Frida Hook So 一些操作說明

Native方法第一個引數是 JNIEnv *env 如何在Frida中獲取 JNIEnv 物件呢?

Java.vm.getEnv();

如何將string型別轉換jstring型別呢?

let jstring = Java.vm.getEnv().newStringUtf(str);

如何將jstring型別轉string型別呢？

aes_value = Java.vm.getEnv().getStringUtfChars(result, null).readCString()

Hook So 匯出函式

let method1_addr = Module.findExportByName('libxiaowei.so', 'Java_com_example_xiaoweiso_MainActivity_method01');
 

Hook So 非匯出函式

let so_addr = Module.findBaseAddress('libxiaowei.so');
// 需要去so中找到非匯出函式的地址
let encrypt_addr = so_addr.add(0x42B0);

如何在so中定義一個字串

let cstring = Memory.allocUtf8String("xiaoweigege");

如何將c中的字串轉成js string?

ptr(result).readCString()

將函式地址定義成一個函式能在js中進行呼叫

let so_addr = Module.findBaseAddress('libxiaowei.so');
let encrypt_addr = so_addr.add(0x42B0);
let encrypt_fun = new NativeFunction(encrypt_addr, 'pointer', ['pointer']);
let cstring = Memory.allocUtf8String(str);
let result = encrypt_fun(cstring);
 

使用示例

function hook_method1(str) {

    let method1_addr = Module.findExportByName('libxiaowei.so', 'Java_com_example_xiaoweiso_MainActivity_method01');

    let method1_fun = new NativeFunction(method1_addr, 'pointer', ['pointer', 'pointer', 'pointer']);
    let aes_value = null


    Java.perform(function () {
        // Java.vm.getEnv() JNIEnv 物件獲取

        let jstring = Java.vm.getEnv().newStringUtf(str);
        let result = method1_fun(Java.vm.getEnv(), jstring, jstring);

        aes_value = Java.vm.getEnv().getStringUtfChars(result, null).readCString()
    })
    return aes_value;


}

function hook_method2(str) {

    let method1_addr = Module.findExportByName('libxiaowei.so', 'Java_com_example_xiaoweiso_MainActivity_method02');

    let method1_fun = new NativeFunction(method1_addr, 'pointer', ['pointer', 'pointer', 'pointer']);
    let aes_value = null


    Java.perform(function () {
        let jstring = Java.vm.getEnv().newStringUtf(str);
        let result = method1_fun(Java.vm.getEnv(), jstring, jstring);

        aes_value = Java.vm.getEnv().getStringUtfChars(result, null).readCString()
    })
    return aes_value;


}


function hook_encrypt(str) {
    let so_addr = Module.findBaseAddress('libxiaowei.so');
    let encrypt_addr = so_addr.add(0x42B0);
    let encrypt_fun = new NativeFunction(encrypt_addr, 'pointer', ['pointer']);
    let cstring = Memory.allocUtf8String(str);
    let result = encrypt_fun(cstring);

    console.log(ptr(result).readCString())

}

function hook_decrypt(str) {

    let so_addr = Module.findBaseAddress('libxiaowei.so');
    let encrypt_addr = so_addr.add(0x4538);
    let encrypt_fun = new NativeFunction(encrypt_addr, 'pointer', ['pointer']);
    let cstring = Memory.allocUtf8String(str);
    let result = encrypt_fun(cstring);

    console.log(ptr(result).readCString())
}


function main() {
    let value = hook_method1('xiaoweigege')
    hook_method2(value)
}


setImmediate(main)