『工具使用』Frida 工程师备忘录

Java.perform(() => {    //对java层的操作});

Java.perform(() => {  // Function to hook is defined here  const MainActivity = Java.use('com.example.seccon2015.rock_paper_scissors.MainActivity');
  // Whenever button is clicked  const onClick = MainActivity.onClick;  onClick.implementation = function (v) {
    // Call the original onClick handler    onClick.call(this, v);
    // Set our values after running the original onClick handler    this.m.value = 0;    this.n.value = 1;    this.cnt.value = 999;
    // Log to the console that it's done, and we should have the flag!    console.log('Done:' + JSON.stringify(this.cnt));  };});

MyClass.MyFuncs.overload("int", "int").implementation = function (s1, s2) {    var ret = this.MyFuncs(s1, s2);}

Java.use("com.example.seccon2015.rock_paper_scissors.MainActivity$User")

Interceptor.attach(Module.findExportByName("libc.so" , "open"), {    onEnter: function(args) {        log("open() called!")    },    onLeave:function(retval){
    }});

var base_addr = Module.findBaseAddress("libMylib.so");

var nativePointer = base_addr.add(0x1498+1) //注意+1 CPU架构问题Interceptor.attach(nativePointer, {    onEnter:        function (args) {
        },    onLeave:        function (retval) {        }});

Java.perform(function () {    var ma = Java.use('com.xx.xx.xx');
    ma.onClick.implementation = function (a) {        send("Stack Trace...");        stackinfo();    }
    function stackinfo(){        var threadef = Java.use('java.lang.Thread');        var threadinstance = threadef.$new();        var stack = threadinstance.currentThread().getStackTrace();        for(var i = 0;i<stack.length;i++){            send("stack:" + stack[i].toString());        }    }});

['java.lang.StringBuilder', 'java.lang.StringBuffer'].forEach(function(clazz, i) {  Java.use(clazz)['toString'].implementation = function() {    var ret = this.toString();    console.log('ret:', ret)    return ret;  }   });