在逆向工程与动态分析领域,Frida凭借其强大的脚本化Hook能力和跨平台特性,已成为移动安全研究人员的核心工具之一。然而,随着Frida版本的迭代更新,互联网中可搜索到的其配置资料都较为过时,在编译与安装新版本Frida源码时已经不再适用。本文将结合Frida官方文档与笔者的实践,系统性地梳理Frida目前最新版本的编译与安装的步骤,为大家魔改和编译Frida奠定基础。
-
Frida项目地址:https://github.com/frida/frida -
官方文档:https://frida.re/docs/building/ -
当前Frida版本:16.7.4 -
环境:MacOS 14.3
从项目地址中clone(包括子项目):
git clone --recurse-submodules https://github.com/frida/frida
security find-certificate -c 你的证书名称
security find-certificate -p -c 你的证书名称 | openssl x509 -checkend 0
security dump-trust-settings -d | grep -A5 你的证书名称
export MACOS_CERTID=你的证书名称export IOS_CERTID=你的证书名称export WATCHOS_CERTID=你的证书名称export TVOS_CERTID=你的证书名称
并且重启taskgated模块以确保新证书被接受:
sudo killall taskgated
./configure
usage: configure [-h] [--prefix PREFIX] [--build BUILD] [--host HOST] [--enable-symbols] [--enable-shared] [--with-meson {internal,system}] [--without-prebuilds {toolchain,sdk,sdk:build,sdk:host}] [--enable-frida-tools] [--disable-frida-tools] [--enable-graft-tool] [--disable-graft-tool] [--enable-gadget] [--disable-gadget] [--enable-server] [--disable-server] [--enable-portal] [--enable-inject] [--disable-inject] [--enable-frida-clr] [--enable-frida-node] [--enable-frida-python] [--disable-frida-python] [--enable-frida-swift] [--enable-frida-qml]generic options: -h, --help show this help message and exit --prefix PREFIX install files in PREFIX --build BUILD configure for building on BUILD --host HOST cross-compile to build binaries to run on HOST --enable-symbols build binaries with debug symbols included (default: disabled) --enable-shared enable building shared libraries (default: disabled) --with-meson {internal,system} which Meson implementation to use (default: internal) --without-prebuilds {toolchain,sdk,sdk:build,sdk:host} do not make use of prebuilt bundlesproject-specific options: --enable-frida-tools build CLI tools, like frida, frida-trace, etc. (default: auto) --disable-frida-tools --enable-graft-tool build gum-graft tool (default: auto) --disable-graft-tool --enable-gadget build frida-gadget (default: auto) --disable-gadget --enable-server build frida-server (default: auto) --disable-server --enable-portal build frida-portal (default: disabled) --enable-inject build frida-inject (default: auto) --disable-inject --enable-frida-clr build .NET bindings (default: disabled) --enable-frida-node build Node.js bindings (default: disabled) --enable-frida-python build Python bindings (default: auto) --disable-frida-python --enable-frida-swift build Swift bindings (default: disabled) --enable-frida-qml build QML bindings (default: disabled)
注意Frida项目的绝对路径不要含有中文,不然会有一些非常规报错。
如无问题则运行以下命令以进行编译:
make
MacOS端编译期间会弹出多次该对话框,均填写当前具有sudo权限的用户名和密码即可:
一般来说直接运行以下命令即完成本机Frida的安装:
sudo make install
// 二进制软件"{bindir}/frida", "{bindir}/frida-apk", "{bindir}/frida-compile", "{bindir}/frida-create", "{bindir}/frida-discover", "{bindir}/frida-itrace", "{bindir}/frida-join", "{bindir}/frida-kill", "{bindir}/frida-ls", "{bindir}/frida-ls-devices", "{bindir}/frida-ps", "{bindir}/frida-pull", "{bindir}/frida-push", "{bindir}/frida-rm", "{bindir}/frida-trace", "{bindir}/gum-graft", // shell自动补全配置"{datadir}/fish/vendor_completions.d/frida.fish", // 头文件"{includedir}/frida-1.0/frida-core.h", "{includedir}/frida-1.0/gum/arch-arm/gumarmreg.h", "{includedir}/frida-1.0/gum/arch-arm/gumarmrelocator.h", "{includedir}/frida-1.0/gum/arch-arm/gumarmwriter.h", "{includedir}/frida-1.0/gum/arch-arm/gumthumbrelocator.h", "{includedir}/frida-1.0/gum/arch-arm/gumthumbwriter.h", "{includedir}/frida-1.0/gum/arch-arm64/gumarm64backtracer.h", "{includedir}/frida-1.0/gum/arch-arm64/gumarm64reader.h", "{includedir}/frida-1.0/gum/arch-arm64/gumarm64relocator.h", "{includedir}/frida-1.0/gum/arch-arm64/gumarm64writer.h", "{includedir}/frida-1.0/gum/arch-mips/gummipsrelocator.h", "{includedir}/frida-1.0/gum/arch-mips/gummipswriter.h", "{includedir}/frida-1.0/gum/arch-x86/gumx86reader.h", "{includedir}/frida-1.0/gum/arch-x86/gumx86relocator.h", "{includedir}/frida-1.0/gum/arch-x86/gumx86writer.h", "{includedir}/frida-1.0/gum/gum-heap.h", "{includedir}/frida-1.0/gum/gum-prof.h", "{includedir}/frida-1.0/gum/gum.h", "{includedir}/frida-1.0/gum/gumapiresolver.h", "{includedir}/frida-1.0/gum/gumbacktracer.h", "{includedir}/frida-1.0/gum/gumcloak.h", "{includedir}/frida-1.0/gum/gumcodeallocator.h", "{includedir}/frida-1.0/gum/gumcodesegment.h", "{includedir}/frida-1.0/gum/gumdarwin.h", "{includedir}/frida-1.0/gum/gumdarwinbacktracer.h", "{includedir}/frida-1.0/gum/gumdarwingrafter.h", "{includedir}/frida-1.0/gum/gumdarwinmapper.h", "{includedir}/frida-1.0/gum/gumdarwinmodule.h", "{includedir}/frida-1.0/gum/gumdarwinmoduleresolver.h", "{includedir}/frida-1.0/gum/gumdarwinsymbolicator.h", "{includedir}/frida-1.0/gum/gumdefs.h", "{includedir}/frida-1.0/gum/gumelfmodule.h", "{includedir}/frida-1.0/gum/gumenumtypes.h", "{includedir}/frida-1.0/gum/gumevent.h", "{includedir}/frida-1.0/gum/gumeventsink.h", "{includedir}/frida-1.0/gum/gumexceptor.h", "{includedir}/frida-1.0/gum/gumfunction.h", "{includedir}/frida-1.0/gum/gumheapapi.h", "{includedir}/frida-1.0/gum/guminterceptor.h", "{includedir}/frida-1.0/gum/guminvocationcontext.h", "{includedir}/frida-1.0/gum/guminvocationlistener.h", "{includedir}/frida-1.0/gum/gumkernel.h", "{includedir}/frida-1.0/gum/gumlibc.h", "{includedir}/frida-1.0/gum/gummemory.h", "{includedir}/frida-1.0/gum/gummemoryaccessmonitor.h", "{includedir}/frida-1.0/gum/gummemorymap.h", "{includedir}/frida-1.0/gum/gummetalarray.h", "{includedir}/frida-1.0/gum/gummetalhash.h", "{includedir}/frida-1.0/gum/gummodule.h", "{includedir}/frida-1.0/gum/gummoduleapiresolver.h", "{includedir}/frida-1.0/gum/gummodulemap.h", "{includedir}/frida-1.0/gum/gummoduleregistry.h", "{includedir}/frida-1.0/gum/gumprintf.h", "{includedir}/frida-1.0/gum/gumprocess.h", "{includedir}/frida-1.0/gum/gumreturnaddress.h", "{includedir}/frida-1.0/gum/gumspinlock.h", "{includedir}/frida-1.0/gum/gumstalker.h", "{includedir}/frida-1.0/gum/gumswiftapiresolver.h", "{includedir}/frida-1.0/gum/gumsymbolutil.h", "{includedir}/frida-1.0/gum/gumsysinternals.h", "{includedir}/frida-1.0/gum/gumthreadregistry.h", "{includedir}/frida-1.0/gum/gumtls.h", "{includedir}/frida-1.0/gum/heap/gumallocationblock.h", "{includedir}/frida-1.0/gum/heap/gumallocationgroup.h", "{includedir}/frida-1.0/gum/heap/gumallocationtracker.h", "{includedir}/frida-1.0/gum/heap/gumallocatorprobe.h", "{includedir}/frida-1.0/gum/heap/gumboundschecker.h", "{includedir}/frida-1.0/gum/heap/gumcobject.h", "{includedir}/frida-1.0/gum/heap/gumcobjecttracker.h", "{includedir}/frida-1.0/gum/heap/guminstancetracker.h", "{includedir}/frida-1.0/gum/heap/gumpagepool.h", "{includedir}/frida-1.0/gum/heap/gumsanitychecker.h", "{includedir}/frida-1.0/gum/prof/gumbusycyclesampler.h", "{includedir}/frida-1.0/gum/prof/gumcallcountsampler.h", "{includedir}/frida-1.0/gum/prof/gumcyclesampler.h", "{includedir}/frida-1.0/gum/prof/gummalloccountsampler.h", "{includedir}/frida-1.0/gum/prof/gumprofiler.h", "{includedir}/frida-1.0/gum/prof/gumprofilereport.h", "{includedir}/frida-1.0/gum/prof/gumsampler.h", "{includedir}/frida-1.0/gum/prof/gumusertimesampler.h", "{includedir}/frida-1.0/gum/prof/gumwallclocksampler.h", "{includedir}/frida-1.0/gumjs/guminspectorserver.h", "{includedir}/frida-1.0/gumjs/gumjs.h", "{includedir}/frida-1.0/gumjs/gumscript.h", "{includedir}/frida-1.0/gumjs/gumscriptbackend.h", "{includedir}/frida-1.0/gumjs/gumscriptscheduler.h", // 库文件"{libdir_static}/frida-base-1.0.vapi", "{libdir_static}/frida-base.h", "{libdir_static}/frida-payload-1.0.vapi", "{libdir_static}/frida-payload.h", "{libdir_static}/libfrida-base-1.0.a", "{libdir_static}/libfrida-gum-1.0.a", "{libdir_static}/libfrida-gum-heap-1.0.a", "{libdir_static}/libfrida-gum-prof-1.0.a", "{libdir_static}/libfrida-gumjs-1.0.a", "{libdir_static}/libfrida-gumjs-inspector-1.0.a", "{libdir_static}/libfrida-payload-1.0.a", "{libdir}/libfrida-core-1.0.a", "{libdir}/pkgconfig/frida-base-1.0.pc", "{libdir}/pkgconfig/frida-core-1.0.pc", "{libdir}/pkgconfig/frida-gum-1.0.pc", "{libdir}/pkgconfig/frida-gum-heap-1.0.pc", "{libdir}/pkgconfig/frida-gum-prof-1.0.pc", "{libdir}/pkgconfig/frida-gumjs-1.0.pc", "{libdir}/pkgconfig/frida-gumjs-inspector-1.0.pc", "{libdir}/pkgconfig/frida-payload-1.0.pc", // 资源数据"{prefix}/share/gir-1.0/Frida-1.0.gir", "{prefix}/share/vala/vapi/frida-gum-1.0.vapi", "{prefix}/share/vala/vapi/frida-gum-darwin-1.0.vapi", "{prefix}/share/vala/vapi/frida-gum-heap-1.0.vapi", "{prefix}/share/vala/vapi/frida-gumjs-1.0.vapi", "{prefix}/share/vala/vapi/frida-gumjs-inspector-1.0.vapi", // Python依赖包"{py_platlib}/frida/__init__.py", "{py_platlib}/frida/_frida.abi3.so", "{py_platlib}/frida/_frida/__init__.pyi", "{py_platlib}/frida/_frida/py.typed", "{py_platlib}/frida/core.py", "{py_platlib}/frida/py.typed", "{py_purelib}/frida_tools/__init__.py", "{py_purelib}/frida_tools/_repl_magic.py", "{py_purelib}/frida_tools/apk.py", "{py_purelib}/frida_tools/application.py", "{py_purelib}/frida_tools/cli_formatting.py", "{py_purelib}/frida_tools/compiler.py", "{py_purelib}/frida_tools/creator.py", "{py_purelib}/frida_tools/discoverer.py", "{py_purelib}/frida_tools/fs_agent.js", "{py_purelib}/frida_tools/itracer_agent.js", "{py_purelib}/frida_tools/join.py", "{py_purelib}/frida_tools/kill.py", "{py_purelib}/frida_tools/ls.py", "{py_purelib}/frida_tools/lsd.py", "{py_purelib}/frida_tools/model.py", "{py_purelib}/frida_tools/ps.py", "{py_purelib}/frida_tools/pull.py", "{py_purelib}/frida_tools/push.py", "{py_purelib}/frida_tools/reactor.py", "{py_purelib}/frida_tools/repl.py", "{py_purelib}/frida_tools/rm.py", "{py_purelib}/frida_tools/tracer.py", "{py_purelib}/frida_tools/tracer_agent.js", "{py_purelib}/frida_tools/tracer_ui/tracer_ui.zip"
这样手动安装的Frida虽然能够成功导入运行,但由于绕过了Python的包管理机制,会导致pip无法正确识别已安装的版本,当后续安装依赖Frida的Python包时,pip会误判Frida缺失而重新下载安装,从而覆盖手动编译的版本。而且这种安装方式默认将Python依赖包安装到/usr/local目录下,如果使用了pyenv等Python环境管理工具,会导致依赖包无法正确安装到当前虚拟环境的site-packages目录中,以至于本机Python导入时找不到模块。
python3 setup.py dist_info
$ pip3 list | grep fridafrida 16.7.4frida-tools 13.6.2.dev18
python3 -c "import site; print(site.getsitepackages())"
./configure --host=android-arm64
export ANDROID_NDK_ROOT=/前置路径/AndroidNDK9519653.app/Contents/NDK
./configure --host=android-arm64make
原文始发于微信公众号(山石网科安全技术研究院):移动安全调试框架Frida最新版编译安装指南
免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,本站不承担任何法律及连带责任;如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截,联系方式见首页),望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论