Frida Hook 常用函数、java 层 hook、so 层 hook、RPC、群控

Bertha 。 2023-01-06 14:53 6626阅读 0赞

From：Frida hook 常用函数分享：[https://www.52pojie.cn/thread-1196917-1-1.html][https_www.52pojie.cn_thread-1196917-1-1.html]  
From：Frida Hook Android 常用方法：[【Frida Hook 学习记录】Frida Hook Android 常用方法\_卦星的专栏-CSDN博客\_frida hook][Frida Hook _Frida Hook Android _-CSDN_frida hook]

Frida官方手册 - 函数Hook：[Frida官方手册 - 函数Hook\_小蓝人敌法的专栏-CSDN博客\_frida主动调用方法][Frida_ - _Hook_-CSDN_frida]  
Frida Java Hook 详解（安卓9）：代码及示例（上）：[Frida Java Hook 详解（安卓9）：代码及示例（上） - SecPulse.COM | 安全脉搏][Frida Java Hook _9_ - SecPulse.COM _]

**写 APP爬虫会需要用到哪些工具呢？**：**[写APP爬虫会需要用到哪些工具呢？ - 知乎][APP_ -]**

> 《**风控要略——互联网业务反欺诈之路**》**主要分为洞察黑产、体系构建、实战教程和新的战场4个部分**

# Frida 使用 #

Frida 使用：[https://zhuanlan.zhihu.com/p/339504595][https_zhuanlan.zhihu.com_p_339504595]

*  1. 打印某个类的所有成员变量
 *  2. 获取成员变量的值
 *  3. 打印调用堆栈

frida 两种启动 hook 方式：

*  1. attach 进程名 ：APP 启动后再 hook，不能 hook app 启动阶段
 *  2. spawn ：重启 APP，适合 hook app 启动阶段

frida Hook Java 类 小提示：

*  **访问成员变量写法：this.成员变量名.value**
 *  **hook匿名类写法：Java.use('类$类') smali文件里找**
 *  **从匿名类 / 内部类访问外部类的属性写法：this.this$0.value.外部类的属性名.value**
 *  **新建一个对象，并调用构造函数的写法：类.方法名.$new(参数)**
 *  **重载写法：类.方法名.overload(参数1，参数2.......).implementation**
 *  **hook 构造方法：类.$init().implementation**

## java 层 hook ##

*  1. hook模板
 *  2. hook方法（非重载方法不用写方法类型）
 *  3. hook重载方法
 *  4. hook所有重载方法
 *  5. hook 构造方法
 *  6. 对象实例化
 *  7. 修改类的字段
 *  8. hook内部类与匿名类
 *  9. hook类的所有方法
 *  10. Hook动态加载的dex(Android 7以上)
 *  11. Java特殊类型的遍历与修改（Map举例）
 *  12. 打印HashMap
 *  13. Java层主动调用
 *  14. 删除对象引用
 *  15. 获取参数类型
 *  16. 用frida注入dex文件
 *  17. 端口检测解决方案
 *  18. frida启动前注入

## so 层 hook ##

*  1. 枚举导入导出表(ELF即so文件)
 *  2. hook导出函数
 *  3. 函数地址计算
 *  4. Hook未导出函数
 *  5. 获取指针参数返回值
 *  6. Hook\_dlopen
 *  7. 内存读写
 *  8. 主动调用JNI函数
 *  9. jni函数Hook(计算地址方式)
 *  10. jni函数Hook(libart.so)
 *  11. so层函数主动调用
 *  12. frida读写文件

## RPC ##

import frida
    import sys
    
    rdev = frida.get_usb_device()
    session = rdev.attach("com.yuanrenxue.onlinejudge2020")  # 包名
    
    js_code = """
    rpc.exports = {
        getsign: function(i) {
            Java.perform(function() {
                console.log("get_sign");
                var my_class1 = Java.use("com.yuanrenxue.onlinejudge2020.OnlineJudgeApp");
                var reslut = my_class1.getSign1(i);
                console.log(reslut);
                send({ "sign": reslut, "num": i })
                return reslut;
            });
        },
    };
    
    """
    
    script = session.create_script(js_code)
    
    
    def on_message(message, data):
        sign = message.get("payload").get("sign")
        num = message.get("payload").get("num")
    
    
    script.on("message", on_message)
    script.load()
    
    script.exports.getsign(1) # 调用的函数
    
    sys.stdin.read()

示例（ 酷安 ）：

import os
    import sys
    import frida
    
    
    def adb_forward():
        os.system('adb forward tcp:27042 tcp:27042')
        os.system('adb forward tcp:27043 tcp:27043')
    
    
    js_rpc_code = """
    rpc.exports = {
        getsig: function(arg_string){
            send('开始 getsig 函数');
            Java.perform(function(){
                // 得到 content 上下文
                var current_application = Java.use('android.app.ActivityThread').currentApplication();
                var context = current_application.getApplicationContext();
    
                var AuthUtils = Java.use('com.coolapk.market.util.AuthUtils');
                var sig = AuthUtils.getAs(context, arg_string);
                send(sig);
            })
        }
    };
    """
    
    
    def on_message(message, data):
        if message['type'] == 'send':
            print(message['payload'])
        elif message['type'] == 'error':
            print(message['stack'])
    
    
    process = frida.get_usb_device().attach('com.coolapk.market')
    script = process.create_script(js_rpc_code)
    script.on('message', on_message)
    script.load()
    
    sig_string = script.exports.getsig('this is a test')
    print(sig_string)

示例（ 某音极速版 ）：

import sys
    import time
    import frida
    import json
    import requests
    
    hook_code = """
    rpc.exports = {
        getRpcSign:function(timstamp ,url, userinfo_array, device_id){
            var sig = "";
            Java.perform(
                function(){
                    var UserInfo = Java.use('com.ss.android.common.applog.UserInfo');
                    var EagleEye = Java.use('com.ss.android.common.applog.EagleEye');
                    var StcSDKFactory = Java.use('com.ss.sys.ces.out.StcSDKFactory');
                    var GlobalContext = Java.use('com.ss.android.common.applog.GlobalContext');
                    var AwemeApplication = Java.use('com.ss.android.ugc.aweme.app.AwemeApplication');
    
                    var sdk = StcSDKFactory.getSDK(GlobalContext.getContext(), AwemeApplication.p().m())
    
                    var usrInfo = UserInfo.getUserInfo(timstamp, url, userinfo_array, device_id);
    
                    var as = usrInfo.substring(0, 22);
                    var cp = usrInfo.substring(22, usrInfo.length);
                    var mas = EagleEye.byteArrayToHexStr(sdk.encode(getBytes(as)));
    
                    //send('as:'+as);
                    //send('cp:'+cp);
                    //send('mas:'+mas);
                    sig = '&as='+as+'&cp='+cp+'&mas='+mas;
                }
            )
            return sig;
        }
    }
    
    function getBytes(s) {
            var bytes = [];
                for (var i = 0; i < s.length; i++) {
                    bytes.push(s.charCodeAt(i));
                }
            return bytes;
    }
    """
    
    
    def on_message(message, data):
        if message['type'] == 'send':
            print("[*] {0}".format(message['payload']))
        else:
            print(message)
    
    
    def get_sig_hook(script):
        print('repose')
        timestamp_w = time.time()
        timestamp = int(timestamp_w)
        device_id = 69852570923
        infos = [
            'sdk_version', '1.3.0', 'ts', str(timestamp), 'app_type', 'lite', 'os_api', '23', 'device_type', 'Nexus 6P',
            'device_platform', 'android', 'ssmix', 'a', 'iid', '91658564592', 'manifest_version_code', '203', 'dpi', '560',
            'version_code', '203', 'app_name', 'douyin_lite', 'version_name', '2.0.3', 'openudid', 'dd08f504420bcde0',
            'device_id', str(device_id), 'resolution', '1440*2392', 'os_version', '6.0', 'language', 'zh', 'device_brand',
            'google', 'ac', 'wifi', 'update_version_code', '2030', 'aid', '2329', 'channel', 'xiaomi', '_rticket',
            str(timestamp_w), 'dwinfo',
            '5r_u5O7C8fL-_On08vO_p_Po8fGxv_zw_O3C8fL-_On08vO_p_Po8fGxv__87vjC7un86fTy87-n5r_-6O_v-PPpv6fmv-nk7fi_p62xv_D-_r-nrbG_8PP-v6etsb_5__C_p62xv_H8_r-nrbG__vjx8dT5v6etsb_-9Pm_p62xv-3u_r-nrbG_7-7u9L-nrbG___T5v6etsb_x_Om_p62xv_Hy8_r0v6etsb_z9Pm_p62xv-70-b-nrbG__-q_p62xv_70v6etsb_4_O_7_vO_p62xv-3-9L-nrbG_6fz-v6et4LG_8_j0-vX_8u_08_q_p8bA4LG_6vT79ML08_vyv6fG5r_q9Pv0wvP88Pi_p7_39Pzz-uf1_PP6v7G_6vT79MLw_P6_p7-t_qelr6erpaevpKeoqKeopb-xv-_u7vS_p7CopLG_9O7C_ujv7_jz6b-nrODAsb_--PHxv6fGwLG_8fL-_On08vPC8PL5-L-nrbG_8fL-_On08vPC7vjp6fTz-r-nrbG_7uj_8PTpwun08Pi_p6yoqq6pq6iupamlqK2xv73x_PP66Pz6-L-nv-f1sN7Tv7G_7fL07r-n8-jx8eA='
        ]
    
        # infos1 = "sdk_version,1.3.0"
        url = 'https://iu.snssdk.com/location/locate/?sdk_version=1.3.0&ts={}&app_type=lite&os_api=23&device_type=Nexus 6P&device_platform=android&ssmix=a&iid=91658564592&manifest_version_code=203&dpi=560&version_code=203&app_name=douyin_lite&version_name=2.0.3&openudid=dd08f504420bcde0&device_id=69852570923&resolution=1440*2392&os_version=6.0&language=zh&device_brand=google&ac=wifi&update_version_code=2030&aid=2329&channel=xiaomi&_rticket={}'.format(
            timestamp, timestamp_w)
    
        # print(','.join(infos))
        sig = script.exports.getRpcSign(timestamp, url, infos, str(device_id))
        print('sig:', sig)
        return sig
    
    
    def get_sig(script, timestamp, url, infos, device_id):
        return script.exports.getRpcSign(timestamp, url, infos, str(device_id))
    
    
    def get_frida_script_obj():
        process = frida.get_usb_device().attach('com.ss.android.ugc.aweme.lite')
        script = process.create_script(hook_code)
        script.on('message', on_message)
        script.load()
        return script
    
    
    def download_video(url, video_id):
        custom_headers = {
            'Accept-Encoding': 'identity',
            'User-Agent': 'okhttp/3.10.0.1 vpwp/',
            'Connection': 'keep-alive',
        }
        print('download video')
        r = requests.get(url=url, verify=False, headers=custom_headers)
        print(r.status_code)
        with open('D:/code/test_decompile/dy/{}.mp4'.format(video_id), 'wb') as f:
            f.write(r.content)
    
    
    def download_req(url):
        custom_headers = {
            'Accept-Encoding': 'gzip',
            'User-Agent': 'com.ss.android.ugc.aweme.lite/203 (Linux; U; Android 6.0; zh_CN; '
                          'Nexus 6P; Build/MDA89D; Cronet/58.0.2991.0)',
            'Connection': 'keep-alive',
            'Host': 'aweme.snssdk.com'
        }
        r = requests.get(url=url, verify=False, headers=custom_headers)
        print(r.status_code)
        return r.text
    
    
    def start():
        # 'https://aweme.snssdk.com/aweme/v1/challenge/aweme/?ch_id=1649450080661508&query_type=0&cursor=20&count=20&type=5&retry_type=no_retry&iid=91658564592&device_id=69852570923&ac=wifi&channel=xiaomi&aid=2329&app_name=douyin_lite&version_code=203&version_name=2.0.3&device_platform=android&ssmix=a&device_type=Nexus+6P&device_brand=google&language=zh&os_api=23&os_version=6.0&openudid=dd08f504420bcde0&manifest_version_code=203&resolution=1440*2392&dpi=560&update_version_code=2030&_rticket=1573385459665&ts=1573385457&as=aad341fde85dc7f4f3d341&cp=fe38d341fde8d341fe3032&mas=01199323991959b313f319b9b985dc10f0b313f319f3591359d3f9'
        crawl_url = 'https://aweme.snssdk.com/aweme/v1/challenge/aweme/?ch_id=1649450080661508&query_type=0&cursor=20&count=20&type=5&retry_type=no_retry&iid=91658564592&device_id=69852570923&ac=wifi&channel=xiaomi&aid=2329&app_name=douyin_lite&version_code=203&version_name=2.0.3&device_platform=android&ssmix=a&device_type=Nexus+6P&device_brand=google&language=zh&os_api=23&os_version=6.0&openudid=dd08f504420bcde0&manifest_version_code=203&resolution=1440*2392&dpi=560&update_version_code=2030&_rticket=1573385459665&ts=1573385457'
        script = get_frida_script_obj()
    
        timestamp_w = time.time()
        timestamp = int(timestamp_w)
        device_id = 69852570923
        infos = [
            'sdk_version', '1.3.0', 'ts', str(timestamp), 'app_type', 'lite', 'os_api', '23', 'device_type', 'Nexus 6P',
            'device_platform', 'android', 'ssmix', 'a', 'iid', '91658564592', 'manifest_version_code', '203', 'dpi', '560',
            'version_code', '203', 'app_name', 'douyin_lite', 'version_name', '2.0.3', 'openudid', 'dd08f504420bcde0',
            'device_id', str(device_id), 'resolution', '1440*2392', 'os_version', '6.0', 'language', 'zh',
            'device_brand', 'google', 'ac', 'wifi', 'update_version_code', '2030', 'aid', '2329', 'channel', 'xiaomi',
            '_rticket', str(timestamp_w), 'dwinfo',
            '5r_u5O7C8fL-_On08vO_p_Po8fGxv_zw_O3C8fL-_On08vO_p_Po8fGxv__87vjC7un86fTy87-n5r_-6O_v-PPpv6fmv-nk7fi_p62xv_D-_r-nrbG_8PP-v6etsb_5__C_p62xv_H8_r-nrbG__vjx8dT5v6etsb_-9Pm_p62xv-3u_r-nrbG_7-7u9L-nrbG___T5v6etsb_x_Om_p62xv_Hy8_r0v6etsb_z9Pm_p62xv-70-b-nrbG__-q_p62xv_70v6etsb_4_O_7_vO_p62xv-3-9L-nrbG_6fz-v6et4LG_8_j0-vX_8u_08_q_p8bA4LG_6vT79ML08_vyv6fG5r_q9Pv0wvP88Pi_p7_39Pzz-uf1_PP6v7G_6vT79MLw_P6_p7-t_qelr6erpaevpKeoqKeopb-xv-_u7vS_p7CopLG_9O7C_ujv7_jz6b-nrODAsb_--PHxv6fGwLG_8fL-_On08vPC8PL5-L-nrbG_8fL-_On08vPC7vjp6fTz-r-nrbG_7uj_8PTpwun08Pi_p6yoqq6pq6iupamlqK2xv73x_PP66Pz6-L-nv-f1sN7Tv7G_7fL07r-n8-jx8eA=']
    
        sig_url = 'https://iu.snssdk.com/location/locate/?sdk_version=1.3.0&ts={}&app_type=lite&os_api=23&device_type=Nexus 6P&device_platform=android&ssmix=a&iid=91658564592&manifest_version_code=203&dpi=560&version_code=203&app_name=douyin_lite&version_name=2.0.3&openudid=dd08f504420bcde0&device_id=69852570923&resolution=1440*2392&os_version=6.0&language=zh&device_brand=google&ac=wifi&update_version_code=2030&aid=2329&channel=xiaomi&_rticket={}'.format(
            timestamp, timestamp_w)
    
        sig = get_sig(script, timestamp, sig_url, infos, str(device_id))
        print(crawl_url + sig)
        req_text = download_req(crawl_url + sig)
        data = json.loads(req_text)
    
        for i in data['aweme_list']:
            print('***video id/forward_count/play_count/digg_count/comment_count/share_count/download_count***')
            print('{}/{}/{}/{}/{}/{}/{}'.format(
                i['statistics']['aweme_id'], i['statistics']['forward_count'],
                i['statistics']['play_count'], i['statistics']['digg_count'],
                i['statistics']['comment_count'], i['statistics']['share_count'],
                i['statistics']['download_count'])
            )
            download_video(i['video']['play_addr']['url_list'][0], i['statistics']['aweme_id'])
    
    
    if __name__ == '__main__':
        start()
        pass

示例 ( 某眼查 )：

import sys
    import frida
    import time
    import json
    import base64
    import requests
    
    hook_code = '''
    rpc.exports = {
        getRpcSign: function(url, app_version){
            var sig = {"tyc-hi":"", "Authorization":"", "duid":"", "deviceID":""};
            Java.perform(
                function(){
                    var dp = Java.use('com.tianyancha.skyeye.utils.dp');
                    var duid = dp.g();
                    var authorization = dp.I();
                    var device_id = dp.i()
                    var tyc = dp.a(url, authorization, app_version, '', device_id, "slat")
    
                    sig["tyc-hi"] = tyc;
                    sig["Authorization"] = authorization;
                    sig["duid"] = duid;
                    sig["deviceID"] = device_id;
                }
            )
            return sig;
        }
    }
    '''
    
    
    def on_message(message, data):
        if message['type'] == 'send':
            print("[*] {0}".format(message['payload']))
        else:
            print(message)
    
    
    def get_frida_script_obj():
        process = frida.get_usb_device().attach('com.tianyancha.skyeye')
        script = process.create_script(hook_code)
        script.on('message', on_message)
        script.load()
        return script
    
    
    # sig = script.exports.getRpcSign("https://api4.tianyancha.com/services/v3/t/common/baseinfoV5/150041670","Android 11.4.0")
    # print(sig)
    # sys.stdin.read()
    
    
    def req(url, params):
        header = {
            'Accept-Encoding': 'gzip',
            'User-Agent': 'com.tianyancha.skyeye/Dalvik/2.1.0 (Linux; U; Android 6.0; Nexus 6P Build/MDA89D; appDevice/google_QAQ_Nexus 6P)',
            'Content-Type': 'application/json',
            'channelID': 'YingYongBao',
            'deviceID': '{}'.format(params['deviceID']),
            'duid': '{}'.format(params['duid']),
            'tyc-hi': '{}'.format(params['tyc-hi']),
            'version': 'Android 11.4.0',
            'X-Auth-Token': '',
            'Authorization': '{}'.format(params['Authorization']),
            'Connection': 'close',
            'Host': 'api4.tianyancha.com'
        }
        r = requests.get(url, headers=header, verify=False, timeout=1.5)
        print(r.status_code)
        return r.text
    
    
    def load_id_list():
        id_list = [
            '3297111045',
            '3297111059',
            '3297111103',
            '3297111120',
            '3297111168',
            '3297111177',
            '3297111203',
            '3297111215',
            '3297111220',
            '3297111230',
            '3297111254',
            '3297111262',
            '3297111264',
            '3297111268',
        ]
        return id_list
    
    
    def to_file(ids, text):
        with open('D:/skyeye/' + ids, 'w') as f:
            f.write(text)
    
    
    def start():
        base_url = 'https://api4.tianyancha.com/services/v3/t/details/appComIcV4/{}?pageSize=1000'
        script = get_frida_script_obj()
        id_list = load_id_list()
        for _id in id_list:
            params = script.exports.getRpcSign(base_url.format(_id), "Android 11.4.0")
            text = req(base_url.format(_id), params)
            to_file(_id, text)
    
    
    if __name__ == '__main__':
        start()
        pass

flask 封装 web api 服务

import sys
    import frida
    from flask import Flask, request
    
    
    app = Flask(__name__)
    
    
    hook_code = '''
    rpc.exports = {
        getRpcSign: function(url, app_version){
            var sig = {"tyc-hi":"", "Authorization":"", "duid":"", "deviceID":""};
            Java.perform(
                function(){
                    var dp = Java.use('com.tianyancha.skyeye.utils.dp');
                    var duid = dp.g();
                    var authorization = dp.I();
                    var device_id = dp.i()
                    var tyc = dp.a(url, authorization, app_version, '', device_id, "slat")
    
                    sig["tyc-hi"] = tyc;
                    sig["Authorization"] = authorization;
                    sig["duid"] = duid;
                    sig["deviceID"] = device_id;
                }
            )
            return sig;
        }
    }
    '''
    
    
    def on_message(message, data):
        if message['type'] == 'send':
            print("[*] {0}".format(message['payload']))
        else:
            print(message)
    
    def get_frida_script_obj():
        process = frida.get_usb_device().attach('com.tianyancha.skyeye')
        script = process.create_script(hook_code)
        script.on('message', on_message)
        script.load()
        return script.exports
    
    
    @app.route('/hello')
    def print_hello():
        return 'hello'
    
    @app.route("/getsign")
    def getsign():
        try:
            req_url = request.args.get('url')
            print(req_url)
            app_version = request.args.get('version')
            print(app_version)
        except Exception as e:
            print(e)
            return "异常情况"
        else:
            return script_exports_rpc.getRpcSign(req_url, app_version)
    
    if __name__ == '__main__':
        print('start')
    
        #开启Hook 把Hook程序注入设备
        script_exports = get_frida_script_obj()
    
        script_exports_rpc = script_exports
        print(script_exports_rpc)
    
        #运行flask 监听5001端口
        app.run(host='0.0.0.0', port=5001)

测试 web api 服务：

import time
    import json
    import base64
    import requests
    
    
    def req(url, params):
        header = {
          'Accept-Encoding': 'gzip',
          'User-Agent': 'com.tianyancha.skyeye/Dalvik/2.1.0 (Linux; U; Android 6.0; Nexus 6P Build/MDA89D; appDevice/google_QAQ_Nexus 6P)',
          'Content-Type': 'application/json',
          'channelID': 'YingYongBao',
          'deviceID': '{}'.format(params['deviceID']),
          'duid': '{}'.format(params['duid']),
          'tyc-hi': '{}'.format(params['tyc-hi']),
          'version': 'Android 11.4.0',
          'X-Auth-Token': '',
          'Authorization': '{}'.format(params['Authorization']),
          'Connection': 'close',
          'Host': 'api4.tianyancha.com'
        }
        r = requests.get(url, headers=header, verify=False, timeout=1.5)
        print(r.status_code)
        return r.text
    
    
    def load_id_list():
        id_list = [
            '3297111045',
            '3297111059',
            '3297111103',
            '3297111120',
            '3297111168',
            '3297111177',
            '3297111203',
            '3297111215',
            '3297111220',
            '3297111230',
            '3297111254',
            '3297111262',
            '3297111264',
            '3297111268',
        ]
        return id_list
    
    def to_file(ids, text):
        with open('D:/code/test_decompile/skyeye/frida-rpc-server/'+ids, 'w') as f:
            f.write(text)
    
    def start():
        base_url = 'https://api4.tianyancha.com/services/v3/t/details/appComIcV4/{}?pageSize=1000'
        #script = hook_sky.hook_prepare()
        id_list = load_id_list()
        for _id in id_list:
           sig_r = requests.get('http://192.168.43.125:5001/getsigs?url={}&version={}'.format(_id, "Android 11.4.0"))
           params = json.loads(sig_r.text)
           #params = script.exports.getsig(base_url.format(_id), "Android 11.4.0")
           text = req(base_url.format(_id), params)
           to_file(_id, text)
    
    start()

hook tcp 和 http 开关（ 手淘 ）：

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5pOS6LS85YWI5pOS546L_size_20_color_FFFFFF_t_70_g_se_x_16][]

代码：

import sys
    import frida
    
    hook_code = '''
    Java.perform(
        function(){
            var SwitchConfig = Java.use('mtopsdk.mtop.global.SwitchConfig')
            SwitchConfig.isGlobalSpdySwitchOpen.implementation = function(){
                //send('SwitchConfig')
                //return false;  // 可以直接返回 false, 关掉 socket 通道
                var ret_val = this.isGlobalSpdySwitchOpen();
                send('ret_val ---> ' + ret_val);
                return ret_val;
            }
        }
    )
    '''
    
    
    def on_message(message, data):
        if message['type'] == 'send':
            print("[*] {0}".format(message['payload']))
        else:
            print(message)
    
    
    # device = frida.get_usb_device()
    device = frida.get_remote_device()
    
    # 直接使用 包名 运行报错，就使用 pid 号 进行 attach
    # process = device.attach('com.taobao.taobao')
    process = device.attach(20233)
    script = process.create_script(hook_code)
    script.on('message', on_message)
    script.load()
    sys.stdin.read()

手淘 9.1.0 版本 x-sign 分析：

tb\_hook\_test.py

import frida,sys
    import time
    
    
    hook_test = '''
    Java.perform(
        function(){
            /*var InnerProtocolParamBuilderImpl = Java.use('mtopsdk.mtop.protocol.builder.impl.InnerProtocolParamBuilderImpl')
            InnerProtocolParamBuilderImpl.buildParams.implementation = function(param1){
                var ret_val = this.buildParams(param1)
                printHashMap(ret_val)
                return ret_val
            },*/
            var lnf = Java.use('tb.lnf')
            lnf.a.overload('java.util.HashMap', 'java.util.HashMap', 'java.lang.String', 'java.lang.String', 'boolean').implementation = function(p1, p2, p3, p4, p5){
                send('hashmap1:')
                printHashMap(p1)
                send('hashmap2:')
                printHashMap(p2)
                send('param3:'+p3)
                send('param4:'+p4)
                send('param5:'+p5)
    
                var ret_val =  this.a(p1, p2, p3, p4, p5)
                printHashMap(ret_val)
                return ret_val
            }
    
        }
    )
    
    function printHashMap(param_hm){
        var HashMap = Java.use('java.util.HashMap');
        var args_map = Java.cast(param_hm, HashMap)
        send('args_map:'+args_map.toString());
    }
    '''
    
    
    
    hook_lnf_code = '''
    Java.perform(
        function(){
            var HashMap = Java.use('java.util.HashMap')
            var IMiddleTierGenericComponent = Java.use('com.alibaba.wireless.security.open.middletier.IMiddleTierGenericComponent');
            IMiddleTierGenericComponent.getSign.implementation = function(a1){
                send('enter getSign')
                var args_map = Java.cast(a1, HashMap)
                send('args_map'+args_map.toString());
                var ret = this.getSign(a1)
    
                var ret_map = Java.cast(ret, HashMap)
                send('ret_map:'+ret_map.toString());
                return ret
            };
    
            var lnf = Java.use('tb.lnf');
            lnf.a.overload('java.util.Map','java.lang.String', 'boolean').implementation = function(aa1, aa2, aa3){
                //printstack()
                send('enter method a map string boolean')
                //send('aa1:'+printHashMap(aa1))
                //send('aa2:'+aa2)
                //send('aa3:'+aa3)
                var ret_str3 = this.a(aa1, aa2, aa3);
                send('ret_str3:'+ret_str3.get('INPUT'));
                return ret_str3
            };
    
            lnf.a.overload('java.util.HashMap','java.lang.String').implementation = function(aa1, aa2){
                send('enter method 2param')
                //send('2pram_a_a1:'+printHashMap(aa1))
                //send('2pram_a_a1:'+aa2)
                var ret_str2 = this.a(aa1, aa2);
                send('2pram_a_ret_str2:'+ret_str2);
                return ret_str2
            };
    
            lnf.d.implementation = function(){
                var ret = this.d()
                //send('d method:'+ret)
                return ret
            };
    
            var InnerProtocolParamBuilderImpl = Java.use('mtopsdk.mtop.protocol.builder.impl.InnerProtocolParamBuilderImpl')
            InnerProtocolParamBuilderImpl.buildParams.implementation = function(r19){
                //send('enter InnerProtocolParamBuilderImpl')
                var ret = this.buildParams(r19)
                //printHashMap(ret)
                return ret
    
            };
    
            lnf.a.overload('java.util.HashMap','java.lang.String', 'java.lang.String').implementation = function(a1, a2, a3){
                send('enter method a hashmap string string')
                //send('2pram_a_a1:'+printHashMap(a1))
                //send('2pram_a_a1:'+a2)
                var ret_str = this.a(a1, a2, a3);
                send('ret_str hashmap string string:'+ret_str);
                return ret_str
            };
            lnf.a.overload('java.lang.String', 'java.lang.String').implementation = function(a1, a2){
                send('enter method a string string')
                //send('2pram_a_a1:'+printHashMap(a1))
                //send('2pram_a_a1:'+a2)
                var ret_str = this.a(a1, a2);
                send('ret_str string string:'+ret_str);
                return ret_str
            };
    
            var SwitchConfig = Java.use('mtopsdk.mtop.global.SwitchConfig')
            SwitchConfig.isGlobalSpdySwitchOpen.implementation = function(){
                //send('SwitchConfig')
                return false
            };
    
            var a_5_para = lnf.a.overload('java.util.HashMap','java.util.HashMap','java.lang.String','java.lang.String','boolean')
            
            a_5_para.implementation = function(a1, a2, a3, a4,a5){
                send('enter a_5_para')
                send('hm1')
                printHashMap(a1)
                send('hm2')
                printHashMap(a2)
                send('a3:'+a3)
                send('a4:'+a4)
                send('a5:'+a5)
                //printstack()
                var ret = this.a(a1, a2, a3, a4,a5)
                printHashMap(ret)
                return ret
    
            };
    
            lnf.a.overload('mtopsdk.mtop.global.MtopConfig').implementation = function(a1){
                send('enter method a MtopConfig')
                return this.a(a1);
                var ret_str = this.a(a1, a2);
                send('ret_str string string:'+ret_str);
                return ret_str
            };
    
            var leb = Java.use('tb.leb')
            leb.signature.implementation = function(data){
                var sig = this.signature(data)
                send('****************sig*******************:'+sig)
                return sig
            }
    
            var SecurityGuardManager = Java.use('com.taobao.wireless.security.sdk.SecurityGuardManager')
            SecurityGuardManager.getSecureSignatureComp.implementation = function(){
                //printstack()
                return this.getSecureSignatureComp()
            }
            
    
        }
    )
    
    function printHashMap(param_hm){
        var HashMap = Java.use('java.util.HashMap');
        var args_map = Java.cast(param_hm, HashMap)
        send('args_map:' + args_map.toString());
    }
    
    function printstack() {
        send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    }
    '''
    
    test_gen_sig = '''
    rpc.exports = {
        getsig:function(){
            Java.perform(
                function(){
                    var lne = Java.use('tb.lne').$new()
    
                    var HashMap = Java.use('java.util.HashMap')
                    var hm = HashMap.$new()
                    var str3 = lne.a(hm, hm,"","", true)
                }
            )
        }
    }
    '''
    
    test_gen_sig = '''
    rpc.exports = {
        getsig:function(timestamp){
            Java.perform(
                function(){
    
                    var TBSdkLog = Java.use('mtopsdk.common.util.TBSdkLog')
                    TBSdkLog.e.overload('java.lang.String', 'java.lang.String').implementation = function(str1, str2){
                        send('log:'+str1)
                        send('log:'+str2)
                    }
    
                    var HashMap = Java.use('java.util.HashMap')
                    var hashMap1 = HashMap.$new();
    
                    var data='{"detail_v":"3.3.2","exParams":"{\"NAV_START_ACTIVITY_TIME\":\"1575640752386\",\"NAV_TO_URL_START_TIME\":\"1575640752378\",\"ad_type\":\"1.0\",\"appReqFrom\":\"detail\",\"clientCachedTemplateKeys\":\"[{\\\"id\\\":\\\"1538383035450\\\",\\\"version\\\":\\\"68\\\"}]\",\"container_type\":\"xdetail\",\"countryCode\":\"CN\",\"cpuCore\":\"8\",\"cpuMaxHz\":\"1555200\",\"dinamic_v3\":\"true\",\"id\":\"605857798916\",\"item_id\":\"605857798916\",\"latitude\":\"0\",\"longitude\":\"0\",\"osVersion\":\"23\",\"phoneType\":\"Nexus 6P\",\"pvid\":\"705dc461-5089-4cf5-8ce7-ace6bc85925d\",\"scm\":\"1007.12144.130673.4948130_0_3032\",\"soVersion\":\"2.0\",\"spm\":\"a2141.1.pinlei_tab4.d4-0\",\"spm-cnt\":\"a2141.7631564\",\"ultron2\":\"true\",\"utdid\":\"Xb6r2HfdTvsDAG4dHHurgSCI\",\"wx_options\":\"{animated=true, url=//item.taobao.com/item.htm?id=605857798916&pvid=705dc461-5089-4cf5-8ce7-ace6bc85925d&scm=1007.12144.130673.4948130_0_3032&spm=a2141.1.pinlei_tab4.d4-0&utparam=%7B%22x_hestia_source%22%3A%22st_fenlei_gul%22%2C%22x_object_type%22%3A%22item%22%2C%22x_mt%22%3A%228%22%2C%22x_src%22%3A%22st_fenlei_gul%22%2C%22x_pos%22%3A%221%22%2C%22x_pvid%22%3A%22705dc461-5089-4cf5-8ce7-ace[*] args_map:{deviceId=AiomvfL6hhU_hX6u80I0DM_cG952UaEtYQuomLzpl4vH, appKey=21646297, utdid=Xb6r2HfdTvsDAG4dHHurgSCI, x-features=27, ttid=255200@taobao_android_9.1.0, v=6.0, sid=null, t=1575640752, api=mtop.taobao.detail.getdetail, data={"detail_v":"3.3.2","exParams":"{\"NAV_START_ACTIVITY_TIME\":\"1575640752386\",\"NAV_TO_URL_START_TIME\":\"1575640752378\",\"ad_type\":\"1.0\",\"appReqFrom\":\"detail\",\"clientCachedTemplateKeys\":\"[{\\\"id\\\":\\\"1538383035450\\\",\\\"version\\\":\\\"68\\\"}]\",\"container_type\":\"xdetail\",\"countryCode\":\"CN\",\"cpuCore\":\"8\",\"cpuMaxHz\":\"1555200\",\"dinamic_v3\":\"true\",\"id\":\"605857798916\",\"item_id\":\"605857798916\",\"latitude\":\"0\",\"longitude\":\"0\",\"osVersion\":\"23\",\"phoneType\":\"Nexus 6P\",\"pvid\":\"705dc461-5089-4cf5-8ce7-ace6bc85925d\",\"scm\":\"1007.12144.130673.4948130_0_3032\",\"soVersion\":\"2.0\",\"spm\":\"a2141.1.pinlei_tab4.d4-0\",\"spm-cnt\":\"a2141.7631564\",\"ultron2\":\"true\",\"utdid\":\"Xb6r2HfdTvsDAG4dHHurgSCI\",\"wx_options\":\"{animated=true, url=//item.taobao.com/item.htm?id=605857798916&pvid=705dc461-5089-4cf5-8ce7-ace6bc85925d&scm=1007.12144.130673.4948130_0_3032&spm=a2141.1.pinlei_tab4.d4-0&utparam=%7B%22x_hestia_source%22%3A%22st_fenlei_gul%22%2C%22x_object_type%22%3A%22item%22%2C%22x_mt%22%3A%228%22%2C%22x_src%22%3A%22st_fenlei_gul%22%2C%22x_pos%22%3A%221%22%2C%22x_pvid%22%3A%22705dc461-5089-4cf5-8ce7-ace6bc85925d%22%2C%22x_object_id%22%3A%22605857798916%22%2C%22home_buckets%22%3A%22%22%2C%22home_industry_id%22%3A%225%22%2C%22item_type%22%3A%22normal%22%2C%22item_id%22%3A%22605857798916%22%7D}\"}","itemNumId":"605857798916"}'
    
                    hashMap1.put("deviceId", "AiomvfL6hhU_hX6u80I0DM_cG952UaEtYQuomLzpl4vH")
                    hashMap1.put("appKey", "21646297")
                    hashMap1.put("utdid","Xb6r2HfdTvsDAG4dHHurgSCI")
                    hashMap1.put("x-features", "27")
                    hashMap1.put("ttid", "255200@taobao_android_9.1.0")
                    hashMap1.put("v", "6.0")
                    hashMap1.put("sid", "26")
                    hashMap1.put("ad_type", "1.0")
    
                    hashMap1.put("t", timestamp)
                    hashMap1.put("api", "mtop.taobao.detail.getdetail")
                   // hashMap1.put("data", JSON.stringify(data))
                    hashMap1.put("data", data)
                   
                    hashMap1.put("uid", null)
    
    
    
                    var hashMap2 = HashMap.$new();
                    hashMap2.put("pageName","com.taobao.android.detail.wrapper.activity.DetailActivity")
                    hashMap2.put("pageId","http://item.taobao.com/item.htm")
    
                    var str = "21646297"
                    var str2 = null
                    var z = false
                    
                    
                    var mtopConfig;
                    Java.choose('mtopsdk.mtop.global.MtopConfig',{
                        "onMatch":function(instance){
                            mtopConfig = instance
                        },
                        "onComplete":function(){
                        }
                    })
    
                    var lnf = Java.use('tb.lnf').$new()
                    lnf.b(mtopConfig)
    
                    var tmp = lnf.a(hashMap1, hashMap2, str, str2, z)
                    printHashMap(tmp)
                    
                }
            )
    
        }
    }
    
    function printHashMap(param_hm){
        var HashMap = Java.use('java.util.HashMap');
        var args_map = Java.cast(param_hm, HashMap)
        send('args_map'+args_map.toString());
    }
    '''
    
    gen_sig = '''
    rpc.exports = {
        getsig:function(timestamp){
            Java.perform(
                function(){
                    //send('eeeeeeeeeeeeeeeeeeeeee')
    
                    //var loga = Java.use('mtopsdk.common.log.a').$new()
    
                    var TBSdkLog = Java.use('mtopsdk.common.util.TBSdkLog')
                    //TBSdkLog.setTLogEnabled(true)
                    //send(TBSdkLog.tLogEnabled.value)
                    //send(TBSdkLog.isLogEnable(TBSdkLog.logEnable.value))
                    
                    //TBSdkLog.setLogEnable(TBSdkLog.logEnable.value)
                    //TBSdkLog.setLogAdapter(loga)
                    //send('eeeeeeeeeeeeeeeeeeeeee')
    
                    TBSdkLog.e.overload('java.lang.String', 'java.lang.String', 'java.lang.String').implementation=function(log1, log2, log3){
                        send(log1)
                        send(log2)
                        send(log3)
                        this.e(log1, log2, log3)
                    }
    
                    var data = '{"detail_v":"3.3.2","exParams":"{\"NAV_START_ACTIVITY_TIME\":\"1575357562038\",\"NAV_TO_URL_START_TIME\":\"1575357562026\",\"ad_type\":\"1.0\",\"appReqFrom\":\"detail\",\"clientCachedTemplateKeys\":\"[{\\\"id\\\":\\\"1538383035450\\\",\\\"version\\\":\\\"68\\\"}]\",\"container_type\":\"xdetail\",\"countryCode\":\"CN\",\"cpuCore\":\"8\",\"cpuMaxHz\":\"1555200\",\"dinamic_v3\":\"true\",\"id\":\"603483014905\",\"item_id\":\"603483014905\",\"latitude\":\"0\",\"longitude\":\"0\",\"osVersion\":\"23\",\"phoneType\":\"Nexus 6P\",\"pvid\":\"0861e6a9-5d8a-4d3d-a53a-f750ef593f85\",\"scm\":\"1007.12144.130672.4948164_0_0\",\"soVersion\":\"2.0\",\"spm\":\"a2141.1.pinlei_tab4.d3-4\",\"spm-cnt\":\"a2141.7631564\",\"u_channel\":\"ystttj\",\"ultron2\":\"true\",\"umpChannel\":\"ystttj\",\"utdid\":\"Xb6r2HfdTvsDAG4dHHurgSCI\",\"wx_options\":\"{animated=true, url=https://item.taobao.com/item.htm?id=603483014905&pvid=0861e6a9-5d8a-4d3d-a53a-f750ef593f85&scm=1007.12144.130672.4948164_0_0&spm=a2141.1.pinlei_tab4.d3-4&u_channel=ystttj&umpChannel=ystttj&utparam=%7B%22home_buckets%22%3A%22%22%2C%22home_industry_id%22%3A%225%22%2C%22item_type%22%3A%22tttm%22%2C%22item_id%22%3A%22603483014905%22%7D}\"}","itemNumId":"603483014905"}'
                    //var data = '{"detail_v": "3.3.2",\
    	            //            "exParams": "{"NAV_START_ACTIVITY_TIME":"1575013794568","NAV_TO_URL_START_TIME":"1575013794538","action":"ipv","ad_type":"1.0","appReqFrom":"detail","clientCachedTemplateKeys":"[{"id":"1538383035450","version":"68"}]","container_type":"xdetail","countryCode":"CN","cpuCore":"8","cpuMaxHz":"1555200","dinamic_v3":"true","from":"search","id":"600686693236","item_id":"600686693236","latitude":"0","list_type":"search","longitude":"0","osVersion":"23","phoneType":"Nexus 6P","search_action":"initiative","soVersion":"2.0","spm":"a2141.7631557.itemlist.12","spm-cnt":"a2141.7631564","ultron2":"true","utdid":"Xb6r2HfdTvsDAG4dHHurgSCI"}",\
    	            //            "itemNumId": "600686693236"}'
                    //send(JSON.stringify(data))
    
                    var HashMap = Java.use('java.util.HashMap')
                    var hashMap1 = HashMap.$new();
                    hashMap1.put("deviceId", "AiomvfL6hhU_hX6u80I0DM_cG952UaEtYQuomLzpl4vH")
                    hashMap1.put("appKey", "21646297")
                    hashMap1.put("utdid","Xb6r2HfdTvsDAG4dHHurgSCI")
                    hashMap1.put("x-features", "27")
                    hashMap1.put("ttid", "255200@taobao_android_9.1.0")
                    hashMap1.put("v", "6.0")
                    hashMap1.put("sid", "26")
                    hashMap1.put("ad_type", "1.0")
    
                    hashMap1.put("t", timestamp)
                    hashMap1.put("api", "mtop.taobao.detail.getdetail")
                   // hashMap1.put("data", JSON.stringify(data))
                    hashMap1.put("data", data)
                   
                    hashMap1.put("uid", null)
    
    
    
                    var hashMap2 = HashMap.$new();
                    hashMap2.put("pageName","com.taobao.android.detail.wrapper.activity.DetailActivity")
                    hashMap2.put("pageId","http://item.taobao.com/item.htm")
    
                    var str = "21646297"
                    var str2 = null
                    var z = false
                    
                    var lnf = Java.use('tb.lnf').$new()
                    var mtopConfig;
                    Java.choose('mtopsdk.mtop.global.MtopConfig',{
                        "onMatch":function(instance){
                            //tmp = instance.a(hashMap1, hashMap2, str, str2, z)
                            //tmp = instance.f.getSecurityFactors(hashMap2)
                            //send('is null:'+tmp)
                            mtopConfig = instance
                        },
                        "onComplete":function(){
                        }
                    })
    
                    lnf.b(mtopConfig)
                    //send('lnf.f'+lnf.f.getSecurityFactors(hashMap2))
                    //send('lnf.e'+lnf.e)
                    var tmp = lnf.a(hashMap1, hashMap2, str, str2, z)
                    
                    printHashMap(tmp)
                }
            )
    
        }
    }
    
    function printHashMap(param_hm){
        var HashMap = Java.use('java.util.HashMap');
        var args_map = Java.cast(param_hm, HashMap)
        send('args_map'+args_map.toString());
    }
    '''
    
    do_gen_sig = '''
    rpc.exports = {
        getsig:function(timestamp, py_hashMap1, py_hashMap2){
            var args_map = ""
            Java.perform(
                function(){
    
                    var HashMap = Java.use('java.util.HashMap')
                    var hashMap1 = HashMap.$new();
                    hashMap1.put("deviceId", py_hashMap1["deviceId"])
                    hashMap1.put("appKey", py_hashMap1["appKey"])
                    hashMap1.put("utdid", py_hashMap1["utdid"])
                    hashMap1.put("x-features", py_hashMap1["x-features"])
                    hashMap1.put("ttid", py_hashMap1["ttid"])
                    hashMap1.put("v", py_hashMap1["v"])
                    hashMap1.put("sid", py_hashMap1["sid"])
                    //hashMap1.put("ad_type", py_hashMap1[""])
                    hashMap1.put("t", py_hashMap1["t"])
                    hashMap1.put("api", py_hashMap1["api"])
                    hashMap1.put("data", py_hashMap1["data"])
                    
                    hashMap1.put("uid", py_hashMap1["uid"])
    
                    send('hashmap1')
                    printHashMap(hashMap1)
                    var hashMap2 = HashMap.$new();
                    hashMap2.put("pageId",py_hashMap2["pageId"])
                    hashMap2.put("pageName",py_hashMap2["pageName"])
                    
                    send('hashmap2')
                    printHashMap(hashMap2)
                    var str = "21646297"
                    var str2 = null
                    var z = false
                    
                    var lnf = Java.use('tb.lnf').$new()
                    var mtopConfig;
                    send('can you see me?')
                    Java.choose('mtopsdk.mtop.global.MtopConfig',{
                        "onMatch":function(instance){
                            mtopConfig = instance
                        },
                        "onComplete":function(){
                        }
                    })
                    send('i can see you')
    
                    lnf.b(mtopConfig)
                    var tmp = lnf.a(hashMap1, hashMap2, str, str2, z)
                    
                    printHashMap(tmp)
                    args_map = '{'+'"x_sign":"'+tmp.get("x-sign")+'",'+'"x_mini_wua":"'+tmp.get("x-mini-wua")+'",'+'"x_umt":"'+tmp.get("x-umt")+'"}'
                    //args_map["x_sign"] = tmp.get("x-sign")
                    //args_map["x_mini_wua"] = tmp.get("x-mini-wua")
                    //args_map["x_umt"] = tmp.get("x-umt")
    
                    //send('x-sign:'+tmp.get("x-sign"))
                    send('all param:'+args_map)
                }
            )
        return args_map
        }
    }
    
    function printHashMap(param_hm){
        var HashMap = Java.use('java.util.HashMap');
        var args_map = Java.cast(param_hm, HashMap)
        send('args_map'+args_map.toString());
    }
    '''
    
    def on_message(message, data):
        if message['type'] == 'send':
            print("[*] {0}".format(message['payload']))
        else:
            print(message)
    
    def test():
        process = frida.get_usb_device().attach('com.taobao.taobao')
        script = process.create_script(test_gen_sig)
        script.on('message', on_message)
        script.load()
        print('hook_prepare is ok')
    
        ts = str(int(time.time()))
        script.exports.getsig(ts)
    
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
    
        sys.stdin.read()
    
    def hook_prepare():
        process = frida.get_usb_device().attach('com.taobao.taobao')
        script = process.create_script(do_gen_sig)
        script.on('message', on_message)
        script.load()
        print('hook_prepare is ok')
        return script
        #ts = str(int(time.time()))
        #script.exports.getsig(ts)
    
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
    
        #sys.stdin.read()
    
    #hook_prepare()
    if __name__ == "__main__":
        test()

tb\_crawl.py

import requests
    import time
    import json
    import base64
    import tb_hook_test
    from urllib.parse import quote
    
    
    def req(url, header):
        r = requests.get(url, headers=header, verify=False)
        print(r.status_code)
        return r.text
    
    def gen_detail_hook_params(timestamp_10d, timestamp_14d, timestamp_14d1, item_id, pvid, scm):
        data = r'{
       {"detail_v":"3.3.2","exParams":"{
       {\"NAV_START_ACTIVITY_TIME\":\"{timestamp}\",\"NAV_TO_URL_START_TIME\":\"{timestamp1}\",\"ad_type\":\"1.0\",\"appReqFrom\":\"detail\",\"clientCachedTemplateKeys\":\"[{
       {\\\"id\\\":\\\"1538383035450\\\",\\\"version\\\":\\\"68\\\"}}]\",\"container_type\":\"xdetail\",\"countryCode\":\"CN\",\"cpuCore\":\"8\",\"cpuMaxHz\":\"1555200\",\"dinamic_v3\":\"true\",\"id\":\"{item_id}\",\"item_id\":\"{item_id}\",\"latitude\":\"0\",\"longitude\":\"0\",\"osVersion\":\"23\",\"phoneType\":\"Nexus 6P\",\"pvid\":\"{pvid}\",\"scm\":\"{scm}\",\"soVersion\":\"2.0\",\"spm\":\"a2141.1.pinlei_tab4.d4-0\",\"spm-cnt\":\"a2141.7631564\",\"ultron2\":\"true\",\"utdid\":\"Xb6r2HfdTvsDAG4dHHurgSCI\",\"wx_options\":\"{
       {animated=true, url=//item.taobao.com/item.htm?id={item_id}&pvid={pvid}&scm={scm}&spm=a2141.1.pinlei_tab4.d4-0&utparam=%7B%22x_hestia_source%22%3A%22st_fenlei_gul%22%2C%22x_object_type%22%3A%22item%22%2C%22x_mt%22%3A%228%22%2C%22x_src%22%3A%22st_fenlei_gul%22%2C%22x_pos%22%3A%221%22%2C%22x_pvid%22%3A%22{pvid}%22%2C%22x_object_id%22%3A%22{item_id}%22%2C%22home_buckets%22%3A%22%22%2C%22home_industry_id%22%3A%225%22%2C%22item_type%22%3A%22normal%22%2C%22item_id%22%3A%22{item_id}%22%7D}}\"}}","itemNumId":"{item_id}"}}'
        #data = r'{
       {"detail_v":"3.3.2","exParams":"{
       {\"NAV_START_ACTIVITY_TIME\":\"{timestamp}\",\"NAV_TO_URL_START_TIME\":\"{timestamp1}\",\"ad_type\":\"1.0\",\"appReqFrom\":\"detail\",\"clientCachedTemplateKeys\":\"[{
       {\\\"id\\\":\\\"1538383035450\\\",\\\"version\\\":\\\"68\\\"}}]\",\"container_type\":\"xdetail\",\"countryCode\":\"CN\",\"cpuCore\":\"8\",\"cpuMaxHz\":\"1555200\",\"dinamic_v3\":\"true\",\"id\":\"{item_id}\",\"item_id\":\"{item_id}\",\"latitude\":\"0\",\"longitude\":\"0\",\"osVersion\":\"23\",\"phoneType\":\"Nexus 6P\",\"pvid\":\"{pvid}\",\"scm\":\"{scm}\",\"soVersion\":\"2.0\",\"spm\":\"a2141.1.pinlei_tab4.d3-4\",\"spm-cnt\":\"a2141.7631564\",\"u_channel\":\"ystttj\",\"ultron2\":\"true\",\"umpChannel\":\"ystttj\",\"utdid\":\"Xb6r2HfdTvsDAG4dHHurgSCI\",\"wx_options\":\"{
       {animated=true, url=https://item.taobao.com/item.htm?id={item_id}&pvid={pvid}&scm={scm}&spm=a2141.1.pinlei_tab4.d3-4&u_channel=ystttj&umpChannel=ystttj&utparam=%7B%22home_buckets%22%3A%22%22%2C%22home_industry_id%22%3A%225%22%2C%22item_type%22%3A%22tttm%22%2C%22item_id%22%3A%22{item_id}%22%7D}}\"}}","itemNumId":"{item_id}"}}'
        #print('ori_data:',data)
        #print('format_data:',data.format(timestamp=timestamp_14d, timestamp1=timestamp_14d1, item_id=item_id, pvid=pvid, scm=scm))
        hashMap1 = {
            "deviceId":"AiomvfL6hhU_hX6u80I0DM_cG952UaEtYQuomLzpl4vH",
            "appKey":"21646297",
            "utdid":"Xb6r2HfdTvsDAG4dHHurgSCI",
            "x-features":"27",
            "ttid":"255200@taobao_android_9.1.0",
            "v":"6.0",
            "sid":None,
            "ad_type":"1.0",
            "t": timestamp_10d,
            "api":"mtop.taobao.detail.getdetail",
            "data":data.format(timestamp=timestamp_14d, timestamp1=timestamp_14d1, item_id=item_id, pvid=pvid, scm=scm),
            "uid":None,
        }
        hashMap2 = {
            "pageName":"com.taobao.android.detail.wrapper.activity.DetailActivity",
            "pageId":"http://item.taobao.com/item.htm",
        }
    
        return hashMap1,hashMap2
    
    def gen_list_hook_params(timestamp):
    
        data = r'{"containerParams":"{\"category_home_main\":{\"passInfo\":{\"categoryId\":\"1\",\"scm\":\"1.1.1.1\",\"spm\":\"2.2.2.2\"},\"count\":\"300\",\"pNum\":1,\"pSize\":\"20\",\"floorDataKey\":\"offline_auto_st_fenlei_gul_5\",\"categoryId\":\"5\"}}"}'
        
        hashMap1 = {
            "deviceId":"AiomvfL6hhU_hX6u80I0DM_cG952UaEtYQuomLzpl4vH",
            "appKey":"21646297",
            "utdid":"Xb6r2HfdTvsDAG4dHHurgSCI",
            "x-features":"27",
            "ttid":"255200@taobao_android_9.1.0",
            "v":"1.0",
            "sid":None,
            "t": timestamp,
            "api": "mtop.taobao.wireless.home.awesome.category",
            "data": data,
            "uid": None,
        }
        hashMap2 = {
            "pageName":"com.taobao.tao.TBMainActivity",
            "pageId":"https://g.alicdn.com/tbsearchwireless-pages/new-categories/0.0.28/pages/index/index.weex.js",
        }
    
        return hashMap1,hashMap2
    
    def gen_detail_url_params(timestamp, timestamp1, item_id, pvid, scm):
        #detail_url = "https://trade-acs.m.taobao.com/gw/mtop.taobao.detail.getdetail/6.0/?data=%7B%22detail_v%22%3A%223.3.2%22%2C%22exParams%22%3A%22%7B%5C%22NAV_START_ACTIVITY_TIME%5C%22%3A%5C%22{timestamp}%5C%22%2C%5C%22NAV_TO_URL_START_TIME%5C%22%3A%5C%22{timestamp1}%5C%22%2C%5C%22ad_type%5C%22%3A%5C%221.0%5C%22%2C%5C%22appReqFrom%5C%22%3A%5C%22detail%5C%22%2C%5C%22clientCachedTemplateKeys%5C%22%3A%5C%22%5B%7B%5C%5C%5C%22id%5C%5C%5C%22%3A%5C%5C%5C%221538383035450%5C%5C%5C%22%2C%5C%5C%5C%22version%5C%5C%5C%22%3A%5C%5C%5C%2268%5C%5C%5C%22%7D%5D%5C%22%2C%5C%22container_type%5C%22%3A%5C%22xdetail%5C%22%2C%5C%22countryCode%5C%22%3A%5C%22CN%5C%22%2C%5C%22cpuCore%5C%22%3A%5C%228%5C%22%2C%5C%22cpuMaxHz%5C%22%3A%5C%221555200%5C%22%2C%5C%22dinamic_v3%5C%22%3A%5C%22true%5C%22%2C%5C%22id%5C%22%3A%5C%22{item_id}%5C%22%2C%5C%22item_id%5C%22%3A%5C%22{item_id}%5C%22%2C%5C%22latitude%5C%22%3A%5C%220%5C%22%2C%5C%22longitude%5C%22%3A%5C%220%5C%22%2C%5C%22osVersion%5C%22%3A%5C%2223%5C%22%2C%5C%22phoneType%5C%22%3A%5C%22Nexus+6P%5C%22%2C%5C%22pvid%5C%22%3A%5C%22{pvid}%5C%22%2C%5C%22scm%5C%22%3A%5C%22{scm}%5C%22%2C%5C%22soVersion%5C%22%3A%5C%222.0%5C%22%2C%5C%22spm%5C%22%3A%5C%22a2141.1.pinlei_tab4.d3-2%5C%22%2C%5C%22spm-cnt%5C%22%3A%5C%22a2141.7631564%5C%22%2C%5C%22u_channel%5C%22%3A%5C%22ystttj%5C%22%2C%5C%22ultron2%5C%22%3A%5C%22true%5C%22%2C%5C%22umpChannel%5C%22%3A%5C%22ystttj%5C%22%2C%5C%22utdid%5C%22%3A%5C%22Xb6r2HfdTvsDAG4dHHurgSCI%5C%22%2C%5C%22wx_options%5C%22%3A%5C%22%7Banimated%3Dtrue%2C+url%3Dhttps%3A%2F%2Fitem.taobao.com%2Fitem.htm%3Fid%3D{item_id}%26pvid%3D{pvid}%26scm%3D{scm}%26spm%3Da2141.1.pinlei_tab4.d3-2%26u_channel%3Dystttj%26umpChannel%3Dystttj%26utparam%3D%257B%2522home_buckets%2522%253A%2522%2522%252C%2522home_industry_id%2522%253A%25225%2522%252C%2522item_type%2522%253A%2522tttm%2522%252C%2522item_id%2522%253A%2522{item_id}%2522%257D%7D%5C%22%7D%22%2C%22itemNumId%22%3A%22{item_id}%22%7D"
        detail_url = "https://trade-acs.m.taobao.com/gw/mtop.taobao.detail.getdetail/6.0/?data=%7B%22detail_v%22%3A%223.3.2%22%2C%22exParams%22%3A%22%7B%5C%22NAV_START_ACTIVITY_TIME%5C%22%3A%5C%22{timestamp}%5C%22%2C%5C%22NAV_TO_URL_START_TIME%5C%22%3A%5C%22{timestamp1}%5C%22%2C%5C%22ad_type%5C%22%3A%5C%221.0%5C%22%2C%5C%22appReqFrom%5C%22%3A%5C%22detail%5C%22%2C%5C%22clientCachedTemplateKeys%5C%22%3A%5C%22%5B%7B%5C%5C%5C%22id%5C%5C%5C%22%3A%5C%5C%5C%221538383035450%5C%5C%5C%22%2C%5C%5C%5C%22version%5C%5C%5C%22%3A%5C%5C%5C%2268%5C%5C%5C%22%7D%5D%5C%22%2C%5C%22container_type%5C%22%3A%5C%22xdetail%5C%22%2C%5C%22countryCode%5C%22%3A%5C%22CN%5C%22%2C%5C%22cpuCore%5C%22%3A%5C%228%5C%22%2C%5C%22cpuMaxHz%5C%22%3A%5C%221555200%5C%22%2C%5C%22dinamic_v3%5C%22%3A%5C%22true%5C%22%2C%5C%22id%5C%22%3A%5C%22{item_id}%5C%22%2C%5C%22item_id%5C%22%3A%5C%22{item_id}%5C%22%2C%5C%22latitude%5C%22%3A%5C%220%5C%22%2C%5C%22longitude%5C%22%3A%5C%220%5C%22%2C%5C%22osVersion%5C%22%3A%5C%2223%5C%22%2C%5C%22phoneType%5C%22%3A%5C%22Nexus+6P%5C%22%2C%5C%22pvid%5C%22%3A%5C%22{pvid}%5C%22%2C%5C%22scm%5C%22%3A%5C%22{scm}%5C%22%2C%5C%22soVersion%5C%22%3A%5C%222.0%5C%22%2C%5C%22spm%5C%22%3A%5C%22a2141.1.pinlei_tab4.d4-0%5C%22%2C%5C%22spm-cnt%5C%22%3A%5C%22a2141.7631564%5C%22%2C%5C%22ultron2%5C%22%3A%5C%22true%5C%22%2C%5C%22utdid%5C%22%3A%5C%22Xb6r2HfdTvsDAG4dHHurgSCI%5C%22%2C%5C%22wx_options%5C%22%3A%5C%22%7Banimated%3Dtrue%2C+url%3D%2F%2Fitem.taobao.com%2Fitem.htm%3Fid%3D{item_id}%26pvid%3D{pvid}%26scm%3D{scm}%26spm%3Da2141.1.pinlei_tab4.d4-0%26utparam%3D%257B%2522x_hestia_source%2522%253A%2522st_fenlei_gul%2522%252C%2522x_object_type%2522%253A%2522item%2522%252C%2522x_mt%2522%253A%25228%2522%252C%2522x_src%2522%253A%2522st_fenlei_gul%2522%252C%2522x_pos%2522%253A%25221%2522%252C%2522x_pvid%2522%253A%2522{pvid}%2522%252C%2522x_object_id%2522%253A%2522{item_id}%2522%252C%2522home_buckets%2522%253A%2522%2522%252C%2522home_industry_id%2522%253A%25225%2522%252C%2522item_type%2522%253A%2522normal%2522%252C%2522item_id%2522%253A%2522{item_id}%2522%257D%7D%5C%22%7D%22%2C%22itemNumId%22%3A%22{item_id}%22%7D"
        return detail_url.format(timestamp=timestamp, timestamp1=timestamp1, item_id=item_id, pvid=pvid, scm=scm)
    
    #'com.taobao.android.detail.wrapper.activity.DetailActivity'
    #'trade-acs.m.taobao.com'
    #https%3A%2F%2Fg.alicdn.com%2Ftbsearchwireless-pages%2Fnew-categories%2F0.0.28%2Fpages%2Findex%2Findex.weex.js
    #'http%3A%2F%2Fitem.taobao.com%2Fitem.htm'
    def gen_req_headers(list_req, timestamp, page_name, host, x_page_url, x_sign, x_mini_wua, x_umt):
        header = {
        'x-features': '1051' if list_req else '27',
        'x-sgext': '923',
        'c-launch-info': '3,0,1575429485394,1575341916000,3',
        'x-page-name': page_name,
        'user-agent': 'MTOPSDK%2F3.1.1.7+%28Android%3B6.0%3BHuawei%3BNexus+6P%29',
        'x-ttid': '255200%40taobao_android_9.1.0',
        'cache-control': 'no-cache',
        'a-orange-q': 'appKey=21646297&appVersion=9.1.0&clientAppIndexVersion=1120191204110702376&clientVersionIndexVersion=0',
        'x-region-channel': 'CN',
        'x-appkey': '21646297',
        'x-nq': 'WIFI',
        'x-mini-wua': x_mini_wua,
        'x-c-traceid': 'Xb6r2HfdTvsDAG4dHHurgSCI1575429485394009919033',
        'A-SLIDER-Q': 'appKey%3D21646297%26ver%3D1575426197715',
        'x-app-conf-v': '19',
        'content-type': 'application/x-www-form-urlencoded;charset=UTF-8',
        'x-bx-version': '6.4.11',
        'x-pv': '6.3',
        'x-t': timestamp,
        'x-app-ver': '9.1.0',
        'f-refer': 'mtop',
        'x-ua': 'Nexus+6P%28Android%2F6.0%29+AliApp%28TB%2F9.1.0%29+Weex%2F0.26.4.15+1440x2392',
        #'Cookie': 't=17154d275dc85be4211c86b37f640561; enc=QYB1iTwtqPin2bSnyWqDI7%2FOvTPMrYoUFjOVBN2%2BxAZZZdE8OMzoULlbNykVVIxKksD4IHCrOGMQcTTb%2FznHMw%3D%3D; isg=AkNDthP_Gkw_ltYB0BOaZueU2QXtuNf6HEwzh3Ugn6IZNGNW_YhnSiGk3P6F; cna=GXdmFhh40jsCAd9X5cLXg6KU',
        'x-nettype': 'WIFI',
        'x-utdid': 'Xb6r2HfdTvsDAG4dHHurgSCI',
        'x-umt': x_umt,
        'x-devid': 'AiomvfL6hhU_hX6u80I0DM_cG952UaEtYQuomLzpl4vH',
        'x-sign': x_sign,
        'x-page-url': x_page_url,
        'Host': host,
        'Accept-Encoding': 'gzip',
        'Connection': 'Keep-Alive'
        }
        return header
    
    def start():
        #注入Hook代码
        script = test_hook_td.hook_prepare()
    
        timestamp_w = time.time()
        timestamp_10d = str(int(timestamp_w))
        #鞋靴
        #list_url = 'https://guide-acs.m.taobao.com/gw/mtop.taobao.wireless.home.awesome.category/1.0/?data=%7B%22containerParams%22%3A%22%7B%5C%22category_home_main%5C%22%3A%7B%5C%22passInfo%5C%22%3A%7B%5C%22categoryId%5C%22%3A%5C%221%5C%22%2C%5C%22scm%5C%22%3A%5C%221.1.1.1%5C%22%2C%5C%22spm%5C%22%3A%5C%222.2.2.2%5C%22%7D%2C%5C%22count%5C%22%3A%5C%22300%5C%22%2C%5C%22pNum%5C%22%3A0%2C%5C%22pSize%5C%22%3A%5C%2220%5C%22%2C%5C%22floorDataKey%5C%22%3A%5C%22offline_auto_st_fenlei_gul_5%5C%22%2C%5C%22categoryId%5C%22%3A%5C%225%5C%22%7D%7D%22%7D'
        list_url = 'https://guide-acs.m.taobao.com/gw/mtop.taobao.wireless.home.awesome.category/1.0/?data=%7B%22containerParams%22%3A%22%7B%5C%22category_home_main%5C%22%3A%7B%5C%22passInfo%5C%22%3A%7B%5C%22categoryId%5C%22%3A%5C%221%5C%22%2C%5C%22scm%5C%22%3A%5C%221.1.1.1%5C%22%2C%5C%22spm%5C%22%3A%5C%222.2.2.2%5C%22%7D%2C%5C%22count%5C%22%3A%5C%22300%5C%22%2C%5C%22pNum%5C%22%3A1%2C%5C%22pSize%5C%22%3A%5C%2220%5C%22%2C%5C%22floorDataKey%5C%22%3A%5C%22offline_auto_st_fenlei_gul_5%5C%22%2C%5C%22categoryId%5C%22%3A%5C%225%5C%22%7D%7D%22%7D'
        #生成hook 列表页需要的参数
        hashmap1,hashmap2 = gen_list_hook_params(timestamp_10d)
    
        #执行Hook 获得x-sign等参数
        args_map = script.exports.getsig(timestamp_10d, hashmap1, hashmap2)
        args_map = json.loads(args_map)
        #生成请求列表页需要的header
        req_headers = gen_req_headers(True, timestamp_10d, "com.taobao.tao.TBMainActivity", "guide-acs.m.taobao.com", "https%3A%2F%2Fg.alicdn.com%2Ftbsearchwireless-pages%2Fnew-categories%2F0.0.28%2Fpages%2Findex%2Findex.weex.js", quote(args_map["x_sign"]), quote(args_map["x_mini_wua"]), quote(args_map["x_umt"]))
        
        #请求列表页
        list_page_source = req(list_url, req_headers)
        data_lists = json.loads(list_page_source)
        print(list_page_source)
        listItems = data_lists['data']['containers']['base']['category_home_main']['sections'][0]['categoryData']['listItems']
        for i in listItems:
            timestamp_w = time.time()
            timestamp_10d = str(int(timestamp_w))
            timestamp_des = int(str(timestamp_w)[:14].replace('.',''))
            timestamp_14d = str(timestamp_des)
            timestamp_14d1 = str(timestamp_des-100)
    
            #生成hook 详细页页需要的参数
            hashmap1,hashmap2 = gen_detail_hook_params(timestamp_10d, timestamp_14d, timestamp_14d1, i['itemId'], i['pvid'], i['scm'])
    
            #执行Hook 获得x-sign等参数
            args_map = script.exports.getsig(timestamp_10d, hashmap1, hashmap2)
            args_map = json.loads(args_map)
    
            print(args_map)
            print(str(args_map['x_sign']))
            #生成请求详情页需要的header
            req_headers = gen_req_headers(False, timestamp_10d, "com.taobao.android.detail.wrapper.activity.DetailActivity", "trade-acs.m.taobao.com", "http%3A%2F%2Fitem.taobao.com%2Fitem.htm", quote(args_map["x_sign"]).replace('/','%2F'), quote(args_map["x_mini_wua"]).replace('/','%2F'), quote(args_map["x_umt"]).replace('/','%2F'))
        
            #生成商品详情页URL
            detail_url = gen_detail_url_params(timestamp_14d, timestamp_14d1, i['itemId'], i['pvid'], i['scm'])
    
            #请求商品详细页
            detail_page_source = req(detail_url, req_headers)
            #print(detail_page_source)
            data_details = json.loads(detail_page_source)
            print('商品名:', data_details['data']['item']['title'])
            print('评论数:', data_details['data']['item']['commentCount'])
    start()

美\*\*\*\*团 9.15.6

import frida,sys
    import time
    
    
    test_hook = '''
    Java.perform(
        function(){
            send('gggg')
            /*var e = Java.use('com.dianping.nvnetwork.tunnel.Encrypt.e')
            e.a.overload('java.lang.String').implementation = function(str){
                send('a string')
                //printstack()
                return this.a(str)
            }
            e.a.overload().implementation = function(){
                send('a none')
                //printstack()
                return this.a()
            }
            e.a.overload('com.dianping.nvnetwork.tunnel.Encrypt.e').implementation = function(p1){
                send('a e')
                //printstack()
                return this.a(p1)
            }
            e.a.overload('com.dianping.nvnetwork.tunnel.Encrypt.e$b').implementation = function(p1){
                send('e$b')
                //printstack()
                return this.a(p1)
            }
            e.a.overload('int', 'com.dianping.nvnetwork.tunnel.Encrypt.SocketSecureCell', 'com.dianping.nvnetwork.tunnel.Encrypt.SecureProtocolData').implementation = function(p1,p2,p3){
                send('a int SocketSecureCell SecureProtocolData')
                //printstack()
                return this.a(p1,p2,p3)
            }
            e.a.overload('com.dianping.nvnetwork.tunnel.Encrypt.SocketSecureCell', 'java.lang.String', 'int').implementation = function(p1,p2,p3){
                send('a SocketSecureCell string int')
                //printstack()
                return this.a(p1,p2,p3)
            }
            e.a.overload('com.dianping.nvnetwork.tunnel.Encrypt.c', 'com.dianping.nvnetwork.tunnel.Encrypt.d').implementation = function(p1,p2){
                send('a c d')
                //printstack()
                return this.a(p1,p2)
            }
            e.a.overload('com.dianping.nvnetwork.tunnel.Encrypt.e', 'com.dianping.nvnetwork.tunnel.Encrypt.e$a').implementation = function(p1,p2){
                send('a e e$a')
                //printstack()
                return this.a(p1,p2)
            }
            e.a.overload('com.dianping.nvnetwork.tunnel.Encrypt.SocketSecureCell', 'com.dianping.nvnetwork.tunnel.Encrypt.SecureProtocolData').implementation = function(p1,p2){
                send('a SocketSecureCell SecureProtocolData')
                //printstack()
                return this.a(p1,p2)
            }
            e.a.overload('com.dianping.nvnetwork.tunnel.Encrypt.e', 'boolean').implementation = function(p1,p2){
                send('a e boolean')
                //printstack()
                return this.a(p1,p2)
            }
            e.a.overload('boolean').implementation = function(p1){
                send('a boolean')
                //printstack()
                return this.a(p1)
            }
            e.a.overload('int', 'com.dianping.nvnetwork.tunnel.Encrypt.SocketSecureCell', 'java.lang.String', 'java.lang.String').implementation = function(p1,p2,p3,p4){
                send('a int SocketSecureCell str str')
                //printstack()
                return this.a(p1,p2,p3,p4)
            }
            
            e.d.implementation = function(){
                send('e.d')
                //printstack()
                return this.d()
            }*/
    
            var SocketSecureManager = Java.use('com.dianping.nvnetwork.tunnel.Encrypt.SocketSecureManager')
            SocketSecureManager.getEncriptData.implementation = function(p1){
                send('getEncriptData')
                //printstack()
                var ret = this.getEncriptData(p1)
                //send(ret.a)
                return ret
            }
            SocketSecureManager.encryptData.implementation = function(p1,p2){
                //send(p1)
                //send(p2)
                //printstack()
                var ret = this.encryptData(p1,p2)
                //send(ret.a)
                return ret
            }
            SocketSecureManager.decryptData.implementation = function(p1,p2){
                send('decryptData')
                //send(p1)
                //send(p2)
                //printstack()
                var ret = this.decryptData(p1,p2)
                //send(ret)
                //bytearr2string(ret)
                return ret
            }
    
            /*var tunnel2a = Java.use('com.dianping.nvnetwork.tunnel2.a')
            tunnel2a.isSocketConnected.implementation = function(){
                return false
            }*/
    
            /*var CandyJni = Java.use('com.meituan.android.common.candy.CandyJni')
            CandyJni.getCandyDataWithKeyForJava.implementation = function(p1,p2,p3){
                //send('p2 str')
                
                var res = bytearr2string(p2)
    
                if(-1 != res.search('/v7/')){
                    send('p2:'+res)
                    //printstack()
                }
                send('p3:'+p3)
                var ret = this.getCandyDataWithKeyForJava(p1,p2,p3)
                send('ret:'+ret)
                return ret
            }*/
        }
    )
    
    function printstack() {
        send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    }
    
    function bytearr2string(ret){
        var buffer = Java.array('byte', ret);
        //console.log(buffer.length);
        var result = "";
        for(var i = 0; i < buffer.length; ++i){
            result+= (String.fromCharCode(buffer[i]));
        }
        return result
        //send(result);
    }
    
    '''
    
    test_scipt = '''
    //遍历已加载的类
    Java.perform(
        function () {
            Java.enumerateLoadedClasses({
                onMatch: function (className) {
                    if (-1 != className.search('.nvnetwork.tunnel.Encrypt')){
                        //send('class name:'+className)
                        traceClass(className);
                    }
                },
                onComplete: function () {
                }
            });
            send('done')
    });
    
    //Hook指定类里的所有方法
    function traceClass(classname) {
        try {
            //Hook住指定的类
            var target = Java.use(classname);
    
            //调用getDeclaredMethods方法获得该类的所有方法的声明
            var methods = target.class.getDeclaredMethods();
    
            //遍历所有方法的声明，拿到方法名和方法的重载名
            methods.forEach(function (method) {
                //得到方法名
                var methodName = method.getName();
    
                //得到方法的所有重载
                var overloads = target[methodName].overloads;
    
                //遍历该方法的所有重载，组装overload()里的参数
                overloads.forEach(function (overload) {
                    var proto = "(";
                    overload.argumentTypes.forEach(function (type) {
                        proto += type.className + ", ";
                    });
                    if (proto.length > 1) {
                        proto = proto.substr(0, proto.length - 2);
                    }
                    proto += ")";
                    //send("hooking: " + classname + "." + methodName + proto);
    
                    //组装overload完成， 开始Hook该方法
                    overload.implementation = function () {
                        send(classname+'.'+methodName+proto)
                        printstack()
                        var args = [];
                        //var tid = getTid();
                        //var tName = getTName();
                        for (var j = 0; j < arguments.length; j++) {
                            args[j] = arguments[j] + ""
                        }
                        //enter(tid, tName, classname, methodName + proto, args);
                        var retval = this[methodName].apply(this, arguments);
                        //exit(tid, "" + retval);
                        return retval;
                    }
                });
            });
        } catch (e) {
            send("'" + classname + "' hook fail: " + e)
        }
    }
    
    
    function printstack() {
        send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    }
    '''
    
    test_rpc = '''
    rpc.exports = {
        getsig:function(bArr_str, str){
            var skcy=''
            Java.perform(function(){
                send('enter')
                var CandyJni = Java.use('com.meituan.android.common.candy.CandyJni')
    
                var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
                var context = currentApplication.getApplicationContext();
                
                send('jack:'+bArr_str)
                var JString = Java.use('java.lang.String')
                bArr_str = JString.$new(bArr_str)
                skcy = CandyJni.getCandyDataWithKeyForJava(context, bArr_str.getBytes(), str)
                send('tom')
                send(skcy)
            })
            return skcy
        }
    }
    '''
    
    
    test_mt='''
    Java.perform(
        function(){
            var SocketSecureManager = Java.use('com.dianping.nvnetwork.tunnel.Encrypt.SocketSecureManager')
            SocketSecureManager.getEncriptData.implementation = function(p1){
                //send('enter getEncriptData')
                //printstack()
                return this.getEncriptData(p1)
            },
            SocketSecureManager.decryptData.implementation = function(p1,p2){
                //send('enter decriptData')
                //printstack()
                return this.decryptData(p1,p2)
            }
    
            var tunnel2a = Java.use('com.dianping.nvnetwork.tunnel2.a')
            tunnel2a.isSocketConnected.implementation = function(){
                //send('enter isSocketConnected')
                //printstack()
                return false
            }
            var CandyJni = Java.use('com.meituan.android.common.candy.CandyJni')
            CandyJni.getCandyDataWithKeyForJava.implementation = function(p1,p2,p3){
                send('enter getCandyDataWithKeyForJava')
                //printstack()
                send("p2:"+p2)
                var ori = bytearr2string(p2)
                send(ori)
                send("p3:"+p3)
                var ret = this.getCandyDataWithKeyForJava(p1,p2,p3)
                send('ret:'+ret)
                return ret
            }
    })
    
    function printstack() {
        send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    }
    function bytearr2string(ret){
        var buffer = Java.array('byte', ret);
        //console.log(buffer.length);
        var result = "";
        for(var i = 0; i < buffer.length; ++i){
            result+= (String.fromCharCode(buffer[i]));
        }
        return result
        //send(result);
    }
    '''
    
    
    test_sky = '''
    rpc.exports = {
        getsig:function(bArr, str){
            var skcy = ''
            Java.perform(function(){
                var CandyJni = Java.use('com.meituan.android.common.candy.CandyJni')
    
                var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
                var context = currentApplication.getApplicationContext();
    
                var JString = Java.use('java.lang.String')
                var bArr_str = JString.$new(bArr)
                skcy = CandyJni.getCandyDataWithKeyForJava(context, bArr_str.getBytes(), str)
            })
            return skcy
        }
    }
    '''
    
    
    def on_message(message, data):
        if message['type'] == 'send':
            print("[*] {0}".format(message['payload']))
        else:
            print(message)
    
    
    def test():
        process = frida.get_usb_device().attach('com.sankuai.meituan')
        script = process.create_script(test_mt)
        script.on('message', on_message)
        script.load()
    
    
        #device = frida.get_usb_device()
        #pid = device.spawn(['com.sankuai.meituan'])
        #device.resume(pid)
        #process = device.attach(pid)
        #script = process.create_script(test_scipt)
        #script.on('message', on_message)
        #script.load()
    
        #print('hook_prepare is ok')
    
        #ts = str(int(time.time()))
        #script.exports.getsig(ts)
    
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
        #script.exports.getsig(ts)
    
        sys.stdin.read()
    
    def hook_prepare():
        process = frida.get_usb_device().attach('com.sankuai.meituan')
        script = process.create_script(test_sky)
        script.on('message', on_message)
        script.load()
        print('hook_prepare is ok')
        return script
    
    #hook_prepare()
    if __name__ == "__main__":
        test()

mt\_crawl.py：

import uuid
    import test_hoo
    import time
    from urllib.parse import quote
    import requests
    import json
    
    def gen_url(reqTraceID,skno,skts,msid,skcy,offset):
        url = '''https://apimeishi.meituan.com/meishi/filter/v7/deal/select?metrics_start_time=607803921\
    &isLocal=1\
    &wifi-name=jiangzhang%08\
    &wifi-cur=0\
    &offset={offset}\
    &hasGroup=true\
    &mypos=30.599354977467076%2C104.14483428665712\
    &wifi-mac=0c%3A82%3A68%3A29%3A55%3A58%08\
    &ci=59\
    &sort=defaults\
    &cityId=59\
    &wifi-strength=-68%08\
    &cateId=1\
    &partner=126\
    &uuid=D4DA6194FF66C5FC03E695C88D21068A10000A00DB8A7E7165BC4FA5B81DC2DB\
    &platform=4\
    &version=9.15.601\
    &app=0\
    &utm_source=zhuoyishichang\
    &utm_medium=android\
    &utm_term=900150601\
    &version_name=9.15.601\
    &utm_content=867686022802852\
    &utm_campaign=AgroupBgroupC0E0Ghomepage_category1_1__a1__c-1024__gfood\
    &msid={msid}\
    &lat=30.599354977467076\
    &lng=104.14483428665712\
    &userid=-1\
    &__reqTraceID={reqTraceID}\
    &__skck=8f5973b085446090f224af74e30e0181\
    &__skts={skts}\
    &__skua=9599ecbaad12eaa38fd585aa839739cb\
    &__skno={skno}\
    &__skcy={skcy}'''
    
        return url.format(reqTraceID=reqTraceID, skno=skno, skts=skts, msid=msid,skcy=skcy,offset=offset)
    
    def gen_skcy_url(reqTraceID,skno,skts,msid):
        skcy_url = '''
    GET https://apimeishi.meituan.com/meishi/filter/v7/deal/select?__reqTraceID={reqTraceID}\
    &__skck=8f5973b085446090f224af74e30e0181\
    &__skno={skno}\
    &__sksc=https\
    &__skts={skts}\
    &__skua=9599ecbaad12eaa38fd585aa839739cb\
    &app=0\
    &cateId=1\
    &ci=59\
    &cityId=59\
    &hasGroup=true\
    &isLocal=1\
    &lat=30.599354977467076\
    &lng=104.14483428665712\
    &metrics_start_time=548722848\
    &msid={msid}\
    &mypos=30.599354977467076%2C104.14483428665712\
    &offset=0\
    &partner=126\
    &platform=4\
    &sort=defaults\
    &userid=-1\
    &utm_campaign=AgroupBgroupC0E0Ghomepage_category1_1__a1__c-1024\
    &utm_content=867686022802852\
    &utm_medium=android\
    &utm_source=zhuoyishichang\
    &utm_term=900150601\
    &uuid=D4DA6194FF66C5FC03E695C88D21068A10000A00DB8A7E7165BC4FA5B81DC2DB\
    &version=9.15.601\
    &version_name=9.15.601\
    &wifi-cur=0\
    &wifi-mac=0c%3A82%3A68%3A29%3A55%3A58%08\
    &wifi-name=jiangzhang%08\
    &wifi-strength=-64%08'''
    
        return skcy_url.format(reqTraceID=reqTraceID, skno=skno, skts=skts, msid=msid)
    
    def gen_header():
        header = {
        'siua': 'nj0Db90b84gua8h3KXjYV/DlUeoY+b9rnEed6T37roCTNcT5CaKAAketodl4nSBQjxVBbMj/IAF+SxTUfP+X8suPcuvxz/Y1bik4cEs85Qpi+kuTVQMSEbUFcnOPbtnztu85twry1pTeCds9PVolPd9KZSuuWlnZB+rFTbwvtm5UpoCw3T2kfgUPbwP/VQJp2fxeecpyYKNTGz0URT3hKWk8nOsjZN+OB7BC97gW6L+JyHnK9LALxhdC5oQVvO2CUy0PoP7bcSoThZAOcYLKSGs4aZPmh/Cn1ZKk+Qy/yRQ5Ctwgw89ILKJsFYRq8ez4Azd6poO740fjhWCkhTCCdCa+4Dr5Y8UdSMcmoG53P9gI9+1hiRBHleweL3lxQbY3MJx2c5s5i5h8q9jAsv6plN9KW0TwGSWmXBmLAo367yeBWDtE4YUa7ccPnQcOE/9CIc/5mvAhrHuzA+4lFtfyTFhZUpBuKwb5C8nXdPPDvj22AXcPNT27MWSeXKxLYe2K0616b8tGzk0jt5CB/EE+BA3t69Mxtv16OCR9HsDbT7nltaJWh9sRx/9aPOi02cR3Olr1fj8h6waeH9/Za5p+cdXmcw9JlxBO/KjtVdcQ38k=',
    'request-belong': 'com.meituan.android.food.homepage.FoodHomePageActivity',
    'pragma-mtid': '867686022802852',
    'pragma-os': 'MApi 1.1 com.sankuai.meituan 9.15.601 zhuoyishichang Nexus_6P; Android 6.0',
    'M-SHARK-TRACEID': '101D4DA6194FF66C5FC03E695C88D21068A10000A00DB8A7E7165BC4FA5B81DC2DB6e0d351576222996409af93b2',
    'mtgdid': 'AAAAAAAAAAAAAMPAgcNckyk9eEv7hqgDBF1A7TgUtiXNN6idMLO0JuewxMRO4ALtT3ZOVb8LtXHJg78Adp9wEyiupkrT7NrAxeU',
    'User-Agent': 'AiMeiTuan /google-6.0-Nexus 6P-2392x1440-560-9.15.601-900150601-867686022802852-zhuoyishichang',
    'userid': '-1',
    'Accept-Encoding': 'gzip',
    'Host': 'apimeishi.meituan.com',
    'Connection': 'Keep-Alive'}
    
    def req(url, header):
        r = requests.get(url=url, headers=header, verify=False)
        print(r.status_code)
        return r.text
    
    def start():
        script = test_hoo.hook_prepare()
    
        for i in range(5):
            reqTraceID=uuid.uuid4()
            skno=uuid.uuid4()
            skts=int(time.time())
            msid='867686022802852'+str(int(time.time()*1000))
    
            skcy_url = gen_skcy_url(reqTraceID,skno,skts,msid)
    
            skcy = script.exports.getsig(skcy_url, 'CandyKey')
    
            url = gen_url(reqTraceID, skno, skts, msid, quote(skcy,safe=''), str(i*25))
            header = gen_header()
            text = req(url, header)
    
            #with open('list.txt','w') as f:
            #    f.write(text)
        
            snip = json.loads(text)
            poiInfos = snip['data']['poiList']['poiInfos']
            for i in poiInfos:
                print(i['name']+'/'+i['poiid']+'/'+str(i['avgPrice'])+'/'+i['rotationTags'][0]['text']['content'])
    
    
    start()
    
    
    
    #skcy_url = skcy_url.format(reqTraceID=uuid.uuid4(), skno=uuid.uuid4(), skts=int(time.time()), msid='867686022802852'+str(int(time.time()*1000)))
    #print(skcy_url)
    #script = test_hoo.hook_prepare()
    
    #script.exports.getsig(skcy_url, 'CandyKey')

hook 签名校验，定位签名校验位置、然后修改 smali过签名校验

import frida, sys
    
    
    def on_message(message, data):
        if message['type'] == 'send':
            print("[*] {0}".format(message['payload']))
        else:
            print(message)
    
    
    test_sig = '''
    
    Java.perform(
        
        function(){
            var Signature = Java.use('android.content.pm.Signature')
            Signature.hashCode.implementation = function() {
                console.log('hashCode')
                return this.hashCode()
            }
    
            Signature.toByteArray.implementation = function() {
                console.log('toByteArray')
                printstack()
                return this.toByteArray()
            }
    
            function printstack() {
                console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
            }
    
            var AA = Java.use('com.chaozhuo.texteditor.widget.a')
            AA.a.overload('android.content.Context').implementation = function() {
                return true
                //this.a()
            }
        }
    )
    
    '''
    
    
    test_context = '''
    Java.perform(
        function(){
            var currentApplication = Java.use('android.app.ActivityThread').currentApplication()
            var context = currentApplication.getApplicationContext()
    
            console.log(context.getPackageName())
    
            console.log(context.getPackageManager().getPackageInfo(context.getPackageName(), 64).signatures.value[0].toByteArray())
    
            send(context.getPackageManager().getPackageInfo(context.getPackageName(), 64).signatures.value[0].toByteArray())
    
            console.log(context.getPackageManager().getPackageInfo(context.getPackageName(), 64).signatures.value[0].hashCode())
        }
    )
    '''
    
    
    #两种启动方式
    
    #启动方式1
    
    
    # process = frida.get_usb_device(-1).attach('com.chaozhuo.texteditor')
    # script = process.create_script(test_context)
    # script.on('message', on_message)
    # script.load()
    # sys.stdin.read()
    
    
    #启动方式2 spawn 重启APP 可以hook APP启动阶段
    device = frida.get_usb_device(-1)
    pid = device.spawn(['com.chaozhuo.texteditor'])
    process = device.attach(pid)
    
    script = process.create_script(test_context)
    script.on('message', on_message)
    print('[*] Running')
    script.load()
    device.resume(pid)
    sys.stdin.read()

## 通过 wifi 连接，然后用 adb 实现群控 ##

import frida
    import os
    import time
    
    app = "com.xxx.xxx";
    
    device_ids = [];
    devices = frida.enumerate_devices();
    for device in devices :
        # print(device)
        ## 枚举所有通过wifiadb 连的机器
        if device.id.find(":") > 0:
            #print(device.id)
            device_ids.append(device.id.replace("5555", "9999"))
    
    for id in device_ids :
        print(id)
        device = frida.get_device_manager().add_remote_device(id)
        print(device)
        pid = device.spawn([app])
        print(pid)
        device.resume(pid)
        time.sleep(1)
        session = device.attach(pid)
        with open("load_hook.js") as f:
            script = session.create_script(f.read())
            script.load()
    input()
    常用命令

## 使用群控软件进行群控 ##

掘金网安卓群控系统：[安卓群控系统 - 手机群控系统][-]

## sekiro全家桶(sekiro 群控不迷路) ##

：[langgithub · GitHub][langgithub _ GitHub]

>  *  sekiro-ios [GitHub - langgithub/SekiroIOS: SekiroIOS是IOS终端和Sekiro即时通讯的网络工具，主要用于IOS加解密和群控方向][GitHub - langgithub_SekiroIOS_ SekiroIOS_IOS_Sekiro_IOS]
>  *  sekiro-Android [GitHub - langgithub/sekiro-lang: sekiro原理学习 sekiro全家桶 sekiroIOS sekiroAndroid sekiroPython sekiroXposed sekiroFrida sekiroUnidbg][GitHub - langgithub_sekiro-lang_ sekiro_ sekiro_ sekiroIOS sekiroAndroid sekiroPython sekiroXposed sekiroFrida sekiroUnidbg]
>  *  sekiro-python [GitHub - langgithub/SekiroPython: sekiropython属于sekiro全家桶结合frida rpc使用，摆脱frida usb链接][GitHub - langgithub_SekiroPython_ sekiropython_sekiro_frida rpc_frida usb]
>  *  sekiro-java [GitHub - langgithub/unidbg-lang][GitHub - langgithub_unidbg-lang]
>  *  sekiro-unidbg [GitHub - langgithub/unidbg-lang][GitHub - langgithub_unidbg-lang]
>  *  sekiro-frida [GitHub - langgithub/FridaInject][GitHub - langgithub_FridaInject]
>  *  sekiro-xposed [GitHub - langgithub/hello: 老忘记xposed项目demo][GitHub - langgithub_hello_ _xposed_demo]
>  *  sekiro-chrome [frida\_app\_hook/baoxianshi.html at master · langgithub/frida\_app\_hook · GitHub][frida_app_hook_baoxianshi.html at master _ langgithub_frida_app_hook _ GitHub]

## 开源群控软件（ 推荐 ） ##

**QtScrcpy：[GitHub - barry-ran/QtScrcpy: Android real-time display control software][GitHub - barry-ran_QtScrcpy_ Android real-time display control software]**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70][]

可以根据 github 上源码，编译 linux 版本。。。

网上编译好的 Linux 版本：安卓手机投屏软件 Qtscrcpy For Linux V1.3.1 最新免费版：[https://www.jb51.net/softs/747562.html][https_www.jb51.net_softs_747562.html]

## 常用命令 ##

*  frida-ps -U         列出正在运行的进程
 *  frida-ps -Uai       列出安装的程序
 *  frida-ps -Ua        列出运行中的程序（查看包名很方便）
 *  frida-ps -D 设备id  连接frida到一个指定的设备上
 *  另外还有四个分别是： frida-trace, frida-discover, frida-ls-devices, frida-kill

## objection 使用 ##

Frida 只是提供了各种 API 供我们调用，在此基础之上可以实现具体的功能，比如禁用证书绑定之类的脚本，就是使用 Frida 的各种 API 来组合编写而成。于是有大佬将各种常见、常用的功能整合进一个工具，供我们直接在命令行中使用，这个工具便是 objection。

> 安装：**pip3 install objection**

连接 app

*  objection -g 包名 explore

Memory 指令

*  memory list modules  // 查看内存中加载的库
 *  memory list exports libssl.so  // 查看库的导出函数
 *  memory list exports libart.so --json /root/libart.json //将结果保存到json文件中
 *  memory search --string --offsets-only //搜索内存
 *  memory search "64 65 78 0a 30 35 00"

root

*  android root disable   // 尝试关闭app的root检测
 *  android root simulate  // 尝试模拟root环境

activities

*  android hooking list activities // 可以列出app具有的所有avtivity

内存漫游

//列出内存中所有的类
    android hooking list classes
    
    //在内存中所有已加载的类中搜索包含特定关键词的类
    android hooking search classes [search_name]
    
    //在内存中所有已加载的方法中搜索包含特定关键词的方法
    android hooking search methods [search_name]
    
    //直接生成hook代码
    android hooking generate simple [class_name]
    
    // 查看类的全部广法
    android hooking list class_methods [class_name]

hook 方式。hook指定方法，如果有重载会 hook 所有重载。

*  \--dump-args : 打印参数
 *  \--dump-backtrace : 打印调用栈
 *  \--dump-return : 打印返回值

// 查看方法的参数、返回值和调用栈
    android hooking watch class_method com.xxx.xxx.methodName --dump-args --dump-backtrace --dump-return
    
    //获取全部tostring的返回来值
    android hooking watch class_method java.lang.StringBuilder.toString --dump-return
    
    //弹窗
    android hooking watch class_method android.app.Dialog.show --dump-args --dump-backtrace --dump-return
    
    //hook指定类, 会打印该类下的所有调用 
    android hooking watch class com.xxx.xxx
    
    //设置返回值(只支持bool类型) 
    android hooking set return_value com.xxx.xxx.methodName false

**关闭 app 的 ssl 校验**：**android sslpinning disable**

**Spawn 方式 Hook （ app 启动之前就 hook ）**

从Objection 的使用操作中我们可以发现，Obejction 采用 Attach 附加模式进行 Hook，这可能会让我们错过较早的 Hook 时机，可以通过如下的代码启动 Objection，引号中的 objection 命令会在启动时就注入App。命令：**objection -g packageName explore --startup-command 'android hooking watch xxx'**

## ARIDA （ 管理PRC脚本，自动生成 http 接口的工具 ） ##

### 1. 安装 ###

下载：git clone git@github.com:lateautumn4lin/arida.git

**使用 conda 安装**

conda create -n arida python==3.8
    conda install --yes --file requirements.txt

**使用 pip 安装**

virtualenv venv
    source venv/bin/activate
    
    // 下载 pip 安装格式的 requirements.txt 
    //  https://github.com/Boris-code/arida/blob/master/requirements.txt
    
    pip install -r requirements.txt

### 2. 运行 ###

uvicorn main:app --reload
    
    watch 127.0.0.1:8000/docs

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 1][]

### 3. 开发 ###

Config文件中写入自己的App信息

apps 目录写开发相应的Frida-Js脚本，可参考其他两个文件

## 参考：( objection、Firda API、ARIDA ) ##

Objection 的安装和简单使用：[Objection的安装和简单使用 - 乔瑞 - 博客园][Objection_ - _ -]  
Firda API 示例：[掘金][Link 1]  
ARIDA：[https://github.com/lateautumn4lin/arida][https_github.com_lateautumn4lin_arida]

# 1. Frida Hook Android 常用方法 #

Android 常用 Hook 方法汇总

*  Hook 一般函数 --- 使用 implementation
 *  Hook 重载函数 --- 使用 overload
 *  Hook 构造函数 --- 使用 $init
 *  Hook 生成对象 --- 使用 $new
 *  Hook 内部类 --- 使用 $
 *  Hook native 函数
 *  Hook 静态变量（属性）/ 参考文章中有反射的方法
 *  打印堆栈
 *  byte 转 String
 *  String 转 Uint8Array
 *  int 转 bytes
 *  String 转 ArrayBuffer
 *  ArrayBuffer 转 String
 *  添加时间戳
 *  byte 转 Hex
 *  Hex 转 byte

## 1、概述 ##

在逆向过程中，Frida 是非常常用的 Hook 工具，这个工具在日常使用的过程中，有很多通用方法，这里记录一下，方便查阅，部分函数使用的时候，可能需要稍微修改一下。  
主要是搬迁的一下参考文章的片段  
[Android逆向之旅—Hook神器家族的Frida工具使用详解][Android_Hook_Frida]  
[Frida官方文档][Frida]  
[看雪 Frida官方手册 - JavaScript API（篇一）][Frida_ - JavaScript API]  
[看雪 Frida官方手册 - JavaScript API（篇二）][Frida_ - JavaScript API 1]  
[Js中几种String Byte转换方法][Js_String Byte]  
[Frida learn by example][]  
[补充一个参考文章–Hook 属性][Hook]

## 2、Hook Java 代码篇 ##

From：[https://www.52pojie.cn/forum.php?mod=viewthread&tid=931872][https_www.52pojie.cn_forum.php_mod_viewthread_tid_931872]

Frida 文档：[Welcome | Frida • A world-class dynamic instrumentation framework][Welcome _ Frida _ A world-class dynamic instrumentation framework]

Frida 从入门到入门 --- 安卓逆向菜鸟的 frida 使用说明：[\[原创\]Frida从入门到入门—安卓逆向菜鸟的frida食用说明-Android安全-看雪论坛-安全社区|安全招聘|bbs.pediy.com][Frida_frida_-Android_-_-_bbs.pediy.com]

frida入门总结：[https://www.52pojie.cn/thread-1128884-1-1.html][https_www.52pojie.cn_thread-1128884-1-1.html]  
\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
**[Ta的论坛][Ta]**  
初识Frida--Android逆向之Java层hook (一)  
初识Frida--Android逆向之Java层hook (二)  
进阶Frida--Android逆向之动态加载dex Hook（三）（上篇）  
进阶Frida--Android逆向之动态加载dex Hook（三）（下篇）  
\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

frida分 **客户端环境** 和 **服务端环境**。

*  在 **客户端，**我们可以编写 Python 代码，用于连接远程设备，提交要注入的代码到远程，接受服务端的发来的消息等。
 *  在 **服务端，**我们需要用 Javascript 代码注入到目标进程，操作内存数据，给客户端发送消息等操作。
 *  可以把 **客户端理解成控制端**，**服务端理解成被控端**。假如我们要用PC来对Android设备上的某个进程进行操作，那么PC就是客户端，而Android设备就是服务端。

### Frida 服务端 环境 ###

> 注：Windows 系统执行命令可以在 CMD 中进行；Linux 和 MacOS 执行命令可以在终端中进行。adb 是 Android一个调试工具，具体安装方法不是本文的重点。

*  根据自己的平台下载 frida 服务端并解压：[Releases · frida/frida · GitHub][Releases _ frida_frida _ GitHub]

![20210128130543263.png][]

*  执行命令，将 **服务端** 推到手机的 **/data/local/tmp** 目录：**adb push frida-server /data/local/tmp/frida-server**
 *  执行命令，修改 frida-server 文件权限：**adb shell chmod 777 /data/local/tmp/frida-server**
 *  运行 frida-server：**./frida-server &**

### Frida 客户端 环境 ###

*  在 PC 上安装 Python 环境（ 推荐 Python3 ），安装完成后执行下面的命令安装 frida：**pip install frida**
 *  将脚本注入到 Android 目标进程：**frida -U -l myhook.js com.xxx.xxxx**  
    **参数解释：**  
            -U    指定对USB设备操作  
            -l      指定加载一个Javascript脚本  
            最后指定一个进程名，如果想指定进程 pid，用 -p 选项。正在运行的进程可以用 frida-ps -U 命令查看  
    frida 运行过程中，执行 %resume 重新注入，执行 %reload 来重新加载脚本；执行 exit 结束脚本注入

Frida 客户端命令行的参数解释：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 2][]

### 启动方式 1：使用 js 脚本启动 ###

frida -U -l exploit.js -f com.package.name

其中 js 脚本的写作方式如下

setImmediate(function() { //prevent timeout
        console.log("[*] Starting script");
    
        Java.perform(function() {
          myClass = Java.use("com.package.name.xxActivity");
          myClass.implementation = function(v) {
             // do sth.
          }
    
        })
    })

### 启动方式 2：使用 Python 脚本启动 ###

import frida, sys
    
    def on_message(message, data):
        if message['type'] == 'send':
            print("[*] {0}".format(message['payload']))
        else:
            print(message)
    
    jscode = """
    Java.perform(function () {
        // Function to hook is defined here
        var MainActivity = Java.use('com.example.hook.MainActivity');
        // hook method is setString
        MainActivity.setString.implementation = function (str) {
            // Show a message to know that the function got called
            send('hook success');
            console.log('string is: ' + str));
        };
    });
    """
    
    process = frida.get_usb_device().attach('com.example.hook')
    #pid = device.spawn(["com.android.chrome"])
    #session = device.attach(pid)
    #device.resume(pid)
    script = process.create_script(jscode)
    script.on('message', on_message)
    print('[*] Hook Start Running')
    script.load()
    sys.stdin.read()

示例 2：

# -*- coding: utf-8 -*-
    # @Author  : 佛祖保佑, 永无 bug
    # @Date    : 2021-03-24, 0024
    # @File    : frida_test.py
    # @Software: PyCharm
    # @description : XXX
    
    
    import sys
    import frida
    
    '''
    /* frida hook 格式示例 */
    console.log("Script loaded successfully ");
    Java.perform(function x() {
        console.log("Inside java perform function");
        //定位类
        var my_class = Java.use("com.example.demo2.MainActivity");
        console.log("Java.Use.Successfully!");//定位类成功！
        //在这里更改类的方法的实现（implementation）
        my_class.fun.implementation = function(x,y){
            //打印替换前的参数
            console.log( "original call: fun("+ x + ", " + y + ")");
            //把参数替换成2和5，依旧调用原函数
            var ret_value = this.fun(2, 5);
            return ret_value;
        }
    });
    '''
    
    # 从此处开始定义用来 Hook 的 javascript 代码
    js_code_1 = """ 
    console.log("Script loaded successfully ");
    
    function get_android_version() {
        // 获取当前安卓设备的安卓版本
        var android_version = Java.androidVersion;
        // send('android version:' + android_version);
        console.log(android_version);
    }
    
    function get_load_classes() {
        //获取该应用加载的类
        var class_names = Java.enumerateLoadedClassesSync();        
        for (var i = 0; i < class_names.length; i++){
            // send('[class_name]:' + class_names[i]);
            console.log('[class name]:' + class_names[i]);
        }
    }
    
    function change_return_value() {
        //获得 MainActivity 类
        var MainActivity = Java.use('com.yaotong.crackme.MainActivity'); 
        var java_string = Java.use('java.lang.String');
        MainActivity.securityCheck.implementation = function(java_string){             
            send('I am here');      // 发送信息，用于回调python中的函数
            return true;            //劫持返回值，修改为我们想要返回的字符串
        }
    }
    
    Java.perform(function() {
        console.log("Inside java perform function");
    
        get_android_version();
        get_load_classes();
        change_return_value();      
    });
    """
    
    js_code_2 = '''
    function hook_main_activity_onCreate() {
        var main_activity = Java.use('com.yaotong.crackme.MainActivity');
        main_activity.onCreate.overload('') = function () {
            send('I am here');
            this.onCreate()
        }
    }
    Java.perform(function(){
        hook_main_activity_onCreate()
    })    
    '''
    
    js_code_3 = '''
    //var walk = Process.enumerateModules();
    //for(var i=0; i<walk.length; i++){
    //    send(walk[i].name);
    //}
    var base_address = Module.findBaseAddress('libc.so');
    send('base_address:' + base_address);
    var func_address = Module.findExportByName("libc.so", "dlopen");
    send('func_address:' + func_address);
    var lib_module = Process.findModuleByAddress(base_address);
    send("lib_module_address:" + lib_module.name);
    Interceptor.attach(func_address, {
        onEnter: function(args){
            //send("open(" + args[0] + "," + args[1] + ")" );
            send("open(" + Memory.readUtf8String(args[0]) + "," + args[1] + ")");
        },
        onLeave: function(ret_val){
            send("ret_val:" + ret_val);
        }
    });
    '''
    
    
    def js_callback_func(msg, data):
        # js中执行send函数后要回调的函数
        if 'send' == msg['type']:
            print(f'[*] {msg["payload"]}')
        else:
            print(msg)
    
    
    '''
    # 使用 get_usb_device 函数来获取设备一直报错找不到设备，改用 get_remote_device 函数即可解决这个问题
    # process = frida.get_usb_device().attach('com.yaotong.crackme')
    '''
    
    
    def test_1():
        # 要 hook 的 app 必须首先启动，才能开始 hook
        process = frida.get_remote_device().attach('com.yaotong.crackme')
        script = process.create_script(js_code_1)  # 创建js脚本
        script.on('message', js_callback_func)  # 加载回调函数，也就是js中执行send函数规定要执行的python函数
        script.load()  # 加载脚本
        sys.stdin.read()
    
    
    def test_2():
        # 可以不启动 app 直接 hook，程序会自动启动 app
        devices = frida.get_remote_device()
        pid = devices.spawn(['com.yaotong.crackme'])
        process = devices.attach(pid)
    
        script = process.create_script(js_code_3)
        script.on('message', js_callback_func)
        print('[*] Running CTF')
        script.load()
        devices.resume(pid)
        sys.stdin.read()
    
    
    if __name__ == '__main__':
        test_1()
        # test_2()

### Java.use 载入 Java类： ###

*  Java.use 方法用于声明一个Java类，**Java类** **必须** **先声明，后使用**。
 *  比如声明一个 String 类，要指定完整的类名：**var StringClass = Java.use("java.lang.String");**

### **函数 的 参数类型 表示** ###

不同的参数类型都有自己的表示方法

对于基本类型，直接用它在Java中的表示方法就可以了，不用改变，例如：

*  int
 *  short
 *  char
 *  byte
 *  boolean
 *  float
 *  double
 *  long

**基本类型** **的** **数组：**用 **左中括号** **接上 基本类型 的缩写**

基本类型缩写表示表：

<table style="width:521px;"> 
 <thead> 
  <tr> 
   <th style="width:297px;">基本类型</th> 
   <th style="width:221px;">缩写</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td style="width:297px;">boolean</td> 
   <td style="width:221px;">Z</td> 
  </tr> 
  <tr> 
   <td style="width:297px;">byte</td> 
   <td style="width:221px;">B</td> 
  </tr> 
  <tr> 
   <td style="width:297px;">char</td> 
   <td style="width:221px;">C</td> 
  </tr> 
  <tr> 
   <td style="width:297px;">double</td> 
   <td style="width:221px;">D</td> 
  </tr> 
  <tr> 
   <td style="width:297px;">float</td> 
   <td style="width:221px;">F</td> 
  </tr> 
  <tr> 
   <td style="width:297px;">int</td> 
   <td style="width:221px;">I</td> 
  </tr> 
  <tr> 
   <td style="width:297px;">long</td> 
   <td style="width:221px;">J</td> 
  </tr> 
  <tr> 
   <td style="width:297px;">short</td> 
   <td style="width:221px;">S</td> 
  </tr> 
 </tbody> 
</table>

*  例如：**int\[\]** 类型，在重载时要写成**\[I**
 *  **任意类**，直接写 **完整类名** 即可。例如：**java.lang.String**
 *  **对象 数组**，**用 左中括号 接上 完整类名 再接上 分号**。例如：**\[java.lang.String;**

### 带参数 的 构造函数 ###

修改参数为 byte\[\] 类型的构造函数的实现

ClassName.$init.overload('[B').implementation=function(param){
        //do something
    }

注：ClassName 是使用 Java.use定义的类，param 是可以在函数体中访问的参数

改多参数的构造函数的实现

ClassName.$init.overload('[B','int','int').implementation=function(param1,param2,param3){
        //do something
    }

### 无参数 的 构造函数 ###

ClassName.$init.overload().implementation=function(){
        //do something
    }

调用原构造函数

ClassName.$init.overload().implementation=function(){
        //do something
        this.$init();
        //do something
    }

> 注意：当 **构造函数** 或者 **函数** 有**多种重载**形式，比如一个类中有两个形式的 func：**void func()** 和 **void func(int)**，要加上 **overload** 来对函数进行重载，**否则可以省略overload**

### Hook 构造方法 ###

Hook 构造方法时，与普通方法类似，只不过将方法名改成了 **$init**

// Hook构造方法时与普通方法类似，只不过将方法名改成了 $init
    Java.perform(function () {
        var hook_cls = Java.use('com.threetails.demo.Utils');
        hook_cls.$init.implementation = function (a, b) {
            console.log("Hook Start...");
            
            send('arg0: '+ a);
            send('arg1: '+ b);
            
            return this.$init(a, b);
        }
    });

### Hook 重载方法 ###

Java.perform(function () {
        var hook_cls = Java.use('com.threetails.demo.Utils');
        
        /* ovldMethod是一个重载方法，必须加上overload(参数类型)才能Hook。
        若参数类型为字符串，应该传java.lang.String，因为字符串在java中与int不同，它不是基本类型，而是类。
        如果不知道参数类型，可以去掉overload，执行一下程序会抛出错误，在错误提示中可以看到对应的参数类型。*/
        hook_cls.ovldMethod.overload("int").implementation = function (a) {
            console.log("Hook Start...");
            
            send('arg0: '+ a);
            
            send('result: '+ this.ovldMethod.overload("int")(a));
            
            return this.ovldMethod.overload("int")(a);
        }
    });

### 创建 类 的 实例，并调用函数 ###

和 Java 一样，创建 **类实例** 就是调用 **构造函数**，用 **$new** 表示一个构造函数。

var ClassName=Java.use("com.luoye.test.ClassName");
    var instance = ClassName.$new();

类实例化以后，就可以调用其他函数

var ClassName=Java.use("com.luoye.test.ClassName");
    var instance = ClassName.$new();
    instance.func();

### 构造对象参数 ###

如果方法参数的类型并非 java 的内置类型，而是一个自定义类，你又想在Hook时传入自定义对象，怎么办？假设现在有个自定义类叫 Dog，它有两个属性：name 和 age。看看下面这个示例：

Java.perform(function () {
        var hook_cls = Java.use('com.threetails.demo.Utils');
        
        // 首先声明一个dog类
        var dog_cls = Java.use('com.threetails.demo.Dog');
        
        hook_cls.feed.implementation = function (dog_obj) {
            console.log("Hook Start...");
            send('old dog:'+dog_obj);
            
            // 调用dog_cls.$new来实例化一个自定义的dog对象
            var new_dog = dog_cls.$new("大黄", 5);
            send('new dog:'+new_dog);
            
            // 调用原方法并将对象参数替换为自定义的dog
            return this.feed(new_dog);
        }
    });

### 修改对象属性 ###

还是以 Dog 类为例， 现在我们需要将传入的 Dog 对象的 age 修改为 1。

**正常修改**

Java.perform(function () {
        var hook_cls = Java.use('com.threetails.demo.Utils');
        
        hook_cls.feed.implementation = function (dog_obj) {
            console.log("Hook Start...");
            // 需要使用.value来获取属性值
            send(dog_obj.age.value);
            
            // 需要使用.value来修改属性值
            dog_obj.age.value = 1;
            send(dog_obj.name.value);
            
            return this.feed(dog_obj);
        }
    });

**使用反射**

修改对象属性还有另外一种方式，也就是使用 java 的反射， 这种方式相对复杂一些。

Java.perform(function () {
        var hook_cls = Java.use('com.threetails.demo.Utils');
        
        // 首先需要声明一个类构造器
        var clazz = Java.use('java.lang.Class');
        
        hook_cls.feed.implementation = function (dog_obj) {
            console.log("Hook Start...");
            
            // 调用Java.cast方法，传入类和类构造器得到类的id，再调用getDeclaredField得到属性id
            var ageid = Java.cast(dog_obj.getClass(),clazz).getDeclaredField('age');
            
            // 设置该属性为可访问
            ageid.setAccessible(true);
            
            // 调用get方法获取属性值
            var old_value = ageid.get(dog_obj);
            
            // 此处必须使用console.log才能打印我们需要的值
            console.log(old_value);
            
            // 调用setInt修改属性值
            ageid.setInt(dog_obj, 1);
            
            return this.feed(dog_obj);
        }
    });

### Hook 普通方法（包括 私有、公有、静态） ###

Java.perform(function () {
        // Java.use(类的路径)，声明一个要hook的类
        var hook_cls = Java.use('com.threetails.demo.Utils');
        
        // 修改该类下normalMethod的实现，参数个数需要与原方法保持一致
        hook_cls.normalMethod.implementation = function (a, b) {
            console.log("Hook Start...");
            
            send('arg0: '+ a);
            send('arg1: '+ b);
            
            send('result: '+ this.normalMethond(a,b));
            
            /* 为了让程序正常运行，需要调用原方法将结果返回。若想修改参数值，可以在调用时直接将参数替换，
            如：return this.normalMethond(1,2)，但需注意参数类型的一致性。*/
            return this.normalMethond(a,b);
        }
    });

### 一般函数 ###

> 注： 在修改函数实现时，如果原函数有返回值，那么我们在实现时，也要返回合适的值。（ **构造函数 没有返回值** ）

修改函数名为 func，参数为 byte\[\] 类型的函数的实现。**如果原函数有返回值，则修改后函数也需要有返回值。**

ClassName.func.overload('[B').implementation=function(param){
        // do something
        // return ...
    }

### 无参数的函数 ###

**如果原函数有返回值，则修改后函数也需要有返回值。**

ClassName.func.overload().implementation=function(){
        // do something
        // return
    }

带返回值的函数修改

ClassName.func.overload().implementation=function(){
        // do something
        return this.func();
    }

### Java.cast 进行 类型转换 ###

用 Java.cast 方法来对一个对象进行类型转换，

示例：将 variable 转换成 java.lang.String

var StringClass = Java.use("java.lang.String");
    var NewTypeClass = Java.cast(variable, StringClass);

### Java.available 字段 ###

这个字段标记 Java[虚拟机][Link 2]（例如： Dalvik 或者 ART）是否已加载, 操作Java任何东西的之前，要确认这个值是否为 true

### Java.perform 方法 ###

当 Javascript 代码被成功附加到目标进程时，则调用 **Java.perform(fn)** 方法，我们核心的代码要在里面写。格式：

Java.perform(function(){
        //do something...
    });

## 3、常用 Hook 方法 汇总 ##

###                                                       Hook 一般函数 --- 使用 implementation ###

var MainActivity = Java.use('ese.xposedtest.MainActivity');
    //外部类 修改返回值
    MainActivity.OutClass.implementation = function (arg) {
        var ret = this.OutClass(arg);
        console.log('Done:' + arg);
        return ret;
    }

### Hook 重载函数 --- 使用 overload ###

// If two methods of a class have the same name
    // you need to use 'overload'
    // hook method 1
    myClass.myMethod.overload().implementation = function(){
      // do sth
    }
    
    myClass.myMethod.overload("[B", "[B").implementation = function(param1, param2) {
      // do sth
    }
    
    myClass.myMethod.overload("android.context.Context", "boolean").implementation = function(param1, param2){
      // do sth
    }
    
    // hook method 2
    //待补充

### Hook 构造函数 --- 使用 $init ###

// Intercept the initialization of java.lang.Stringbuilder's overloaded constructor.
    // Write the partial argument to the console.
    const StringBuilder = Java.use('java.lang.StringBuilder');
    //We need to overwrite .$init() instead of .$new(), since .$new() = .alloc() + .init()
    StringBuilder.$init.overload('java.lang.String').implementation = function (arg) {
        var partial = "";
        var result = this.$init(arg);
        if (arg !== null) {
             partial = arg.toString().replace('\n', '').slice(0,10);
        }
        // console.log('new StringBuilder(java.lang.String); => ' + result)
        console.log('new StringBuilder("' + partial + '");')
        return result;
    }
    console.log('[+] new StringBuilder(java.lang.String) hooked');

### Hook 新生成的 对象的实例 --- 使用 $new ###

const JavaString = Java.use('java.lang.String');
    var exampleString1 = JavaString.$new('Hello World, this is an example string in Java.');
    console.log('[+] exampleString1: ' + exampleString1);

### Hook 内部类—使用 $ ###

var inInnerClass = Java.use('ese.xposedtest.MainActivity$inInnerClass');
    
    inInnerClass.methodInclass.implementation = function()
    {
        var arg0 = arguments[0];
        var arg1 = arguments[1];
        send("params1: "+ arg0 +" params2: " + arg1);
        return this.formInclass(1,"Frida");
    }

### Hook native 函数 ###

Interceptor.attach(Module.findExportByName("xxx.so" , "xxxx"), {
        onEnter: function(args) {
            send("open(" + Memory.readCString(args[0])+","+args[1]+")");
        },
        onLeave:function(retval){
        
        }
    });

### Hook 静态变量（属性）/ 参考文章中有反射的方法 ###

var ah = Java.use("com.ah");
    console.log("To Log: " + ah.a.value);
    ah.a.value = true;

### 打印堆栈 ###

AndroidLog = Java.use("android.util.Log")
    AndroidException = Java.use("java.lang.Exception")
    function printStackTrace(){
    	console.log(AndroidLog .getStackTraceString(AndroidException .$new()));
    }

### byte\[ \] 转 String ###

function byte2string(array){
        var result = "";
        for(var i = 0; i < array.length; ++i){
            result+= (String.fromCharCode(array[i]));
        }
       return result;
    }

ArrayBuffer转String: 解决中文乱码(模板)

function ab2str(buf) {
        return new Uint16Array(buf)
        // encodedString = String.fromCodePoint.apply(null, new Uint16Array(buf));
        // // decodedString = encodeURI(encodedString);//没有这一步中文会乱码
        // // console.log(decodedString);
        // return encodedString
    }

### String 转 Uint8Array ###

function string2byte(str){
      for (var i = 0,arr=[]; i < str.length;i++){
        arr.push(str.charCodeAt(i));
      }
      return new Uint8Array(arr);
    }

字符串 转 Uint8Array (模板)

function stringToUint8Array(str){
      var arr = [];
      for (var i = 0, j = str.length; i < j; ++i) {
        arr.push(str.charCodeAt(i));
      }
    
      var tmpUint8Array = new Uint8Array(arr);
      return tmpUint8Array
    }

string 转 ArrayBuffer (模板)

function str2ab(str) {
        var buf = new ArrayBuffer(str.length * 2); // 每个字符占用2个字节
        var bufView = new Uint16Array(buf);
        for (var i = 0, strLen = str.length; i < strLen; i++) {
            bufView[i] = str.charCodeAt(i);
        }
        return buf;
    }

Uint8Array 转 字符串 (模板)

function Uint8ArrayToString(fileData){
        console.log(fileData)
      var dataString = "";
      for (var i = 0; i < fileData.length; i++) {
        dataString += String.fromCharCode(fileData[i]);
      }
    
      return dataString
    }

### int 转 bytes ###

function intTobytes(n) {
      var bytes = [];
      for (var i = 0; i < 2; i++) {
        bytes[i] = n >> (8 - i * 8);
     
      }
      return bytes;
    }

### string 转 ArrayBuffer ###

function str2arraybuffer(str) {
      var buf = new ArrayBuffer(str.length * 2); // 每个字符占用2个字节
      var bufView = new Uint16Array(buf);
      for (var i = 0, strLen = str.length; i < strLen; i++) {
        bufView[i] = str.charCodeAt(i);
      }
      return buf;
    }

### ArrayBuffer 转 String ###

function ab2str(buf) {
      return String.fromCharCode.apply(null, new Uint8Array(buf));
    }

### 添加时间戳 ###

console.log(new Date(new Date().getTime())

### byte 转 Hex ###

这个非常常用，因为有些byte是没有办法转成string的，只能转成hex，用来查看

### Hex 转 byte ###

### frida hook so 导出函数 ###

# -*- coding: UTF-8 -*-
    import frida, sys
     
    jsCode = """
    Java.perform(function(){
        var nativePointer = Module.findExportByName("libhello.so", "Java_com_xiaojianbang_app_NativeHelper_add");
        send("native: " + nativePointer);
        Interceptor.attach(nativePointer, {
            onEnter: function(args){
                send(args[0]);
                send(args[1]);
                send(args[2].toInt32());
                send(args[3].toInt32());
                send(args[4].toInt32());
            },
            onLeave: function(retval){
                send(retval.toInt32());
            }
        });
    });
    """;
     
    def message(message, data):
        if message["type"] == 'send':
            print(u"[*] {0}".format(message['payload']))
        else:
            print(message)
     
    process = frida.get_remote_device().attach("com.xiaojianbang.app")
    script= process.create_script(jsCode)
    script.on("message", message)
    script.load()
    sys.stdin.read()

基于frida框架Hook native中的函数(1)：[基于frida框架Hook native中的函数(1)\_Fly20141201. 的专栏-CSDN博客\_frida hook so][frida_Hook native_1_Fly20141201. _-CSDN_frida hook so]

安卓逆向入门之使用 frida 框架简单 Hook native 层的函数：[安卓逆向入门之使用frida框架简单Hook native层的函数\_测试0901-1-CSDN博客][frida_Hook native_0901-1-CSDN]

[抖音数据采集Frida教程，Frida Java Hook 详解：代码及示例（下）][Frida_Frida Java Hook]：[https://segmentfault.com/a/1190000039041770][Frida_Frida Java Hook]

hook工具 frida 原理及使用：[hook工具frida原理及使用 - 简书][hook_frida_ -]

### frida hook AES DES 3DES RSA MD5 SHA MAC firda 自吐算法 ###

哔哩哔哩：[frida hook AES DES RSA 自吐算法\_哔哩哔哩\_bilibili][frida hook AES DES RSA _bilibili]

frida hook AES DES RSA 自吐算法：[frida hook AES DES RSA 自吐算法 - 移动安全王铁头 - 博客园][frida hook AES DES RSA _ - _ -]  
frida hook java原生算法同时打印调用堆栈：[frida hook java原生算法同时打印调用堆栈\_weixin\_34365417的博客-CSDN博客][frida hook java_weixin_34365417_-CSDN]  
FridaHookSysAPI：[GitHub - zhudongjie/FridaHookSysAPI: System level encryption algorithm Hook from Frida][GitHub - zhudongjie_FridaHookSysAPI_ System level encryption algorithm Hook from Frida]  
Frida 各种 Hook 示例 js ：[Frida Hook - 简书][Frida Hook -]

**百度关键字：****frida hook 安卓 抓包**    或者    **frida hook okhttp 抓包**

精品连载丨安卓 App 逆向课程之四 frida 注入 Okhttp 抓包中篇：[精品连载丨安卓 App 逆向课程之四 frida 注入 Okhttp 抓包中篇\_静觅-CSDN博客][App _ frida _ Okhttp _-CSDN]

Android的网络请求库选择：[Android的网络请求库选择 - 简书][Android_ -]

android 网络请求库的比较：[android 网络请求库的比较 - 水马 - 博客园][android _ - _ -]

示例代码：

# -*- coding: UTF-8 -*-
     
    import sys
    import frida
     
     
    '''
    哔哩哔哩:https://www.bilibili.com/video/av927982888/
    frida hook AES DES RSA 自吐算法:
        https://www.cnblogs.com/shlyd/p/14057423.html
    frida hook java原生算法同时打印调用堆栈:
        https://blog.csdn.net/weixin_34365417/article/details/93088342
    FridaHookSysAPI
        https://github.com/zhudongjie/FridaHookSysAPI
    Frida 各种 Hook 示例 js 
        https://www.jianshu.com/p/4291ee42c412
    '''
     
     
    js_code = """
    function showStacks() {
        send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    }
    // 这两种打印 堆栈信息的方法都可以
    function showStacks_2() {
        Java.perform(function () {
            send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
        });
    }
    function bytesToHex(arr)
    {
        var str = "";
        for(var i=0; i<arr.length; i++)
        {
           var tmp = arr[i];
           if (tmp < 0) {
           tmp =(255+tmp+1).toString(16);
           } else {
                tmp = tmp.toString(16);
           }
           if(tmp.length == 1) 
           {
               tmp = "0" + tmp; 
           }
           str += tmp;
        }
        return str;
    }
    function bytesToBase64(arr)
    {
        var str = "";
        for(var i=0; i<arr.length; i++)
        {
           var tmp = arr[i];
           if (tmp < 0) {
           tmp =(255+tmp+1).toString(16);
           } else {
                tmp = tmp.toString(16);
           }
           if(tmp.length == 1) 
           {
               tmp = "0" + tmp; 
           }
           str += tmp;
        }
        return str;
    }
    function byteArray2String(byteArray) {  // 把 byte 转换成 对应的ASCII字符
        var buffer = Java.array('byte', byteArray);
        // console.log(buffer.length)
        var result = "";
        for (var i = 0; i < buffer.length; i++) {
            result += (String.fromCharCode(buffer[i]));
        }
        return result;
    }
    function bytesToString(arr)  //把 byte 转换成 16进制的ASCII值
    {
        var str = "";
        for(var i=0; i<arr.length; i++)
        {
           var tmp = arr[i];
           if (tmp < 0) {
           tmp =(255+tmp+1).toString(16);
           } else {
                tmp = tmp.toString(16);
           }
           if(tmp.length == 1) 
           {
               tmp = "0" + tmp; 
           }
           str += tmp;
        }
        return str;
    }
    Java.perform(function () {
        var secretKeySpec = Java.use('javax.crypto.spec.SecretKeySpec');
        secretKeySpec.$init.overload('[B','java.lang.String').implementation = function (a,b) {
            showStacks();
            var result = this.$init(a, b);
            send("======================================");
            send("算法名：" + b + "|Dec密钥:" + bytesToString(a));
            send("算法名：" + b + "|Hex密钥:" + bytesToHex(a));
            return result;
        }
        
        var mac = Java.use('javax.crypto.Mac');
        mac.getInstance.overload('java.lang.String').implementation = function (a) {
            showStacks();
            var result = this.getInstance(a);
            send("======================================");
            send("算法名：" + a);
            return result;
        }
        mac.update.overload('[B').implementation = function (a) {
            showStacks();
            this.update(a);
            send("======================================");
            send("update:" + bytesToString(a))
        }
        mac.update.overload('[B','int','int').implementation = function (a,b,c) {
            showStacks();
            this.update(a,b,c)
            send("======================================");
            send("update:" + bytesToString(a) + "|" + b + "|" + c);
        }
        mac.doFinal.overload().implementation = function () {
            showStacks();
            var result = this.doFinal();
            send("======================================");
            send("doFinal结果:" + bytesToHex(result));
            send("doFinal结果:" + bytesToBase64(result));
            return result;
        }
        mac.doFinal.overload('[B').implementation = function (a) {
            showStacks();
            var result = this.doFinal(a);
            send("======================================");
            send("doFinal参数:" + bytesToString(a));
            send("doFinal结果:" + bytesToHex(result));
            send("doFinal结果:" + bytesToBase64(result));
            return result;
        }
        
        var md = Java.use('java.security.MessageDigest');
        md.getInstance.overload('java.lang.String','java.lang.String').implementation = function (a,b) {
            showStacks();
            send("======================================");
            send("算法名：" + a);
            send("参数：" + b);
            return this.getInstance(a, b);
        }
        md.getInstance.overload('java.lang.String').implementation = function (a) {
            showStacks();
            send("======================================");
            send("算法名：" + a);
            return this.getInstance(a);
        }
        md.update.overload('[B').implementation = function (byte_array) {
            showStacks();
            send("======================================");
            //send("update:" + bytesToString(byte_array));
            //send("ori:" + bytesToString(byte_array));
            send("ori:" + byteArray2String(byte_array));
            return this.update(byte_array);
        }
        md.update.overload('byte').implementation = function (byte_array) {
            showStacks();
            send("======================================");
            //send("update:" + bytesToString(byte_array));
            send("update:" + byteArray2String(byte_array));   
            return this.update(byte_array);
        }
        md.update.overload('java.nio.ByteBuffer').implementation = function (byte_array) {
            showStacks();
            send("======================================");
            //send("update:" + bytesToString(byte_array));
            send("update:" + byteArray2String(byte_array));       
            return this.update(byte_array);
        }
        
        md.update.overload('[B','int','int').implementation = function (a,b,c) {
            showStacks();
            send("======================================");
            send("update:" + bytesToString(a) + "|" + b + "|" + c);
            return this.update(a,b,c);
        }
        md.digest.overload().implementation = function () {
            showStacks();
            send("======================================");
            var result = this.digest();
            send("digest结果:" + bytesToHex(result));
            send("digest结果:" + bytesToBase64(result));
            return result;
        }
        md.digest.overload('[B').implementation = function (a) {
            showStacks();
            send("======================================");
            send("digest参数:" + bytesToString(a));
            var result = this.digest(a);
            send("digest结果:" + bytesToHex(result));
            send("digest结果:" + bytesToBase64(result));
            return result;
        }
        
        var ivParameterSpec = Java.use('javax.crypto.spec.IvParameterSpec');
        ivParameterSpec.$init.overload('[B').implementation = function (a) {
            showStacks();
            var result = this.$init(a);
            send("======================================");
            send("iv向量:" + bytesToString(a));
            send("iv向量:" + bytesToHex(a));
            return result;
        }
        
        var cipher = Java.use('javax.crypto.Cipher');
        cipher.getInstance.overload('java.lang.String').implementation = function (a) {
            showStacks();
            var result = this.getInstance(a);
            send("======================================");
            send("模式填充:" + a);
            return result;
        }
        cipher.update.overload('[B').implementation = function (a) {
            showStacks();
            var result = this.update(a);
            send("======================================");
            send("update:" + bytesToString(a));
            return result;
        }
        cipher.update.overload('[B','int','int').implementation = function (a,b,c) {
            showStacks();
            var result = this.update(a,b,c);
            send("======================================");
            send("update:" + bytesToString(a) + "|" + b + "|" + c);
            return result;
        }
        cipher.doFinal.overload().implementation = function () {
            showStacks();
            var result = this.doFinal();
            send("======================================");
            send("doFinal结果:" + bytesToHex(result));
            send("doFinal结果:" + bytesToBase64(result));
            return result;
        }
        cipher.doFinal.overload('[B').implementation = function (a) {
            showStacks();
            var result = this.doFinal(a);
            send("======================================");
            send("doFinal参数:" + bytesToString(a));
            send("doFinal结果:" + bytesToHex(result));
            send("doFinal结果:" + bytesToBase64(result));
            return result;
        }
        
        var x509EncodedKeySpec = Java.use('java.security.spec.X509EncodedKeySpec');
        x509EncodedKeySpec.$init.overload('[B').implementation = function (a) {
            showStacks();
            var result = this.$init(a);
            send("======================================");
            send("RSA密钥:" + bytesToBase64(a));
            return result;
        }
        
        var rSAPublicKeySpec = Java.use('java.security.spec.RSAPublicKeySpec');
        rSAPublicKeySpec.$init.overload('java.math.BigInteger','java.math.BigInteger').implementation = function (a,b) {
            showStacks();
            var result = this.$init(a,b);
            send("======================================");
            //send("RSA密钥:" + bytesToBase64(a));
            send("RSA密钥N:" + a.toString(16));
            send("RSA密钥E:" + b.toString(16));
            return result;
        }
    });
    """
     
     
    def js_callback_func(msg, data):
        if msg["type"] == 'send':
            print("[*] {0}".format(msg['payload']))
        else:
            print(msg)
     
     
    if __name__ == '__main__':
        flag = 1
        if 1 == flag:
            process = frida.get_remote_device().attach("com.iCitySuzhou.suzhou001")
            script = process.create_script(js_code)
            script.on("message", js_callback_func)
            script.load()
            sys.stdin.read()
        elif 2 == flag:
            devices = frida.get_remote_device()
            pid = devices.spawn(['com.iCitySuzhou.suzhou001'])
            process = devices.attach(pid)
     
            script = process.create_script(js_code)
            script.on('message', js_callback_func)
            print('[*] Running CTF')
            script.load()
            devices.resume(pid)
            sys.stdin.read()

## 实例 1：修改 返回值 和 参数 ##

有了以上的基础知识，我们就可以进行编写代码了

### 修改返回值 ###

**场景**：假设有以下的程序，给isExcellent方法传入两个值，通过计算，返回一个布尔值，表示是否优秀。默认情况下，它是只会显示`是否优秀：false`的，因为我们默认传入的数很小:

![20210128162213285.png][]

**Java  代码：**

public class MainActivity extends AppCompatActivity {
        private  String TAG="Crackme";
        private TextView textView;
        @Override
        protected void onCreate(Bundle savedInstanceState) {
            super.onCreate(savedInstanceState);
            setContentView(R.layout.activity_main);
            textView =findViewById(R.id.tv);
            textView.setText("是否优秀："+isExcellent(46,54));
        }
     
        private  boolean isExcellent(int chinese, int math){
            if( chinese + math >=180){
                return true;
            }
            else{
                return false;
            }
        }
     
    }

我们编写一个脚本来 Hook isExcellent函数，使它返回true，显示为是否优秀：true。对于这种简单的场景，直接修改返回值就可以了，因为只有结果是重要的。

**JavaScript 代码**

想直接返回结果很简单，直接在匿名方法里return即可。

if(Java.available){
        Java.perform(function(){
            var MainActivity = Java.use("com.luoyesiqiu.crackme.MainActivity");
            MainActivity.isExcellent.implementation=function(){
                return true;        
            }
        });
     
    }

*  将上面的代码保存为：exp1.js
 *  执行 adb shell 'su -c /data/local/tmp/frida-server' 启动服务端
 *  运行目标 App
 *  执行 frida -U -l exp1.js com.luoyesiqiu.crackme 注入代码
 *  按返回键返回桌面，再重新打开App, 发现达到预期
 *  在命令行输入exit，回车，停止注入代码

![20210128162254658.png][]

注：这里为什么要打开两次App？第一打开是为了让 frida 能够找到进程，第二次打开是为了验证结果，即使 Hook 成功了，界面是有缓存的，并不能实时显示 Hook 结果，所以需要重新打开 App

### 修改参数 ###

**场景：**假设有以下场景，isExcellent 除了返回是否优秀以外，方法的内部还把分数打印出来。

![20210128162505113.png][]

**Java 代码：**

public class MainActivity extends AppCompatActivity {
        private  String TAG="Crackme";
        private TextView textView;
        @Override
        protected void onCreate(Bundle savedInstanceState) {
            super.onCreate(savedInstanceState);
            setContentView(R.layout.activity_main);
            textView =findViewById(R.id.tv);
            textView.append("是否优秀："+isExcellent(46,54)+"\n");
        }
     
        private  boolean isExcellent(int chinese, int math){
            textView.append("语文+数学总分："+(chinese+math)+"\n");
            if( chinese + math >=180){
                return true;
            }
            else{
                return false;
            }
        }
    }

这种情况下我们不可能只返回是否优秀吧，显示的总分很低，但是却返回优秀，是很尴尬的...所以我们要修改 isExcellent 方法的参数，使其通过计算打印和返回合理的值。

**JavaScript 代码**

if(Java.available){
        Java.perform(function(){
            var MainActivity = Java.use("com.luoyesiqiu.crackme.MainActivity");
            MainActivity.isExcellent.overload("int","int").implementation=function(chinese,math){
                return this.isExcellent(95,96);      
            }
        });
     
    }

上面的代码，通过 overload 方法重载参数，修改 isExcellent 方法实现，并在实现函数里调用原来的方法，得到新的返回值

*  将上面的代码保存为：exp2.js
 *  执行 adb shell 'su -c /data/local/tmp/frida-server'启动服务端（如果上面启动的服务端还开着可省略这一步）
 *  运行目标 App
 *  执行 frida -U -l exp2.js com.luoyesiqiu.crackme 注入代码
 *  按返回键，再重新打开 App, 发现达到预期
 *  在命令行输入exit，回车，停止注入代码

![20210128162757625.png][]

### 配合 Python 脚本注入 ###

在本文刚开始的时候说到，我们可以编写 Python 代码来配合 Javascript 代码注入。

下面我们来看看，怎么使用，先看一段代码：

# -*- coding: UTF-8 -*-
     
    import frida, sys
     
    jscode = """
    if(Java.available){
        Java.perform(function(){
            var MainActivity = Java.use("com.luoyesiqiu.crackme.MainActivity");
            MainActivity.isExcellent.overload("int","int").implementation=function(chinese,math){
                console.log("[javascript] isExcellent be called.");
                send("isExcellent be called.");
                return this.isExcellent(95,96);      
            }
        });
    }
    """
     
    def on_message(message, data):
        if message['type'] == 'send':
            print(" {0}".format(message['payload']))
        else:
            print(message)
    pass
     
    # 查找USB设备并附加到目标进程
    session = frida.get_usb_device().attach('com.luoyesiqiu.crackme')
    # 在目标进程里创建脚本
    script = session.create_script(jscode)
    # 注册消息回调
    script.on('message', on_message)
    print(' Start attach')
    # 加载创建好的javascript脚本
    script.load()
    # 读取系统输入
    sys.stdin.read()

*  将上面的代码，保存为 exp3.py
 *  执行 adb shell 'su -c /data/local/tmp/frida-server'启动服务端（如果上面启动的服务端还开着可省略这一步）
 *  运行目标 App
 *  执行 python exp3.py 注入代码
 *  按返回键，再重新打开 App, 发现达到预期
 *  按 Ctrl+C 停止脚本和停止注入代码

上面是一段 Python 代码，我们来分析它的步骤：

1.  通过调用 **frida.get\_usb\_device()** 方法来得到一个连接中的 USB 设备（ Device类 ）实例
2.  调用 Device类的 **attach()** 方法来附加到目标进程并得到一个 **会话**（ **Session类**）实例，该方法有一个参数，就是需要注入的进程名
3.  接着调用 **Session类** 的 **create\_script()** 方法创建一个脚本，传入需要注入的 **javascript** 代码并得到**Script类** 的 实例
4.  调用 **Script类** 的 **on()方法** 添加一个消息回调，第一个参数是**信号名**，乖乖传入message 就行，第二个是**回调函数**
5.  最后调用 **Script类** 的 **load()方法** 来加载刚才创建的脚本。

> 注： 1. 如果想在 javascript 输出日志，可以调用 console.log()方法。  
>         2. 如果想给客户端发送消息，可以在 javascript 代码里调用 send()方法，  
>             并在客户端 Python 代码里注册一个消息回调来接收服务端发来的消息。

可以看到，结合python代码，使注入更加的灵活了。

如果想看 Python端 frida 模块的代码，可以访问：[frida-python/core.py at master · frida/frida-python · GitHub][frida-python_core.py at master _ frida_frida-python _ GitHub]

参考：[Welcome | Frida • A world-class dynamic instrumentation framework][Welcome _ Frida _ A world-class dynamic instrumentation framework 1]

### 示例代码： ###

# -*- coding: UTF-8 -*-
     
    import frida, sys
     
    jscode = """
    if(Java.available){
        Java.perform(function(){
            var MainActivity = Java.use("com.lanshifu.demo_module.ui.activity.DemoMainActivity");
            
            MainActivity.testCrash.overload("int").implementation=function(chinese,math){
                console.log("[javascript] testCrash method be called.");
                send("hook  testCrash method success>>>");
                return this.testCrash(12345678);      
            }
            
            //声明一个Java类
            var MyClass = Java.use("com.lanshifu.demo_module.ui.activity.DemoHookTestActivity$MyClass");
            
            //hook 无参构造
            MyClass.$init.overload().implementation=function(){
                    //调用原来构造
                    this.$init();
                    send("hook 无参构造 ");
            }
            
            //hook 有参构造，入参是 int[]
            MyClass.$init.overload('[I').implementation=function(param){
                 send("hook  有参构造 init(int[] i) method ");
            }
            
            //hook 多个参数构造，入参是 int，int
            MyClass.$init.overload("int","int").implementation=function(param1,param2){
                 send("hook  success  ");
                 send(param1);
                 send(param2);
                 //修改返回值
                 return 100;
            }
            
            //void函数
            MyClass.method1.overload().implementation=function(){
                send("hook  method1  ");
                this.method1();
            }
            
            //有入参的函数
            MyClass.method2.overload("int","int").implementation=function(param1,param2){
                send("hook  method2  ");
                
                //实例化一个类并调用它的method3方法
                var ClassName=Java.use("com.lanshifu.demo_module.ui.activity.DemoHookTestActivity$MyClass");
               var instance = ClassName.$new();
               instance.method3(1,2,3);
            
                this.method2(100,100)
            }
            
            //
            MyClass.method3.overload("int","int","int").implementation=function(param1,param2,param3){
                send("hook  method3  ");
                this.method3(100,100,100)
            }
            
            
        });
    }
    """
     
    def on_message(message, data):
        if message['type'] == 'send':
            print("[*] {0}".format(message['payload']))
        else:
            print(message)
    pass
     
    # 查找USB设备并附加到目标进程
    session = frida.get_usb_device().attach('com.lanshifu.demo_module')
     
    # 在目标进程里创建脚本
    script = session.create_script(jscode)
     
    # 注册消息回调
    script.on('message', on_message)
    print('[*] Start attach')
     
    # 加载创建好的javascript脚本
    script.load()
     
    # 读取系统输入
    sys.stdin.read()

## 实例 2：frida hook 加解密函数 ##

**定位关键函数**

取消勾选反混淆，否则影响关键函数定位

![20210128114317573.png][]

尝试搜索 AES、DES、RSA、加密、encode、decode 等关键字，也可以仔细跟进 http 等请求发起过程定位加解密函数

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 3][]

分析实现加密与解密的函数。加密函数：传入了公钥以及需要加密的字节数组

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 4][]

编写 hook.js

运行：frida -U -l demo.js xxx.xxx.xxx.xxx

# **2. frida hook 混淆后的方法** #

关键字：**frida hook 混淆后的方法**

求助\] Frida Hook混淆后的类、方法、变量异常

[GitHub - xiaokanghub/Android: Android 加固应用Hook方式-Frida][GitHub - xiaokanghub_Android_ Android _Hook_-Frida]

[\[求助\]这种反混淆的代码，frida如何hook-问答版块-看雪论坛-安全社区|安全招聘|bbs.pediy.com][frida_hook-_-_-_bbs.pediy.com]

# 3. FRIDA 实用手册 #

：[FRIDA 实用手册-阿里云开发者社区][FRIDA _-]

## Python 部分 ##

### JS 中文支持 ###

使用 `codecs.open(scriptpath, "r", "utf-8")` 打开文件读取 js 即可。

### 获取指定 UID 设备 ###

device = frida.get_device_manager().get_device("094fdb0a0b0df7f8")

### 获取远程设备 ###

mgr = frida.get_device_manager()
    device = mgr.add_remote_device("30.137.25.128:13355")

### 启动调试进程 ###

pid = device.spawn([packename])
    process = device.attach(pid)
    script = process.create_script(jscode)
    script.on('message', on_message)
    script.load()
    device.resume(pid)

### python 与 js 交互的官方示例 ###

import sys
    import frida
    
    
    session = frida.attach("hello")
    script = session.create_script("""
    Interceptor.attach(ptr("%s"), {
        onEnter: function(args) {
            send(args[0].toString());
            var op = recv('input', function(value) {
                args[0] = ptr(value.payload);
            });
            op.wait();
        }
    });
    """ % int(sys.argv[1], 16))
    
    
    def on_message(message, data):
        print(message)
        val = int(message['payload'], 16)
        script.post({'type': 'input', 'payload': str(val * 2)})
    
    
    script.on('message', on_message)
    script.load()
    sys.stdin.read()

### 从 bytecode 加载脚本 ###

# -*- coding: utf-8 -*-
    
    import frida
    
    system_session = frida.attach(0)
    bytecode = system_session.compile_script(name="bytecode-example", source="""\
    'use strict';
    rpc.exports = {
      listThreads: function () {
        return Process.enumerateThreadsSync();
      }
    };
    """)
    
    session = frida.attach("Twitter")
    script = session.create_script_from_bytes(bytecode)
    script.load()
    api = script.exports
    
    # 这里的 list_threads 是 listThreads 驼峰命名法自动转换后的结果，
    # 由 rpc exports 功能导出给 python 调用
    print("api.list_threads() =>", api.list_threads())

## JS 部分 ##

### hook Android 短信发送 SendDataMessage ###

function hook_sms() {
        var SmsManager = Java.use('android.telephony.SmsManager');
        SmsManager.sendDataMessage.implementation = function (
            destinationAddress, scAddress, destinationPort, data, sentIntent, deliveryIntent) {
            console.log("sendDataMessage destinationAddress: " + destinationAddress + " port: " + destinationPort);
            showStacks();
            this.sendDataMessage(destinationAddress, scAddress, destinationPort, data, sentIntent, deliveryIntent);
        }
    }

### 定时执行函数 ###

1.  `setTimeout` 延迟执行一次

setTimeout(funcA, 15000);

1.  `setInterval` 间隔循环执行

var id_ = setInterval(funcB, 15000);
    clearInterval(id_);    // 终止

### bin array 转字符串 ###

### 自己封装输出函数（ 加入 线程ID 和 时间 ） ###

### 打印 Android Java 层堆栈 ###

var showStacks = function () {
        Java.perform(function () {
            dmLogout(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));  // 打印堆栈
        });
    }

### TracerPid fgets 反调试 ###

### 反调试时读取 LR 寄存器溯源 ###

var anti_antiDebug = function () {
        var funcPtr = null;
    
        funcPtr = Module.findExportByName("xxxx.so", "p57F7418DCD0C22CD8909F9B22F0991D3");
    
        dmLogout("anti_antiDebug " + funcPtr);
        Interceptor.replace(funcPtr, new NativeCallback(function (pathPtr, flags) {
            dmLogout("anti ddddddddddddddebug LR: " + this.context.lr);
            return 0;
        }, 'int', ['int', 'int']));
    };

### hook JNI API NewStringUTF ###

### hook JNI API GetStringUTFChars ###

### hook Android URI 打印堆栈 ###

var hook_uri = function () {
        // coord: (7520,0,19) | addr: Ljava/net/URI;->parseURI(Ljava/lang/String;Z)V | loc: ?
        var uri = Java.use('java.net.URI');
        uri.parseURI.implementation = function (a1, a2) {
            a1 = a1.replace("xxxx.com", "yyyy.com");
    
            dmLogout("uri: " + a1);
            showStacks();
            return this.parseURI(a1, a2);
        }
    }

### hook KXmlSerializer 拼装内容 ###

### hook Android Log 输出 ###

### native 主动调用 ###

var friendlyFunctionName = new NativeFunction(friendlyFunctionPtr, 'void', ['pointer', 'pointer']);
    var returnValue = Memory.alloc(sizeOfLargeObject);
    friendlyFunctionName(returnValue, param1);

[https_www.52pojie.cn_thread-1196917-1-1.html]: https://www.52pojie.cn/thread-1196917-1-1.html
[Frida Hook _Frida Hook Android _-CSDN_frida hook]: https://blog.csdn.net/zhy025907/article/details/89512096
[Frida_ - _Hook_-CSDN_frida]: https://blog.csdn.net/freakishfox/article/details/78289293
[Frida Java Hook _9_ - SecPulse.COM _]: https://www.secpulse.com/archives/132082.html
[APP_ -]: https://zhuanlan.zhihu.com/p/63899519
[https_zhuanlan.zhihu.com_p_339504595]: https://zhuanlan.zhihu.com/p/339504595
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5pOS6LS85YWI5pOS546L_size_20_color_FFFFFF_t_70_g_se_x_16]: /images/20221119/382ffd6696ac472d813bd73373ec3062.png
[-]: https://www.54nb.com/androids/index.html
[langgithub _ GitHub]: https://github.com/langgithub
[GitHub - langgithub_SekiroIOS_ SekiroIOS_IOS_Sekiro_IOS]: https://github.com/langgithub/SekiroIOS
[GitHub - langgithub_sekiro-lang_ sekiro_ sekiro_ sekiroIOS sekiroAndroid sekiroPython sekiroXposed sekiroFrida sekiroUnidbg]: https://github.com/langgithub/sekiro-lang
[GitHub - langgithub_SekiroPython_ sekiropython_sekiro_frida rpc_frida usb]: https://github.com/langgithub/SekiroPython
[GitHub - langgithub_unidbg-lang]: https://github.com/langgithub/unidbg-lang
[GitHub - langgithub_FridaInject]: https://github.com/langgithub/FridaInject
[GitHub - langgithub_hello_ _xposed_demo]: https://github.com/langgithub/hello
[frida_app_hook_baoxianshi.html at master _ langgithub_frida_app_hook _ GitHub]: https://github.com/langgithub/frida_app_hook/blob/master/baoxianshi.html
[GitHub - barry-ran_QtScrcpy_ Android real-time display control software]: https://github.com/barry-ran/QtScrcpy
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70]: /images/20221119/93aa133c6aae4c84a2b056b04dd9b7a5.png
[https_www.jb51.net_softs_747562.html]: https://www.jb51.net/softs/747562.html
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20210608005814472.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx,size_16,color_FFFFFF,t_70
[Objection_ - _ -]: https://www.cnblogs.com/qiaorui/p/13455420.html
[Link 1]: https://juejin.cn/post/6844904127705661448#heading-9
[https_github.com_lateautumn4lin_arida]: https://github.com/lateautumn4lin/arida
[Android_Hook_Frida]: https://blog.csdn.net/jiangwei0910410003/article/details/80372118
[Frida]: https://www.frida.re/docs/javascript-api/#java
[Frida_ - JavaScript API]: https://zhuanlan.kanxue.com/article-342.htm
[Frida_ - JavaScript API 1]: https://zhuanlan.kanxue.com/article-414.htm
[Js_String Byte]: https://blog.csdn.net/LightUpHeaven/article/details/81240862
[Frida learn by example]: http://blog.ninoishere.com/frida-learn-by-example/
[Hook]: http://www.threetails.xyz/2019/07/14/Frida%20Hook%20Java/
[https_www.52pojie.cn_forum.php_mod_viewthread_tid_931872]: https://www.52pojie.cn/forum.php?mod=viewthread&tid=931872
[Welcome _ Frida _ A world-class dynamic instrumentation framework]: https://frida.re/docs/home/
[Frida_frida_-Android_-_-_bbs.pediy.com]: https://bbs.pediy.com/thread-226846.htm
[https_www.52pojie.cn_thread-1128884-1-1.html]: https://www.52pojie.cn/thread-1128884-1-1.html
[Ta]: https://bbs.pediy.com/user-811277.htm
[Releases _ frida_frida _ GitHub]: https://github.com/frida/frida/releases
[20210128130543263.png]: https://img-blog.csdnimg.cn/20210128130543263.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200721183801182.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx,size_16,color_FFFFFF,t_70
[Link 2]: https://www.52pojie.cn/thread-661779-1-1.html
[frida_Hook native_1_Fly20141201. _-CSDN_frida hook so]: https://blog.csdn.net/qq1084283172/article/details/80788959
[frida_Hook native_0901-1-CSDN]: https://blog.csdn.net/cpongo1/article/details/102580584
[Frida_Frida Java Hook]: https://segmentfault.com/a/1190000039041770
[hook_frida_ -]: https://www.jianshu.com/p/51e6aef175a2
[frida hook AES DES RSA _bilibili]: https://www.bilibili.com/video/av927982888/
[frida hook AES DES RSA _ - _ -]: https://www.cnblogs.com/shlyd/p/14057423.html
[frida hook java_weixin_34365417_-CSDN]: https://blog.csdn.net/weixin_34365417/article/details/93088342
[GitHub - zhudongjie_FridaHookSysAPI_ System level encryption algorithm Hook from Frida]: https://github.com/zhudongjie/FridaHookSysAPI
[Frida Hook -]: https://www.jianshu.com/p/4291ee42c412
[App _ frida _ Okhttp _-CSDN]: https://blog.csdn.net/cqcre/article/details/107293553
[Android_ -]: https://www.jianshu.com/p/e97530e9e0b6
[android _ - _ -]: https://www.cnblogs.com/waterhorse/p/5153624.html
[20210128162213285.png]: https://img-blog.csdnimg.cn/20210128162213285.png
[20210128162254658.png]: https://img-blog.csdnimg.cn/20210128162254658.png
[20210128162505113.png]: https://img-blog.csdnimg.cn/20210128162505113.png
[20210128162757625.png]: https://img-blog.csdnimg.cn/20210128162757625.png
[frida-python_core.py at master _ frida_frida-python _ GitHub]: https://github.com/frida/frida-python/blob/master/frida/core.py
[Welcome _ Frida _ A world-class dynamic instrumentation framework 1]: https://www.frida.re/docs/home/
[20210128114317573.png]: https://img-blog.csdnimg.cn/20210128114317573.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/2021012811442162.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20210128114624958.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx,size_16,color_FFFFFF,t_70
[GitHub - xiaokanghub_Android_ Android _Hook_-Frida]: https://github.com/xiaokanghub/Android
[frida_hook-_-_-_bbs.pediy.com]: https://bbs.pediy.com/thread-258200.htm
[FRIDA _-]: https://developer.aliyun.com/article/690210