• 加載fridaalias activityFrida="adb shell 'su /data/local/tmp/frida-server64 &'"

• 電腦啟動frida

  • 直接啟動frida -U packageName -l hook.js
  • app 剛啟動的時候hook, 用frida去啟動app frida -U --no-pause -f com.tlamb96.spetsnazmessenger -l hook.js

• hook 構造函數，類對象然后.$init來hook 構造函數

  • //hook 構造函數
    a.$init.implementation = function (i, str, str2, z) {
      this.$init(i, str, str2, z);
      console.log("a.$init:", i, str, str2, z);
      print_stack();       //打印了調用棧
    };
    

• 打印調用棧，調用java自帶的功能，拋出一個異常，打印內容，打印完之后 要把對象析構掉

  • function print_stack() {
        Java.perform(function () {
            var Exception = Java.use("java.lang.Exception");
            var instance = Exception.$new("print_stack");
            var stack = instance.getStackTrace();
            console.log(stack);
            instance.$dispose();
        });
    }
    

• jar -cvf ddex.jar com/example/androiddemo/DecodeUtils.class

? /Users/yang/Library/Android/sdk/build-tools/28.0.3/dx --dex --output=ddex.dex ddex.jar

打包成dex

• 加載dex var ddex2 = Java.openClassFile("/data/local/tmp/ddex2.dex");

• 構造字符串數組

   var Ref_arr  = Java.use('java.lang.reflect.Array')
       var stringClass = Java.use("java.lang.String").class
       var arg1 = Ref_arr.newInstance(stringClass, array.length);
       for (var i =0; i < array.length; i++) {
           Ref_arr.set(arg1, i, array[i])
       }