Frida工作原理学习

frida-core: Frida 核心库frida-gum: inline-hook 框架bindings:frida-python: pythonfrida-node: Node.jsfrida-qml: Qmlfrida-swift: Swiftfrida-tools: CLI toolscapstone: instruction disammbler

GumInterceptor * interceptor;GumInvocationListener * listener;gum_init ();interceptor = gum_interceptor_obtain ();//GumInvocationListener*的接口listener = g_object_new (EXAMPLE_TYPE_LISTENER, NULL);
// 开始 hook `open` 函数gum_interceptor_begin_transaction (interceptor);gum_interceptor_attach_listener (interceptor,      GSIZE_TO_POINTER (gum_module_find_export_by_name (NULL, "open")),      listener,      GSIZE_TO_POINTER (EXAMPLE_HOOK_OPEN));gum_interceptor_end_transaction (interceptor);
// 测试 hook 效果close (open ("/etc/hosts", O_RDONLY));
// 结束 hookgum_interceptor_detach_listener (interceptor, listener);g_object_unref (listener);g_object_unref (interceptor);

Interceptor.attach(addr, {       onEnter: function (args) {           this.args0 = args[0];           this.tid = Process.getCurrentThreadId();           //跟随           Stalker.follow(this.tid, {               events: {//事件                   call: true,//呼叫                   ret: false,//返回                   exec: true,//执行                   block: false,//块                   compile: false//编译               },               //接收               onReceive(events){                   for (const [index,value] of Stalker.parse(events)) {                       console.log(index,value);                       //findModuleByAddress    {"name":"libc.so","base":"0x7d1f0af000","size":3178496,"path":"/apex/com.android.runtime/lib64/bionic/libc.so"}                       //console.log("tuzi",Process.findModuleByAddress(0x7d1f13adb8));
                   }               }               // onCallSummary(summay){               //console.log("onCallSummary"+JSON.stringify(summay));               // },           });       }, onLeave: function (retval) {           Stalker.unfollow(this.tid);       }   });

//C 代码gbooleangum_memory_access_monitor_enable (GumMemoryAccessMonitor * self,                                  GError ** error){  if (self->enabled)    return TRUE;  // ...  self->exceptor = gum_exceptor_obtain ();  gum_exceptor_add (self->exceptor, gum_memory_access_monitor_on_exception,      self);  // ...}

//js代码function read_write_break(){    function hook_dlopen(addr, soName, callback) {        Interceptor.attach(addr, {            onEnter: function (args) {                var soPath = args[0].readCString();                if(soPath.indexOf(soName) != -1) hook_call_constructors();            }, onLeave: function (retval) {            }        });    }    var dlopen = Module.findExportByName("libdl.so", "dlopen");    var android_dlopen_ext = Module.findExportByName("libdl.so", "android_dlopen_ext");    hook_dlopen(dlopen, "libaes.so", set_read_write_break);    hook_dlopen(android_dlopen_ext, "libaes.so", set_read_write_break);
    function set_read_write_break(){        //实现一个异常回调   处理好这个异常就可以正常返回        Process.setExceptionHandler(function(details) {            console.log(JSON.stringify(details, null, 2));            console.log("lr", DebugSymbol.fromAddress(details.context.lr));            console.log("pc", DebugSymbol.fromAddress(details.context.pc));            Memory.protect(details.memory.address, Process.pointerSize, 'rwx');            console.log(Thread.backtrace(details.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('n') + 'n');            return true;        });        var addr = Module.findBaseAddress("libaes.so").add(0x6666);        Memory.protect(addr, 8, '---'); //修改内存页的权限        /**         * 比如有一个地址是0x12345678  我想看一下是那个代码去访问了这个地址         * 我只需要把这个内存地址置空 有函数去访问这个地址时 就会触发非法访问异常         * 比较鸡肋这种方法 这种方法会一次修改一个内存页  并且触发一次就无效了         */    }}

1.注入进程ptracedlopen2.hook 目标函数2.1 Java HookStatic Field Hook：静态成员hookMethod Hook：函数hook2.2 Native So HookGOT Hook：全局偏移表hookSYM Hook：符号表hookInline Hook：函数内联hook执行自身代码获取敏感信息修改返回值etc.

struct Method {      ClassObject*    clazz;   /* method所属的类 public、native等*/    u4              accessFlags; /* 访问标记 */    u2             methodIndex; //method索引    //三个size为边界值，对于native函数，这3个size均等于参数列表的size    u2              registersSize;  /* ins + locals */    u2              outsSize;    u2              insSize;    const char*     name;//函数名称    /*     * Method prototype descriptor string (return and argument types)     */    DexProto        prototype;    /* short-form method descriptor string */    const char*     shorty;    /*     * The remaining items are not used for abstract or native methods.     * (JNI is currently hijacking "insns" as a function pointer, set     * after the first call.  For internal-native this stays null.)     */    /* the actual code */    const u2*       insns;          /* instructions, in memory-mapped .dex */    /* cached JNI argument and return-type hints */    int             jniArgInfo;    /*     * Native method ptr; could be actual function or a JNI bridge.  We     * don't currently discriminate between DalvikBridgeFunc and     * DalvikNativeFunc; the former takes an argument superset (i.e. two     * extra args) which will be ignored.  If necessary we can use     * insns==NULL to detect JNI bridge vs. internal native.     */    DalvikBridgeFunc nativeFunc;    /*     * Register map data, if available.  This will point into the DEX file     * if the data was computed during pre-verification, or into the     * linear alloc area if not.     */    const RegisterMap* registerMap;
};
………
function replaceDalvikImplementation (fn) {  if (fn === null && dalvikOriginalMethod === null) {    return;  }//备份原来的method,  if (dalvikOriginalMethod === null) {    dalvikOriginalMethod = Memory.dup(methodId, DVM_METHOD_SIZE);    dalvikTargetMethodId = Memory.dup(methodId, DVM_METHOD_SIZE);  }
  if (fn !== null) {   //自定的代码    implementation = implement(f, fn);
    let argsSize = argTypes.reduce((acc, t) => (acc + t.size), 0);    if (type === INSTANCE_METHOD) {      argsSize++;    }    // 把method变成native函数    /*     * make method native (with kAccNative)     * insSize and registersSize are set to arguments size     */    const accessFlags = (Memory.readU32(methodId.add(DVM_METHOD_OFFSET_ACCESS_FLAGS)) | kAccNative) >>> 0;    const registersSize = argsSize;    const outsSize = 0;    const insSize = argsSize;
    Memory.writeU32(methodId.add(DVM_METHOD_OFFSET_ACCESS_FLAGS), accessFlags);    Memory.writeU16(methodId.add(DVM_METHOD_OFFSET_REGISTERS_SIZE), registersSize);    Memory.writeU16(methodId.add(DVM_METHOD_OFFSET_OUTS_SIZE), outsSize);    Memory.writeU16(methodId.add(DVM_METHOD_OFFSET_INS_SIZE), insSize);    Memory.writeU32(methodId.add(DVM_METHOD_OFFSET_JNI_ARG_INFO), computeDalvikJniArgInfo(methodId));    //调用dvmUseJNIBridge为这个Method设置一个Bridge,本质上是修改结构体中的nativeFunc为自定义的implementation函数    api.dvmUseJNIBridge(methodId, implementation);
    patchedMethods.add(f);  } else {    patchedMethods.delete(f);
    Memory.copy(methodId, dalvikOriginalMethod, DVM_METHOD_SIZE);    implementation = null;  }}

quick code 模式：执行 arm 汇编指令Interpreter 模式：由解释器解释执行 Dalvik 字节码

patchMethod(methodId, {  //jnicode入口entry_point_from_jni_改为自定义的代码  'jniCode': implementation,  //修改为access_flags_为native  'accessFlags': (Memory.readU32(methodId.add(artMethodOffset.accessFlags)) | kAccNative | kAccFastNative) >>> 0,  //art_quick_generic_jni_trampoline函数的地址  'quickCode': api.artQuickGenericJniTrampoline,  //artInterpreterToCompiledCodeBridge函数地址  'interpreterCode': api.artInterpreterToCompiledCodeBridge});