/*
*
* 极速版:
* frida -U -l E:\frida_out.js -f com.ss.android.ugc.aweme.lite --no-pause -o c:\log\20220111.txt
*
* 附加方式
* frida -U com.ss.android.ugc.aweme.lite -l E:\frida_out.js
*
*
*/
function dumpAddr(address, length) {
length = length || 1024;
console.log(hexdump(address, {
offset: 0,
length: length,
header: true,
ansi: true
}));
}
//5. 打印堆栈
function showStacks() {
Java.perform(function () {
console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
});
}
function hook_dy_so2() {
hook_dy();
var time = 1000;
var base_addr = Module.findBaseAddress("libmetasec_ml.so");
if (base_addr == null) {
//console.log("base_addr is null");
setTimeout(hook_dy_so2, time);
} else {
var modLibil2cpp = Process.getModuleByName("libmetasec_ml.so")
console.log("hook_dy_so2 base_addr:", base_addr, modLibil2cpp.base, modLibil2cpp.size.toString(16));
//var func_addr = base_addr.add(0x0c6b93);
var iSignOffset = 0xXXXXX; //17.9版本 Q 1 52 409 3145
iSignOffset = 0xXXXXX; //19.3版本 Q 1 52 409 3145
iSignOffset = 0xXXXXX; //19.5版本 Q 1 52 409 3145
iSignOffset = 0xXXXXX; //19.6版本 Q 1 52 409 3145
var func_addr = base_addr.add(iSignOffset);
console.log(" hook_dy_so2: my_make_XGorgon be found 2", base_addr.toString(16), func_addr.toString(16))
var src_func = new NativePointer(ptr(func_addr));
Interceptor.attach(src_func, {
//onEnter: function(args)顾名思义就是进入该函数前要执行的代码，其中args是传入的参数，一般so层函数第一个参数都是JniEnv，第二个参数是jclass，从第三个参数开始才是我们java层传入的参数
onEnter: function (args) {
//对于调用者直接是native里面的函数，用下面方式打印参数
console.log("args0",args[0].readCString());
console.log("args1", args[1].readCString());
if (args[1] != null) {
console.log("args2", args[2].readCString());
}
//console.log("\nBacktrace:\n" + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n"));
},
onLeave: function (retval) { //onLeave: function(retval)是该函数执行结束要执行的代码，其中retval参数即是返回值
console.log("return:" + retval, retval.readCString()); //打印返回值
//retval.replace(0); //替换返回值为0
}
});
}
//打印请求数据
//hook_sscronet();
}
function hook_dy() {
//Java.use()与Java.choose()最大的区别，就是在于前者会新建一个对象，后者会选择内存中已有的实例。
//com.topgamesinc.thirdpart
//public void purchaseItem(String uin,String serverId, String itemId,String itemName,String itemPrice, final String specialItemId)
Java.perform(function () {
if (Java.available) {
//hook弹出检测到root环境的提示框
//第一个参数：MainActivity.this，当前的上下文环境
//第二个参数：要显示的字符串，就是你想在屏幕上显示的内容
//第三个参数：显示的时间长短，就是这个字符串在屏幕上显示的时长。Toast默认的有两个LENGTH_LONG(长)和LENGTH_SHORT(短) 。
var javaString = Java.use('java.lang.String')
var CharSequence = Java.use('java.lang.CharSequence');
var MainActivity = Java.use('android.widget.Toast');
if (MainActivity != null) {
MainActivity.makeText.overload('android.content.Context', 'java.lang.CharSequence', 'int').implementation = function (a, b, c) {
console.log("call Toast makeText: ", b);
//console.log("call Toast makeText: ", Java.cast(b, javaString));
showStacks();
//var hookContent = javaString.$new('hook')
var bRet = this.makeText(a, b, c);
return bRet;
}
}
//com.ttnet.org.chromium.net.impl nativeCreateRequestAdapter function ( j, str, i, i2, z, z2, z3, z4, i3, z5, i4)
//N.MnXVOzVo Object obj, long j, String str, int i, int i2, boolean z, boolean z2, boolean z3, boolean z4, int i3, boolean z5, int i4
MainActivity = Java.use('J.N');
if (MainActivity != null) {
MainActivity.MnXVOzVo.implementation = function (obj, j, str, i, i2, z, z2, z3, z4, i3, z5, i4) {
console.log("\r\n call nativeCreateRequestAdapter: " + str);
//return 0; //这里返回0，只是让流程不继续，不实际发送请求到服务器，不然多次测试会时不时出安全验证，影响分析
return this.MnXVOzVo(obj,j, str, i, i2, z, z2, z3, z4, i3, z5, i4);
}
}
//com.ttnet.org.chromium.net.CronetEngine.Builder
var bHaveFlag = false;
MainActivity = Java.use('org.chromium.CronetClient');
if (MainActivity != null) {
MainActivity.openConnection.implementation = function (context, str, z, str2, executor) {
//需要查询url请求记录，就打开下面日志
console.log("\r\n call openConnection: ", str);
//这样可以拿到url
//call openConnection: f44K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6S2N6$3g2E0k6g2)9J5k6i4y4F1M7%4y4V1K9#2)9J5k6h3y4G2L8g2)9J5c8X3q4%4k6h3#2W2i4K6u0r3N6U0q4Q4x3V1k6U0L8$3#2E0K9i4c8Q4x3V1k6A6N6r3g2E0i4K6u0r3k6r3W2Y4k6#2)9J5c8W2)9K6c8X3q4%4k6h3#2W2i4K6g2X3K9h3c8Q4x3@1b7%4x3o6x3J5x3e0p5K6y4U0t1&6x3e0x3H3x3K6V1@1z5e0p5I4i4K6t1$3j5h3#2H3i4K6y4n7N6s2W2H3k6g2)9K6c8o6q4Q4x3U0k6S2L8i4m8Q4x3@1u0U0K9r3q4F1L8X3g2D9i4K6g2X3K9h3c8Q4x3@1b7H3i4K6t1$3j5h3#2H3i4K6y4n7j5$3W2@1P5g2)9K6c8o6b7@1x3o6p5H3x3q4)9J5y4X3q4E0M7q4)9K6b7X3q4U0N6r3W2$3K9i4c8&6i4K6y4p5x3q4)9J5y4X3q4E0M7q4)9K6b7X3W2@1k6h3#2Q4y4h3k6@1P5i4m8W2i4K6y4p5x3q4)9J5y4X3q4E0M7q4)9K6b7X3W2K6i4K6g2X3j5$3!0E0L8h3g2J5j5$3g2Q4x3@1b7H3i4K6t1$3j5h3#2H3i4K6y4n7K9h3W2V1i4K6y4p5x3e0l9I4x3U0l9H3z5o6p5K6y4U0t1J5y4U0R3^5x3#2)9J5y4X3q4E0M7q4)9K6b7X3c8W2N6X3W2U0k6g2)9#2k6X3W2V1i4K6y4p5x3K6l9$3x3e0b7&6x3o6R3&6z5e0M7#2x3o6x3K6x3#2)9J5y4X3q4E0M7q4)9K6b7X3q4U0i4K6y4p5N6$3W2X3K9g2)9J5y4X3q4E0M7q4)9K6b7X3y4Z5j5h3&6F1k6h3I4Q4x3@1c8@1k6h3&6Y4P5s2g2F1i4K6g2X3x3e0p5J5z5q4)9#2k6U0j5@1i4K6t1$3j5h3#2H3i4K6y4n7j5h3W2V1i4K6y4p5x3e0p5J5z5q4)9J5y4X3q4E0M7q4)9K6b7X3q4H3M7q4)9#2k6X3&6S2L8h3g2Q4x3@1c8S2N6$3g2E0k6g2)9J5y4X3q4E0M7q4)9K6b7Y4k6W2M7Y4y4A6L8$3&6Q4y4h3k6U0L8$3c8W2i4K6y4p5x3e0R3H3y4K6l9H3i4K6t1$3j5h3#2H3i4K6y4n7N6X3g2J5M7$3W2G2L8W2)9#2k6X3&6S2L8h3g2Q4x3@1b7I4z5q4)9J5k6e0N6Q4x3X3f1H3i4K6t1$3j5h3#2H3i4K6y4n7k6r3g2$3K9h3y4W2i4K6g2X3M7r3I4S2N6r3k6G2M7X3#2Q4x3@1c8S2L8X3c8J5L8$3W2V1i4K6t1$3j5h3#2H3i4K6y4n7L8%4y4Q4x3@1c8S2L8X3c8J5L8$3W2V1i4K6t1$3j5h3#2H3i4K6y4n7M7%4y4E0K9i4S2Q4x3@1c8S2i4K6t1$3j5h3#2H3i4K6y4n7k6r3g2$3K9h3y4W2i4K6g2X3N6s2W2H3k6g2)9K6c8p5#2u0i4K6u0n7z5q4)9J5y4X3q4E0M7q4)9K6b7X3c8W2N6X3W2U0k6g2)9#2k6X3u0J5j5h3&6V1i4K6y4p5h3r3W2S2L8$3#2A6i4K6t1$3j5h3#2H3i4K6y4n7L8r3q4F1k6%4g2S2k6$3g2Q4x3@1c8*7K9q4)9J5y4X3q4E0M7q4)9K6b7X3!0K6i4K6g2X3j5i4m8A6i4K6y4p5x3U0W2Q4x3U0k6S2L8i4m8Q4x3@1u0G2M7#2)9#2k6Y4k6W2M7Y4y4A6L8$3&6Q4x3@1b7I4x3q4)9J5y4X3q4E0M7q4)9K6b7X3#2S2L8X3W2X3k6i4y4@1i4K6g2X3N6X3g2J5M7$3W2G2L8W2)9#2k6X3y4G2k6r3g2Q4x3@1b7I4z5o6l9%4x3o6q4Q4x3U0k6S2L8i4m8Q4x3@1u0J5k6i4y4G2L8s2g2@1K9h3!0F1i4K6y4p5x3e0l9^5x3q4)9J5b7e0t1H3x3U0S2Q4x3U0k6S2L8i4m8Q4x3@1u0V1M7r3W2Q4x3@1b7@1y4o6m8Q4x3U0k6S2L8i4m8Q4x3@1u0#2M7r3c8S2N6r3g2Q4y4h3k6$3k6i4u0K6K9h3!0F1i4K6g2X3j5$3!0V1k6g2)9K6c8o6p5^5y4K6l9&6z5e0l9H3i4K6t1$3j5h3#2H3i4K6y4n7i4K6g2X3M7Y4c8A6j5$3E0W2N6q4)9K6c8o6p5$3x3K6R3%4y4K6f1&6z5o6V1^5x3U0y4Q4x3U0k6S2L8i4m8Q4x3@1u0H3j5h3y4C8j5h3N6W2i4K6y4p5j5$3!0E0i4K6u0W2M7%4y4Q4x3X3g2S2L8X3c8J5L8$3W2V1i4K6u0W2N6h3N6U0i4K6u0W2j5i4N6W2L8h3g2Q4x3U0k6S2L8i4m8Q4x3@1u0U0M7s2g2Q4y4h3k6K6N6i4m8H3L8%4u0@1y4U0c8Q4x3@1c8@1M7Y4g2W2i4K6t1$3j5h3#2H3i4K6y4n7K9r3!0K6N6q4)9#2k6X3q4T1K9g2)9K6c8r3q4J5L8e0j5@1i4K6u0V1N6U0S2S2i4K6t1$3j5h3#2H3i4K6y4n7K9i4y4Q4y4h3k6Y4N6h3g2K6N6q4)9#2k6X3#2G2k6r3g2Q4x3@1b7H3i4K6t1$3j5h3#2H3i4K6y4n7j5i4m8H3i4K6g2X3N6s2W2H3k6g2)9K6c8r3&6G2M7X3#2S2L8q4)9J5y4X3q4E0M7q4)9K6b7X3#2A6L8X3!0J5i4K6g2X3M7%4c8S2N6s2g2K6i4K6y4p5x3q4)9J5y4X3q4E0M7q4)9K6b7X3q4H3M7q4c8Z5k6h3#2W2i4K6y4p5L8r3W2Y4K9s2c8Q4x3U0k6S2L8i4m8Q4x3@1u0F1k6h3g2V1i4K6g2X3M7r3g2J5M7$3!0F1j5h3I4Q4y4h3k6J5k6h3y4G2L8h3#2W2L8X3c8Q4x3@1b7I4i4K6t1$3j5h3#2H3i4K6y4n7K9i4y4Q4y4h3k6S2L8X3c8J5L8$3W2V1i4K6g2X3M7r3q4V1i4K6y4p5x3q4)9J5y4X3q4E0M7q4)9K6b7Y4c8K6i4K6y4p5x3e0j5K6z5o6M7%4y4e0V1^5z5q4)9J5y4X3q4E0M7q4)9K6b7X3y4V1K9h3c8Q4x3@1b7#2k6e0x3%4k6o6u0W2x3q4)9J5k6o6t1%4j5U0S2Q4x3X3b7@1j5K6q4T1i4K6u0V1j5X3u0S2k6W2)9J5k6o6q4V1j5e0t1I4x3o6N6T1x3X3k6W2x3R3`.`.
//Found instance: org.chromium.CronetClient@515f501
//var sCronetEngine = this.build();
//var haveObj = Java.choose('org.chromium.CronetClient');
if (!bHaveFlag) {
Java.choose("org.chromium.CronetClient", {
onMatch: function (instance) { //该类有多少个实例，该回调就会被触发多少次
console.log("Found instance: " + instance);
//instance.getCronetEngine().startNetLogToFile("/data/local/tmp/cronet_log.json", true);
bHaveFlag = true;
},
onComplete: function () { }
});
}
return this.openConnection(context, str, z, str2, executor);
}
}
//hook 设备注册激活相关
//hookAllOverloads("com.ss.android.deviceregister.DeviceRegisterManager", "getSigHash"); //
hookAllOverloads("com.bytedance.common.utility.DigestUtils", "md5Hex");
hookAllOverloads("com.ss.bduploader.BDAuthHelper","setStringValue");
MainActivity = Java.use('com.alipay.sdk.util.f');
if (MainActivity != null) {
MainActivity.LIZIZ.overload('java.lang.String', 'java.lang.String').implementation = function (str1 ,str2) {
console.log("\r\n call com.alipay.sdk.util.f.LIZIZ: ", str1,str2);
//showStacks();
//return 0; //这里返回0，只是让流程不继续，不实际发送请求到服务器，不然多次测试会时不时出安全验证，影响分析
//dumpAddr(hexTemp,0x80);
return this.LIZIZ(str1,str2);
}
}
MainActivity = Java.use('com.bytedance.retrofit2.mime.DigestUtil');
if (MainActivity != null) {
MainActivity.md5Hex.overload('[B').implementation = function (byteArray) {
var result = this.md5Hex(byteArray);
// 2. 使用 javascript JSON.stringify() 打印 [B
var result1 = JSON.stringify(byteArray);
var strByte = byteToString(byteArray);
console.log('byteArray,byte src :', result1);
console.log(strByte);
console.log('byteArray,md5str: ', result);
return result;
}
}
MainActivity = Java.use('android.os.Debug');
if (MainActivity != null) {
MainActivity.isDebuggerConnected.implementation = function () {
console.log("call isDebuggerConnected");
//console.log(p0);
showStacks();
//java.lang.Exception
//at android.os.Debug.isDebuggerConnected(Native Method)
//at com.inca.security.IiIIiiiiIi.IiIIIiiIII(hc: 449)
//at com.inca.security.IiIIiiiiIi.run(hc: 319)
var bRet = this.isDebuggerConnected();
//bRet = true;
console.log("isDebuggerConnected bRet: ", bRet);
return bRet;
}
}
//void android.os.Process.killProcess(int)
MainActivity = Java.use('android.os.Process');
if (MainActivity != null) {
MainActivity.killProcess.implementation = function (pid) {
console.log("call killProcess");
//console.log(p0);
showStacks();
var bRet = this.killProcess(pid);
return bRet;
}
}
//com.kugou.common.utils.bv
}
});
}
//byte数组转字符串
//7f8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3K9r3q4A6M7$3S2A6K9%4g2Y4N6h3q4Q4x3V1k6S2M7X3y4Z5K9i4k6W2i4K6u0r3x3U0l9J5x3q4)9J5c8U0l9#2i4K6u0r3x3o6S2Q4x3V1j5I4x3U0R3#2x3o6x3@1x3g2)9J5k6h3S2@1L8h3H3`.
function byteToString(arr) {
if (typeof arr === 'string') {
return arr;
}
var str = '',
_arr = arr;
for (var i = 0; i < _arr.length; i++) {
var one = _arr[i].toString(2),
v = one.match(/^1+?(?=0)/);
if (v && one.length == 8) {
var bytesLength = v[0].length;
var store = _arr[i].toString(2).slice(7 - bytesLength);
for (var st = 1; st < bytesLength; st++) {
store += _arr[st + i].toString(2).slice(2);
}
str += String.fromCharCode(parseInt(store, 2));
i += bytesLength - 1;
} else {
str += String.fromCharCode(_arr[i]);
}
}
return str;
}
function get_func_addr(module, offset) {
var base_addr = Module.findBaseAddress(module);
console.log("base_addr: " + base_addr);
console.log(hexdump(ptr(base_addr), {
length: 16,
header: true,
ansi: true
}))
var func_addr = base_addr.add(offset);
if (Process.arch == 'arm')
return func_addr.add(1); //如果是32位地址+1
else
return func_addr;
}
//setImmediate(hook_dy_so2,3); // hook_dy_so2
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
