Frida内置

Frida Gadget 方案

Frida Gadget

配置文件

{
  "interaction": {
    "type": "script-directory",
    "path": "/usr/local/frida/scripts"
  }
}

网络方式

{
  "interaction": {
    "type": "listen",
    "address": "127.0.0.1",
    "port": 27042,
    "on_port_conflict": "fail",
    "on_load": "wait"
  }
}

参见官网gadget介绍

Frida gumjs 方案

gumjs 是一个js 加载引擎,可以直接运行frida js代码

$ ls external/frida/frida-gumjs-devkit-16.2.5-android-arm64/
  frida-gumjs.h  libfrida-gumjs.a

从示例代码可以看出来可以直接运行frida js代码进行Hook

/ frida-gumjs-example.c
#include "frida-gumjs.h"

#include <fcntl.h>
#include <string.h>
#include <unistd.h>

static void on_message (const gchar * message, GBytes * data, gpointer user_data);

int
main (__attribute__((unused)) int argc, __attribute__((unused)) char * argv[])
{
  GumScriptBackend * backend;
  GCancellable * cancellable = NULL;
  GError * error = NULL;
  GumScript * script;
  GMainContext * context;

  gum_init_embedded ();

  backend = gum_script_backend_obtain_qjs ();

  script = gum_script_backend_create_sync (backend, "example",
      "console.log('Hello Frida')\n"
      "Interceptor.attach(Module.getExportByName(null, 'faccessat'), {\n"
      "  onEnter(args) {\n"
      "    console.log(`[*] onEnter faccessat(\"${args[1].readUtf8String()}\")`);\n"
      "  }\n"
      "});\n"
      "Interceptor.attach(Module.getExportByName(null, 'close'), {\n"
      "  onEnter(args) {\n"
      "    console.log(`[*] onEnter close(${args[0].toInt32()})`);\n"
      "  }\n"
      "});",
      NULL, cancellable, &error);
  g_assert (error == NULL);

  gum_script_set_message_handler (script, on_message, NULL, NULL);

  gum_script_load_sync (script, cancellable);

  close (open ("/etc/hosts", O_RDONLY));
  close (open ("/system/build.prop", O_RDONLY));

  access("/etc/business-conf.xml", F_OK);

  context = g_main_context_get_thread_default ();
  while (g_main_context_pending (context))
    g_main_context_iteration (context, FALSE);

  gum_script_unload_sync (script, cancellable);

  g_object_unref (script);

  gum_deinit_embedded ();

  return 0;
}

static void
on_message (const gchar * message,
            __attribute__((unused)) GBytes * data,
            __attribute__((unused)) gpointer user_data)
{
  JsonParser * parser;
  JsonObject * root;
  const gchar * type;

  parser = json_parser_new ();
  json_parser_load_from_data (parser, message, -1, NULL);
  root = json_node_get_object (json_parser_get_root (parser));

  type = json_object_get_string_member (root, "type");
  if (strcmp (type, "log") == 0)
  {
    const gchar * log_message;

    log_message = json_object_get_string_member (root, "payload");
    g_print ("%s\n", log_message);
  }
  else
  {
    g_print ("on_message: %s\n", message);
  }

  g_object_unref (parser);
}

并且提供了静态库libfrida-gumjs.a ,因此只要将静态库链接进去就OK了,我测试的环境是AOSP12, AOSP10中是编译不过去的

cc_prebuilt_library_static {                                                                                                                                                                                      
    name: "libfrida-gumjs",
    arch: {
        arm64: {
            srcs: ["frida-gumjs-devkit-16.2.5-android-arm64/libfrida-gumjs.a"],
            export_include_dirs: ["frida-gumjs-devkit-16.2.5-android-arm64"],
        },
        arm: {
            srcs: ["frida-gumjs-devkit-16.2.5-android-arm/libfrida-gumjs.a"],
            export_include_dirs: ["frida-gumjs-devkit-16.2.5-android-arm"],
        },
    },
}

cc_binary {
    name: "js-loader-test",
    srcs: [
        "frida-gumjs-devkit-16.2.5-android-arm64/frida-gumjs-example.c",
    ],

    static_libs: [
        "libfrida-gumjs",
    ],

    shared_libs: [
        "liblog",
        "libdl",
        "libm",
    ],

    cflags: [
        "-Wall",
        "-Werror",
        "-Wunused",
        "-Wunreachable-code",
        "-ffunction-sections",
        "-fdata-sections",
        "-pthread",
    ],
}

想在AOSP将他编译成动态库,不过一直失败

cc_library_shared {
    name: "libjs",
    
    srcs: ["js_loader.c"],
    
    static_libs: [
        "libfrida-gumjs",
    ],

    shared_libs: [
        "liblog",
        "libc++",
    ],

    static_libs: [
        "libfrida-gumjs",
    ],

    shared_libs: [
        "liblog",
        "libc++",
    ],

    cflags: [
        // "-Wall",
        // "-Werror",
        // "-Wunused",
        // "-Wunreachable-code",
        "-ffunction-sections",                                                                                                                                                                                    
        "-fdata-sections",
        "-DANDROID",
        "-DANDROID_STL=c++_shared"
    ],

    stl: "libc++_static",
}