Frida 实现 Hook 功能的强大能力

pip install frida-tools

PID Name
----- --------------------------------------------------
1313 adbd
12621 android.process.acore
18037 android.process.media
14455 com.android.defcontainer
11656 com.android.deskclock

package com.example.target_frida;

import androidx.appcompat.app.AppCompatActivity;

import android.annotation.SuppressLint;
import android.os.Bundle;
import android.view.View;
import android.widget.Button;
import android.widget.TextView;

public class MainActivity extends AppCompatActivity implements View.OnClickListener {
TextView winCountView;
TextView battleInfoTextView;
int winCount = 0;

@SuppressLint("SetTextI18n")
@Override
public void onClick(View view) {
if (winCount > 100) {
return;
}
if (view.getId() == R.id.tvButtonBlack) {
if (!getCPUResult()) {
winCount++;
winCountView.setText(winCount + "");
battleInfoTextView.setText("Right!");
} else {
winCount = 0;
winCountView.setText(winCount + "");
battleInfoTextView.setText("Wrong! Clean All!");
}
} else if (view.getId() == R.id.tvButtonWhite) {
if (getCPUResult()) {
winCount++;
winCountView.setText(winCount + "");
battleInfoTextView.setText("Right!");
} else {
winCount = 0;
winCountView.setText(winCount + "");
battleInfoTextView.setText("Wrong! Clean All!");
}
}
if (winCount >= 100) {
battleInfoTextView.setText("Win 100 times!!!");
}
}

@SuppressLint("SetTextI18n")
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);
winCountView = findViewById(R.id.winCount);
winCountView.setText(winCount + "");
battleInfoTextView = findViewById(R.id.battleInfo);
battleInfoTextView.setText("猜黑白！！！");
Button buttonBlack = (Button) findViewById(R.id.tvButtonBlack);
Button buttonWhite = (Button) findViewById(R.id.tvButtonWhite);
buttonBlack.setOnClickListener(this);
buttonWhite.setOnClickListener(this);
}

public boolean getCPUResult() {
//true为白，false为黑
return Math.random() > 0.5;
}

}

import time
import frida, sys

date_str = time.strftime('%m-%d %H:%M:%S')


def on_message(message, data):
if message['type'] == 'send':
print(f"[{date_str}] {message['payload']}")
else:
print(f"[{date_str}] {message}")


def run_all():
# Java.perform方法：当 js 附加到目标的进程中时被执行，运行其中定义的函数
# Java.choose方法：通过完整类名，获取它的实例，从而对实例中的数据进行修改
# 通过 key:value 结构定义了两个函数：
# onMatch 对应的函数在命中一个实例的时候被调用，传入函数中的参数 instance 就是被命中的实例
# onComplete 函数会在所有实例遍历完毕之后被调用，可以做一些后续处理操作
jscode = """
Java.perform(function () {
Java.choose("com.example.target_frida.MainActivity",{
onMatch:function(instance){
console.log("winCount value is "+instance.winCount.value);
instance.winCount.value=99;
console.log("winCount value is "+instance.winCount.value);
},
onComplete:function(){
console.log("Complete!!!")
}
});
});
"""
# attach目标App进程
target_app = 'com.example.target_frida'
process = frida.get_usb_device().attach(target_app)
# 将JS代码注入进程，并附加监听方法，用来获取返回的日志信息
script = process.create_script(jscode)
script.on('message', on_message)
# 打印起始日志
print(f'[{date_str}] Start Frida on {target_app}')
# 加载注入的JS代码逻辑
script.load()
# 使用系统输入语句阻止函数运行完毕自动退出
sys.stdin.read()


if __name__ == '__main__':
run_all()

[04-15 18:19:57] Start Frida on com.example.target_frida
winCount value is 0
winCount value is 99
Complete!!!