Frida入门使用
vscode环境搭建
直接cloen代码,然后在vscode打开文件夹
How to compile & load
$ git clone git://github.com/oleavr/frida-agent-example.git
$ cd frida-agent-example/
$ npm install
$ frida -U -f com.example.android --no-pause -l _agent.js
Development workflow
To continuously recompile on change, keep this running in a terminal:
$ npm run watch
And use an editor like Visual Studio Code for code completion and instant
type-checking feedback.
frida命令
-U 表示通过USB连接设备
-l 表示使用JavaScript文件
-f 会启动指定的app
-D 设备id
-p pid
frida -U -p pid -l app.js
frida代码示例
实例JAVA类
let HashMap = Java.use('java.util.HashMap');
let hashmap = HashMap.$new();
hashmap .put("PATH", "/sbin:/system/sbin:/system/bin:/system/xbin:/vendor/bin:/vendor/xbin:/nopd/bin");
HookJva类的方法
两种方式都是可以的 格式如下:
Class[方法名].overload(参数类型).implementation = funcation(形参){...}
function hook_method_impl() {
// const logger = Java.use("com.invcase.LogUtils");
// const debug = logger.isDebug.value;
// console.log("LogUtils debug: ", debug)
// logger.isDebug.value = true;
// const Invcase = Java.use("com.invcase.Invcase");
// const showToast = Invcase.showToast.overload('java.lang.String');
// showToast.implementation = function (msg) {
// console.log('frida_method:', msg);
// const result = showToast.call(this, msg + " hooked");
// return result;
// };
// 写法二
let Invcase = Java.use("com.invcase.Invcase");
Invcase["showToast"].overload('java.lang.String').implementation = function (content) {
console.log('showToast is called' + ', ' + 'content: ' + content);
const ret = this.showToast(content + " hooked");
return ret;
};
}
Java.perform(() => {
hook_env();
});
输出成员变量值
格式:类名.变量名.value
对用 A.str.value
public class A{
String str;
}
console.log("st.isOpen:" + A.str.value);
调用对象方法
console.log("isDestroyed:", this.isDestroyed())
调用对象带参数方法
// 构建一个String
const JavaString = Java.use('java.lang.String');
const exampleString1 = JavaString.$new('Hello World, this is an example string in Java.');
console.log('[+] exampleString1: ' + exampleString1);
console.log('[+] exampleString1.length(): ' + exampleString1.length());
this.shwoString(exampleString1);
打印堆栈
const Exception = Java.use('java.lang.Exception');
const Log = Java.use('android.util.Log');
console.log(stackTraceHere());
function stackTraceHere() {
return Log.getStackTraceString(Exception.$new());
}