反反frida调试

1,理论链接

https://www.anquanke.com/post/id/85996

2.firda_js代码

复制setImmediate(function() {
    Java.perform(function() {
        console.log("[*] Hooking calls to System.exit");
        exitClass = Java.use("java.lang.System");
        exitClass.exit.implementation = function() {
            console.log("[*] System.exit called");
        }
 
        var strncmp = undefined;
        imports = Module.enumerateImportsSync("libfoo.so");
 
        for(i = 0; i < imports.length; i++) {
            if(imports[i].name == "strncmp") {
                strncmp = imports[i].address;
                break;
            }
 
        }
 
        //Get base address of library
        var libfoo = Module.findBaseAddress("libfoo.so");
 
        //Calculate address of variable
        var initialized = libfoo.add(ptr("0x400C"));
 
        //Write 1 to the variable
        Memory.writeInt(initialized,1);
 
        Interceptor.attach(strncmp, {
            onEnter: function (args) {
               if(args[2].toInt32() == 23 && Memory.readUtf8String(args[0],23) == "01234567890123456789012") {
                    console.log("[*] Secret string at " + args[1] + ": " + Memory.readUtf8String(args[1],23));
                }
             },
        });
        console.log("[*] Intercepting strncmp");
    });
});