 InjectLog3。。。。。。。。。。。。InjectLogN ? 这样岂不更能区分执行顺序?
[Python] 纯文本查看 复制代码import os
class ParserError(Exception):
pass
#
def inject_code_to_method_section(method_section):
#
if method_section[0].find("static constructor") != -1:
return method_section
#
if method_section[0].find("synthetic") != -1:
return method_section
#
if method_section[0].find("abstract") != -1:
return method_section
#
inject_code = [
'\n',
' invoke-static {}, Lcom/hook/testsmali/InjectLog;->PrintFunc()V\n',
'\n'
]
#
for i in range(0, len(method_section)):
if method_section[i].find(".prologue") != -1:
method_section[i + 1: i + 1] = inject_code
return method_section
#
for ii in range(0, len(method_section)-1):
if len(method_section[ii].strip())!= 0 and len(method_section[ii+1].strip()) == 0 and method_section[ii+2].find(".annotation") == -1:
method_section[ii + 1: ii + 1] = inject_code
return method_section
return method_section
def inject_log_code(content):
new_content = []
method_section = []
is_method_begin = False
for line in content:
if line[:7] == ".method":
is_method_begin = True
method_section.append(line)
continue
if is_method_begin:
method_section.append(line)
else:
new_content.append(line)
if line[:11] == ".end method":
if not is_method_begin:
raise ParserError(".method error")
is_method_begin = False
new_method_section = inject_code_to_method_section(method_section)
new_content.extend(new_method_section)
method_section.clear()
return new_content
def main():
walker = os.walk("./")
for root, directory, files in walker:
for file_name in files:
if file_name[-6:] != ".smali" or file_name[:5] == "Cocos":
continue
file_path = root + "/" + file_name
print(file_path)
file = open(file_path,'r',encoding='UTF-8')
lines = file.readlines()
file.close()
new_code = inject_log_code(lines)
file = open(file_path, "w",encoding='UTF-8')
file.writelines(new_code)
file.close()
if __name__ == '__main__':
main()
[SQL] 纯文本查看 复制代码.class public Lcom/hook/testsmali/InjectLog;
.super Ljava/lang/Object;
.source "InjectLog.java"
# direct methods
.method public constructor ()V
.locals 0
.prologue
.line 3
invoke-direct {p0}, Ljava/lang/Object;->()V
return-void
.end method
.method public static PrintFunc()V
.locals 6
.prologue
.line 7
invoke-static {}, Ljava/lang/Thread;->currentThread()Ljava/lang/Thread;
move-result-object v0
.line 8
.local v0, "cur_thread":Ljava/lang/Thread;
invoke-virtual {v0}, Ljava/lang/Thread;->getStackTrace()[Ljava/lang/StackTraceElement;
move-result-object v1
.line 9
.local v1, "stack":[Ljava/lang/StackTraceElement;
const-string v2, "InjectLog"
new-instance v3, Ljava/lang/StringBuilder;
invoke-direct {v3}, Ljava/lang/StringBuilder;->()V
const/4 v4, 0x3
aget-object v4, v1, v4
invoke-virtual {v4}, Ljava/lang/StackTraceElement;->toString()Ljava/lang/String;
move-result-object v4
invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v3
const-string v4, "["
invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v3
invoke-virtual {v0}, Ljava/lang/Thread;->getId()J
move-result-wide v4
invoke-virtual {v3, v4, v5}, Ljava/lang/StringBuilder;->append(J)Ljava/lang/StringBuilder;
move-result-object v3
const-string v4, "]"
invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
move-result-object v3
invoke-virtual {v3}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
move-result-object v3
invoke-static {v2, v3}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I
.line 10
return-void
.end method
[Asm] 纯文本查看 复制代码@echo off
color 0A
echo ===========injectlog===========
:start
cls
set current_dir=%~dp0
pushd %current_dir%
:start
echo.请输入要注入LOG的逆向工程名称(输入【apk的文件名】等价于AndroidKiller\projects【apk的文件名】)
set /p inputgc=
if not exist .\projects\%inputgc%\ (
echo "工程文件夹不存在"
goto start
)
xcopy smalihook.py /y .\projects\%inputgc%\Project\smali\
set do_dir=.\projects\%inputgc%\Project\smali\
pushd %do_dir%
call python.exe smalihook.py
del smalihook.py
pushd %current_dir%
xcopy InjectLog.smali /y .\projects\%inputgc%\Project\smali\com\hook\testsmali\
if exist .\projects\%inputgc%\Project\smali_classes2\ (
echo "存在dex2,继续处理"
rem goto starttwo
) else (
goto done
)
:done
echo "已处理完毕"
pause
exit
:starttwo
xcopy smalihook.py /y .\projects\%inputgc%\Project\smali_classes2\
set did_dir=.\projects\%inputgc%\Project\smali_classes2\
pushd %did_dir%
call python.exe smalihook.py
del smalihook.py
pushd %current_dir%
xcopy InjectLog.smali /y .\projects\%inputgc%\Project\smali_classes2\com\hook\testsmali\
goto done