frida, 启动!#

如果报错 {"type":"error","description":"Error: invalid address","stack":"Error: invalid address\n    at Object.value [as patchCode] (frida/runtime/core.js:170:.....}
>>> setenforce 0

>>> adb shell
>>> su
>>> cd /data/local/tmp
>>> ./frida    ./fd14   ./fuck h

>>> adb forward tcp:27042 tcp:27042
>>> adb forward tcp:27043 tcp:27043

操作app#

启动app到某个activity

am start 包名/活动名

eg. am start com.jamcz.test/com.jamcz.test.MainActivity

如果活动中含有包名，包名可以用 . 替代

eg. am start com.jamcz.test/.MainActivity

提取apk

1. 获取apk路径pm path com.xx.xx exit
2. 推送 adb pull /phone_path window_path

输入#

adb shell input text "......"

input text ......

更改端口#

服务端

cd /data/local/tmp
./frida -l 0.0.0.0:9999

转发端口 adb forward tcp:9999 tcp:9999

更改端口 frida-ps -H 127.0.0.1:9999

加载脚本 frida -H 127.0.0.1:9999 com.xxx.xxx -l hook.js

修改服务器进程名#

frida-server -> ns

使用hluda#

cd /data/local/tmp
./hluda

其它一样

D-Bus通信协议检测#

App向每一个端口都发送了D-Bus认证消息，那肯定会利用strcmp( )或者strstr( )函数进行检测回复的消息

function hook_strcmp() {
    var strcmp = Module.findExportByName('libc.so', "strcmp");
    Interceptor.attach(strcmp, {
        onEnter : function (args) {
            if (args[1].readCString().indexOf("REJECT")!=-1){
            console.log(args[0].readCString());
            console.log(args[1].readCString());
            }
        }, onLeave : function(retval) {
        }
    })
}

有的app检测非常恶心，只要是maps和fd中存在/data/local/tmp/，甚至只有tmp的字段，app就给kill掉。因为这个目录对于安卓逆向工作来说，是一个比较敏感的目录。hluda-server和frida-server都会在/data/local/tmp/目录下生成一个包含frida所需要的so库等文件。所以当app一旦发现了加载了/data/local/tmp下的任何东西，直接就挂掉。 ———————————————— 原文链接：https://blog.csdn.net/weixin_43889136/article/details/127713563

function main() {
    const openPtr = Module.getExportByName('libc.so', 'open');
    const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
    var readPtr = Module.findExportByName("libc.so", "read");
    var read = new NativeFunction(readPtr, 'int', ['int', 'pointer', "int"]);
    var fakePath = "/data/data/******/maps";
    var file = new File(fakePath, "w");
    var buffer = Memory.alloc(512);
    Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
        var pathname = Memory.readUtf8String(pathnameptr);
        var realFd = open(pathnameptr, flag);
        if (pathname.indexOf("maps") != 0) {
            while (parseInt(read(realFd, buffer, 512)) !== 0) {
                var oneLine = Memory.readCString(buffer);
                if (oneLine.indexOf("tmp") === -1) {
                    file.write(oneLine);
                }
            }
            var filename = Memory.allocUtf8String(fakePath);
            return open(filename, flag);
        }
        var fd = open(pathnameptr, flag);
        return fd;
    }, 'int', ['pointer', 'int']));
}
setImmediate(main)

frida反调试#

P-trace占坑

查看手机上正在运行的进程 ps -A

过滤关键字 ps -A | grep [app包名] app包名不用写全，有一点就行

只要看到有两个进程的，其中之一就是用了p-trace占坑，另一个是主进程

注意，包名后面有:的不算

解决方案

1. 尝试把占坑的进程杀掉，但不一定成功 kill -9 [进程id]
2. 使用spawn方法启动frida，让hook脚本早于占坑的进程
3. aosp刷机改源码，让app自己附加的进程都启动失败 :laughing:
4. 输出用到的so文件（代码见“打印用到的so文件”），看执行到哪里程序终端，把那个so删了逝世。系统so不需要管。

博客推荐#

http://1997.pro/

https://www.redoc.top/article/1188-Android%20%E9%80%86%E5%90%91%E6%9F%90%E7%94%9F%E9%B2%9C%E5%B9%B3%E5%8F%B0app

定位hook#

1. hook map map.put(data, "加密的data")
2. hook stringBuilder sb.append('data')
3. hook base64
4. 所有接口都有某个加密，hook 拦截器；hook每个拦截器，打印

构造方法 遇到this.x#

public final class SignedQuery {
    ...    
	// 搜索sign= 或&sign 找到 
     // hook它看是谁创建了这个对象
    public String toString() {
        String str = this.a;
        if (str == null) {
            return "";
        }
        if (this.b == null) {
            return str;
        }
        return this.a + "&sign=" + this.b; // 生成sign的地方
                                            // aid=xxx&... + "&sign=" + ths.b
    }
}

目标：找this.b，也就是生成sign的地方

注意到该类构造方法

public final class SignedQuery {
    ...
// 有地方实例化了这个对象 传入了这两个参数 或者hook这个构造方法 $init
    public SignedQuery(String str, String str2) {
        this.a = str;
        this.b = str2; // sign
    }
    ...
}

方法：输出调用栈 -> 找到上一层，谁调用了toString()

aVar.s(h).l(c0.create(w.d("application/x-www-form-urlencoded; charset=utf-8"), h(hashMap).toString()));

请求体 = h(hashMap).toString()相当于请求体 =SignedQuery对象.toString()，前面肯定有newSignedQuery对象的地方

    // 返回了SignedQuery 传入了map
    public SignedQuery h(Map<String, String> map) {
        return LibBili.g(map); // 看看是怎么生成SignedQuery的 关注实例化它的时候第二个参数 即是sign
    }

    // 相当于把原来的map转成Treemap(有序的) 然后调用s
    public static SignedQuery g(Map<String, String> map) {
        return s(map == null ? new TreeMap() : new TreeMap(map));
    }

static native SignedQuery s(SortedMap<String, String> sortedMap);

是在so层创建的对象，返回SignedQuery对象

参考正向开发-静态方法

抽象方法/接口#

开发角度 https://youtu.be/HvPlEJ3LHgE?si=v-h88b1bsKmSv6i0 看完就会

public abstract a_func();

首先往上滑，找到a_func是哪个类(假设是BClass)，然后查找类的用例或者全局搜索

同时，看看调用这个函数的时候创建的是什么类（由什么类调用这个函数的）可以为之前的查找作为借鉴

格式应该是 public class AClass extends BClass(){} 进入这里面后 查询a_func方法就能找到它的具体代码

反射#

clazz = KeyInfo.class; // 类
object = KeyInfo.class.newInstance();  // 实例化
method = clazz.getMethod("getInfo", Context.class, String.class);
return (String) method.invoke(object, context, str);

双击进入类KeyInfo去寻找getInfo方法

so#

1. ida
2. hook看看返回值是否固定 清除数据
3. 抓包看是否固定

❤so实例化对象相关#

  v22 = a1->functions->FindClass(a1, "javax/crypto/Cipher");
  v23 = a1->functions->GetStaticMethodID(a1, v22, "getInstance", "(Ljava/lang/String;)Ljavax/crypto/Cipher;");
  v24 = a1->functions->NewStringUTF(a1, "AES/CBC/PKCS5Padding");
  v58 = a1->functions->CallStaticObjectMethod((JNIEnv *)a1, v22, v23, v24);

这个方法签名表示getInstance()方法接受一个java.lang.String类型的参数，并且返回一个javax.crypto.Cipher类型的对象

相当于 Cipher obj = Cipher.getInstance("AES/CBC/PKCS5Padding")

    v25 = a1->functions->NewStringUTF(a1, "AES");
    v26 = a1->functions->FindClass(a1, "javax/crypto/spec/SecretKeySpec");
    v27 = a1->functions->GetMethodID(a1, v26, "<init>", "([BLjava/lang/String;)V");
    v21 = a1->functions->NewObject((JNIEnv *)a1, v26, v27, v20, v25);
    a1->functions->DeleteLocalRef((JNIEnv *)a1, v20);

相当于 SecretKeySpec secretKeySpec = new SecretKeySpec(字节数组"key", string "AES")

  v19 = (const jbyte *)j_getMD516(v60, s, v18);
  v20 = a1->functions->NewByteArray(a1, 16);
  v21 = 0;
//使用JNI中的SetByteArrayRegion()方法，设置Java中一个byte[]数组的值。具体来说，此函数将v19数组的前16个字节复制到Java中v20所代表的byte数组的前16个字节处。其中，v20是一个byte[]数组对象的引用，a1是一个JNIEnv对象的指针，v19是一个指针，指向一个长度至少为16个字节的缓冲区，该缓冲区保存了将作为初始化向量使用的字节序列。
  a1->functions->SetByteArrayRegion((JNIEnv *)a1, v20, 0, 16, v19);
  v59[0] = 0LL;
  v59[1] = 0LL;
  v59[2] = 0LL;
  v59[3] = 0LL;
  j_rand16Str();
  v22 = a1->functions->FindClass(a1, "javax/crypto/Cipher");
  v23 = a1->functions->GetStaticMethodID(a1, v22, "getInstance", "(Ljava/lang/String;)Ljavax/crypto/Cipher;");
  v24 = a1->functions->NewStringUTF(a1, "AES/CBC/PKCS5Padding");
  v58 = a1->functions->CallStaticObjectMethod((JNIEnv *)a1, v22, v23, v24);
  if ( v20 )
  {
    v25 = a1->functions->NewStringUTF(a1, "AES");
    v26 = a1->functions->FindClass(a1, "javax/crypto/spec/SecretKeySpec");
    v27 = a1->functions->GetMethodID(a1, v26, "<init>", "([BLjava/lang/String;)V");
    v21 = a1->functions->NewObject((JNIEnv *)a1, v26, v27, v20, v25);
    a1->functions->DeleteLocalRef((JNIEnv *)a1, v20);
  }

分析可知，v20是key.获取key有两种方法.用hook java的方法，和hookgetMD516的返回值:

hook指定长度的方法，见下面类型转换输出-控制长度输出

遇到了动态的iv#

有时可能遇到动态的iv，服务器需要解密就要知道key和iv，如何让服务器解密？可能会把iv添加在密文的前面，随着请求一起发送过去。可以hook base64，看看传入的参数里有没有出现iv. 也有可能把变化的key或iv放到请求头的某个参数中去

不要完全相信反编译出来的结果#

ida有时候会漏参数，或者有函数没传值进去<-没显示出来 be like :

// function(v26) vs function() 这里是空的

输出太多#

package com.yoloho.controller.api;

import java.security.MessageDigest;

public class PeriodAPIV2 extends NetAPI {
    ...
    public void setDeviceCode() {
        ...
        MessageDigest messageDigest = MessageDigest.getInstance("sha-1");
        messageDigest.update(str6.getBytes());
        byte[] digest = messageDigest.digest();
        ...
    }
}

var PeriodAPIV2 = Java.use("com.yoloho.controller.api.PeriodAPIV2");
var flag = false;  //防止输出太多东西

PeriodAPIV2.setDeviceCode.implementation = function () {
    console.log("-------------------------setDeviceCode-------------------------")
    flag = true;  //防止输出太多东西
    return this.setDeviceCode();
}

var MessageDigest = Java.use("java.security.MessageDigest");
var ByteString = Java.use("com.android.okhttp.okio.ByteString");
MessageDigest.update.overload("[B").implementation = function (data) {
    if (flag) {
        console.log(ByteString.of(data).utf8(), '\n' );
        console.log("---------------")
    }
    return this.update(data);
}

打印log#

adb logcat -s ActivityThread

interface#

某个方法在interface里

public interrface c {
    // ...
    String f(Context context, Long l);
}

法一：查找用例c 搜索方法名f

找到形如 public class u implements c{} 的代码。进入后寻找f的具体实现即可。

通常实现方法的两种代码如下

class Info implements ab {
    Info Obj = new Info;
}
// usage
obj.getColorStatParamStr();

or 类似于匿名

Ab obj = new ab() {
    Map<String, String> getColorStatParamStr(boolean z, boolean z2, boolean z3) {
        ...
    }
}
// usage
obj.getColorStatParamStr();

法二： hook输出类型

Map<String, String> colorStatParamStr = a.WV().getStatInfoConfigImpl().getColorStatParamStr(true, true, z);

public interface ab {
    Map<String, String> getColorStatParamStr(boolean z, boolean z2, boolean z3);
}

hook getStatInfoConfigImpl 方法, 获取返回值 Json.stringify(对象)

eg.

@Override // com.bilibili.api.a.b
public String getSessionId() {
    return com.bilibili.lib.foundation.e.b().getSessionId(); // 看e.b()是哪个类实现的
}

点入 getSessionId() 是接口

public interface a {
    // 又是一个接口 不看它了
    String getSessionId();
}

点 getSessionId前面的b()

public final class e {
    public static final Application a() {
        return d.g.b().c();
    }

    // a 表示返回值的类型
    public static final a b() {
        return d.g.b().d(); // hook返回值看看是哪个类的对象
    }

    public static final d.b c() {
        return d.g.b().e();
    }

    public static final c d() {
        return d.g.b().f();
    }

    // 读取xml文件
    public static final SharedPreferences e() {
        return d.g.b().g();
    }
}

Java.perform(function() {
    var e = Java.use("com.xx.x.e");
    e.b.implementation = function() {
        var res = this.b();
        console.log("obj = ", JSON.stringify(res));
        return res;
    }
})

输出的$className就是它真正的类，就去这个类里面找getSessionId()方法

法三：hook输出调用栈

速查#

• 开启代理后没有网络，抓包显示200：安居客，尚亦城 lsposed 使用Justtrustme.apk 框架，勾选对应的app，手机不需要重启,app重启即可
• 压根没有抓到(显示)目标包：得物 drony,SocksDroid,ProxyDroid

客户端校验#

很可能用了客户端校验之类的东西，如果justtrustme 和 frida 脚本依然抓不到包，就有可能是混淆的代码。

校验的触发位置是在：okhttp3.internal.connection.RealConnection类中的connectTls方法

有执行顺序，可能只hook掉第三个就能抓到包，也可能需要全部hook掉才行

Java.perform(function () {
    var Platform = Java.use('com.android.org.conscrypt.Platform');
    Platform.checkServerTrusted.overload('javax.net.ssl.X509TrustManager', '[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'com.android.org.conscrypt.AbstractConscryptSocket').implementation = function (x509tm, chain, authType, socket) {
        console.log('\n[+] checkServer  ',x509tm,JSON.stringify(x509tm) );//输出tm可定位到真实的使用位置

        //return this.checkServerTrusted(x509tm, chain, authType, socket);
    };
});

// frida -U -f 包名 -l 6.hook_check.js --no-pause
// frida -UF -l 6.hook_check.js

Java.perform(function () {
    function getFieldValue(obj, fieldName) {
        var cls = obj.getClass();
        var field = cls.getDeclaredField(fieldName);
        field.setAccessible(true);
        var name = field.getName();
        var value = field.get(obj);
        return value;
    }

    function getMethodValue(obj, methodName) {
        var res;
        var cls = obj.getClass();
        var methods = cls.getDeclaredMethods();

        methods.forEach(function (method) {
            var method_name = method.getName();
            console.log(method_name, method);
            if (method_name === methodName) {
                method.setAccessible(true);
                res = method;
                return;
            }
        })
        return res;
    }

    var RealConnection = Java.use('okhttp3.internal.connection.RealConnection');// 混淆改这里
    // 这里传入的参数个数混淆后也有可能不同
    //.implementation 前面的需要改
    RealConnection.connectTls.implementation = function (connectionSpecSelector) {
        var route = getFieldValue(this, "route"); // this.route
        console.log('route=', route);
        var address = getFieldValue(route, 'address');
        console.log('address=', address);
        var hostnameVerifier = getFieldValue(address, 'hostnameVerifier');
        console.log('\n[+] hostnameVerifier', hostnameVerifier);
        /* 混淆的用这里
        try {
            var route = getFieldValue(this, "route");//混淆改这里
            console.log('route=', route);
            var address = getFieldValue(route, 'address');//混淆改这里
            console.log('address=', address);
            var func = getMethodValue(address, "hostnameVerifier");
            console.log('\n[+] addhostnameVerifierress', func.invoke(address, null));
        } catch (e) {
            console.log(e);
        }
        */
        return this.connectTls(connectionSpecSelector);
    };
});

// frida -U -f 包名 -l 7.hook_verify.js
// frida -UF -l 7.hook_verify.js
// frida -U -f cn.ticktick.task -l 7.hook_verify.js

TCP hook抓包#

tcp通用脚本

// java.net.SocketOutputStream
OutputStream outputStream = socket.getOutputStream();
outputStream.write(sb.toString().getBytes());

private void doRequest() {
    new Thread() {
        @Override
        public void run() {
            try {
                // http://wiki.mikecrm.com/index?ajax=1&page=2
                Socket socket = new Socket("wiki.mikecrm.com", 80);

                // 1.构造请求头
                StringBuilder sb = new StringBuilder();
                sb.append("GET /index?ajax=1&page=2 HTTP/1.1\r\n");
                sb.append("host: wiki.mikecrm.com\r\n");
                sb.append("user-Agent: test\r\n");
                sb.append("\r\n");

                // 2.写入数据（发送数据）
                // java.net.SocketOutputStream
                OutputStream outputStream = socket.getOutputStream();
                outputStream.write(sb.toString().getBytes());
                Log.e("outputStream的类 => ", outputStream.getClass().getName());

                // 3.读取数据（获取数据）
                // java.net.SocketInputStream
                InputStream inputStream = socket.getInputStream();
                Log.e("inputStream的类 => ", inputStream.getClass().getName());

                while (true) {
                    byte[] buffer = new byte[1024];
                    int len = inputStream.read(buffer, 0, buffer.length);
                    if (len == -1) {
                        break;
                    }
                    Log.e("读取相应内容 =>", new String(Arrays.copyOf(buffer, len)));
                }
                socket.close();
            } catch (Exception ex) {
                Log.e("Main", "网络请求异常" + ex);
            }
        }
    }.start();
}

Java.perform(function () {
    var SocketOutputStream = Java.use('java.net.SocketOutputStream');
    var HexDump = Java.use("com.android.internal.util.HexDump");
    var ByteString = Java.use("com.android.okhttp.okio.ByteString");

    SocketOutputStream.socketWrite0.overload('java.io.FileDescriptor', '[B', 'int', 'int').implementation = function (fd, b, off, len) {
        console.log("参数：", fd, b, off, len);
        console.log(HexDump.dumpHexString(b, off, len), "\n");
        console.log(ByteString.of(b).utf8(), "\n"); // 字节->字符串
        console.log(ByteString.of(b).utf8());

        return this.socketWrite0(fd, b, off, len);
    };
});

// frida -UF -l  1.hook.js
// console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

Java.perform(function () {
    var SocketOutputStream = Java.use('java.net.SocketOutputStream');
    var ByteString = Java.use("com.android.okhttp.okio.ByteString");

    SocketOutputStream.write.overload('[B').implementation = function (arr) {
        console.log(arr); // byte 104,101,108,,..
        console.log(ByteString.of(arr).utf8(), "\n"); // 字节->字符串
        console.log(ByteString.of(arr).hex()); // 68656c...
        // 只写这一行也可以 打印类似wireshark里的格式
        console.log(HexDump.dumpHexString(arr), "\n");
        return this.write(arr);
    };
});

// frida -UF -l  1.hook.js
// console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

// java.net.SocketInputStream
InputStream inputStream = socket.getInputStream();
Log.e("inputStream的类 => ", inputStream.getClass().getName());
while (true) {
    byte[] buffer = new byte[1024];
    int len = inputStream.read(buffer, 0, buffer.length);
    if (len == -1) {
        break;
    }
    Log.e("读取相应内容 =>", new String(Arrays.copyOf(buffer, len)));
}

Java.perform(function () {
    var SocketInputStream = Java.use('java.net.SocketInputStream');
    var ByteString = Java.use("com.android.okhttp.okio.ByteString");

    SocketInputStream.read.overload('[B','int','int').implementation = function (b,off,len) {
        var res = this.read(b,off,len);
        console.log(HexDump.dumpHexString(b, off, len));
        return res;
    };
});

// frida -UF -l  1.hook.js
// console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

Java.perform(function() {
    const apiResolver = new ApiResolver('module');
    apiResolver.enumerateMatches('exports:*!*socket*0*').forEach(function (v) {
        console.log(v.name);
    });
});

Java.perform(function () {
    const NET_Send = Module.getExportByName('libopenjdk.so', 'NET_Send');
    const NET_Read = Module.getExportByName('libopenjdk.so', 'NET_Read');
    Interceptor.attach(NET_Send, {
        onEnter(args) {
            console.log('write call'); // jni,jobj,data,off,len
            //console.log(hexdump(args[1], {length: args[2].toInt32()}));
            console.log(Memory.readByteArray(args[1], args[2].toInt32()));
        }
    });
    Interceptor.attach(NET_Read, {
        onEnter(args) {
            console.log('read call');
            this.buf = args[1];
        }, onLeave: function (retval) {
            retval |= 0; // Cast retval to 32-bit integer.
            if (retval <= 0) {
                return;
            }
            console.log(Memory.readByteArray(this.buf, retval));
        }
    });
});

// frida -UF -l hook.js

Java.perform(function () {
    var NativeCrypto = Java.use('com.android.org.conscrypt.NativeCrypto');
    var HexDump = Java.use("com.android.internal.util.HexDump");
    var ByteString = Java.use("com.android.okhttp.okio.ByteString");

    NativeCrypto.SSL_write.implementation = function (ssl, ssl_holder, fd, shc, b, off, len, timeout) {
        //console.log(HexDump.dumpHexString(b, off, len), "\n")
        console.log(ByteString.of(b).utf8(), "\n");

        return this.SSL_write(ssl, ssl_holder, fd, shc, b, off, len, timeout);
    };
});

// frida -UF -l  3.hook.js
// console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

Java.perform(function () {
    var NativeCrypto = Java.use('com.android.org.conscrypt.NativeCrypto');
    var HexDump = Java.use("com.android.internal.util.HexDump");
    var ByteString = Java.use("com.android.okhttp.okio.ByteString");

    NativeCrypto.SSL_read.implementation = function (ssl, ssl_holder, fd, shc, b, off, len, timeout) {
        var res = this.SSL_read(ssl, ssl_holder, fd, shc, b, off, len, timeout);
        //console.log(HexDump.dumpHexString(b, off, len), "\n")
        console.log(ByteString.of(b).utf8(), "\n");
        return res;
    };
});

// frida -UF -l  4.hook.js
// console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

Java.perform(function () {
    const apiResolver = new ApiResolver('module');
    // 包含：libttboringssl.so 或 libssl.so
    // 'exports:*lib*ssl*!SSL_*'
    apiResolver.enumerateMatches('exports:*lib*ssl*!SSL_*').forEach(function (v) {
        if (v.name.indexOf('SSL_write') > 0) {
            // SSL_write = v.address;
            console.log(v.name);
        } else if (v.name.indexOf('SSL_read') > 0) {
            // SSL_read = v.address;
            console.log(v.name);
        }
    });
});

Java.perform(function () {
    const SSL_write = Module.getExportByName('libssl.so', 'SSL_write');
    const SSL_read = Module.getExportByName('libssl.so', 'SSL_read');

    Interceptor.attach(SSL_write, {
        onEnter(args) {
            console.log('write call');
            //console.log(args[0]); // ssl
            //console.log(args[1]); // buffer
            //console.log(args[2]); // len
            //console.log(hexdump(args[1], {length: args[2].toInt32()}));
            console.log(Memory.readByteArray(args[1], parseInt(args[2])));
        }
    });

    Interceptor.attach(SSL_read, {
        onEnter(args) {
            console.log('read call');
            this.buf = args[1];
        }, onLeave: function (retval) {
            retval |= 0; // Cast retval to 32-bit integer.
            if (retval <= 0) {
                return;
            }
            console.log(Memory.readByteArray(this.buf, retval));
        }
    });
});

// frida -UF -l  7.hook.js
// frida -U -f com.nb.ssldemo2 -l 7.hook.js --no-pause

抓不到有用的包/一个都抓不到#

在安卓开发时，OkHttp发送请求，设置 Proxy.NO_PROXY，基于系统代理都是抓不到包。

OkHttpClient client = new OkHttpClient.Builder().proxy(Proxy.NO_PROXY).build();
FormBody form = new FormBody.Builder()
    .add("user", dataMap.get("username"))
    .add("pwd", dataMap.get("password"))
    .add("sign", dataMap.get("sign")).build();

Request req = new Request.Builder().url("http://192.168.0.6:9999/login").post(form).build();

proxydroid，SocketDroid, drony启动！小黄鸟也能抓到这种Charles抓不到的包，原因未知

drony有时加载不出wifi

SocksDroid 切记：在使用前删除手机上设置的系统代理。

打开Charles，配置socksdroid

ProxyDroid 切记：在使用前删除手机上设置的系统代理。

一个都没有的那种，原因：

1. 证书没装到根证书上，而在用户上
2. 其它协议

抓包显示 ❌#

使用SocketDroid转发

LSposed 模块 JustTrustMe or Turstmealready

• 要么是unknown
• 要么是：加密的乱码
• 要么是：报错无法抓包

而无法看到我们希望的明文数据，则：

最大可能是，对方用了https的 SSL pinning

https://www.redream.cn/2021/11/04/android-%e7%a0%b4%e8%a7%a3app%e6%8a%93%e5%8c%85%e9%99%90%e5%88%b6%e7%bb%95%e5%bc%80https%e7%9a%84ssl-pinning/

❓ 其它协议#

mitmproxy#

用来抓包的，和Charles类似，可配置代理抓国外包。可写脚本。详见抓包文件夹

url转回来#

import json
from urllib.parse import quote_plus, unquote_plus

dinfo = "%7B%22ah1%22%3A%22%22%2C%22ah2%22%3A%22%22%2C%22ah3%22%3A%22%22%2C%22ah4%22%3A%22wifi%22%2C%22ah5%22%3A%221080_2236%22%2C%22ah6%22%3A1785600%2C%22ah7%22%3A8%2C%22ah8%22%3A5732413440%2C%22ah9%22%3A%22Pixel+4%22%2C%22ah10%22%3A%22%22%2C%22ah11%22%3A%22%22%2C%22ah12%22%3A%22%22%2C%22ah13%22%3A%22%22%2C%22as1%22%3A%2210%22%2C%22as2%22%3A%22%22%2C%22as3%22%3A%22%22%2C%22as4%22%3A%22b9ab99eb4438fddd%22%2C%22as5%22%3A%22%22%2C%22as6%22%3A%22%22%2C%22as7%22%3A%2229%22%2C%22ac1%22%3A%22ac791f31-66b8-301e-837d-539d4c0c39c8%22%7D"

result = unquote_plus(dinfo)
print(result)
data_dict = json.loads(result)
print(json.dumps(data_dict, indent=4))

spawn 重启应用#

import frida
import sys
# ---------------------------------
rdev = frida.get_remote_device()
pid = rdev.spawn(["com.xx.xx"])
session = rdev.attach(pid)
# ---------------------------------
scr = """
Java.perform(function () {
	var ClassName = Java.use('com.xxx.xx.ClassName');
	ClassName.Method.implementation = function(arg1, arg2, ...) {
		result = this.Method(arg1, arg2, ...);
		return result;
	}
})
"""
script = session.create_script(scr)

def on_message(message, data):
    print(message, data)
    
script.on("message", on_message)
script.load()
rdev.resume(pid)  # spawn
sys.stdin.read()  # 程序阻塞 不让停止

attach 直接附加#

import frida
import sys

rdev = frida.get_remote_device()
session = rdev.attach("中文名")  # 14y

scr = """
Java.perform(function () {
   ...
});
"""
script = session.create_script(scr)

def on_message(message, data):
    print(message, data)

script.on("message", on_message)
script.load()
sys.stdin.read()

格式一#

import frida

def get_frida_rpc_script():
    rdev = frida.get_remote_device()
    session = rdev.attach("猿人学2022")

    scr = """
    function invokeSign(data){
    var result;
        Java.perform(function () {
            Java.choose("com.yuanrenxue.match2022.security.Sign",{
                onMatch:function(ins){  // 实例化对象 可能需要刷新一下手机页面加载对象
                    console.log("ins=>",ins);
                    result = ins.sign(stringToByte(data));
                },onComplete(){}
            });
        })
        return result;
    }
    
    rpc.exports = {
        invokesignn:invokeSign,
    }
    """
    script = session.create_script(scr)
    script.load()
    return script


# 调用
script = get_frida_rpc_script()
sign = script.exports.invokesignn(sb)  # exports.后面的名字必须和上面exports{}键的一样 不支持下划线_

格式二#

import frida

def get_frida_rpc_script():
    rdev = frida.get_remote_device()
    session = rdev.attach("抖音短视频")
    scr = """
    rpc.exports = {   
        ttencrypt:function(bArr,len){
             var res;
             Java.perform(function () {
                 ......
             return res;
        },
        execandleviathan: function (i2,str){
            var result;
            Java.perform(function () {
				......
            });
            return result;
        }
    }
    """
    script = session.create_script(scr)
    script.load()
    return script


# 调用
script = get_frida_rpc_script()
gorgon_byte_list = script.exports.execandleviathan(khronos, un_sign_string)

python#

def des3(data_string):
    BS = 8
    pad = lambda s: s + (BS - len(s) % BS) * chr(BS - len(s) % BS)

    # 3DES的MODE_CBC模式下只有前24位有意义
    key = b'appapiche168comappapiche168comap'[0:24]
    iv = b'appapich'

    plaintext = pad(data_string).encode("utf-8")

    # 使用MODE_CBC创建cipher
    cipher = DES3.new(key, DES3.MODE_CBC, iv)
    result = cipher.encrypt(plaintext)
    return base64.b64encode(result).decode('utf-8')

DES

• 加密

from Crypto.Cipher import DES
from Crypto.Util.Padding import pad
import base64

s = "小JR❤狱卒"
byte_s = s.encode("utf-8")
des = DES.new(key=b'12345678', iv=b'12345678', mode=DES.MODE_CBC)
byte_s = pad(byte_s, 8) # ValueError: Data must be padded to 8 byte boundary in CBC mode
encrypted_byte = des.encrypt(byte_s)
print(encrypted_byte)  # b'\x05\xcf\\(\xaa\x07\x9b\xe68\x0e\x15A.\xa3\xba\xdb'
encrypted_s = base64.b64encode(encrypted_byte).decode()
print(encrypted_s) # Bc9cKKoHm+Y4DhVBLqO62w==

• 解密

from Crypto.Util.Padding import pad, unpad
encrypted_s = "Bc9cKKoHm+Y4DhVBLqO62w=="
encrypted_byte = base64.b64decode(encrypted_s)
des = DES.new(key=b'12345678', iv=b'12345678', mode=DES.MODE_CBC)
decrypted_byte = des.decrypt(encrypted_byte)
decrypted_byte = unpad(decrypted_byte, 8)
print(decrypted_byte.decode("utf-8"))

java#

import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.io.UnsupportedEncodingException;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;
import java.util.Base64;

public class Hello {
    public static void main(String[] args) throws Exception {
        String data = "会写点代码的本子画手";
        String key = "fd6b639dbcff0c2a1b03b389ec763c4b";
        String iv = "77b07a672d57d64c";	
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");    
        // 加密
        byte[] raw = key.getBytes();
        SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
        IvParameterSpec ivSpec = new IvParameterSpec(iv.getBytes());         
        cipher.init(Cipher.ENCRYPT_MODE, skeySpec, ivSpec);
        byte[] encrypted = cipher.doFinal(data.getBytes()); 
        //[90, -31, 86, -75, -100, -108, 2, -97, -56, -49, 55, 108, -2, 122, 41, -4]
        System.out.println(Arrays.toString(encrypted));
    }
}

python#

# pip install pycryptodome
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

KEY = "fd6b639dbcff0c2a1b03b389ec763c4b"
IV = "77b07a672d57d64c"
def aes_encrypt(data_string):
    aes = AES.new(
        key=KEY.encode('utf-8'),
        mode=AES.MODE_CBC,
        iv=IV.encode('utf-8')
    )
    raw = pad(data_string.encode('utf-8'), 16)
    return aes.encrypt(raw)

data = aes_encrypt("会写点代码的本子画手")
print(data)  # b"\x8b'\xedT\xd2j\xc1C\xeb\x83=\x16\x94|\xe4\xc3\x90wnV\x85\xb7\xb1fHb}\x81\xc3)W\xe4"
# 然后需要用base64处理成字符串发送请求
print(base64.b64encode(data).decode())  # iyftVNJqwUPrgz0WlHzkw5B3blaFt7FmSGJ9gcMpV+Q=

print([i for i in data])
# [139, 39, 237, 84, 210, 106, 193, 67, 235, 131, 61, 22, 148, 124, 228, 195, 144, 119, 110, 86, 133, 183, 177, 102, 72, 98, 125, 129, 195, 41, 87, 228]

data = 'iyftVNJqwUPrgz0WlHzkw5B3blaFt7FmSGJ9gcMpV+Q='
byte_data = base64.b64decode(data)
print(byte_data)  # b"\x8b'\xedT\xd2j\xc1C\xeb\x83=\x16\x94|\xe4\xc3\x90wnV\x85\xb7\xb1fHb}\x81\xc3)W\xe4"
aes = AES.new(key=b"fd6b639dbcff0c2a1b03b389ec763c4b", iv=b"77b07a672d57d64c", mode=AES.MODE_CBC)
real_byte_data = aes.decrypt(byte_data)
print(real_byte_data) # b'\xe4\xbc\x9a\xe5\x86\x99\xe7\x82\xb9\xe4\xbb\xa3\xe7\xa0\x81\xe7\x9a\x84\xe6\x9c\xac\xe5\xad\x90\xe7\x94\xbb\xe6\x89\x8b\x02\x02'

# 如果在加密时做了填充，可以把后面填充的东西干掉
# unpad(real_byte_data, 16)

print(real_byte_data.decode("utf-8")) # 会写点代码的本子画手  
# real_byte_data = unpad(real_byte_data, 16)

java#

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;
import java.util.Base64;

public class Hello {
    public static void main(String[] args) throws NoSuchAlgorithmException {
        String name = "会写点代码的本子画手";
        MessageDigest instance = MessageDigest.getInstance("SHA-256");
        byte[] nameBytes = instance.digest(name.getBytes());
        // System.out.println(Arrays.toString(nameBytes));
        // String res = new String(nameBytes);
        // System.out.println(res);
        
        // 十六进制展示
        StringBuilder sb = new StringBuilder();
        for(int i=0;i<nameBytes.length;i++){
            int val = nameBytes[i] & 255;  // 负数转换为正数
            if (val<16){
                sb.append("0");
            }
            sb.append(Integer.toHexString(val));
        }
        String hexData = sb.toString();
        System.out.println(hexData); // 9841a685174241d957d28c49b868402d0170fdb7abf808af73cba60f70145fea
    }
}

python#

import hashlib
data = "明文"
salt = "9cafa6466a028bfb"  # 盐
obj = hashlib.sha256()
# 按app的顺序update
obj.update(data.encode('utf-8'))
obj.update(salt.encode('utf-8'))
# --------------------------
res = obj.hexdigest()
print(res)
# e61583f49efa13187b053d2ab1cf2cc8cd99360367f42a6b7d013a49de72108e

java#

import java.security.MessageDigest;

MessageDigest messageDigest = MessageDigest.getInstance("sha-1");
messageDigest.update(str6.getBytes());
byte[] digest = messageDigest.digest();
// byte 2 hex -> arg7 = hash_object.hexdigest()
StringBuffer stringBuffer = new StringBuffer();
for (byte b : digest) {
    String lowerCase = Integer.toHexString(b & 255).toLowerCase(Locale.getDefault());
    if (lowerCase.length() < 2) {
        lowerCase = "0" + lowerCase;
    }
    stringBuffer.append(lowerCase);
}
deviceCode = stringBuffer.toString();

python#

import hashlib
arg0 = "明文" 
hash_object = hashlib.sha1()
hash_object.update(arg0.encode('utf-8'))
arg7 = hash_object.hexdigest()
print(arg7)

hook#

var MessageDigest = Java.use("java.security.MessageDigest");
var ByteString = Java.use("com.android.okhttp.okio.ByteString");
MessageDigest.update.overload("[B").implementation = function (data) {
    if (flag) {
        console.log(ByteString.of(data).utf8(), '\n' );
        console.log("---------------")
    }
    return this.update(data);
}

java#

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;
import java.util.Base64;

public class Hello {
    public static void main(String[] args) throws NoSuchAlgorithmException {
        String name = "会写点代码的本子画手";
        MessageDigest instance = MessageDigest.getInstance("MD5");
        byte[] nameBytes = instance.digest(name.getBytes());       
        // 十六进制展示
        StringBuilder sb = new StringBuilder();
        for(int i=0;i<nameBytes.length;i++){
            int val = nameBytes[i] & 255;  // 负数转换为正数
            if (val<16){
                sb.append("0");
            }
            sb.append(Integer.toHexString(val));
        }
        String hexData = sb.toString();
        System.out.println(hexData); // 17351012472429d52d0c0d23d468173d
    }
}

python#

# from hashlib import md5
import hashlib
data_string = "会写点代码的本子画手"
def md5_h(data_string):
    obj = hashlib.md5()  # 这行不可以放在外面
    obj.update(data_string.encode("utf-8"))
    # 原始的加密结果
    v1 = obj.digest()
	print(v1) # b'D\xeaEf\x97\xab\xce\xde\x86\xa3\x8f7\xeb\x0e\xbd\xfa'
    # 得到十六进制字符串。java中没有这个功能
    hex_string = obj.hexdigest()
    # print(hex_string) # 44ea456697abcede86a38f37eb0ebdfa
    return hex_string

加盐#

    String name = "会写点代码的本子画手";
    MessageDigest instance = MessageDigest.getInstance("MD5");
    instance.update("xxxxxx".getBytes());  //只是多了这一行

import hashlib
m = hashlib.md5("xxxxxx".encode('utf-8'))  # salt
m.update("会写点代码的本子画手".encode("utf-8"))
v2 = m.hexdigest()
print(v2) # 'cd972488db69e949230996b29c3ad90d'

java#

byte [] arg5 = {10, -26, -83, -90, -26, -78, -101, -23, -67, -112};
StringBuilder v0 = new StringBuilder();
int v1 = arg5.length;
int v2;
for(v2=0; v2 < v1; ++v2) {
    int v3 = arg5[v2] & 0xFF;
    if (v3 < 16) {
        v0.append('0');
    }
    v0.append(Integer.toHexString(v3));
}
System.out.println(v0.toString()); //0ae6ada6e6b29be9bd90

StringBuffer stringBuffer = new StringBuffer();
for (byte b : digest) {
    String lowerCase = Integer.toHexString(b & 255).toLowerCase(Locale.getDefault());
    if (lowerCase.length() < 2) {
        lowerCase = "0" + lowerCase; // 不满两位补0
    }
    stringBuffer.append(lowerCase);
}
deviceCode = stringBuffer.toString();

python#

# name_bytes = "会写点代码的本子画手".encode('utf-8')
name_bytes = [10, -26, -83, -90, -26, -78, -101, -23, -67, -112]

data_list = []

for item in name_bytes:
    item = item & 0xff   # item<0时，让item+256
    ele = "%02x" % item
    data_list.append(ele)
    
print("".join(data_list))  # 0ae6ada6e6b29be9bd90

输出#

输出地址中的字符串

Memory.readCString(args[1]);

args[1].readUtf8String();

上面如果输出乱码，可以十六进制形式输出

hexdump(args[2]);

输出如下

             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
75de1c7b98  68 0b 05 13 30 01 29 15 d8 0b 05 13 00 00 00 00  h...0.).........
75de1c7ba8  90 84 1c de 75 00 00 00 ae 0a 00 00 ae 0a 00 00  ....u...........
75de1c7bb8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
75de1c7bc8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
75de1c7bd8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
75de1c7be8  00 00 00 00 00 00 00 00 00 54 5b 01 76 00 00 00  .........T[.v...
75de1c7bf8  00 00 00 00 00 00 00 00 00 54 5b 01 76 00 00 00  .........T[.v...

减少一部分输出

hexdump(args[2], {length:16, header:false});

打印用到的so文件#

使用场景：反调试 看看到了哪里被检测 找到so文件 删掉试试 没大碍就ok 如果不行另寻他路

Java.perform(function () {
    var dlopen = Module.findExportByName(null, "dlopen"); // 系统文件 old android
    var android_dlopen_ext = Module.findExportByName(null, "android_dlopen_ext"); // new android
    Interceptor.attach(dlopen, {
        onEnter: function (args) {
            var path_ptr = args[0];
            var path = ptr(path_ptr).readCString();
            console.log("[dlopen:]", path);
        },
        onLeave: function (retval) {
    
        }
    });
    
    Interceptor.attach(android_dlopen_ext, {
        onEnter: function (args) {
            var path_ptr = args[0];
            var path = ptr(path_ptr).readCString();
            console.log("[dlopen_ext:]", path);
        },
        onLeave: function (retval) {
    
        }
    });
});
// spawn mode
// frida -Uf com.xxx.xxxx -l hook.js  15.2.2版本不可使用
// frida -U -l hook.js -f com.xxx.xxxx --no-pause 用这个代替

🔺定位RegisterNatives+使用内存地址hook#

indexOf判断是否包含，不包含返回-1；包含返回索引位置

function hook_RegisterNatives() {
    // 列举 libart.so 中的所有导出函数（成员列表）
    var symbols = Module.enumerateSymbolsSync("libart.so");
    // 获取 RegisterNatives 函数的内存地址，并赋值给addrRegisterNatives
    var addrRegisterNatives = null;
    for (var i = 0; i < symbols.length; i++) {
        var symbol = symbols[i]; // 成员对象

        // _ZN3art3JNI15RegisterNativesEP7_JNIEnvP7_jclassPK15JNINativeMethodi
        // 方式1：
        if (symbol.name.indexOf("art") >= 0 &&
            symbol.name.indexOf("JNI") >= 0 &&
            symbol.name.indexOf("RegisterNatives") >= 0 &&
            symbol.name.indexOf("CheckJNI") < 0) {
            addrRegisterNatives = symbol.address;
            console.log("RegisterNatives is at ", symbol.address, symbol.name);
        }

        // 方式2：
        var name = "_ZN3art3JNI15RegisterNativesEP7_JNIEnvP7_jclassPK15JNINativeMethodi";
        if(symbol.name.indexOf("art") >= 0){
            if(symbol.name.indexOf(name)>=0){
                addrRegisterNatives = symbol.address;
            }
        }
    }


    if (addrRegisterNatives != null) {
        //      这里写某函数的内存地址
        Interceptor.attach(addrRegisterNatives, {
            onEnter: function (args) {
                var env = args[0]; // jni对象 env
                var java_class = args[1]; // 类 jclass
                var class_name = Java.vm.tryGetEnv().getClassName(java_class);
                //console.log(class_name); //得到类名
                // 只有类名为com.bilibili.nativelibrary.LibBili，才打印输出
                var taget_class = "com.bilibili.nativelibrary.LibBili";
                if (class_name === taget_class) {
                    console.log("\n[RegisterNatives] method_count:", args[3]);
                    // args[2] 就是动态注册的对应关系。
                    // ptr是new NativePointer(s) 的缩写。(C语言中的指针)
                    var methods_ptr = ptr(args[2]);
                    var method_count = parseInt(args[3]);

                    for (var i = 0; i < method_count; i++) {
                        // Java中函数名字的
                        var name_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3));
                        // 参数和返回值类型
                        var sig_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize));
                        // C中的函数指针
                        var fnPtr_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize * 2));
                        var name = Memory.readCString(name_ptr); // 读取java中函数名
                        var sig = Memory.readCString(sig_ptr); // 参数和返回值类型 e.g.(Ljava/lang/String;)Ljava/lan/String
                        var find_module = Process.findModuleByAddress(fnPtr_ptr); // 根据C中函数指针获取模块
                        // 偏移量(hex) = fnPtr_ptr - 模块基地址
                        var offset = ptr(fnPtr_ptr).sub(find_module.base)
                        // console.log("[RegisterNatives] java_class:", class_name);
                        console.log("name:", name, "sig:", sig, "module_name:", find_module.name, "offset:", offset);
                    }
                }
            }
        });
    }
}

setImmediate(hook_RegisterNatives);
// frida -U -f com.xingin.xhs  -l 8.dynamic_find_so.js