Frida 动态插桩入门实战：从环境搭建到 Hook 脚本编写#

1
-U          通过 USB 连接设备
2
-f 包名     Spawn 模式，启动指定包名的 App
3
-n 进程名   Attach 模式，附加到指定进程名
4
-p PID      Attach 模式，附加到指定 PID
5
-l script   加载 JS 脚本文件
6
--no-pause  Spawn 后自动恢复执行（不加则暂停等待）
7
-F          附加到前台进程

1
Java.perform(function() {
2
    var Utils = Java.use("com.example.app.Utils");
3

4
    // 指定重载版本: encrypt(String)
5
    Utils.encrypt.overload('java.lang.String').implementation = function(data) {
6
        console.log("[+] encrypt(String) 参数: " + data);
7
        var result = this.encrypt(data);
8
        console.log("[+] 加密结果: " + result);
9
        return result;
10
    };
11

12
    // 指定重载版本: encrypt(String, String) — key + data
13
    Utils.encrypt.overload('java.lang.String', 'java.lang.String').implementation = function(key, data) {
14
        console.log("[+] encrypt(String, String) Key: " + key + ", Data: " + data);
15
        return this.encrypt(key, data);
16
    };
17
});

1
Java.perform(function() {
2
    var User = Java.use("com.example.app.User");
3

4
    // Hook 构造函数
5
    User.$init.overload('java.lang.String', 'int').implementation = function(name, age) {
6
        console.log("[+] User 构造: name=" + name + ", age=" + age);
7
        return this.$init(name, age);
8
    };
9

10
    // Hook 静态方法
11
    var Utils = Java.use("com.example.app.Utils");
12
    Utils.getSecret.implementation = function() {
13
        console.log("[+] 静态方法 getSecret 被调用");
14
        var result = this.getSecret();
15
        console.log("[+] Secret: " + result);
16
        return result;
17
    };
18
});

1
Java.perform(function() {
2
    Java.enumerateLoadedClasses({
3
        onMatch: function(className) {
4
            // 只打印目标包名下的类
5
            if (className.includes("com.example")) {
6
                console.log(className);
7
            }
8
        },
9
        onComplete: function() {
10
            console.log("[*] 类枚举完成");
11
        }
12
    });
13
});

1
Java.perform(function() {
2
    var target = Java.use("com.example.app.AESHelper");
3
    var methods = target.class.getDeclaredMethods();
4
    methods.forEach(function(method) {
5
        console.log(method.toString());
6
    });
7
});

1
Java.perform(function() {
2
    // Hook AES Cipher.doFinal 抓明文和密文
3
    var Cipher = Java.use('javax.crypto.Cipher');
4
    Cipher.doFinal.overload('[B').implementation = function(input) {
5
        var bytesToHex = function(bytes) {
6
            var hex = [];
7
            for (var i = 0; i < bytes.length; i++) {
8
                hex.push(('0' + (bytes[i] & 0xFF).toString(16)).slice(-2));
9
            }
10
            return hex.join('');
11
        };
12

13
        console.log('[AES] 输入明文: ' + bytesToHex(input));
14
        var result = this.doFinal(input);
15
        console.log('[AES] 输出密文: ' + bytesToHex(result));
16
        return result;
17
    };
18

19
    // Hook Base64 编解码
20
    var Base64 = Java.use('android.util.Base64');
21
    Base64.encodeToString.overload('[B', 'int').implementation = function(input, flags) {
22
        var result = this.encodeToString(input, flags);
23
        console.log('[Base64] 编码结果: ' + result);
24
        return result;
25
    };
26
});

1
// 拦截 libc.so 中的 open 函数
2
Interceptor.attach(Module.findExportByName("libc.so", "open"), {
3
    onEnter: function(args) {
4
        // args[0] 是第一个参数（文件路径）
5
        var path = Memory.readUtf8String(args[0]);
6
        console.log("[open] 打开文件: " + path);
7
    },
8
    onLeave: function(retval) {
9
        // retval 是返回值（文件描述符）
10
        console.log("[open] 返回 fd: " + retval.toInt32());
11
    }
12
});

1
Interceptor.attach(Module.findExportByName("libnative.so", "check_license"), {
2
    onEnter: function(args) {
3
        console.log("[check_license] 原始参数: " + Memory.readUtf8String(args[0]));
4
        // 替换参数
5
        args[0] = Memory.allocUtf8String("VALID-LICENSE-KEY");
6
    },
7
    onLeave: function(retval) {
8
        console.log("[check_license] 原始返回值: " + retval);
9
        // 强制返回 1（验证通过）
10
        retval.replace(ptr(1));
11
    }
12
});

1
var module = Process.findModuleByName("libnative.so");
2
var baseAddr = module.base;
3
// 假设目标函数在 offset 0x4A2C 处
4
var targetAddr = baseAddr.add(0x4A2C);
5

6
Interceptor.attach(targetAddr, {
7
    onEnter: function(args) {
8
        console.log("[+] 未导出函数被调用，地址: " + targetAddr);
9
    }
10
});

1
// Hook RegisterNatives 抓 JNI 动态注册
2
var registerNatives = Module.findExportByName("libart.so", "RegisterNatives");
3
if (registerNatives) {
4
    Interceptor.attach(registerNatives, {
5
        onEnter: function(args) {
6
            var methods = args[2];
7
            var count = args[3].toInt32();
8
            console.log("[RegisterNatives] 注册 " + count + " 个方法");
9
            for (var i = 0; i < count; i++) {
10
                var name = Memory.readUtf8String(methods.add(i * 24).readPointer());
11
                var signature = Memory.readUtf8String(methods.add(i * 24 + 8).readPointer());
12
                console.log("  - " + name + " :: " + signature);
13
            }
14
        }
15
    });
16
}

1
import frida
2
import sys
3

4
# JS Hook 脚本
5
js_code = """
6
Java.perform(function() {
7
    var MainActivity = Java.use("com.example.app.MainActivity");
8
    MainActivity.checkPassword.implementation = function(pwd) {
9
        console.log("[+] Password: " + pwd);
10
        return true;  // 绕过验证
11
    };
12
});
13
"""
14

15
def on_message(message, data):
16
    if message['type'] == 'send':
17
        print(f"[JS] {message['payload']}")
18
    else:
19
        print(message)
20

21
# Spawn 模式启动
22
device = frida.get_usb_device()
23
pid = device.spawn(["com.example.app"])
24
session = device.attach(pid)
25

26
script = session.create_script(js_code)
27
script.on('message', on_message)
28
script.load()
29

30
# 恢复执行
31
device.resume(pid)
32

33
# 保持运行
34
print("[*] 脚本运行中，Ctrl+C 退出...")
35
sys.stdin.read()

1
device = frida.get_usb_device()
2
session = device.attach("com.example.app")  # 通过进程名
3
# 或者 session = device.attach(12345)  # 通过 PID
4

5
script = session.create_script(js_code)
6
script.on('message', on_message)
7
script.load()
8
sys.stdin.read()

1
// JS 端
2
Java.perform(function() {
3
    var Base64 = Java.use('android.util.Base64');
4
    Base64.encodeToString.overload('[B', 'int').implementation = function(input, flags) {
5
        var result = this.encodeToString(input, flags);
6
        // 发回 Python 端记录
7
        send({type: "base64", data: result});
8
        return result;
9
    };
10
});

1
# Python 端接收并写入文件
2
def on_message(message, data):
3
    if message['type'] == 'send':
4
        payload = message['payload']
5
        if payload.get('type') == 'base64':
6
            with open('base64_log.txt', 'a') as f:
7
                f.write(payload['data'] + '\n')

1
Java.perform(function() {
2
    var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
3
    var TrustManager = Java.registerClass({
4
        name: 'com.frida.TrustManager',
5
        implements: [X509TrustManager],
6
        methods: {
7
            checkClientTrusted: function(chain, authType) {},
8
            checkServerTrusted: function(chain, authType) {},
9
            getAcceptedIssuers: function() { return []; }
10
        }
11
    });
12
    var TrustManagers = [TrustManager.$new()];
13

14
    var SSLContext = Java.use('javax.net.ssl.SSLContext');
15
    SSLContext.init.overload(
16
        '[Ljavax.net.ssl.KeyManager;',
17
        '[Ljavax.net.ssl.TrustManager;',
18
        'java.security.SecureRandom'
19
    ).implementation = function(km, tm, sr) {
20
        console.log('[+] SSL Pinning 已绕过');
21
        SSLContext.init.call(this, km, TrustManagers, sr);
22
    };
23
});

1
Java.perform(function() {
2
    // 常见 Root 检测绕过
3
    var Runtime = Java.use('java.lang.Runtime');
4
    Runtime.exec.overload('java.lang.String').implementation = function(cmd) {
5
        if (cmd.includes('su') || cmd.includes('which')) {
6
            console.log('[+] 拦截敏感命令: ' + cmd);
7
            throw new Error('Command blocked');
8
        }
9
        return this.exec(cmd);
10
    };
11

12
    // 屏蔽 Build.TAGS 检测
13
    var Build = Java.use('android.os.Build');
14
    Build.TAGS.value = 'release-keys';
15
});