frida补充篇

我会带着你远行 2022-12-29 02:24 186阅读 0赞

![在这里插入图片描述][4c5de3ec3cbe4c839a5cd6ea09036c7e.gif_pic_center]  
整个9月份几乎一点状态都没有，基本上文章都没有更新，感谢大家的持续关注。后续会慢慢恢复文章的更新频率，再次感谢大家的支持。

### 纠正一个错误 ###

在 [Frida API使用(1)][Frida API_1] 中对数据类型介绍的时候，代码有一处不完美的地方，对应的修改如下:

console.log("new Int64(1):"+new Int64(1));
     console.log("new UInt64(1):"+new UInt64(1));
     console.log("new NativePointer(0xEC644071):"+new NativePointer(0x123456));
     console.log("new ptr('0xEC644071'):"+ ptr(0x123456));
     console.log("null point:"+ptr('0'));

将其中的new ptr(0x123456)应修改为ptr(0x123456)。**ptr** is short-hand for **new NativePointer**。

### Frida基础补充 ###

#### 对象转数组 ####

Java代码:

public static void  test(Object object){ 
                Log.d("无情剑客", "" + object);
        }

hook脚本:

Java.perform(function(){     
        console.log("buring");
        var mainActivity = Java.use("com.example.myapplication.MainActivity");
        mainActivity.test.overload("java.lang.Object").implementation = function (p1) { 
            console.log(p1);
            var arr = object2Arr(p1);
            console.log("after:" + arr);
            this.test(p1);
        }
    
    })
    
    function object2Arr(object){ 
        var new_arr = new Array();
        var arr_class = Java.use("java.lang.reflect.Array");
        console.log("object2Arr:" + arr_class.getLength(object));
        for (var i = 0; i < arr_class.getLength(object); i++){ 
           // new_arr.push(arr_class.get(object, i));
           var ele = arr_class.get(object, i);
           new_arr.push(ele);
        }
        return new_arr;
    }

#### 停止scan ####

return ‘stop’;　枚举类的时候也可以使用．

Memory.scan(m.base, m.size, pattern, { 
      onMatch(address, size) { 
        console.log'Memory.scan() found match at', address,
            'with size', size);
    
        // Optionally stop scanning early:
        return 'stop';
      },
      onComplete() { 
        console.log('Memory.scan() complete');
      }
    });

#### ptrace\_scope ####

对于Linux系统需要设置ptrace\_scope的值，这是因为Frida会用到ptrace函数。

`sysctl -w kernel.yama.ptrace_scope=0` \#临时修改某个变量的当前值,即虚拟文件系统/proc下的值,重启失效

kernel.yama.ptrace_scope = 0

#### 查看手机架构 ####

对于Android平台，查看手机的架构构用途还是很大的。

adb shell getprop ro.product.cpu.abi

查看笔者手机的架构，是V8的。  
![在这里插入图片描述][20210115001544570.png_pic_center]

#### 修改返回值 ####

在[使用Radare2静态分析apk(2)][Radare2_apk_2] 中通过重写Java层的stringFromJNI来修改返回值。这里通过Interceptor.attach中的onLeave来修改返回值。

> onLeave(retval): callback function given one argument retval that is a NativePointer-derived object containing the raw return value. You may call retval.replace(1337) to replace the return value with the integer 1337, or retval.replace(ptr(“0x1234”)) to replace with a pointer. Note that this object is recycled across onLeave calls, so do not store and use it outside your callback. Make a deep copy if you need to store the contained value, e.g.: ptr(retval.toString()).

修改返回值:

onLeave: function (retval) { 
       console.log("retval "+retval);
       var env = Java.vm.getEnv();
       var jstring = env.newStringUtf('无情剑客');
       retval.replace(jstring);
     }

#### 打印Java调用栈 ####

console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

### 公众好 ###

更多内容，欢迎关注我的微信公众号:无情剑客。

![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5peg5oOF5YmR5a6iQnVybmluZ1Rlbmc_size_18_color_FFFFFF_t_70_g_se_x_16_pic_center]  
技术交流群:  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5peg5oOF5YmR5a6iQnVybmluZ1Rlbmc_size_20_color_FFFFFF_t_70_g_se_x_16_pic_center]

[4c5de3ec3cbe4c839a5cd6ea09036c7e.gif_pic_center]: /images/20221120/f24b45fcffe64fde8eec8ec188c222aa.png
[Frida API_1]: https://mp.weixin.qq.com/s?__biz=MzI1NjEyMzgxMw==&mid=2247484270&idx=1&sn=616b8d30b8f837054bfccd7d6aeebfb9&chksm=ea2a35a4dd5dbcb2fadce7058b69e78844980971c68b9e2d6012c932e50e5815f4869e557ecb&token=164294255&lang=zh_CN#rd
[20210115001544570.png_pic_center]: /images/20221120/3c3afb323cb54a839cea392f35bcc509.png
[Radare2_apk_2]: https://mp.weixin.qq.com/s?__biz=MzI1NjEyMzgxMw==&mid=2247484739&idx=1&sn=4fb1f9aef921177430ca3a2c7ef54cd4&chksm=ea2a3389dd5dba9fa9145883aa7c26a457aa9bf1a07ac93d47ee9b8e156ab42169fa8445d6d0&token=210937915&lang=zh_CN#rd
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5peg5oOF5YmR5a6iQnVybmluZ1Rlbmc_size_18_color_FFFFFF_t_70_g_se_x_16_pic_center]: /images/20221120/d50d631b8672483995a8cf48dba9abb9.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5peg5oOF5YmR5a6iQnVybmluZ1Rlbmc_size_20_color_FFFFFF_t_70_g_se_x_16_pic_center]: /images/20221120/40aa5470f24e4e03a1feed3edef500c5.png