Frida Hook so示例模板

拼搏现实的明天。 2023-10-01 10:37 20阅读 0赞

# -*- coding: utf-8 -*-
    # @Author  : Codeooo
    # @Time    : 2021/12/24
    
    
    import frida
    import sys
    
    
    
    """
    NDK开发
    https://blog.csdn.net/weixin_38927522/article/details/120078401
    动静态注册
    https://blog.csdn.net/weixin_38927522/article/details/119672156
    """
    
    
    
    # hook so层方法
    jscode = """
    Java.perform(function(){
        Interceptor.attach(Module.findExportByName("libfridaso.so","Java_com_example_fridasostring_fridaSoString_FridaSo"),{
            onEnter: function(args) {
                send("Hook start");
                send("args[2]=" + args[2]); //这里打印第一个参数为下标2,因为静态注册: 0,1 为JNIEnv* env,jobject obj|jclass clazz 动态注册: JavaVM* vm
            },
            onLeave: function(retval){
                send("return:"+retval);
                var env = Java.vm.getEnv(); //获取env对象，也就是native函数的第一个参数
                var jstrings = env.newStringUtf("tamper"); //因为返回的是字符串指针，使用我们需要构造一个newStringUtf对象，用来代替这个指针
                retval.replace(jstrings); //替换返回值
            }
        });
    });
    """
    
    jscode_fun = """
    Java.perform(function(){
        var str_name_so = "libnative-lib.so";    //要hook的so名
        var str_name_func = "func_exp";          //要hook的函数名
        //var str_name_func = "_Z12func_exp_cppv";    //这里注意名称
        
        var n_addr_func = Module.findExportByName(str_name_so , str_name_func);
        console.log("func addr is ---" + n_addr_func);
        
        Interceptor.attach(n_addr_func, {
            //在hook函数之前执行的语句
            onEnter: function(args)
            {
                console.log("hook on enter")
            },
            //在hook函数之后执行的语句
            onLeave:function(retval)
            {
                console.log("hook on leave")
            }
        });
    });
    """
    
    # hook so地址
    jscode_addr = """
    Java.perform(function(){
        var str_name_so = "libnative-lib.so";    //要hook的so名
        var n_addr_func_offset = 0x7078;         //要hook的函数在函数里面的偏移
        
        //加载到内存后 函数地址 = so地址 + 函数偏移
        var n_addr_so = Module.findBaseAddress(str_name_so);
        var n_addr_func = parseInt(n_addr_so, 16) + n_addr_func_offset;
        
        var ptr_func = new NativePointer(n_addr_func);
        Interceptor.attach(ptr_func, 
        {
            onEnter: function(args) 
            {
                console.log("hook on enter no exp");
            },
            onLeave:function(retval)
            {
                console.log("hook on Leave no exp");
            }
        });
    });
    """
    
    
    
    
    def printMessage(message,data):
        if message['type'] == 'send':
            print(' {0}'.format(message['payload']))
        else:
            print(message)
    
    process = frida.get_remote_device().attach('com.sun.codeooo')
    script = process.create_script(jscode)
    script.on('message',printMessage)
    script.load()
    sys.stdin.read()