Android逆向 frida练习

作者: LiuJP | 来源:发表于2020-06-20 10:33 被阅读0次

Android逆向 frida练习
逆向提取360 root方案
Android逆向 Frida的安装
免Root使用Frida的一种简易方案
人民**新闻APP逆向实战
Android逆向多种特征检测 Frida
Android逆向 Frida的Hook之旅
Android逆向 Frida自动脱壳Fart
每日总结-第五十二天-Android脱壳
Android逆向之hook框架frida篇

多看官方文档https://frida.re/docs/javascript-api/

飞智游戏厅server分析：
hook 偏移地址

setImmediate(function () {
    var base = Module.findBaseAddress("knife_server");
    console.log(base);
    var hh = base.add(0x311C).add(1);
    console.log("hh1:" + hh);
    Interceptor.attach(hh, {
        onEnter: function (args) {
            console.log("onEnter",args[0],args[1],args[2]);
        },
        onLeave: function (retval) {
            console.log("return:");
        },
    });
    Interceptor.attach(Module.findExportByName("libc.so", "read"), {
        onEnter: function (args) {
            console.log("read:", args[0],args[1], args[2]);
        },
        onLeave: function (retval) {
            console.log("ret:" + retval);
        }
    });
});

hook java

setImmediate(function () {
    //基地址
    // var base = Module.findBaseAddress("knife_server");
    // var hh = base.add(0x21B0);
    // console.log("hh:" + hh);

    // Interceptor.attach(ptr(hh), {
    //     onEnter: function (args) {
    //         console.log("Enter CheckSN()")
    //     },
    //     onLeave: function (retval) {
    //         console.log("return:");
    //     },
    // });
    // console.log("base:" + new NativePointer(base+0x12600).readU8());

    //export 变量符号
    // var sys_touchscreen_param = Module.findExportByName("libmotionelf_server.so", "sys_touchscreen_param");
    //读取 unsigned char U8
    // console.log(":" + ptr(sys_touchscreen_param).readU8());
    // var fd_x9e = Module.findExportByName("libmotionelf_server.so", "fd_x9e");
    // console.log("fd_x9e:", ptr(fd_x9e).readU8());
    // // var touch_fd = Module.findExportByName("libmotionelf_server.so", "touch_fd");
    // // console.log("touch_fd:", ptr(touch_fd).readU32());
    // var dev_touch = Module.findExportByName("libmotionelf_server.so", "dev_touch");
    // console.log("dev_touch:", ptr(dev_touch).readU32());

    // var sys_touchscreen_param = Module.findExportByName("libmotionelf_server.so", "sys_touchscreen_param");
    // console.log("sys_touchscreen_param:", ptr(sys_touchscreen_param).readU32());
    // var abs_b = Module.findExportByName("libmotionelf_server.so", "abs_b");
    // console.log("abs_b:", ptr(abs_b).readU8());
    // Interceptor.attach(Module.findExportByName("libmotionelf_server.so", "testX9eProp"), {
    //     onEnter: function (args) {
    //         console.log("testX9eProp called! args[0]", args[0]);
    //     },
    //     onLeave: function (retval) {
    //         console.log("ret:" + retval);
    //     }
    // });
    // Interceptor.attach(Module.findExportByName("libmotionelf_server.so", "jniSendRawTouch"), {
    //     onEnter: function (args) {
    //         //读取byte 数组
    //         console.log("jniSendRawTouch called! args[0]", Memory.readByteArray(args[0], 48))
    //     },
    //     onLeave: function (retval) {
    //         console.log("ret:" + retval);
    //     }
    // });

    // var real_touch_buf = Module.findExportByName("libmotionelf_server.so", "real_touch_buf");
    // console.log("real_touch_buf:", Memory.readByteArray(real_touch_buf, 24));
    // Thread.s/leep(500000);

    // var f1 = Module.findExportByName("libmotionelf_server.so", "send_data_to_app");
    // console.log("send_data_to_app:" + f1);
    // Interceptor.attach(f1, {
    //     onEnter: function (args) {
    //         console.log("send_data_to_app() called! args[0]\n", args[0]);
    //     },
    //     onLeave: function (retval) {
    //         console.log("ret:" + retval);
    //     }
    // });

    //  var f1 = Module.findExportByName("libmotionelf_server.so", "process_gamectrl_generic_data");
    // Interceptor.attach(f1, {
    //     onEnter: function (args) {
    //         console.log("process_gamectrl_generic_data() called! args[0] ", args[0]);
    //     },
    //     onLeave: function (retval) {
    //         // console.log("ret:" + retval);
    //     }
    // });
    // var f1 = Module.findExportByName("libmotionelf_server.so", "socket_client_write_udp");
    // Interceptor.attach(f1, {
    //     onEnter: function (args) {
    //         console.log("socket_client_write_udp() called! args[0]", args[0])
    //     },
    //     onLeave: function (retval) {
    //         console.log("ret:" + retval);
    //     }
    // });
    // Interceptor.attach(Module.findExportByName("libmotionelf_server.so", "thread_read_touch"), {
    //     onEnter: function (args) {
    //         console.log("thread_read_touch() called! args[0]", Memory.readByteArray(args[0], 48));
    //     },
    //     onLeave: function (retval) {
    //         console.log("thread_read_touch ret:" + retval);
    //     }
    // });
    // Interceptor.attach(Module.findExportByName("libmotionelf_server.so", "fd_find_event_key"), {
    //     onEnter: function (args) {
    //         console.log("fd_find_event_key() called! args[0]", args[0]);
    //     },
    //     onLeave: function (retval) {
    //         console.log("fd_find_event_key ret:" + retval);
    //         // var TouchEventBuf = Module.findExportByName("libmotionelf_server.so", "TouchEventBuf");
    //         // console.log("TouchEventBuf:args[0]", Memory.readByteArray(TouchEventBuf, 16));
    //     }
    // });
    // Interceptor.attach(Module.findExportByName("libmotionelf_server.so", "uinput_report_touch_reset_touch"), {
    //     onEnter: function (args) {
    //         console.log("uinput_report_touch_reset_touch() called! args[0]", args[0]);
    //     },
    //     onLeave: function (retval) {
    //         console.log("uinput_report_touch_reset_touch ret:" + retval);
    //     }
    // });
    // var dev_touch = Module.findExportByName("libmotionelf_server.so", "dev_touch");
    // console.log("dev_touch:"+ptr(dev_touch).readU32());

    //立刻执行
    Java.performNow(function () {
        //  var FZToolMain = Java.use('com.flydigi.tool.FZToolMain');
        var InputManager = Java.use('android.hardware.input.InputManager');
        // var e = Java.use("com.coffee.injectmotionevent.d.e");
        // var a = Java.use("com.coffee.injectmotionevent.e.a");

        var MotionEvent = Java.use("android.view.MotionEvent");
        // var String = Java.use("java.lang.String");
        var PointerProperties = Java.use('android.view.MotionEvent$PointerProperties');
        var PointerCoords = Java.use('android.view.MotionEvent$PointerCoords');
        MotionEvent.obtain.overload('long', 'long', 'int', 'int', '[Landroid.view.MotionEvent$PointerProperties;', '[Landroid.view.MotionEvent$PointerCoords;', 'int', 'int', 'float', 'float', 'int', 'int', 'int', 'int').implementation = function (a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12, a13) {
            console.log("action", a2);
            console.log("count", a3);
            // var a44 = Java.cast(a4[0], PointerProperties);
            console.log("properties" + a4[0]);
            console.log("coords" + a5.length);
            var a55 = Java.cast(a5[0], PointerCoords);
            console.log("coords x:", a55.getAxisValue(0));
            console.log("coords y:", a55.getAxisValue(1));
            console.log("coords pressure", a55.getAxisValue(2));
            console.log("coords size", a55.getAxisValue(3));
            console.log("coords touchMajor", a55.getAxisValue(4));
            console.log("coords touchMinor", a55.getAxisValue(5));
            console.log("coords toolMajor", a55.getAxisValue(6));
            console.log("coords toolMinor", a55.getAxisValue(7));
            console.log("coords orientation", a55.getAxisValue(8));
            console.log("meta", a6);
            console.log("button", a7);
            console.log("xP", a8);
            console.log("yP", a9);
            console.log("devId", a10);
            console.log("edgeflag", a11);
            console.log("source", a12);
            console.log("flag", a13);
            return this.obtain(a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12, a13);
        };
        // var members = MotionEvent.class.getDeclaredMethods();
        // var method;
        // members.forEach(function (member) {
        //     // console.log("member: ", member.getParameterCount());
        //     if (member.getName() == "obtain" && member.getParameterCount()==14) {

        //         method = member;
        //     }
        // });
        // console.log("member: 1 ", method);

        // method.implementation = function(a0,a1,a2,a3,a4,a5,a6,a7,a8,a9,a10,a11,a12,a13){
        //     // method.in
        // }
        // String.$init.overload('[C', 'int', 'int').implementation = function(a0,a1,a2){
        //     console.log("!!",this);
        //     var ret  =  this.$init(a0,a1,a2);
        //     return ret;
        // }
        // String.split.overload('java.lang.String').implementation = function(a0){
        //     console.log("~~",this);
        //     return this.split(a0);
        // }
        // e.a.overload('com.coffee.injectmotionevent.bean.DeviceInfo', 'int', 'int', 'float', 'float').implementation = function (a0, a1, a2, a3, a4) {
        //     console.log("??", a0, a1, a2, a3, a4);
        //     console.log(Process.getCurrentThreadId());
        //     console.log(Process.id);
        //     return this.a(a0, a1, a2, a3, a4);
        // };
        // e.a.overload('java.lang.String').implementation = function (args0) {
        //     console.log("?:", args0);
        //     return this.a(args0);
        // };
        InputManager.injectInputEvent.overload("android.view.InputEvent", "int").implementation = function (args0, args1) {
            console.log("injectInputEvent: ", args0, args1);
            console.log(Process.getCurrentThreadId());
            console.log(Process.id);
            return this.injectInputEvent(args0, args1);
        };
        // var enumerateThreads = Process.enumerateThreads();
        // for (var i = 0; i < enumerateThreads.length; i++) {
        //     console.log("");
        //     console.log("id:", enumerateThreads[i].id);
        //     console.log("state:", enumerateThreads[i].state);
        //     console.log("context:", JSON.stringify(enumerateThreads[i].context));
        // }
        // var Exception = Java.use('java.lang.Exception');
        //  overload 指定参数类型
        // FZToolMain.receiveTouchData.overload('[B').implementation = function (args) {
        //     console.log('receiveTouchData() ', bytesToHex(args));
        //     // console.log("FZToolMain ", Process.getCurrentThreadId());
        //     this.receiveTouchData(args);
        // };
        //     var KeyEvent = Java.use("android.view.KeyEvent");
        //     FZToolMain.injectEvent.overload('android.view.KeyEvent').implementation = function (args) {
        //         var m = Java.cast(args, KeyEvent);
        //         console.log("\ninjectKeyEvent:", m);
        //         this.injectEvent(args);
        //     };

        // FZToolMain.InjectUp.implementation = function (args) {
        // //     // var m=Java.cast(args,KeyEvent);
        //     console.log("\n InjectUp:", args);
        //     this.InjectUp(args);
        // };

        // console.log("Java.available args[0]", Java.enumerateLoadedClassesSync());
        // Java.enumerateLoadedClasses({
        //     onMatch: function (className) {
        //         console.log(className);
        //     },
        //     onComplete: function () {
        //         console.log("done");
        //     }
        // });
    });
});

Android逆向 frida练习
多看官方文档https://frida.re/docs/javascript-api/ 飞智游戏厅server分析...
逆向提取360 root方案
0x00 安装frida 请参见：Android逆向之hook框架frida篇 0x01 获取360root ap...
Android逆向 Frida的安装
1、问题1 有一个SSL 错误这个是证书问题以上填你对用的python 版本 2、去官网下载库，安装https:...
免Root使用Frida的一种简易方案
前言在Android逆向过程中，除了Xposed，还有一个必不可少的Hook神器，那就是Frida。而且，Fir...
人民**新闻APP逆向实战
最近学习frida上瘾啊。今日上某日报APP的逆向。环境：python：3.6+frida：12.6.4jadx：...
Android逆向多种特征检测 Frida
多种特征检测 Frida. 转载自 https://bbs.pediy.com/thread-217482.htm...
Android逆向 Frida的Hook之旅
1 安装python环境 mac 自带不需要安装 2 安装pip easy_install pip 3 安装fri...
Android逆向 Frida自动脱壳Fart
每日总结-第五十二天-Android脱壳
参考链接 ApkShelling脱壳和FART脱壳Frida从入门到入门—安卓逆向菜鸟的frida食用说明初识Fr...
Android逆向之hook框架frida篇
前言 Frida是一款基于python + javascript 的hook框架，通杀android\ios\li...