本文为看雪论坛文章
看雪论坛作者ID：无造
本文为看雪安卓高研3w班（8月班）优秀学员作品。
对于Java层的单纯调用关系，可以比较方便的打印。参数的打印还是比较麻烦，Java对象的地址如何获取属性值等信息还是需要进一步深入研究。
好消息！！
现在看雪《安卓高级研修班》线下班 & 网课（12月班）开始同步招生啦！
以前没报上高研班的小伙伴赶快抓紧机会报名，升职加薪唾手可得！！
首先写个Demo，实现这几种调用
public int JavaCallJava(int i){Log.i("javajnitrace","step1->JavaCallJava onEnter");return JavaCallJni(0x1111);}public int JniCallJava(int i){int javajnitrace = Log.i("javajnitrace", "step4->JniCallJava onEnter " + i);return 1;}public String JniCallJavaISS(int i, String s1, String s2){int javajnitrace = Log.i("javajnitrace", "stepX->JniCallJavaISS onEnter " + i+" "+s1+" "+s2);JavaCallJavaIII(0x1111,0x2222,0x3333);return "JniCallJavaISS Called";}public int JavaCallJavaIII(int i, int j, int k){Log.i("javajnitrace","stepX->JavaCallJavaIII onEnter");//JavaCallJavaI17(1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17);return i+j+k;}
extern "C"JNIEXPORT jint JNICALLJava_com_cwuzao_javajnitrace_MainActivity_JavaCallJni(JNIEnv *env, jobject thiz, jint i) {__android_log_print(4, "javajnitrace", "step2->JavaCallJni onEnter %0x", i);jclass class_MainActivity = env->FindClass("com/cwuzao/javajnitrace/MainActivity");jmethodID method_JniCallJni = env->GetMethodID(class_MainActivity, "JniCallJni", "(I)I");int callResult = env->CallIntMethod(thiz, method_JniCallJni, 0x2222);return callResult + 1;}extern "C"JNIEXPORT jint JNICALLJava_com_cwuzao_javajnitrace_MainActivity_JniCallJni(JNIEnv *env, jobject thiz, jint i) {__android_log_print(4, "javajnitrace", "step3->JniCallJni onEnter %0x",i);jclass class_MainActivity = env->FindClass("com/cwuzao/javajnitrace/MainActivity");jmethodID method_JniCallJava = env->GetMethodID(class_MainActivity, "JniCallJava", "(I)I");int callResult = env->CallIntMethod(thiz, method_JniCallJava, 0x3333);return callResult + 1;}
首先进行DoCall方法的HOOK
function DoCall_onEnter(args) {var addr_ArtMethod = args[2].add(8).readPointer();allocPrettyMethod.writeByteArray(allocPrettyMethodInit);PrettyMethod(addr_ArtMethod_PrettyMethod, addr_ArtMethod, allocPrettyMethod, 0x100);var methodName = allocPrettyMethod.readCString();if(methodName.indexOf(searchName) > -1){var addr_Call_ArtMethod = args[0];allocPrettyMethod.writeByteArray(allocPrettyMethodInit);PrettyMethod(addr_ArtMethod_PrettyMethod, addr_Call_ArtMethod, allocPrettyMethod, 0x100);var call_methodName = allocPrettyMethod.readCString();console.log("DoCall:",methodName,"->", call_methodName);}}
DoCall: void com.cwuzao.javajnitrace.MainActivity$1.onClick(android.view.View) -> int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int)DoCall: int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int) -> int android.util.Log.i(java.lang.String, java.lang.String)DoCall: int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int) -> int com.cwuzao.javajnitrace.MainActivity.JavaCallJni(int)addr_InvokeWithArgArray onEnter-> int com.cwuzao.javajnitrace.MainActivity.JniCallJni(int)addr_InvokeWithArgArray onEnter-> int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int)DoCall: int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int) -> int android.util.Log.i(java.lang.String, java.lang.String)addr_InvokeWithArgArray onLeaveaddr_InvokeWithArgArray onLeave
查看InvokeWithArgArray的HOOK
Interceptor.attach(addr_InvokeWithArgArray, {onEnter: function(args){var addr_ArtMethod = args[1];allocPrettyMethod.writeByteArray(allocPrettyMethodInit);PrettyMethod(addr_ArtMethod_PrettyMethod, addr_ArtMethod, allocPrettyMethod, 0x100);var methodName = allocPrettyMethod.readCString();if(methodName.indexOf(searchName) > -1 ){this.methodName = methodName;console.log("InvokeWithArgArray->",methodName, args[1], args[2], args[3], args[4]);}},onLeave: function(retval){}});
DoCall: int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int) -> int com.cwuzao.javajnitrace.MainActivity.JavaCallJni(int)addr_ArtMethod6Invoke onEnteraddr_InvokeWithArgArray onEnter-> int com.cwuzao.javajnitrace.MainActivity.JniCallJni(int)addr_ArtMethod6Invoke onEnteraddr_InvokeWithArgArray onEnter-> int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int)addr_ArtMethod6Invoke onEnterDoCall: int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int) -> int android.util.Log.i(java.lang.String, java.lang.String)
打印线程Tid
[]DoCall: void com.cwuzao.javajnitrace.MainActivity$1.onClick(android.view.View) -> int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int)[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int) -> int android.util.Log.i(java.lang.String, java.lang.String)[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int) -> int com.cwuzao.javajnitrace.MainActivity.JavaCallJni(int)[]addr_ArtMethod6Invoke onEnter->int com.cwuzao.javajnitrace.MainActivity.JavaCallJni(int)[]addr_ArtMethod6Invoke onEnter->int com.cwuzao.javajnitrace.MainActivity.JniCallJni(int)[]addr_ArtMethod6Invoke onEnter->int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int)[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int) -> int android.util.Log.i(java.lang.String, java.lang.String)
打印参数
InvokeWithArgArray调用的参数
Interceptor.attach(addr_InvokeWithArgArray, {onEnter: function(args){var addr_ArtMethod = args[1];allocPrettyMethod.writeByteArray(allocPrettyMethodInit);PrettyMethod(addr_ArtMethod_PrettyMethod, addr_ArtMethod, allocPrettyMethod, 0x100);var methodName = allocPrettyMethod.readCString();if(methodName.indexOf("com.cwuzao.javajnitrace") > -1 ){this.showResult = true;this.methodName = methodName;this.tid = args[0].readPointer().add(0x10).readU32();var argscount = args[2].add(0x8).readU32();console.log("["+this.tid+"]InvokeWithArgArray->",methodName, args[1], args[2], args[3], args[4]);// console.log("["+this.tid+"]args count:", argscount, "NumBytes:", args[2].add(0xC).readU32());// console.log("addr_InvokeWithArgArray args[0]->", hexdump(args[2].add(0x10).readPointer()));var argspointer = args[2].add(0x10).readPointer();for(var i=0; i< argscount; i++){console.log("["+this.tid+"] args_", i+1,"->0x"+argspointer.add(i*4).readU32().toString(16));}}},onLeave: function(retval){if(this.showResult){console.log("["+this.tid+"]InvokeWithArgArray onLeave->",this.methodName, "n result->0x"+retval.toString(16));}}});
DoCall方法的参数打印
Interceptor.attach(addr_ArtInterpreterToInterpreterBridge, {onEnter: function(args){var addr_ArtMethod = args[2].add(8).readPointer();allocPrettyMethod.writeByteArray(allocPrettyMethodInit);PrettyMethod(addr_ArtMethod_PrettyMethod, addr_ArtMethod, allocPrettyMethod, 0x100);this.methodName = allocPrettyMethod.readCString();if(this.methodName.indexOf(searchName) > -1){this.showReuslt = true;// this.result = args[4];this.result = args[2].add(0x3C)this.tid = args[0].add(0x10).readU32();console.log("["+this.tid+"]ArtInterpreterToInterpreterBridge onEnter->",this.methodName);// var regcount = args[2].add(0x30).readU32(); //var registers_size_ = args[1].readU16();var ins_size_ = args[1].add(0x2).readU16();var outs_size_ = args[1].add(0x4).readU16();// console.log("registers_size_->",registers_size_, "ins_size_->",ins_size_,"outs_size_->",outs_size_);//读取参数var argsPointer = args[2].add(0x3C + 4*outs_size_);// console.log(hexdump(argsPointer));for(var i=0; i< ins_size_; i++){console.log("["+this.tid+"] args_"+i+"->0x"+argsPointer.add(i*4).readU32().toString(16));}}},onLeave: function(retval){if(this.showReuslt){console.log("["+this.tid+"]ArtInterpreterToInterpreterBridge onLeave->",this.methodName,"n result->0x"+this.result.readU32().toString(16));}}});Interceptor.attach(addr_ArtInterpreterToCompiledCodeBridge, {onEnter: function(args){var addr_ArtMethod = args[3].add(8).readPointer();allocPrettyMethod.writeByteArray(allocPrettyMethodInit);PrettyMethod(addr_ArtMethod_PrettyMethod, addr_ArtMethod, allocPrettyMethod, 0x100);this.methodName = allocPrettyMethod.readCString();if(this.methodName.indexOf(searchName) > -1){this.showReuslt = true;this.result = args[4];this.tid = args[0].add(0x10).readU32();console.log("["+this.tid+"]ArtInterpreterToCompiledCodeBridge onEnter->",this.methodName, args[1],args[2],args[3]);var registers_size_ = args[3].add(0x30).readU32();var argsPointer = args[3].add(0x3C);//这里并不是参数数量for(var i=0; i< registers_size_; i++){console.log("["+this.tid+"] args_"+i+"->0x"+argsPointer.add(i*4).readU32().toString(16));}}},onLeave: function(retval){if(this.showReuslt){console.log("["+this.tid+"]ArtInterpreterToCompiledCodeBridge onLeave->",this.methodName,"n result->0x"+this.result.readU16().toString(16));}}});
打印查看效果
[]ArtInterpreterToInterpreterBridge onEnter-> void com.cwuzao.javajnitrace.MainActivity$1.onClick(android.view.View)[] args_0->0x1309e270[] args_1->0x1309da98[]DoCall: void com.cwuzao.javajnitrace.MainActivity$1.onClick(android.view.View) -> int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int)[]ArtInterpreterToInterpreterBridge onEnter-> int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int)[] args_0->0x13097278[] args_1->0x1234[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int) -> int android.util.Log.i(java.lang.String, java.lang.String)[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int) -> int com.cwuzao.javajnitrace.MainActivity.JavaCallJni(int)[]ArtInterpreterToCompiledCodeBridge onEnter-> int com.cwuzao.javajnitrace.MainActivity.JavaCallJni(int) 0x773f087068 0x0 0x7ff6a60400[] args_0->0x13097278[] args_1->0x1111[]InvokeWithArgArray-> int com.cwuzao.javajnitrace.MainActivity.JniCallJni(int) 0x773f087188 0x7ff6a5f868 0x7ff6a5f860 0x772585b765[] args_0->0x13097278[] args_1->0x2222[]InvokeWithArgArray-> int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int) 0x773f087128 0x7ff6a5eb78 0x7ff6a5eb70 0x772585b765[] args_0->0x13097278[] args_1->0x3333[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int) -> void java.lang.StringBuilder.<init>()[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int) -> java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int) -> java.lang.StringBuilder java.lang.StringBuilder.append(int)[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int) -> java.lang.String java.lang.StringBuilder.toString()[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int) -> int android.util.Log.i(java.lang.String, java.lang.String)[]InvokeWithArgArray onLeave-> int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int)result->0x1[]InvokeWithArgArray-> java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) 0x773f087158 0x7ff6a5eb78 0x7ff6a5eb70 0x772585d0e0[] args_0->0x13097278[] args_1->0x4444[] args_2->0x12c41b58[] args_3->0x12c41b78[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> void java.lang.StringBuilder.<init>()[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> java.lang.StringBuilder java.lang.StringBuilder.append(int)[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> java.lang.String java.lang.StringBuilder.toString()[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> int android.util.Log.i(java.lang.String, java.lang.String)[]DoCall: java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String) -> int com.cwuzao.javajnitrace.MainActivity.JavaCallJavaIII(int, int, int)ArtInterpreterToInterpreterBridge onEnter-> int com.cwuzao.javajnitrace.MainActivity.JavaCallJavaIII(int, int, int)[] args_0->0x13097278[] args_1->0x1111[] args_2->0x2222[] args_3->0x3333[]DoCall: int com.cwuzao.javajnitrace.MainActivity.JavaCallJavaIII(int, int, int) -> int android.util.Log.i(java.lang.String, java.lang.String)[]ArtInterpreterToInterpreterBridge onLeave-> int com.cwuzao.javajnitrace.MainActivity.JavaCallJavaIII(int, int, int)result->0x6666[]InvokeWithArgArray onLeave-> java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)result->0x12c41d70[]InvokeWithArgArray onLeave-> int com.cwuzao.javajnitrace.MainActivity.JniCallJni(int)result->0x2ArtInterpreterToCompiledCodeBridge onLeave-> int com.cwuzao.javajnitrace.MainActivity.JavaCallJni(int)result->0x3[]ArtInterpreterToInterpreterBridge onLeave-> int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int)result->0x3[]ArtInterpreterToInterpreterBridge onLeave-> void com.cwuzao.javajnitrace.MainActivity$1.onClick(android.view.View)result->0x3
接下来就可以去修改源码刷机了
//reflection.ccstatic void InvokeWithArgArray(const ScopedObjectAccessAlreadyRunnable& soa,ArtMethod* method, ArgArray* arg_array, JValue* result,const char* shorty)//addconst char* methodName = method->PrettyMethod().c_str();if(strstr(methodName, "com.cwuzao.javajnitrace")){LOG(ERROR)<< android::base::StringPrintf("[%d]InvokeWithArgArray %s", soa.Self()->GetTid(),methodName);}//addend}//interpreter_common.ccbool DoCall(ArtMethod* called_method, Thread* self, ShadowFrame& shadow_frame,const Instruction* inst, uint16_t inst_data, JValue* result) {//addconst char* methodName = shadow_frame.GetMethod()->PrettyMethod().c_str();if(strstr(methodName, "com.cwuzao.javajnitrace")){LOG(ERROR)<< android::base::StringPrintf("[%d]DoCall %s->%s", self->GetTid(), methodName, called_method->PrettyMethod().c_str());}//addend}
[]DoCall void com.cwuzao.javajnitrace.MainActivity.<clinit>()->void java.lang.System.loadLibrary(java.lang.String)[]DoCall void androidx.appcompat.app.AppCompatActivity.onCreate(android.os.Bundle)->void androidx.appcompat.app.AppCompatActivity.onCreate(android.os.Bundle)[]DoCall void androidx.appcompat.app.AppCompatActivity.setContentView(int)->void androidx.appcompat.app.AppCompatActivity.setContentView(int)[]DoCall void com.cwuzao.javajnitrace.MainActivity.onCreate(android.os.Bundle)->android.view.View androidx.appcompat.app.AppCompatActivity.findViewById(int)[]DoCall void com.cwuzao.javajnitrace.MainActivity.onCreate(android.os.Bundle)->java.lang.String com.cwuzao.javajnitrace.MainActivity.stringFromJNI()[]DoCall void com.cwuzao.javajnitrace.MainActivity.onCreate(android.os.Bundle)->void android.widget.TextView.setText(java.lang.CharSequence)[]DoCall void com.cwuzao.javajnitrace.MainActivity.onCreate(android.os.Bundle)->android.view.View androidx.appcompat.app.AppCompatActivity.findViewById(int)[]DoCall void com.cwuzao.javajnitrace.MainActivity$1.<init>(com.cwuzao.javajnitrace.MainActivity)->void com.cwuzao.javajnitrace.MainActivity$1.<init>(com.cwuzao.javajnitrace.MainActivity)[]DoCall void com.cwuzao.javajnitrace.MainActivity$1.<init>(com.cwuzao.javajnitrace.MainActivity)->void java.lang.Object.<init>()[]DoCall void com.cwuzao.javajnitrace.MainActivity.onCreate(android.os.Bundle)->void android.view.View.setOnClickListener(android.view.View$OnClickListener)[]DoCall void com.cwuzao.javajnitrace.MainActivity.onCreate(android.os.Bundle)->android.view.View androidx.appcompat.app.AppCompatActivity.findViewById(int)[]DoCall void com.cwuzao.javajnitrace.MainActivity$2.<init>(com.cwuzao.javajnitrace.MainActivity)->void com.cwuzao.javajnitrace.MainActivity$2.<init>(com.cwuzao.javajnitrace.MainActivity)[]DoCall void com.cwuzao.javajnitrace.MainActivity$2.<init>(com.cwuzao.javajnitrace.MainActivity)->void java.lang.Object.<init>()[]DoCall void com.cwuzao.javajnitrace.MainActivity.onCreate(android.os.Bundle)->void android.view.View.setOnClickListener(android.view.View$OnClickListener)[]DoCall void com.cwuzao.javajnitrace.MainActivity$1.onClick(android.view.View)->int com.cwuzao.javajnitrace.MainActivity.JavaCallJava(int)[]DoCall int android.util.Log.i(java.lang.String, java.lang.String)->int android.util.Log.i(java.lang.String, java.lang.String)[]DoCall int com.cwuzao.javajnitrace.MainActivity.JavaCallJni(int)->int com.cwuzao.javajnitrace.MainActivity.JavaCallJni(int)[]InvokeWithArgArray int com.cwuzao.javajnitrace.MainActivity.JniCallJni(int)[]InvokeWithArgArray int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int)[]DoCall int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int)->void java.lang.StringBuilder.<init>()[]DoCall int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int)->java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall int com.cwuzao.javajnitrace.MainActivity.JniCallJava(int)->java.lang.StringBuilder java.lang.StringBuilder.append(int)[]DoCall java.lang.String java.lang.StringBuilder.toString()->java.lang.String java.lang.StringBuilder.toString()[]DoCall int android.util.Log.i(java.lang.String, java.lang.String)->int android.util.Log.i(java.lang.String, java.lang.String)[]InvokeWithArgArray java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)[]DoCall java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)->void java.lang.StringBuilder.<init>()[]DoCall java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)->java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)->java.lang.StringBuilder java.lang.StringBuilder.append(int)[]DoCall java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)->java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)->java.lang.StringBuilder java.lang.StringBuilder.append(java.lang.String)[]DoCall java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)->java.lang.String java.lang.StringBuilder.toString()[]DoCall java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)->int android.util.Log.i(java.lang.String, java.lang.String)[]DoCall java.lang.String com.cwuzao.javajnitrace.MainActivity.JniCallJavaISS(int, java.lang.String, java.lang.String)->int com.cwuzao.javajnitrace.MainActivity.JavaCallJavaIII(int, int, int)[]DoCall int com.cwuzao.javajnitrace.MainActivity.JavaCallJavaIII(int, int, int)->int android.util.Log.i(java.lang.String, java.lang.String)
看雪ID：无造
https://bbs.pediy.com/user-home-571058.htm
*本文由看雪论坛 无造 原创，转载请注明来自看雪社区。
推荐文章++++
* Linux Kernel Pwn_1_Double fetch
求分享
求点赞
求在看
本文始发于微信公众号（看雪学院）：使用Frida打印Java类函数调用关系
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论