frida学习--02：常用定位代码

frida常用定位代码

1、Base64定位

var base64 = Java.use("android.util.Base64");
base64.encodeToString.overload('[B', 'int').implementation = function (a, b) {
    console.log("base64.encodeToString: ", JSON.stringify(a));
    var result = this.encodeToString(a, b);
    console.log("base64.encodeToString result: ", result)
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    return result;
}

2、HashMap定位

var hashMap = Java.use("java.util.HashMap");
hashMap.put.implementation = function (a, b) {
    //a=="username"和a.equals("username")一般都可以
    //如果不行换一下即可
    if (a.equals("username")) {
     	console.log("hashMap.put: ", a, b);
     	console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
 }
 return this.put(a, b);
}

3、Toastd定位

var toast = Java.use("android.widget.Toast");
toast.show.implementation=function(){
   console.log("输出调用栈：")
   console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
   return this.show();
}

4、jsonObject定位

var jSONObject = Java.use("org.json.JSONObject");
jSONObject.put.overload('java.lang.String', 'java.lang.Object').implementation = function (a, b) {
    //var result = Java.cast(a, Java.use("java.util.ArrayList"));
    console.log("jSONObject.put: ", a, b);
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    return this.put(a, b);
}
jSONObject.getString.implementation = function (a) {
    //var result = Java.cast(a, Java.use("java.util.ArrayList"));
    console.log("jSONObject.getString: ", a);
    var result = this.getString(a);
    console.log("jSONObject.getString result: ", result);
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    return result;
}

5、EditText的getText方法定位

var editText = Java.use("android.widget.EditText");
editText.getText.overload().implementation = function () {
    var result = this.getText();
    result = Java.cast(result, Java.use("java.lang.CharSequence"));
    console.log("editText.getText: ", result.toString());
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    return result;
}

6、ArrayList的定位

var arrayList = Java.use("java.util.ArrayList");
arrayList.add.overload('java.lang.Object').implementation = function (a) {
    if (a.equals("username=12555")) {
        console.log("arrayList.add: ", a);
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
    }
    //console.log("arrayList.add: ", a);
    return this.add(a);
}
arrayList.add.overload('int', 'java.lang.Object').implementation = function (a, b) {
    console.log("arrayList.add: ", a, b);
    return this.add(a, b);
}

7、System.loadLibrary的定位

Java.perform(function() {

	let Systemclazz = Java.use("java.lang.System");
	Systemclazz.loadLibrary.implementation = function(){  // loadLibrary、load、mapLibraryName等，都hook看看
		console.log('System.loadLibrary is called');
		console.log('library name:', arguments[0]);
		var retval = Systemclazz.loadLibrary.apply(this, arguments)

		//打印堆栈
		console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
		return retval
	};
});

8、NewStringUTF定位（通过密文定位so文件）
知道密文是so层加密的情况下，快速定位到是哪个so文件调用加密的

function hook_NewStringUTF(){
 
    var artModule = Process.findModuleByName("libart.so");
    var symbols = artModule.enumerateSymbols();
    var newStringUTF = null;
    for (let i = 0; i < symbols.length; i++) {
        let symbol = symbols[i];
        if(symbol.name.indexOf("NewStringUTF") != -1 && symbol.name.indexOf("Check") == -1){
            console.log(symbol.name);
            newStringUTF = symbol.address;
        }
        
    }
 
    Interceptor.attach(newStringUTF, {
        onEnter : function(args){
            if(args[1].readCString() && args[1].readCString().indexOf("*")!= -1 && args[1].readCString().indexOf("B")!= -1){  // 设置密文过滤规则
                console.log("\x1B[33m[加密字符串]:\x1B[0m",args[1].readCString());
                console.log("\x1B[33m[调用栈]:\x1B[0m\n",Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n') + '\n');

            }
        },onLeave : function(retval){
 
        }
    })
 
}

setTimeout(hook_NewStringUTF,1000);

9、文件路径定位

var File = Java.use("java.io.File");
File.$init.overload('java.lang.String').implementation=function(path){
   console.log("文件路径：",path)
   console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
   return File.apply(this, path);
}