技术分享 | Frida 实现 Hook 功能的强大能力

pip install frida-tools

PID  Name-----  --------------------------------------------------
 1313  adbd
12621  android.process.acore
18037  android.process.media
14455  com.android.defcontainer
11656  com.android.deskclock
...

package com.example.target_frida;
import androidx.appcompat.app.AppCompatActivity;
import android.annotation.SuppressLint;
import android.os.Bundle;
import android.view.View;
import android.widget.Button;
import android.widget.TextView;
public class MainActivity extends AppCompatActivity implements View.OnClickListener {
    TextView winCountView;
    TextView battleInfoTextView;
    int winCount = 0;
    @SuppressLint("SetTextI18n")
    @Override
    public void onClick(View view) {
        if (winCount > 100) {
            return;
        }
        if (view.getId() == R.id.tvButtonBlack) {
            if (!getCPUResult()) {
                winCount++;
                winCountView.setText(winCount + "");
                battleInfoTextView.setText("Right!");
            } else {
                winCount = 0;
                winCountView.setText(winCount + "");
                battleInfoTextView.setText("Wrong! Clean All!");
            }
        } else if (view.getId() == R.id.tvButtonWhite) {
            if (getCPUResult()) {
                winCount++;
                winCountView.setText(winCount + "");
                battleInfoTextView.setText("Right!");
            } else {
                winCount = 0;
                winCountView.setText(winCount + "");
                battleInfoTextView.setText("Wrong! Clean All!");
            }
        }
        if (winCount >= 100) {
            battleInfoTextView.setText("Win 100 times!!!");
        }
    }
    @SuppressLint("SetTextI18n")    @Override    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        winCountView = findViewById(R.id.winCount);
        winCountView.setText(winCount + "");
        battleInfoTextView = findViewById(R.id.battleInfo);
        battleInfoTextView.setText("猜黑白！！！");
        Button buttonBlack = (Button) findViewById(R.id.tvButtonBlack);
        Button buttonWhite = (Button) findViewById(R.id.tvButtonWhite);
        buttonBlack.setOnClickListener(this);
        buttonWhite.setOnClickListener(this);
    }
    public boolean getCPUResult() {
        //true为白，false为黑
        return Math.random() > 0.5;
    }}

import time
import frida, sys
date_str = time.strftime('%m-%d %H:%M:%S')
def on_message(message, data):
    if message['type'] == 'send':
        print(f"[{date_str}] {message['payload']}")
    else:
        print(f"[{date_str}] {message}")
def run_all():
  # Java.perform方法：当 js 附加到目标的进程中时被执行，运行其中定义的函数
  # Java.choose方法：通过完整类名，获取它的实例，从而对实例中的数据进行修改
  # 通过 key:value 结构定义了两个函数：
  # onMatch 对应的函数在命中一个实例的时候被调用，传入函数中的参数 instance 就是被命中的实例
  # onComplete 函数会在所有实例遍历完毕之后被调用，可以做一些后续处理操作
    jscode = """
    Java.perform(function () {
      Java.choose("com.example.target_frida.MainActivity",{
        onMatch:function(instance){
            console.log("winCount value is "+instance.winCount.value);
            instance.winCount.value=99;
            console.log("winCount value is "+instance.winCount.value);
        },
        onComplete:function(){
            console.log("Complete!!!")
        }
      });
    });
    """
    # attach目标App进程
    target_app = 'com.example.target_frida'
    process = frida.get_usb_device().attach(target_app)
    # 将JS代码注入进程，并附加监听方法，用来获取返回的日志信息
    script = process.create_script(jscode)
    script.on('message', on_message)
    # 打印起始日志
    print(f'[{date_str}] Start Frida on {target_app}')
    # 加载注入的JS代码逻辑
    script.load()
    # 使用系统输入语句阻止函数运行完毕自动退出
    sys.stdin.read()
if __name__ == '__main__':
    run_all()

[04-15 18:19:57] Start Frida on com.example.target_frida
winCount value is 0
winCount value is 99
Complete!!!