美文网首页
frida基础应用

frida基础应用

作者: KinKen | 来源:发表于2019-07-24 10:57 被阅读0次

    一、获取第一个USB设备

    #!/usr/bin/env python2
    # -*- coding: utf-8 -*-
    
    import sys
    import frida
    import threading
    
    def get_usb_iphone():
        dManager = frida.get_device_manager();
        changed = threading.Event()
        def on_changed():
            changed.set()
        dManager.on('changed',on_changed)
    
        device = None
        while device is None:
            devices = [dev for dev in dManager.enumerate_devices() if dev.type =='usb']
            if len(devices) == 0:
                print ('Waiting for usb device...')
                changed.wait()
            else:
                device = devices[0]
    
        dManager.off('changed',on_changed)
    
        return device
    
    def main():
        device = get_usb_iphone()
        print ('设备信息:' + str(device))
    
    if __name__ == '__main__':
        try:
            main()
        except KeyboardInterrupt:
            sys.exit()
        else:
            pass
        finally:
            pass
    

    二、枚举进程信息

    #!/usr/bin/env python2
    # -*- coding: utf-8 -*-
    
    import sys
    import frida
    import threading
    
    #系统标准输出,支持grep
    def outWrite(text):
        sys.stdout.write(text.encode('utf8') + '\n');
    
    #获取设备信息
    def get_usb_iphone():
        dManager = frida.get_device_manager();
        changed = threading.Event()
        def on_changed():
            changed.set()
        dManager.on('changed',on_changed)
    
        device = None
        while device is None:
            devices = [dev for dev in dManager.enumerate_devices() if dev.type =='usb']
            if len(devices) == 0:
                print ('Waiting for usb device...')
                changed.wait()
            else:
                device = devices[0]
    
        dManager.off('changed',on_changed)
    
        return device
    
    #枚举运行进程
    def listRunningProcess():
        device = get_usb_iphone();
        processes = device.enumerate_processes();
        processes.sort(key = lambda item : item.pid)
        outWrite('%-10s\t%s' % ('pid', 'name'))
        for process in processes:
            outWrite('%-10s\t%s' % (str(process.pid),process.name))
    
    def main():
        listRunningProcess()
    
    if __name__ == '__main__':
        try:
            main()
        except KeyboardInterrupt:
            sys.exit()
        else:
            pass
        finally:
            pass
    

    三、列出所有已安装应用

    #!/usr/bin/env python2
    # -*- coding: utf-8 -*-
    
    import sys
    import frida
    import codecs
    import threading
    
    global session
    
    finished = threading.Event()
    
    APP_JS = './js/app.js'
    
    #系统标准输出,支持grep
    def outWrite(text):
        sys.stdout.write(text.encode('utf8') + '\n');
    
    #从JS接受信息
    def on_message(message, data):
        if message.has_key('payload'):
            payload = message['payload']
            if isinstance(payload, dict):
                deal_message(payload)
            else:
                print payload
    
    #处理JS调用后返回的信息
    def deal_message(payload):
        #基本信息输出
        if payload.has_key('mes'):
            print payload['mes']
    
        #安装app信息
        if payload.has_key('app'):
            app = payload['app']
            lines = app.split('\n')
            for line in lines:
                if len(line):
                    arr = line.split('\t')
                    if len(arr) == 3:
                        outWrite('%-40s\t%-70s\t%-80s' % (arr[0], arr[1], arr[2]))
    
        #处理完成事件
        if payload.has_key('finished'):
            finished.set()
    
    #获取设备信息
    def get_usb_iphone():
        dManager = frida.get_device_manager();
        changed = threading.Event()
        def on_changed():
            changed.set()
        dManager.on('changed',on_changed)
    
        device = None
        while device is None:
            devices = [dev for dev in dManager.enumerate_devices() if dev.type =='usb']
            if len(devices) == 0:
                print ('Waiting for usb device...')
                changed.wait()
            else:
                device = devices[0]
    
        dManager.off('changed',on_changed)
    
        return device
    
    #加载JS文件脚本
    def loadJSFile(session, filename):
        source = ''
        with codecs.open(filename, 'r', 'utf-8') as f:
            source = source + f.read()
        script = session.create_script(source)
        script.on('message', on_message)                    #调用JS后返回数据,Python做的回调
        script.load()                                       #加载JS脚本
        return script
    
    def main():
        global session
    
        device = get_usb_iphone()
    
        session = device.attach('SpringBoard')              #注入SpringBoard来获取一个session
        script = loadJSFile(session, APP_JS)                #加载JS脚本
        script.post({'cmd' : 'installed'})                  #获取所有已安装应用信息          
        finished.wait()
    
    if __name__ == '__main__':
        try:
            main()
        except KeyboardInterrupt:
            if session:
                session.detatch()
            sys.exit()
        else:
            pass
        finally:
            pass
    

    四、枚举进程加载的所有模块

    原实现提示session没有enumerate_modules这个API

    #枚举某个进程的所有模块信息
    def listModulesoOfProcess(session):
        moduels = session.enumerate_modules()
        moduels.sort(key = lambda item : item.base_address)
        for module in moduels:
            outWrite('%-40s\t%-10s\t%-10s\t%s' % (module.name, hex(module.base_address), hex(module.size), module.path))
        session.detach()
    

    使用以下实现

    #!/usr/bin/env python2
    # -*- coding: utf-8 -*-
    
    import sys
    import frida
    import threading
    
    global session
    
    #系统标准输出,支持grep
    def outWrite(text):
        sys.stdout.write(text.encode('utf8') + '\n');
    
    #获取设备信息
    def get_usb_iphone():
        dManager = frida.get_device_manager();
        changed = threading.Event()
        def on_changed():
            changed.set()
        dManager.on('changed',on_changed)
    
        device = None
        while device is None:
            devices = [dev for dev in dManager.enumerate_devices() if dev.type =='usb']
            if len(devices) == 0:
                print ('Waiting for usb device...')
                changed.wait()
            else:
                device = devices[0]
    
        dManager.off('changed',on_changed)
    
        return device
    
    def on_message(message, data):
        print("[on_message] message:", message, "data:", data)
    
    #列出程序加载的模块
    def listModulesOfProcess(session):
        script = session.create_script("""
            'use strict';
            rpc.exports.enumerateModules = function () {
            return Process.enumerateModulesSync();
            };"""
            )
        script.on("message", on_message)
        script.load()
        modules = script.exports.enumerate_modules()
        modules.sort(key = lambda item : item['base'])
        outWrite('%-40s\t%-10s\t%-10s\t%s' % ('module name', 'module base', 'module size', 'module path'))
        for module in modules:
            outWrite('%-40s\t%-10s\t%-10s\t%s' % (module['name'],module['base'], module['size'], module['path']))
    
    def main():
        global session
        device = get_usb_iphone()
        session = device.attach(1771)   #1771为pid
        listModulesOfProcess(session)
    
    if __name__ == '__main__':
        try:
            main()
        except KeyboardInterrupt:
            if session:
                session.detach()
            sys.exit()
        else:
            pass
        finally:
            pass
    
    

    五、 显示当前界面UI

    #!/usr/bin/env python2
    # -*- coding: utf-8 -*-
    
    import sys
    import frida
    import codecs
    import threading
    
    global session
    
    UI_JS = '/Users/ruanjianqin/ReverseTool/frida脚本分析调试/js/ui.js'
    
    #带颜色打印输出
    def colorPrint(color, s):
        return "%s[31;%dm%s%s[0m" % (chr(27), color, s , chr(27))
    
    #获取设备
    def get_usb_iphone():
        dManager = frida.get_device_manager();   #获取设备管理器
        changed = threading.Event()
        def on_changed():
            changed.set()
        dManager.on('changed',on_changed)        #监听添加设备的事件
    
        device = None
        while device is None:
            devices = [dev for dev in dManager.enumerate_devices() if dev.type =='usb']  #类型为tether为USB连接的设备
            if len(devices) == 0:
                print 'Waiting for usb device...'
                changed.wait()
            else:
                device = devices[0]              #获取第一个设备
    
        dManager.off('changed',on_changed)    
    
        return device
    
    #从JS接受信息
    def on_message(message, data):
        if message.has_key('payload'):
            payload = message['payload']
            if isinstance(payload, dict):
                deal_message(payload)
            else:
                print payload
    
    #处理JS中不同的信息
    def deal_message(payload):
        #基本信息输出
        if payload.has_key('mes'):
            print payload['mes']
    
        #处理UI界面输出
        if payload.has_key('ui'):
            print colorPrint(31, payload['ui'])
    
    #加载JS文件脚本
    def loadJsFile(session, filename):
        source = ''
        with codecs.open(filename, 'r', 'utf-8') as f:
            source = source + f.read()
        script = session.create_script(source)
        script.on('message', on_message)
        script.load()
        return script
    
    def main():
        global session
        
        device = get_usb_iphone()
        session = device.attach(long(sys.argv[1]))
        script = loadJsFile(session, UI_JS)
        print device
        print session
        print script
        while True:
            line = sys.stdin.readline()
            if not line:
                break
            script.post(line[:-1])
    
    
    if __name__ == '__main__':
        try:
            main()
        except KeyboardInterrupt:
            if session:
                session.detach()
            sys.exit()
        else:
            pass
        finally:
            pass
    

    相关文章

      网友评论

          本文标题:frida基础应用

          本文链接:https://www.haomeiwen.com/subject/powtrctx.html