⑵ 认知Frida
官网API文档
Frida 常用命令
帮助命令：
frida -h,frida-ps -h通过USB连接，仅列出应用程序：
frida-ps -U -a
Frida 启动
Frida有
attach和spawn两种启动方式
attach：在APP启动后进行注入。适用于Hook点处于靠后的情况，若启动时已加载则无法Hook到。
spawn：在启动时进行注入。交由Frida管控APP，运行中则会重启APP在启动时注入。
attach
hello-frida.js
Java.perform(function () {
console.log('hello frida ~')
})通过USB，根据包名/应用名，加载脚本
# 打开应用 查询信息
frida-ps -U -a
# PID Name Identifier
# ---------- ---------------------------------------
# 15883 LessonTest com.hexl.lessontest
# 低版本（12）的用包名
frida -U com.hexl.lessontest -l .\hello-frida.js
# Failed to spawn: unable to find process with name 'com.hexl.lessontest'
# 高版本的需要用应用名 -n 可省略
frida -U LessonTest -l .\hello-frida.js
# -N 为指定包名
frida -U -N com.hexl.lessontest -l .\hello-frida.js
# ____
# / _ | Frida 16.0.2 - A world-class dynamic instrumentation toolkit
# | (_| |
# > _ | Commands:
# /_/ |_| help -> Displays the help system
# . . . . object? -> Display information about 'object'
# . . . . exit/quit -> Exit
# . . . .
# . . . . More info at https://frida.re/docs/home/
# . . . .
# . . . . Connected to Nexus 6P (id=CVH7N15A31000710)
# Attaching...
# hello frida ~通过USB，Hook最前端的APP
frida -UF -l .\hello-frida.jsspawn
必须增加
-f参数
frida -U -f com.hexl.lessontest -l .\hello-frida.js
--no-pause新版本取消，默认立即执行。暂停主线程参数--pause
通过python调用
import sys
import frida
def on_message(message, data):
print('message', message)
print('data', data)
def start_by_attach(name, js_path):
device = frida.get_usb_device()
session = device.attach(name)
with open(js_path, 'r') as f:
script = session.create_script(f.read())
script.on('message', on_message)
script.load()
sys.stdin.read()
def start_by_spawn(name, js_path):
device = frida.get_usb_device()
pid = device.spawn(name)
device.resume(pid)
session = device.attach(pid)
with open(js_path, 'r') as f:
script = session.create_script(f.read())
script.on('message', on_message)
script.load()
sys.stdin.read()
if __name__ == '__main__':
# start_by_attach('LessonTest', "./hello-frida.js")
start_by_spawn('com.hexl.lessontest', "./hello-frida.js")Frida自定义连接
Frida Server自定义端口
./frida-server -l 192.168.0.1:6666Frida远程连接自定义端口
通过命令连接
frida -H 192.168.0.1:6666 com.demo.app -l encryption-algorithm.js通过python连接
# 核心代码
process = frida.get_device_manager().add_remote_device('127.0.0.1:6666').attach('com.demo.app')Frida Hook
https://kevinspider.github.io/frida/frida-hook-java/
https://kevinspider.github.io/frida/frida-hook-so/
https://eternalsakura13.com/2020/07/04/frida/
https://zhuanlan.zhihu.com/p/157604388
https://copyfuture.com/blogs-details/20200728143553957rr76y0poznfo875
⑵ 认知Frida
https://元气码农少女酱.我爱你/a79955185f6f/