From 139c9437882502c73de9016c170ee6c85715cac5 Mon Sep 17 00:00:00 2001 From: luzhisheng Date: Tue, 30 Jan 2024 03:11:43 +0800 Subject: [PATCH] =?UTF-8?q?app=E7=AD=BE=E5=90=8D=E6=A3=80=E6=B5=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../__init__.py | 0 .../hook签名相关函数.py | 52 +++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 猿人学app逆向/新-sec6-lesson3-平头哥框架(ratel)的安装及其简单应用/__init__.py create mode 100644 猿人学app逆向/新-sec6-lesson3-平头哥框架(ratel)的安装及其简单应用/hook签名相关函数.py diff --git a/猿人学app逆向/新-sec6-lesson3-平头哥框架(ratel)的安装及其简单应用/__init__.py b/猿人学app逆向/新-sec6-lesson3-平头哥框架(ratel)的安装及其简单应用/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/猿人学app逆向/新-sec6-lesson3-平头哥框架(ratel)的安装及其简单应用/hook签名相关函数.py b/猿人学app逆向/新-sec6-lesson3-平头哥框架(ratel)的安装及其简单应用/hook签名相关函数.py new file mode 100644 index 0000000..bb35a53 --- /dev/null +++ b/猿人学app逆向/新-sec6-lesson3-平头哥框架(ratel)的安装及其简单应用/hook签名相关函数.py @@ -0,0 +1,52 @@ +import frida +import sys + + +def on_message(message, data): + if message['type'] == 'send': + print("[*] {0}".format(message['payload'])) + else: + print(message) + + +test_sig = ''' +Java.perform( + function(){ + # hook 内置类android.content.pm.Signature + var Signature = Java.use('android.content.pm.Signature') + # hook 内置类的hashCode方法 + Signature.hashCode.implementation = function() { + console.log('hashCode') + return this.hashCode() + } + # hook 内置类的toByteArray方法 + Signature.toByteArray.implementation = function() { + console.log('toByteArray') + printstack() + return this.toByteArray() + } + # 打印调用堆栈 + function printstack() { + console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new())); + } + # 过掉检测 + var AA = Java.use('com.chaozhuo.texteditor.widget.a') + AA.a.overload('android.content.Context').implementation = function() { + return true + //this.a() + } + } +) +''' + +# 启动方式2 spawn 重启APP 可以hook APP启动阶段 +device = frida.get_usb_device(-1) +pid = device.spawn(['com.chaozhuo.texteditor']) +process = device.attach(pid) + +script = process.create_script(test_sig) +script.on('message', on_message) +print('[*] Running') +script.load() +device.resume(pid) +sys.stdin.read()