frida进行hook的常用定位招数大全

一、Base64的定位

var base64 = Java.use("android.util.Base64");
base64.encodeToString.overload('[B', 'int').implementation = function (a, b) {
    console.log("base64.encodeToString: ", JSON.stringify(a));
    var result = this.encodeToString(a, b);
    console.log("base64.encodeToString result: ", result)
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    return result;
}

二、Toast显示的定位

var toast = Java.use("android.widget.Toast");
toast.show.implementation=function(){
   console.log("输出调用栈：")
   console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
   return this.show();
}

三、jSONObject的定位

var jSONObject = Java.use("org.json.JSONObject");
jSONObject.put.overload('java.lang.String', 'java.lang.Object').implementation = function (a, b) {
    //var result = Java.cast(a, Java.use("java.util.ArrayList"));
    console.log("jSONObject.put: ", a, b);
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    return this.put(a, b);
}
jSONObject.getString.implementation = function (a) {
    //var result = Java.cast(a, Java.use("java.util.ArrayList"));
    console.log("jSONObject.getString: ", a);
    var result = this.getString(a);
    console.log("jSONObject.getString result: ", result);
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    return result;
}

四、HashMap的定位

var hashMap = Java.use("java.util.HashMap");
hashMap.put.implementation = function (a, b) {
    //a=="username"和a.equals("username")一般都可以
    //如果不行换一下即可
    if (a.equals("username")) {
     console.log("hashMap.put: ", a, b);
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
 }
 return this.put(a, b);
}

五、EditText的getText方法定位

var editText = Java.use("android.widget.EditText");
editText.getText.overload().implementation = function () {
    var result = this.getText();
    result = Java.cast(result, Java.use("java.lang.CharSequence"));
    console.log("editText.getText: ", result.toString());
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    return result;
}

六、ArrayList的定位

var arrayList = Java.use("java.util.ArrayList");
arrayList.add.overload('java.lang.Object').implementation = function (a) {
    if (a.equals("username=12555")) {
        console.log("arrayList.add: ", a);
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    }
    //console.log("arrayList.add: ", a);
    return this.add(a);
}
arrayList.add.overload('int', 'java.lang.Object').implementation = function (a, b) {
    console.log("arrayList.add: ", a, b);
    return this.add(a, b);
}

七、System.loadLibrary的定位

Java.perform(function() {

let Systemclazz = Java.use("java.lang.System");
Systemclazz.loadLibrary.implementation = function(){  // loadLibrary、load、mapLibraryName等，都hook看看
    console.log('System.loadLibrary is called');
    console.log('library name:', arguments[0]);
    var retval = Systemclazz.loadLibrary.apply(this, arguments)
	
	//打印堆栈
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
    return retval
};

});

八、NewStringUTF定位（通过密文定位so文件）

知道密文是so层加密的情况下，快速定位到是哪个so文件调用加密的

function hook_NewStringUTF(){
 
    var artModule = Process.findModuleByName("libart.so");
    var symbols = artModule.enumerateSymbols();
    var newStringUTF = null;
    for (let i = 0; i < symbols.length; i++) {
        let symbol = symbols[i];
        if(symbol.name.indexOf("NewStringUTF") != -1 && symbol.name.indexOf("Check") == -1){
            console.log(symbol.name);
            newStringUTF = symbol.address;
        }
        
    }
 
    Interceptor.attach(newStringUTF, {
        onEnter : function(args){
            if(args[1].readCString() && args[1].readCString().indexOf("*")!= -1 && args[1].readCString().indexOf("B")!= -1){  // 设置密文过滤规则
                console.log("\x1B[33m[加密字符串]:\x1B[0m",args[1].readCString());
                console.log("\x1B[33m[调用栈]:\x1B[0m\n",Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n') + '\n');

            }
        },onLeave : function(retval){
 
        }
    })
 
}

setTimeout(hook_NewStringUTF,1000);

九、文件路径定位

var File = Java.use("java.io.File");
File.$init.overload('java.lang.String').implementation=function(path){
   console.log("文件路径：",path)
   console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
   return File.apply(this, path);
}