{"id":796,"date":"2024-03-03T15:27:36","date_gmt":"2024-03-03T07:27:36","guid":{"rendered":"https:\/\/shangwendada.top\/?p=796"},"modified":"2024-03-07T21:10:52","modified_gmt":"2024-03-07T13:10:52","slug":"fridafrida%e6%93%8d%e4%bd%9c%e6%89%8b%e5%86%8c","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2024\/03\/03\/fridafrida%e6%93%8d%e4%bd%9c%e6%89%8b%e5%86%8c\/","title":{"rendered":"[Frida]Frida\u64cd\u4f5c\u65b9\u6cd5\u603b\u7ed3"},"content":{"rendered":"<h2>\u9644\u4ef6\u4e0b\u8f7d<\/h2>\n<p><a href=\"https:\/\/github.com\/DERE-ad2001\/Frida-Labs\">https:\/\/github.com\/DERE-ad2001\/Frida-Labs<\/a><\/p>\n<h1>Java\u5c42<\/h1>\n<h2>\u524d\u671f\u51c6\u5907<\/h2>\n<ol>\n<li>\u4f7f\u7528 jadx \u8fdb\u884c\u9006\u5411\u5de5\u7a0b\u7684\u57fa\u7840\u77e5\u8bc6\u3002<\/li>\n<li>\u5e94\u5177\u5907\u7406\u89e3 Java \u4ee3\u7801\u7684\u80fd\u529b\u3002<\/li>\n<li>\u5177\u5907\u7f16\u5199\u5c0f\u578b JavaScript \u4ee3\u7801\u7247\u6bb5\u7684\u80fd\u529b\u3002<\/li>\n<li>\u719f\u6089 adb\u3002<\/li>\n<li>\u8bbe\u5907\u5df2 root\u3002<\/li>\n<li><a href=\"https:\/\/shangwendada.top\/index.php\/2024\/02\/17\/fridafrida%e7%8e%af%e5%a2%83%e9%85%8d%e7%bd%ae\/\" title=\"Frida\u73af\u5883\u914d\u7f6e\">Frida\u73af\u5883\u914d\u7f6e<\/a><\/li>\n<\/ol>\n<h2>Hook\uff08Hooking\uff09\u7b80\u4ecb<\/h2>\n<p>\u8ba9\u6211\u4eec\u4ece\u975e\u5e38\u57fa\u7840\u7684\u77e5\u8bc6\u5f00\u59cb\u3002<\/p>\n<p><strong>\u4ec0\u4e48\u662f\u94a9\u5b50\uff1f<\/strong><\/p>\n<p><strong>Hook<\/strong>\u662f\u6307\u62e6\u622a\u548c\u4fee\u6539\u5e94\u7528\u7a0b\u5e8f\u6216Android\u7cfb\u7edf\u4e2d\u51fd\u6570\u6216\u65b9\u6cd5\u884c\u4e3a\u7684\u8fc7\u7a0b\u3002\u4f8b\u5982\uff0c\u6211\u4eec\u53ef\u4ee5\u94a9\u53d6\u6211\u4eec\u5e94\u7528\u7a0b\u5e8f\u4e2d\u7684\u4e00\u4e2a\u65b9\u6cd5\uff0c\u5e76\u901a\u8fc7\u63d2\u5165\u6211\u4eec\u81ea\u5df1\u7684\u5b9e\u73b0\u6765\u6539\u53d8\u5176\u529f\u80fd\u3002<\/p>\n<p>\u73b0\u5728\uff0c\u8ba9\u6211\u4eec\u5c1d\u8bd5\u5728\u4e00\u4e2a\u5e94\u7528\u7a0b\u5e8f\u4e2d\u94a9\u53d6\u4e00\u4e2a\u65b9\u6cd5\u3002\u6211\u4eec\u5c06\u4f7f\u7528JavaScript API \u6765\u5b8c\u6210\u8fd9\u4e2a\u4efb\u52a1\uff0c\u4f46\u503c\u5f97\u6ce8\u610f\u7684\u662f\uff0cFrida\u4e5f\u652f\u6301Python\u3002<\/p>\n<h2>1\u3001\u4f7f\u7528Hook\u4fee\u6539\u88ab\u8c03\u7528\u7684\u65b9\u6cd5\u7684\u903b\u8f91\uff0c\u8fd4\u56de\u503c\uff0c\u4f20\u5165\u53c2\u6570<\/h2>\n<h3>\u57fa\u672c\u6a21\u677f<\/h3>\n<p>\u9996\u5148\u8ba9\u6211\u63d0\u4f9b\u7ed9\u4f60\u4e00\u4e2a\u6a21\u677f\uff0c\u7136\u540e\u6211\u4eec\u4e00\u6b65\u6b65\u6765\u89e3\u91ca\u3002<\/p>\n<pre><code class=\"language-javascript\">Java.perform(function() {\n\n  var &lt;class_reference&gt; = Java.use(&quot;&lt;package_name&gt;.&lt;class&gt;&quot;);\n  &lt;class_reference&gt;.&lt;method_to_hook&gt;.implementation = function(&lt;args&gt;) {\n\n    \/*\n      \u6211\u4eec\u81ea\u5df1\u7684\u65b9\u6cd5\u5b9e\u73b0\n    *\/\n\n  }\n\n})<\/code><\/pre>\n<ul>\n<li>\n<p><code>Java.perform<\/code> \u662f Frida \u4e2d\u7528\u4e8e\u521b\u5efa\u4e00\u4e2a\u7279\u6b8a\u4e0a\u4e0b\u6587\u7684\u51fd\u6570\uff0c\u8ba9\u4f60\u7684\u811a\u672c\u80fd\u591f\u4e0e Android \u5e94\u7528\u7a0b\u5e8f\u4e2d\u7684 Java \u4ee3\u7801\u8fdb\u884c\u4ea4\u4e92\u3002\u5b83\u5c31\u50cf\u662f\u6253\u5f00\u4e86\u4e00\u6247\u95e8\uff0c\u8ba9\u4f60\u80fd\u591f\u8bbf\u95ee\u5e76\u64cd\u7eb5\u5e94\u7528\u7a0b\u5e8f\u5185\u90e8\u8fd0\u884c\u7684 Java \u4ee3\u7801\u3002\u4e00\u65e6\u8fdb\u5165\u8fd9\u4e2a\u4e0a\u4e0b\u6587\uff0c\u4f60\u5c31\u53ef\u4ee5\u6267\u884c\u8bf8\u5982\u94a9\u53d6\u65b9\u6cd5\u6216\u8bbf\u95ee Java \u7c7b\u7b49\u64cd\u4f5c\u6765\u63a7\u5236\u6216\u89c2\u5bdf\u5e94\u7528\u7a0b\u5e8f\u7684\u884c\u4e3a\u3002<\/p>\n<\/li>\n<li>\n<p><code>var &lt;class_reference&gt; = Java.use(&quot;&lt;package_name&gt;.&lt;class&gt;&quot;);<\/code><br \/>\n\u5728\u8fd9\u91cc\uff0c\u4f60\u58f0\u660e\u4e00\u4e2a\u53d8\u91cf <code>&lt;class_reference&gt;<\/code> \u6765\u8868\u793a\u76ee\u6807 Android \u5e94\u7528\u7a0b\u5e8f\u4e2d\u7684\u4e00\u4e2a Java \u7c7b\u3002\u4f60\u4f7f\u7528 <code>Java.use<\/code> \u51fd\u6570\u6307\u5b9a\u8981\u4f7f\u7528\u7684\u7c7b\uff0c\u8be5\u51fd\u6570\u63a5\u53d7\u7c7b\u540d\u4f5c\u4e3a\u53c2\u6570\u3002<code>&lt;package_name&gt;<\/code> \u8868\u793a Android \u5e94\u7528\u7a0b\u5e8f\u7684\u5305\u540d\uff0c<code>&lt;class&gt;<\/code> \u8868\u793a\u4f60\u60f3\u8981\u4e0e\u4e4b\u4ea4\u4e92\u7684\u7c7b\u3002<br \/>\n<code>&lt;package_name&gt;<\/code> \uff1a<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709457853451.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709457853451.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<\/li>\n<li>\n<p><code>&lt;class_reference&gt;.&lt;method_to_hook&gt;.implementation = function(&lt;args&gt;) {}<\/code><br \/>\n\u5728\u6240\u9009\u7684\u7c7b\u5185\u90e8\uff0c\u901a\u8fc7 <code>&lt;class_reference&gt;.&lt;method_to_hook&gt;<\/code> \u7b26\u53f7\u8bbf\u95ee\u4f60\u60f3\u8981\u94a9\u53d6\u7684\u65b9\u6cd5\u3002\u8fd9\u662f\u4f60\u53ef\u4ee5\u5b9a\u4e49\u81ea\u5df1\u7684\u903b\u8f91\u4ee5\u5728\u94a9\u53d6\u7684\u65b9\u6cd5\u88ab\u8c03\u7528\u65f6\u6267\u884c\u7684\u5730\u65b9\u3002<code>&lt;args&gt;<\/code> \u8868\u793a\u4f20\u9012\u7ed9\u51fd\u6570\u7684\u53c2\u6570\u3002<\/p>\n<\/li>\n<\/ul>\n<h3>\u4f8b\u9898Frida-Labs 0x1<\/h3>\n<p>\u901a\u8fc7Jadx\u5206\u6790Frida-labs 0x1<\/p>\n<h4>onCreate\u65b9\u6cd5<\/h4>\n<pre><code class=\"language-java\">    public void onCreate(Bundle bundle) {\n        super.onCreate(bundle);\n        setContentView(C0570R.layout.activity_main);\n        final EditText editText = (EditText) findViewById(C0570R.C0573id.editTextTextPassword);\n        this.f103t1 = (TextView) findViewById(C0570R.C0573id.textview1);\n        final int i = get_random();\n        ((Button) findViewById(C0570R.C0573id.button)).setOnClickListener(new View.OnClickListener() { \/\/ from class: com.ad2001.frida0x1.MainActivity.1\n            @Override \/\/ android.view.View.OnClickListener\n            public void onClick(View view) {\n                String obj = editText.getText().toString();\n                if (TextUtils.isDigitsOnly(obj)) {\n                    MainActivity.this.check(i, Integer.parseInt(obj));\n                } else {\n                    Toast.makeText(MainActivity.this.getApplicationContext(), &quot;Enter a valid number !!&quot;, 1).show();\n                }\n            }\n        });\n    }\n<\/code><\/pre>\n<p>\u53ef\u4ee5\u53d1\u73b0\uff0c\u5728onCreate\u65b9\u6cd5\u4e2d\uff0c\u6709\u4e00\u4e2a\u76d1\u542c\u4e8b\u4ef6\uff0c\u76d1\u542c\u4e86button\u7684\u70b9\u51fb\uff0c\u5f53\u6309\u94ae\u70b9\u51fb\u4e0b\u53bb\u4e4b\u540e\uff0c\u7a0b\u5e8f\u9996\u5148\u5224\u65ad\u8f93\u5165\u662f\u4e0d\u662f\u6570\u5b57\uff0c\u662f\u6570\u5b57\u7684\u8bdd\uff0c\u5c31\u5c06\u5176\u4ecestring\u8f6c\u5316\u4e3aint\uff0c\u518d\u8fdb\u5165check\u4e2d\u4e0ei\u6bd4\u8f83\uff0c\u56e0\u6b64\u6211\u4eec\u9700\u8981\u68c0\u67e5check\u65b9\u6cd5\u3002<\/p>\n<h4>check\u65b9\u6cd5<\/h4>\n<pre><code class=\"language-java\"> void check(int i, int i2) {\n        if ((i * 2) + 4 == i2) {\n            Toast.makeText(getApplicationContext(), &quot;Yey you guessed it right&quot;, 1).show();\n            StringBuilder sb = new StringBuilder();\n            for (int i3 = 0; i3 &lt; 20; i3++) {\n                char charAt = &quot;AMDYV{WVWT_CJJF_0s1}&quot;.charAt(i3);\n                if (charAt &lt; &#039;a&#039; || charAt &gt; &#039;z&#039;) {\n                    if (charAt &gt;= &#039;A&#039;) {\n                        if (charAt &lt;= &#039;Z&#039;) {\n                            charAt = (char) (charAt - 21);\n                            if (charAt &gt;= &#039;A&#039;) {\n                            }\n                            charAt = (char) (charAt + 26);\n                        }\n                    }\n                    sb.append(charAt);\n                } else {\n                    charAt = (char) (charAt - 21);\n                    if (charAt &gt;= &#039;a&#039;) {\n                        sb.append(charAt);\n                    }\n                    charAt = (char) (charAt + 26);\n                    sb.append(charAt);\n                }\n            }\n            this.f103t1.setText(sb.toString());\n            return;\n        }\n        Toast.makeText(getApplicationContext(), &quot;Try again&quot;, 1).show();\n    }\n<\/code><\/pre>\n<p>\u672c\u65b9\u6cd5\u663e\u800c\u6613\u89c1\u5c31\u662f\u68c0\u67e5\u8f93\u5165\u662f\u5426\u80fd\u591f\u6ee1\u8db3i*2 + 4 == i2,\u5982\u679c\u6ee1\u8db3\u5219\u5c06flag\u8f93\u51fa\u5230f103t1\u6240\u7ed1\u5b9a\u7684textView\u63a7\u4ef6\u4e0a,\u5176\u4e2d\u7528\u4e8e\u5224\u65ad\u7684i\u5219\u6765\u81eaget_random\u3002<\/p>\n<h4>get_random<\/h4>\n<pre><code class=\"language-java\">    int get_random() {\n        return new Random().nextInt(100);\n    }\n<\/code><\/pre>\n<p>\u663e\u800c\u6613\u89c1\uff0c\u672c\u65b9\u6cd5\u5c31\u53ea\u662f\u666e\u901a\u7684\u8fd4\u56de\u4e00\u4e2a\u968f\u673a\u6570\u3002<\/p>\n<h4>Hook begin!<\/h4>\n<p>\u5bf9\u4e8e\u672c\u6837\u4f8b\u7a0b\u5e8f\uff0c\u6211\u4eec\u6709\u4e24\u79cd\u65b9\u6cd5\u53bb\u89e3\u51b3\uff0c\u9996\u5148\u6211\u4eec\u53ef\u4ee5\u76f4\u63a5hook\u7a0b\u5e8f\u903b\u8f91\u3002\u66f4\u6539\u968f\u673a\u4ea7\u751f\u7684\u503c\u4e3a\u4e00\u4e2a\u56fa\u5b9a\u503c\u3002\u6216\u8005hook check\u65b9\u6cd5\u66f4\u6539check\u65b9\u6cd5\u4f20\u5165\u7684\u53c2\u6570<\/p>\n<h5>Hook get_random\u65b9\u6cd5<\/h5>\n<h6>\u5b9e\u73b0\u4ee3\u7801<\/h6>\n<pre><code class=\"language-javascript\">function hook(){\n    var MainActivity = Java.use(&quot;com.ad2001.frida0x1.MainActivity&quot;);\n    MainActivity.get_random.implementation = function (){\n        return 0;\n    }\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook();\n    })\n}\n\nsetImmediate(main);\n<\/code><\/pre>\n<p>\u4ee3\u7801\u89e3\u91ca\u5982\u4e0b\uff1a<\/p>\n<ol>\n<li>\n<p>\u9996\u5148\u5b9a\u4e49\u4e86\u4e00\u4e2a\u540d\u4e3a<code>hook<\/code>\u7684JavaScript\u51fd\u6570\uff0c\u5176\u4e2d\u5305\u542b\u4e86\u5bf9\u76ee\u6807\u5e94\u7528\u7279\u5b9a\u65b9\u6cd5\u7684hook\u903b\u8f91\u3002<\/p>\n<ul>\n<li><code>hook<\/code>\u51fd\u6570\u901a\u8fc7Frida\u7684Java API\u6765\u83b7\u53d6\u76ee\u6807\u5e94\u7528\u4e2d\u7684<code>MainActivity<\/code>\u7c7b\u3002<\/li>\n<li>\u7136\u540e\uff0c\u5b83\u901a\u8fc7<code>Java.use()<\/code>\u65b9\u6cd5\u83b7\u53d6\u4e86<code>MainActivity<\/code>\u7c7b\u7684\u5f15\u7528\uff0c\u4f7f\u5f97\u6211\u4eec\u53ef\u4ee5\u8bbf\u95ee\u8be5\u7c7b\u7684\u65b9\u6cd5\u3002<\/li>\n<li>\u6700\u540e\uff0c<code>hook<\/code>\u51fd\u6570\u5c06<code>MainActivity<\/code>\u7c7b\u4e2d\u7684<code>get_random<\/code>\u65b9\u6cd5\u8fdb\u884c\u4e86\u4fee\u6539\u3002\u5b83\u7528\u81ea\u5b9a\u4e49\u7684\u5b9e\u73b0\u66ff\u6362\u4e86\u539f\u6709\u65b9\u6cd5\u7684\u5b9e\u73b0\uff0c\u4f7f\u5f97\u6bcf\u6b21\u8c03\u7528<code>get_random<\/code>\u65b9\u6cd5\u65f6\u90fd\u8fd4\u56de\u56fa\u5b9a\u503c0\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u63a5\u7740\u5b9a\u4e49\u4e86\u4e00\u4e2a\u540d\u4e3a<code>main<\/code>\u7684JavaScript\u51fd\u6570\uff0c\u5176\u4e2d\u5305\u542b\u4e86Frida\u7684<code>Java.perform()<\/code>\u65b9\u6cd5\uff0c\u7528\u4e8e\u6267\u884c\u6307\u5b9a\u7684hook\u903b\u8f91\u3002<\/p>\n<\/li>\n<li>\n<p>\u6700\u540e\uff0c\u901a\u8fc7<code>setImmediate()<\/code>\u51fd\u6570\u8c03\u7528<code>main<\/code>\u51fd\u6570\uff0c\u786e\u4fdd\u5728Frida\u811a\u672c\u542f\u52a8\u540e\u7acb\u5373\u6267\u884c\u3002<\/p>\n<\/li>\n<\/ol>\n<h5>hook check\u65b9\u6cd5<\/h5>\n<p>\u5982\u679c\u6211\u4eec\u68c0\u67e5check\u51fd\u6570\u7684\u53c2\u6570\uff0c\u7b2c\u4e00\u4e2a\u53c2\u6570i\u8868\u793a\u968f\u673a\u6570\uff0c\u800c\u7b2c\u4e8c\u4e2a\u53c2\u6570i2\u5bf9\u5e94\u4e8e\u7528\u6237\u8f93\u5165\u7684\u6570\u5b57\u3002\u8ba9\u6211\u4eec\u4f7f\u7528Frida\u6765\u6355\u83b7\u5e76\u8f6c\u50a8\u8fd9\u4e24\u4e2a\u53c2\u6570\u3002<\/p>\n<p>\u5728\u5904\u7406\u5177\u6709\u53c2\u6570\u7684\u65b9\u6cd5\u65f6\uff0c\u91cd\u8981\u7684\u662f\u4f7f\u7528overload(arg_type)\u5173\u952e\u5b57\u6307\u5b9a\u9884\u671f\u7684\u53c2\u6570\u7c7b\u578b\u3002\u6b64\u5916\uff0c\u5728\u94a9\u5165\u65b9\u6cd5\u65f6\u786e\u4fdd\u5305\u62ec\u8fd9\u4e9b\u6307\u5b9a\u7684\u53c2\u6570\u5728\u4f60\u7684\u5b9e\u73b0\u4e2d\u3002\u5728\u8fd9\u91cc\uff0c\u6211\u4eec\u7684check()\u51fd\u6570\u63a5\u53d7\u4e24\u4e2a\u6574\u6570\u53c2\u6570\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u8fd9\u6837\u6307\u5b9a\uff1a<\/p>\n<pre><code class=\"language-javascript\">a.check.overload(int, int).implementation = function(a, b) {\n\n  ...\n\n}\n<\/code><\/pre>\n<pre><code class=\"language-javascript\">function hook2(){\n    var MainActivity = Java.use(&quot;com.ad2001.frida0x1.MainActivity&quot;);\n    MainActivity.check.overload(&#039;int&#039;,&#039;int&#039;).implementation = function (a,b){\n        console.log(&quot;Origin i and i2 = &quot;,a,b);\n        return this.check(a,b);\n    }\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook2();\n    })\n}\n\nsetImmediate(main);<\/code><\/pre>\n<p>\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528console.log\u67e5\u770b\u4f20\u5165\u7684a\u4e0eb\u662f\u4ec0\u4e48<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709460070492.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709460070492.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<p>\u5728<code>this.check(a,b);<\/code>\u4e2d\u7684a,b\u6539\u4e3a\u81ea\u5df1\u8bbe\u5b9a\u7684\u503c\u5c31\u53ef\u4ee5\u4e86\u3002<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709460323348.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709460323348.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h2>2\u3001Hook\u8c03\u7528\u9759\u6001\u7684\u672a\u88ab\u8c03\u7528\u7684\u65b9\u6cd5<\/h2>\n<p>\u5728\u4e4b\u524d\u8bb2\u5230\u7684Java.use Api\u4e2d\uff0c\u5982\u679c\u6211\u4eec\u6307\u5b9a\u7684\u7c7b\u4e2d\u5305\u542b\u4e86\u9759\u6001\u7684\u65b9\u6cd5\uff0c\u5219\u6211\u4eec\u53ef\u4ee5\u76f4\u63a5\u8c03\u7528\u8be5\u65b9\u6cd5\u3002\u6a21\u677f\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-javascript\">Java.perform(function (){\n    var &lt;class_reference&gt; = Java.use(&quot;&lt;package_name&gt;.&lt;class&gt;&quot;);\n    a.function(val);\n})<\/code><\/pre>\n<h3>\u4f8b\u9898Frida-labs 0x2<\/h3>\n<h4>MainActivity\u7c7b<\/h4>\n<pre><code class=\"language-java\">package com.ad2001.frida0x2;\n\nimport android.os.Bundle;\nimport android.util.Base64;\nimport android.widget.TextView;\nimport androidx.appcompat.app.AppCompatActivity;\nimport javax.crypto.Cipher;\nimport javax.crypto.spec.IvParameterSpec;\nimport javax.crypto.spec.SecretKeySpec;\n\n\/* loaded from: classes3.dex *\/\npublic class MainActivity extends AppCompatActivity {\n\n    \/* renamed from: t1 *\/\n    static TextView f103t1;\n\n    \/* JADX INFO: Access modifiers changed from: protected *\/\n    @Override \/\/ androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity\n    public void onCreate(Bundle savedInstanceState) {\n        super.onCreate(savedInstanceState);\n        setContentView(C0569R.layout.activity_main);\n        f103t1 = (TextView) findViewById(C0569R.C0572id.textview);\n    }\n\n    public static void get_flag(int a) {\n        if (a == 4919) {\n            try {\n                SecretKeySpec secretKeySpec = new SecretKeySpec(&quot;HILLBILLWILLBINN&quot;.getBytes(), &quot;AES&quot;);\n                Cipher cipher = Cipher.getInstance(&quot;AES\/CBC\/PKCS5Padding&quot;);\n                IvParameterSpec iv = new IvParameterSpec(new byte[16]);\n                cipher.init(2, secretKeySpec, iv);\n                byte[] decryptedBytes = cipher.doFinal(Base64.decode(&quot;q7mBQegjhpfIAr0OgfLvH0t\/D0Xi0ieG0vd+8ZVW+b4=&quot;, 0));\n                String decryptedText = new String(decryptedBytes);\n                f103t1.setText(decryptedText);\n            } catch (Exception e) {\n                e.printStackTrace();\n            }\n        }\n    }\n}<\/code><\/pre>\n<p>\u672c\u7528\u4f8b\u7a0b\u5e8f\u5c31\u4e00\u4e2aMainActivity\u7c7b\uff0c\u7c7b\u4e2d\u5b58\u5728\u4e00\u4e2a\u672a\u88ab\u4f7f\u7528\u7684\u9759\u6001\u65b9\u6cd5get_flag\uff0c\u5728get_flag\u4e2d\u6bd4\u8f83\u4e86\u4f20\u5165\u7684\u53c2\u6570\uff0c\u5982\u679c\u4f20\u5165\u7684\u53c2\u6570\u4e3a4919\u5219\u89e3\u5bc6flag\uff0c\u8bbe\u7f6e\u7ed9txtView\u63a7\u4ef6\uff0c\u90a3\u4e48\u6839\u636e\u4e4b\u524d\u7ed9\u51fa\u7684\u8c03\u7528\u6a21\u677f\uff0c\u6211\u4eechook\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n<h4>Hook\u4ee3\u7801\uff1a<\/h4>\n<pre><code class=\"language-java\">function hook(){\n    var MainActivity = Java.use(&quot;com.ad2001.frida0x2.MainActivity&quot;);\n    MainActivity.get_flag(4919);\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook();\n    })\n}\n\nsetImmediate(main);<\/code><\/pre>\n<p>\u4f46\u662f\u6211\u4eec\u53d1\u73b0\u5982\u679c\u4f7f\u7528\u7684\u662fsetIMMediate(main)\u7684\u8bdd\u6211\u4eec\u4f7f\u7528<br \/>\n<code>frida -U -f com.ad2001.frida0x2 -l .\\Hook.js<\/code><br \/>\n\u53ef\u80fd\u4f1a\u5bfc\u81f4hook\u4e0d\u4e0a\u7684\u60c5\u51b5\u3002<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709465780915.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709465780915.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h5>\u89e3\u51b3\u65b9\u6cd51<\/h5>\n<p>\u6211\u4eec\u4e8b\u5148\u542f\u52a8Frida 0x2\u5e94\u7528\u7a0b\u5e8f\u3002\u7136\u540e\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u6ce8\u5165\u6211\u4eec\u7684\u811a\u672c<br \/>\n<code>frida -U &#039;Frida 0x2&#039; -l .\\Hook.js<\/code><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709465999157.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709465999157.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u672c\u65b9\u6cd5\u4e0e\u4e4b\u524d\u7684\u65b9\u6cd5\u4e0d\u540c\u4e4b\u5904\u662f\u8be5\u65b9\u6cd5\u662f\u76f4\u63a5hook\u5165\u6211\u4eec\u540e\u53f0\u6b63\u5728\u542f\u52a8\u7684\u7a0b\u5e8f\uff0c\u800c\u4e4b\u524d\u7684\u65b9\u6cd5\u662f\u6839\u636e\u5305\u540d\u518d\u542f\u52a8\u4e00\u4e2a\u7a0b\u5e8f\u3002<\/p>\n<h5>\u89e3\u51b3\u65b9\u6cd52<\/h5>\n<p>\u5f53\u6211\u4eec\u53d1\u73b0\u4f7f\u7528<code>\u89e3\u51b3\u65b9\u6cd51<\/code>\u80fd\u591f\u6210\u529fhook\u7684\u65f6\u5019\uff0c\u5c31\u53ef\u4ee5\u63a8\u65ad\u51fa\uff0c\u662f\u7531\u4e8e\u6211\u4eec\u542f\u52a8main\u51fd\u6570\u4f7f\u7528\u7684\u662fsetImmediate(main)\uff0c\u662f\u7acb\u5373\u542f\u52a8\u53ef\u80fd\u4f1a\u5bfc\u81f4\u811a\u672c\u6ce8\u5165\u7684\u901f\u5ea6\u6bd4\u7a0b\u5e8f\u542f\u52a8\u7684\u901f\u5ea6\u5feb\u3002\u56e0\u6b64\u6211\u4eec\u53ef\u4ee5\u6539\u7528<code>setTimeout(main,1000)<\/code>\uff0c\u4e5f\u5c31\u662f\u5ef6\u8fdf1\u79d2\u949f\u542f\u52a8\u7a0b\u5e8f\u3002<br \/>\n\u8be6\u60c5\u53ef\u89c1https:\/\/www.cnblogs.com\/fsjohnhuang\/p\/4151595.html<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709466387598.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709466387598.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h2>3\u3001\u66f4\u6539\u7c7b\u4e2d\u7684\u9759\u6001\u53d8\u91cf<\/h2>\n<p>\u7c7b\u4f3c\u4e8e\u5982\u4e0b\u5199\u6cd5static int code = 0;<br \/>\n\u4f7f\u7528static \u4fee\u9970\u7684\u53d8\u91cf\u5219\u4e3a\u9759\u6001\u53d8\u91cf\u3002\u6211\u4eec\u53ef\u4ee5\u7528\u5982\u4e0b\u65b9\u6cd5\u66f4\u6539\u9759\u6001\u53d8\u91cf\u3002<\/p>\n<pre><code class=\"language-javascript\">Java.perform(function (){\n\n    var &lt;class_reference&gt; = Java.use(&quot;&lt;package_name&gt;.&lt;class&gt;&quot;);\n    &lt;class_reference&gt;.&lt;variable&gt;.value = &lt;value&gt;;\n\n})<\/code><\/pre>\n<h3>\u4f8b\u9898 Frida-labs 0x3<\/h3>\n<p>MainActivity\u7c7b<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709468739573.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709468739573.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u6807\u8bb0\u5904\u6211\u4eec\u53ef\u4ee5\u53d1\u73b0\uff0c\u5f53Checker.code\u4e3a512\u7684\u65f6\u5019\u70b9\u51fb\u6309\u94ae\uff0c\u7a0b\u5e8f\u5219\u4f1a\u89e3\u5bc6\u5e76\u4e14\u5c06textView\u63a7\u4ef6\u8bbe\u7f6e\u4e3aFlag\u3002<\/p>\n<h3>Hook\u4ee3\u7801<\/h3>\n<pre><code class=\"language-javascript\">function hook(){\n    var a = Java.use(&quot;com.ad2001.frida0x3.Checker&quot;);\n    a.code.value = 512;\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook();\n    })\n}\nsetImmediate(main);\n<\/code><\/pre>\n<h2>4\u3001\u8c03\u7528\u975eMainActivity,\u975e\u9759\u6001\u65b9\u6cd5<\/h2>\n<p>\u5728JAVA\u4ee3\u7801\u4e2d\uff0c\u5982\u679c\u521b\u5efa\u4e86\u4e00\u4e2a\u975e\u9759\u6001\u7684\u7c7b\uff0c\u5f53\u6211\u4eec\u9700\u8981\u4f7f\u7528\u8fd9\u4e2a\u7c7b\u7684\u65f6\u5019\u9700\u8981new\u4e00\u4e2a\u7c7b\u7684\u5bf9\u8c61\u51fa\u6765\u6211\u4eec\u624d\u80fd\u4f7f\u7528\u8fd9\u4e2a\u7c7b\u7684\u529f\u80fd\u3002\u7c7b\u4f3c\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-java\">\nCheck ch = new Check();\nString flag = ch.get_flag(1337);\n<\/code><\/pre>\n<p>\u90a3\u4e48\u5728Java\u6e90\u7801\u4e2d\u9700\u8981new\u51fa\u6765\u7684\u5b9e\u4f8b\uff0c\u6211\u4eec\u600e\u4e48\u4f7f\u7528Frida\u6765\u5b9e\u73b0\u5462\uff1f<br \/>\n\u6a21\u677f\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-javascript\">Java.perform(function() {\n\n  var &lt;class_reference&gt; = Java.use(&quot;&lt;package_name&gt;.&lt;class&gt;&quot;);\n  var &lt;class_instance&gt; = &lt;class_reference&gt;.$new(); \/\/ Class Object\n  &lt;class_instance&gt;.&lt;method&gt;(); \/\/ \u8c03\u7528\u65b9\u6cd5\n\n})\n<\/code><\/pre>\n<h3>\u4f8b\u9898Frida-labs 0x4<\/h3>\n<h4>MainActivity\uff1a<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709471309782.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709471309782.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\nMainActivity\u4e2d\u6ca1\u6709\u4efb\u4f55\u4e1c\u897f\u3002<\/p>\n<h4>Checker<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709471365351.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709471365351.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\nChecker\u4e2d\u51fa\u73b0\u4e86get_flag\u65b9\u6cd5\uff0c\u8fd4\u56de\u4e86flag\u3002\u5219\u6211\u4eec\u4f7f\u7528\u4e4b\u524d\u7684\u6a21\u677f\u6765Hook<\/p>\n<h4>Hook\u4ee3\u7801\uff1a<\/h4>\n<pre><code class=\"language-javascript\">function hook(){\n    console.log(&quot;Hook Success!&quot;);\n    var Check = Java.use(&quot;com.ad2001.frida0x4.Check&quot;);\n    var Check_obj = Check.$new();\n    var String = Check_obj.get_flag(1337);\n    console.log(String);\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook();\n\n    })\n}\n\nsetImmediate(main);<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709471656698.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709471656698.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h2>5\u3001\u8c03\u7528MainActivity\u4e2d\u7684\u975e\u9759\u6001\u65b9\u6cd5<\/h2>\n<p>\u524d\u9762\u6709\u63d0\u5230\u8fc7\u5982\u679c\u4e0d\u662fMainActivity\u4e2d\u7684\u65b9\u6cd5\u6211\u4eec\u4f7f\u7528.$new()\u53ef\u4ee5\u521b\u5efa\u4e00\u4e2a\u5b9e\u4f8b\u3002\u90a3\u4e48\u5982\u679c\u6211\u4eec\u5c06\u8fd9\u4e2a\u4f7f\u7528\u5230MainActivity\u4f1a\u53d1\u751f\u4ec0\u4e48\u5462?<\/p>\n<pre><code class=\"language-javascript\">function hook(){\n    var MainActivity = Java.use(&quot;com.ad2001.frida0x5&quot;);\n    var MainActivity_obj = MainActivity.$new();\n}<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709483078034.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709483078034.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u597d\u5427\uff0c\u5b83\u5d29\u6e83\u4e86\u3002\u90a3\u4e48\u8fd9\u662f\u4ec0\u4e48\u539f\u56e0\u5462\uff1f<\/p>\n<p>\u76f4\u63a5\u4f7f\u7528Frida\u521b\u5efa<code>MainActivity<\/code>\u6216\u4efb\u4f55Android\u7ec4\u4ef6\u53ef\u80fd\u4f1a\u5f88\u68d8\u624b\uff0c\u56e0\u4e3aAndroid\u7684\u751f\u547d\u5468\u671f\u548c\u7ebf\u7a0b\u89c4\u5219\u3002Android\u7ec4\u4ef6\uff0c\u5982<code>Activity<\/code>\u5b50\u7c7b\uff0c\u4f9d\u8d56\u4e8e\u5e94\u7528\u7a0b\u5e8f\u4e0a\u4e0b\u6587\u8fdb\u884c\u6b63\u786e\u8fd0\u884c\u3002\u5728Frida\u4e2d\uff0c\u60a8\u53ef\u80fd\u7f3a\u5c11\u5fc5\u8981\u7684\u4e0a\u4e0b\u6587\u3002Android UI\u7ec4\u4ef6\u901a\u5e38\u9700\u8981\u5177\u6709\u5173\u8054<code>Looper<\/code>\u7684\u7279\u5b9a\u7ebf\u7a0b\u3002\u5982\u679c\u6d89\u53caUI\u4efb\u52a1\uff0c\u8bf7\u786e\u4fdd\u5728\u5177\u6709\u6d3b\u52a8<code>Looper<\/code>\u7684\u4e3b\u7ebf\u7a0b\u4e0a\u6267\u884c\u3002\u6d3b\u52a8\u662f\u8f83\u5927\u7684Android\u5e94\u7528\u7a0b\u5e8f\u751f\u547d\u5468\u671f\u7684\u4e00\u90e8\u5206\u3002\u521b\u5efa<code>MainActivity<\/code>\u7684\u5b9e\u4f8b\u53ef\u80fd\u9700\u8981\u5e94\u7528\u5904\u4e8e\u7279\u5b9a\u72b6\u6001\uff0c\u5e76\u4e14\u901a\u8fc7Frida\u7ba1\u7406\u6574\u4e2a\u751f\u547d\u5468\u671f\u53ef\u80fd\u5e76\u4e0d\u76f4\u63a5\u3002\u603b\u4e4b\uff0c\u4e3a<code>MainActivity<\/code>\u521b\u5efa\u5b9e\u4f8b\u5e76\u4e0d\u662f\u4e00\u4e2a\u597d\u4e3b\u610f\u3002<\/p>\n<p>\u90a3\u4e48\u8fd9\u91cc\u7684\u89e3\u51b3\u65b9\u6848\u662f\u4ec0\u4e48\u5462\uff1f<\/p>\n<p>\u5f53Android\u5e94\u7528\u7a0b\u5e8f\u542f\u52a8\u65f6\uff0c\u7cfb\u7edf\u4f1a\u521b\u5efa<code>MainActivity<\/code>\u7684\u4e00\u4e2a\u5b9e\u4f8b\uff08\u6216AndroidManifest.xml\u6587\u4ef6\u4e2d\u6307\u5b9a\u7684\u542f\u52a8\u5668\u6d3b\u52a8\uff09\u3002\u521b\u5efa<code>MainActivity<\/code>\u5b9e\u4f8b\u662fAndroid\u5e94\u7528\u7a0b\u5e8f\u751f\u547d\u5468\u671f\u7684\u4e00\u90e8\u5206\u3002\u56e0\u6b64\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528frida\u83b7\u53d6<code>MainActivity<\/code>\u7684\u5b9e\u4f8b\uff0c\u7136\u540e\u8c03\u7528<code>flag()<\/code>\u65b9\u6cd5\u6765\u83b7\u53d6\u6211\u4eec\u7684\u6807\u5fd7\u3002<\/p>\n<h3>\u5728\u73b0\u6709\u5b9e\u4f8b\u4e0a\u8c03\u7528\u65b9\u6cd5<\/h3>\n<p>\u5728\u73b0\u6709\u5b9e\u4f8b\u4e0a\u8c03\u7528\u65b9\u6cd5\u53ef\u4ee5\u5f88\u5bb9\u6613\u5730\u901a\u8fc7Frida\u5b8c\u6210\u3002\u4e3a\u6b64\uff0c\u6211\u4eec\u5c06\u4f7f\u7528\u4e24\u4e2aAPI\u3002<\/p>\n<ul>\n<li>\n<p><code>Java.performNow<\/code>\uff1a\u7528\u4e8e\u5728Java\u8fd0\u884c\u65f6\u73af\u5883\u4e2d\u6267\u884c\u4ee3\u7801\u7684\u51fd\u6570\u3002<\/p>\n<\/li>\n<li>\n<p><code>Java.choose<\/code>\uff1a\u5728\u8fd0\u884c\u65f6\u679a\u4e3e\u6307\u5b9aJava\u7c7b\uff08\u4f5c\u4e3a\u7b2c\u4e00\u4e2a\u53c2\u6570\u63d0\u4f9b\uff09\u7684\u5b9e\u4f8b\u3002<\/p>\n<\/li>\n<\/ul>\n<p>\u8ba9\u6211\u5c55\u793a\u4e00\u4e2a\u6a21\u677f\u7ed9\u4f60\u3002<\/p>\n<pre><code class=\"language-javascript\">Java.performNow(function() {\n  Java.choose(&#039;&lt;\u5305\u540d&gt;.&lt;\u7c7b\u540d&gt;&#039;, {\n    onMatch: function(instance) {\n      \/\/ \u5f85\u529e\u4e8b\u9879\n    },\n    onComplete: function() {}\n  });\n});<\/code><\/pre>\n<p>\u8fd9\u91cc\u6709\u4e24\u4e2a\u56de\u8c03\u51fd\u6570\uff1a<\/p>\n<ul>\n<li><strong>onMatch<\/strong>\n<ul>\n<li><code>onMatch<\/code>\u56de\u8c03\u51fd\u6570\u5728<code>Java.choose<\/code>\u64cd\u4f5c\u671f\u95f4\u627e\u5230\u6307\u5b9a\u7c7b\u7684\u6bcf\u4e2a\u5b9e\u4f8b\u65f6\u6267\u884c\u3002<\/li>\n<li>\u8fd9\u4e2a\u56de\u8c03\u51fd\u6570\u63a5\u6536\u5f53\u524d\u5b9e\u4f8b\u4f5c\u4e3a\u5b83\u7684\u53c2\u6570\u3002<\/li>\n<li>\u60a8\u53ef\u4ee5\u5728<code>onMatch<\/code>\u56de\u8c03\u4e2d\u5b9a\u4e49\u81ea\u5b9a\u4e49\u64cd\u4f5c\uff0c\u4ee5\u5728\u6bcf\u4e2a\u5b9e\u4f8b\u4e0a\u6267\u884c\u3002<\/li>\n<li><code>function(instance) {}<\/code>\uff0c<code>instance<\/code>\u53c2\u6570\u8868\u793a\u76ee\u6807\u7c7b\u7684\u6bcf\u4e2a\u5339\u914d\u5b9e\u4f8b\u3002\u60a8\u53ef\u4ee5\u4f7f\u7528\u4efb\u4f55\u5176\u4ed6\u540d\u79f0\u3002<\/li>\n<\/ul>\n<\/li>\n<li><strong>onComplete<\/strong>\n<ul>\n<li><code>onComplete<\/code>\u56de\u8c03\u5728<code>Java.choose<\/code>\u64cd\u4f5c\u5b8c\u6210\u540e\u6267\u884c\u64cd\u4f5c\u6216\u6e05\u7406\u4efb\u52a1\u3002\u6b64\u5757\u662f\u53ef\u9009\u7684\uff0c\u5982\u679c\u60a8\u5728\u641c\u7d22\u5b8c\u6210\u540e\u4e0d\u9700\u8981\u6267\u884c\u4efb\u4f55\u7279\u5b9a\u64cd\u4f5c\uff0c\u5219\u53ef\u4ee5\u9009\u62e9\u5c06\u5176\u7559\u7a7a\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>\u4f8b\u9898Frida-labs 0x5<\/h3>\n<h4>MainActivity<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709483467607.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709483467607.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u53ef\u4ee5\u53d1\u73b0\u5176\u4e2dflag\u65b9\u6cd5\u662f\u672a\u88ab\u8c03\u7528\u7684\u65b9\u6cd5\uff0c\u5e76\u4e14\u662f\u89e3\u5bc6\u5bc6\u6587\u5c06Flag\u8f93\u51fa\u5230TextView\u63a7\u4ef6\u4e0a\u3002<\/p>\n<h4>BeginHook\uff01<\/h4>\n<p>\u73b0\u5728\u6211\u4eec\u77e5\u9053\u5982\u4f55\u4f7f\u7528<code>Java.choose<\/code> API\uff0c\u8ba9\u6211\u4eec\u5f00\u59cb\u7f16\u5199\u6211\u4eec\u7684frida\u811a\u672c\u3002<\/p>\n<ul>\n<li>\u5305\u540d\uff1a<code>com.ad2001.frida0x5<\/code><\/li>\n<li>\u7c7b\u540d\uff1a<code>MainActivity<\/code><\/li>\n<li>\u51fd\u6570\u540d\uff1a<code>flag<\/code><\/li>\n<\/ul>\n<pre><code class=\"language-javascript\">Java.performNow(function() {\n  Java.choose(&#039;com.ad2001.frida0x5.MainActivity&#039;, {\n    onMatch: function(instance) {\n      \/\/ \u5f85\u529e\u4e8b\u9879\n    },\n    onComplete: function() {}\n  });\n});<\/code><\/pre>\n<p>\u8ba9\u6211\u4eec\u5728\u6210\u529f\u627e\u5230<code>MainActivity<\/code>\u5b9e\u4f8b\u65f6\u5305\u542b\u4e00\u4e2a<code>console.log<\/code>\u8bed\u53e5\u4ee5\u6253\u5370\u4e00\u6761\u6d88\u606f\u3002\u7531\u4e8e\u5728\u679a\u4e3e\u5b8c\u6210\u540e\u6211\u4eec\u6ca1\u6709\u4efb\u4f55\u7279\u5b9a\u7684\u64cd\u4f5c\u8981\u6267\u884c\uff0c\u6211\u4eec\u53ef\u4ee5\u5c06<code>onComplete<\/code>\u5757\u7559\u7a7a\u3002<\/p>\n<pre><code class=\"language-javascript\">Java.performNow(function() {\n  Java.choose(&#039;com.ad2001.frida0x5.MainActivity&#039;, {\n    onMatch: function(instance) {\n      console.log(&quot;\u627e\u5230\u5b9e\u4f8b&quot;);\n    },\n    onComplete: function() {}\n  });\n});<\/code><\/pre>\n<p>\u8ba9\u6211\u4eec\u542f\u52a8Frida\u5e76\u6ce8\u5165\u6211\u4eec\u7684\u811a\u672c\u3002<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709483710080.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709483710080.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h4>Hook\u4ee3\u7801<\/h4>\n<pre><code class=\"language-javascript\">function hook(){\n    Java.choose(&#039;com.ad2001.frida0x5.MainActivity&#039;,{\n        onMatch:function (MainActivity){\n            MainActivity.flag(1337);\n            console.log(&quot;Hook Success!&quot;);\n        },onComplete:function (){\n\n        }\n    })\n}\n\nfunction main(){\n\n    Java.perform(function (){\n        hook();\n    })\n}\n\nsetImmediate(main);<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709483873021.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709483873021.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h2>6\u3001MainActivity\u4e2d\u975e\u9759\u6001\u5e76\u4e14\u53c2\u6570\u4e3a\u975e\u9759\u6001\u53d8\u91cf\u65b9\u6cd5\u8c03\u7528<\/h2>\n<h3>\u4f8b\u9898Frida-labs 0x6<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709485036952.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709485036952.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u6211\u4eec\u4e4b\u524d\u5df2\u7ecf\u89e3\u51b3\u8fc7\u7c7b\u4f3c\u7684\u95ee\u9898\u4e86\u3002\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b\uff0c\u6211\u4eec\u6709\u4e00\u4e2a<code>get_flag()<\/code>\u65b9\u6cd5\uff0c\u5728\u5e94\u7528\u7a0b\u5e8f\u4e2d\u6ca1\u6709\u88ab\u8c03\u7528\u3002\u5982\u679c\u8c03\u7528\u6b64\u65b9\u6cd5\uff0c\u5b83\u5c06\u4f7f\u7528<code>AES<\/code>\u89e3\u5bc6\u6807\u5fd7\uff0c\u5e76\u5c06\u6807\u5fd7\u8bbe\u7f6e\u5728Textview\u4e2d\u3002\u5982\u679c\u6211\u4eec\u68c0\u67e5<code>get_flag<\/code>\u65b9\u6cd5\uff0c\u5b83\u53ea\u63a5\u53d7\u4e00\u4e2a\u53c2\u6570\uff0c\u8fd9\u4e2a\u53c2\u6570\u662f<code>Checker<\/code>\u7c7b\u7684\u4e00\u4e2a\u5b9e\u4f8b\u3002\u53c2\u6570\u88ab\u547d\u540d\u4e3a<code>A<\/code>\uff0c\u5176\u7c7b\u578b\u662f<code>Checker<\/code>\u3002<\/p>\n<pre><code class=\"language-java\">public void get_flag(Checker A) throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException {\n    \/\/ \u65b9\u6cd5\u4f53\n}<\/code><\/pre>\n<p>\u5728\u65b9\u6cd5\u5185\u90e8\uff0c\u5b83\u68c0\u67e5<code>A.num1<\/code>\u662f\u5426\u7b49\u4e8e<code>1234<\/code>\uff0c\u4ee5\u53ca<code>A.num2<\/code>\u662f\u5426\u7b49\u4e8e<code>4321<\/code>\u3002\u5982\u679c\u6761\u4ef6\u6210\u7acb\uff0c\u8be5\u65b9\u6cd5\u5c06\u7ee7\u7eed\u4f7f\u7528AES\u89e3\u5bc6\u52a0\u5bc6\u5b57\u7b26\u4e32\uff0c\u5e76\u5c06\u89e3\u5bc6\u540e\u7684\u7ed3\u679c\u8bbe\u7f6e\u5728TextView\u4e2d\u3002\u56e0\u6b64\uff0c\u8ba9\u6211\u4eec\u68c0\u67e5\u4e00\u4e0bChecker\u7c7b\u3002<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709485070587.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709485070587.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<p>\u5728Checker\u7c7b\u4e2d\uff0c\u6211\u4eec\u6709\u4e24\u4e2a\u53d8\u91cf\u3002<\/p>\n<ul>\n<li>num1<\/li>\n<li>num2<\/li>\n<\/ul>\n<p><code>num1<\/code>\u5e94\u8be5\u7b49\u4e8e<code>1234<\/code>\uff0c<code>num2<\/code>\u5e94\u8be5\u7b49\u4e8e<code>4321<\/code>\uff0c\u4ee5\u6ee1\u8db3<code>if<\/code>\u6761\u4ef6\u6267\u884c\u89e3\u5bc6\u5e76\u8bbe\u7f6e\u6807\u5fd7\u7684\u4ee3\u7801\u5757\u3002\u8bf7\u8bb0\u4f4f\uff0c\u8fd9\u4e2a\u7c7b\u4e5f\u6ca1\u6709\u5b9e\u4f8b\u3002<\/p>\n<h4>\u89e3\u51b3\u65b9\u6848<\/h4>\n<p>\u8fd9\u4e2a\u95ee\u9898\u5f88\u5bb9\u6613\u89e3\u51b3\uff0c\u56e0\u4e3a\u6211\u4eec\u4e4b\u524d\u5df2\u7ecf\u5728\u4e0a\u4e00\u7bc7\u5e16\u5b50\u4e2d\u505a\u8fc7\u4e86\uff0c\u552f\u4e00\u7684\u533a\u522b\u662f<code>get_flag<\/code>\u65b9\u6cd5\u7684\u53c2\u6570\u662f<code>Checker<\/code>\u7c7b\u7684\u4e00\u4e2a\u5bf9\u8c61\u3002\u6211\u5c06\u603b\u7ed3\u89e3\u51b3\u8fd9\u4e2a\u95ee\u9898\u7684\u6b65\u9aa4\u5982\u4e0b\uff1a<\/p>\n<ul>\n<li>\u521b\u5efa\u4e00\u4e2a<code>Checker<\/code>\u7c7b\u7684\u5b9e\u4f8b\u3002<\/li>\n<li>\u5c06<code>num1<\/code>\u8bbe\u7f6e\u4e3a1234\uff0c<code>num2<\/code>\u8bbe\u7f6e\u4e3a4321\u3002<\/li>\n<li>\u83b7\u53d6<code>MainActivity<\/code>\u7684\u5b9e\u4f8b\u3002<\/li>\n<li>\u4f7f\u7528\u5b9e\u4f8b\u4f5c\u4e3a\u53c2\u6570\u8c03\u7528<code>get_flag<\/code>\u65b9\u6cd5\u3002<\/li>\n<\/ul>\n<p>\u8ba9\u6211\u4eec\u5f00\u59cb\u7f16\u5199\u6211\u4eec\u7684frida\u811a\u672c\u3002<\/p>\n<p>\u9996\u5148\u8ba9\u6211\u4eec\u521b\u5efa<code>Checker<\/code>\u7c7b\u7684\u5b9e\u4f8b\u3002<\/p>\n<pre><code class=\"language-javascript\">var checker = Java.use(&quot;com.ad2001.frida0x6.Checker&quot;);\nvar checker_obj = checker.$new(); \/\/ \u7c7b\u5bf9\u8c61<\/code><\/pre>\n<p>\u8bbe\u7f6e<code>num1<\/code>\u548c<code>num2<\/code>\u7684\u503c\u3002<\/p>\n<pre><code class=\"language-javascript\">checker_obj.num1.value = 1234;\nchecker_obj.num2.value = 4321;<\/code><\/pre>\n<p>\u73b0\u5728\u8ba9\u6211\u4eec\u83b7\u53d6<code>MainActivity<\/code>\u7684\u5b9e\u4f8b\u3002\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528<code>Java.performNow<\/code>\u548c<code>Java.choose<\/code>API\u3002\u6211\u4eec\u5728\u4e4b\u524d\u7684\u6311\u6218\u4e2d\u5df2\u7ecf\u505a\u8fc7\u4e86\u3002<\/p>\n<pre><code class=\"language-javascript\">Java.performNow(function() {\n  Java.choose(&#039;com.ad2001.frida0x6.MainActivity&#039;, {\n    onMatch: function(instance) {\n      console.log(&quot;\u627e\u5230\u5b9e\u4f8b&quot;);\n\n    },\n    onComplete: function() {}\n  });\n})<\/code><\/pre>\n<p>\u8ba9\u6211\u4eec\u66f4\u65b0\u811a\u672c\uff0c\u52a0\u5165<code>Checker<\/code>\u7c7b\u7684\u5b9e\u4f8b\u3002<\/p>\n<pre><code class=\"language-javascript\">Java.performNow(function() {\n  Java.choose(&#039;com.ad2001.frida0x6.MainActivity&#039;, {\n    onMatch: function(instance) {\n      console.log(&quot;\u627e\u5230\u5b9e\u4f8b&quot;);\n\n      var checker = Java.use(&quot;com.ad2001.frida0x6.Checker&quot;);\n      var checker_obj  = checker.$new();  \/\/ \u7c7b\u5bf9\u8c61\n      checker_obj.num1.value = 1234;\n      checker_obj.num2.value = 4321;\n\n    },\n    onComplete: function() {}\n  });\n});<\/code><\/pre>\n<p>\u73b0\u5728\u552f\u4e00\u8981\u505a\u7684\u662f\u901a\u8fc7\u4f20\u9012<code>Checker<\/code>\u7c7b\u7684\u5b9e\u4f8b\u6765\u8c03\u7528<code>get_flag<\/code>\u65b9\u6cd5\u3002<\/p>\n<pre><code class=\"language-javascript\">Java.performNow(function() {\n  Java.choose(&#039;com.ad2001.frida0x6.MainActivity&#039;, {\n    onMatch: function(instance) {\n      console.log(&quot;\u627e\u5230\u5b9e\u4f8b&quot;);\n\n      var checker = Java.use(&quot;com.ad2001.frida0x6.Checker&quot;);\n      var checker_obj  = checker.$new();  \/\/ \u7c7b\u5bf9\u8c61\n      checker_obj.num1.value = 1234; \/\/ num1\n      checker_obj.num2.value = 4321; \/\/ num2\n      instance.get_flag(checker_obj); \/\/ \u8c03\u7528get_flag\u65b9\u6cd5\n\n    },\n    onComplete: function() {}\n  });\n});<\/code><\/pre>\n<p>\u8ba9\u6211\u4eec\u542f\u52a8frida\u5e76\u8fd0\u884c\u6211\u4eec\u7684\u811a\u672c\u3002<\/p>\n<pre><code>PS C:\\Users\\ajind&gt; frida -U -f com.ad2001.frida0x6<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709485205036.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709485205036.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<p>\u5f53\u6211\u4eec\u68c0\u67e5\u6211\u4eec\u7684\u624b\u673a\u65f6\uff0cTextView\u5c06\u663e\u793a\u6807\u5fd7\u3002<\/p>\n<h2>7\u3001Hook\u6784\u9020\u51fd\u6570<\/h2>\n<p><strong>\u5982\u679c\u5728ARM64 \u8bbe\u5907\u4e0a\u4e0d\u5de5\u4f5c\u8bf7\u770bissue\uff1a<a href=\"https:\/\/github.com\/frida\/frida\/issues\/1575\">https:\/\/github.com\/frida\/frida\/issues\/1575<\/a><\/strong><\/p>\n<p>\u6302\u94a9\u6784\u9020\u51fd\u6570\u5341\u5206\u7b80\u5355\uff0c\u4e0e\u6302\u94a9\u65b9\u6cd5\u7c7b\u4f3c\u3002\u8ba9\u6211\u4e3a\u60a8\u63d0\u4f9b\u4e00\u4e2a\u6a21\u677f\u3002<\/p>\n<pre><code class=\"language-javascript\">Java.perform(function() {\n  var &lt;class_reference&gt; = Java.use(&quot;&lt;package_name&gt;.&lt;class&gt;&quot;);\n  &lt;class_reference&gt;.$init.implementation = function(&lt;args&gt;){\n\n    \/*\n\n    *\/\n\n  }\n});<\/code><\/pre>\n<p>\u6211\u4eec\u53ef\u4ee5\u770b\u5230\uff0c\u4e3a\u4e86\u6302\u94a9\u6784\u9020\u51fd\u6570\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528<code>$init<\/code>\u5173\u952e\u5b57\u3002<\/p>\n<h3>\u4f8b\u9898Frida-labs 0x7<\/h3>\n<h4>MainActivity<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709485878632.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709485878632.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u53ef\u4ee5\u770b\u5230\u7a0b\u5e8f\u5728\u4f7f\u7528flag\u65b9\u6cd5\u5224\u65ad\u4e4b\u524d\uff0c\u9996\u5148\u4f7f\u7528 Checker ch = new Checker(123, 321); \u521b\u5efa\u4e86\u4e00\u4e2aChecker\u5b9e\u4f8b\uff0c\u5219123 \uff0c 321 \u5206\u522b\u5bf9\u5e94A.num1\u4e0e A.num2\u3002<br \/>\n\u90a3\u4e48\u6211\u4eec\u53ea\u9700\u8981\u94a9\u4f4f\u6784\u9020\u51fd\u6570\u5373\u53ef\u3002<\/p>\n<h4>Hook\u4ee3\u7801<\/h4>\n<pre><code class=\"language-java\">function hook(){\n    var Checker = Java.use(&quot;com.ad2001.frida0x7.Checker&quot;);\n    Checker.$init.implementation = function (a,b){\n        console.log(&quot;Origin num&quot;,a,b);\n        this.$init(600,600);\n        console.log(&quot;Hook Success&quot;);\n    }\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook();\n    })\n}\nsetImmediate(main);<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709486446902.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709486446902.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h1>Native\u5c42<\/h1>\n<h2>\u524d\u671f\u51c6\u5907<\/h2>\n<ul>\n<li>\u4f7f\u7528 jadx \u8fdb\u884c\u9006\u5411\u5de5\u7a0b\u7684\u57fa\u7840\u77e5\u8bc6\u3002<\/li>\n<li>\u80fd\u591f\u7406\u89e3 Java \u4ee3\u7801\u3002<\/li>\n<li>\u80fd\u591f\u7f16\u5199\u7b80\u77ed\u7684 JavaScript \u4ee3\u7801\u7247\u6bb5\u3002<\/li>\n<li>\u719f\u6089 adb\u3002<\/li>\n<li>\u5df2 root \u7684\u8bbe\u5907\u3002<\/li>\n<li>\u5bf9 x86\/ARM64 \u6c47\u7f16\u548c\u9006\u5411\u5de5\u7a0b\u6709\u57fa\u7840\u4e86\u89e3\u3002<\/li>\n<\/ul>\n<h2>1\u3001Hook Native\u5c42\u4e2d\u8c03\u7528\u7684\u51fd\u6570\u5e76\u4e14\u8bfb\u53d6\u4f20\u5165\u7684\u53c2\u6570<\/h2>\n<p>\u5bf9\u4e8eNative\u5c42\u7684\u51fd\u6570Hook\uff0c\u6211\u4eec\u4f7f\u7528\u5982\u4e0b\u6a21\u677f<\/p>\n<pre><code class=\"language-javascript\">Interceptor.attach(targetAddress, {\n    onEnter: function (args) {\n        console.log(&#039;Entering &#039; + functionName);\n        \/\/ Modify or log arguments if needed\n    },\n    onLeave: function (retval) {\n        console.log(&#039;Leaving &#039; + functionName);\n        \/\/ Modify or log return value if needed\n    }\n});\n<\/code><\/pre>\n<ul>\n<li><code>Interceptor.attach<\/code>\uff1a\u5c06\u56de\u8c03\u51fd\u6570\u9644\u52a0\u5230\u6307\u5b9a\u7684\u51fd\u6570\u5730\u5740\u3002<code>targetAddress<\/code> \u5e94\u8be5\u662f\u6211\u4eec\u60f3\u8981\u6302\u94a9\u7684\u672c\u5730\u51fd\u6570\u7684\u5730\u5740\u3002<\/li>\n<li><code>onEnter<\/code>\uff1a\u5f53\u6302\u94a9\u7684\u51fd\u6570\u88ab\u8c03\u7528\u65f6\uff0c\u8c03\u7528\u6b64\u56de\u8c03\u3002\u5b83\u63d0\u4f9b\u5bf9\u51fd\u6570\u53c2\u6570 (<code>args<\/code>) \u7684\u8bbf\u95ee\u3002<\/li>\n<li><code>onLeave<\/code>\uff1a\u5f53\u6302\u94a9\u7684\u51fd\u6570\u5373\u5c06\u9000\u51fa\u65f6\uff0c\u8c03\u7528\u6b64\u56de\u8c03\u3002\u5b83\u63d0\u4f9b\u5bf9\u8fd4\u56de\u503c (<code>retval<\/code>) \u7684\u8bbf\u95ee\u3002<br \/>\n\u9700\u8981\u83b7\u53d6targetAddress\u6211\u4eec\u53ef\u4ee5\u65b9\u4fbf\u7684\u4f7f\u7528\u5982\u4e0bAPI<\/p>\n<ol>\n<li><code>Module.enumerateExports()<\/code><br \/>\n\u901a\u8fc7\u8c03\u7528 Module.enumerateExports()\uff0c\u6211\u4eec\u53ef\u4ee5\u83b7\u53d6\u5230\u5bfc\u51fa\u51fd\u6570\u7684\u540d\u79f0\u3001\u5730\u5740\u4ee5\u53ca\u5176\u4ed6\u76f8\u5173\u4fe1\u606f\u3002\u8fd9\u4e9b\u4fe1\u606f\u5bf9\u4e8e\u8fdb\u884c\u51fd\u6570\u6302\u94a9\u3001\u51fd\u6570\u8ddf\u8e2a\u6216\u8005\u8c03\u7528\u5176\u4ed6\u51fd\u6570\u90fd\u975e\u5e38\u6709\u7528\u3002<\/li>\n<li><code>Module.getExportByName()<\/code><br \/>\n\u5f53\u6211\u4eec\u77e5\u9053\u8981\u67e5\u627e\u7684\u5bfc\u51fa\u9879\u7684\u540d\u79f0\u4f46\u4e0d\u77e5\u9053\u5176\u5730\u5740\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528 Module.getExportByName()\u3002\u901a\u8fc7\u63d0\u4f9b\u5bfc\u51fa\u9879\u7684\u540d\u79f0\u4f5c\u4e3a\u53c2\u6570\uff0c\u8fd9\u4e2a\u51fd\u6570\u4f1a\u8fd4\u56de\u4e0e\u8be5\u540d\u79f0\u5bf9\u5e94\u7684\u5bfc\u51fa\u9879\u7684\u5730\u5740\u3002<\/li>\n<li><code>Module.findExportByName()<\/code><br \/>\n\u8fd9\u4e0e Module.getExportByName() \u662f\u4e00\u6837\u7684\u3002\u552f\u4e00\u7684\u533a\u522b\u5728\u4e8e\uff0c\u5982\u679c\u672a\u627e\u5230\u5bfc\u51fa\u9879\uff0cModule.getExportByName() \u4f1a\u5f15\u53d1\u5f02\u5e38\uff0c\u800c Module.findExportByName() \u5982\u679c\u672a\u627e\u5230\u5bfc\u51fa\u9879\u5219\u8fd4\u56de <code>null<\/code>\u3002\u8ba9\u6211\u4eec\u770b\u4e00\u4e2a\u793a\u4f8b\u3002<\/li>\n<li><code>Module.getBaseAddress()<\/code><br \/>\n\u901a\u8fc7\u8c03\u7528 Module.getBaseAddress() \u51fd\u6570\uff0c\u6211\u4eec\u53ef\u4ee5\u83b7\u53d6\u6307\u5b9a\u6a21\u5757\u7684\u57fa\u5740\u5730\u5740\uff0c\u7136\u540e\u53ef\u4ee5\u57fa\u4e8e\u8fd9\u4e2a\u57fa\u5740\u5730\u5740\u8fdb\u884c\u504f\u79fb\u8ba1\u7b97\uff0c\u4ee5\u5b9a\u4f4d\u6a21\u5757\u5185\u90e8\u7684\u7279\u5b9a\u51fd\u6570\u3001\u53d8\u91cf\u6216\u8005\u6570\u636e\u7ed3\u6784<\/li>\n<li><code>Module.enumerateImports()<\/code><br \/>\n\u901a\u8fc7\u8c03\u7528 Module.enumerateImports() \u51fd\u6570\uff0c\u6211\u4eec\u53ef\u4ee5\u83b7\u53d6\u5230\u6307\u5b9a\u6a21\u5757\u5bfc\u5165\u7684\u5916\u90e8\u51fd\u6570\u6216\u53d8\u91cf\u7684\u540d\u79f0\u3001\u5730\u5740\u4ee5\u53ca\u5176\u4ed6\u76f8\u5173\u4fe1\u606f\u3002<\/p>\n<h3>\u4f8b\u9898 Frida-Labs 0x8<\/h3>\n<h4>MainActivity<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709574518436.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709574518436.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u53ef\u4ee5\u53d1\u73b0\uff0c\u7a0b\u5e8f\u4eceEditText\u63a7\u4ef6\u4e2d\u83b7\u53d6\u5230\u4e86\u7528\u6237\u7684\u8f93\u5165\uff0c\u7136\u540e\u8c03\u7528\u4e86native\u5c42\u4e2d\u7684cmpstr\u51fd\u6570\u8fdb\u884c\u6bd4\u8f83\u3002<\/p>\n<\/li>\n<\/ol>\n<\/li>\n<\/ul>\n<h4>Navtive\u5c42\u903b\u8f91<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709574726794.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709574726794.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u7a0b\u5e8f\u5728cmpstr\u4e2d\u4f7f\u7528\u4e86strcmp\u51fd\u6570\uff0c\u90a3\u4e48\u6211\u4eec\u53ea\u9700\u8981\u62ff\u5230strcmp\u51fd\u6570\u7684\u4f20\u5165\u53c2\u6570\u5c31\u53ef\u4ee5\u77e5\u9053\u7a0b\u5e8f\u7684\u6b63\u786e\u8f93\u5165\u4e86<\/p>\n<h4>Hook begin<\/h4>\n<p>\u9996\u5148\u6211\u4eec\u4f7f\u7528Module.enumerateImports(&quot;libfrida0x8.so&quot;)\u67e5\u770b\u5bfc\u5165\u8868<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709575080623.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709575080623.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u53ef\u4ee5\u53d1\u73b0strcmp\u6765\u81ea\u4e8elibc.so\uff0c\u90a3\u4e48\u6211\u4eec\u5c31\u53ef\u4ee5\u4f7f\u7528Module.findExportByName(&quot;libc.so&quot;,&quot;strcmp&quot;);\u6765\u83b7\u53d6strcmp\u7684\u5730\u5740\u4e86<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709575169677.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709575169677.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<p>\u83b7\u53d6\u4e86strcmp\u7684\u5730\u5740\u5c31\u53ef\u4ee5\u4f7f\u7528\u4e4b\u524d\u7ed9\u7684\u6a21\u677f\u8fdb\u884cHook\u4e86<\/p>\n<pre><code class=\"language-javascript\">function hook(){\n\n    var targetAddress = Module.findExportByName(&quot;libc.so&quot;,&quot;strcmp&quot;);\n    console.log(&quot;Strcmp Address: &quot;,targetAddress.toString(16));\n\n    Interceptor.attach(targetAddress,{\n        onEnter:function (args){\n\n        },onLeave:function(retval){\n\n        }\n    })\n    console.log(&quot;success!&quot;);\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook();\n    })\n}\nsetImmediate(main);<\/code><\/pre>\n<p>\u4f46\u662f\u6211\u4eec\u9700\u8981\u6ce8\u610f\u7684\u662fstrcmp\u53ef\u80fd\u4e0d\u6b62\u8c03\u7528\u4e00\u6b21\uff0c\u56e0\u6b64\u6211\u4eec\u9700\u8981\u5224\u65adstrcmp\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u5426\u4e3a0\u6211\u4eec\u624d\u8fdb\u884c\u64cd\u4f5c\uff0c\u4e0d\u7136hook\u53ef\u80fd\u4f1a\u4e00\u76f4\u5faa\u73af\u8f93\u51fa<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709575765450.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709575765450.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u56e0\u6b64\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528Memory.readUtf8String(args[0]);\u6765\u83b7\u53d6\u6211\u4eec\u7684\u8f93\u5165\u5b57\u7b26\u4e32\uff0c\u5e73\u4e14\u4f7f\u7528 if (input.includes(&quot;111&quot;))\u6765\u5224\u65ad<\/p>\n<h3>hook\u4ee3\u7801<\/h3>\n<pre><code class=\"language-javascript\">function hook(){\n\n    var targetAddress = Module.findExportByName(&quot;libc.so&quot;,&quot;strcmp&quot;);\n    console.log(&quot;Strcmp Address: &quot;,targetAddress.toString(16));\n\n    Interceptor.attach(targetAddress,{\n        onEnter:function (args){\n            var input = Memory.readUtf8String(args[0]);\n            if (input.includes(&quot;111&quot;)){\n                console.log(Memory.readUtf8String(args[1]));\n            }\n\n        },onLeave:function(retval){\n\n        }\n    })\n    console.log(&quot;success!&quot;);\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook();\n    })\n}\nsetImmediate(main);<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709721364849.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709721364849.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h2>2\u3001Hook\u4fee\u6539native\u5c42\u7a0b\u5e8f\u8fd4\u56de\u503c<\/h2>\n<p>\u9996\u5148\u8fd8\u662f\u7ed9\u51fahook\u7684\u6a21\u677f\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-javascript\">Interceptor.attach(functionaddr, {\n    onEnter: function (args) {\n\n    },\n    onLeave: function (retval) {\n\n    }\n});<\/code><\/pre>\n<p>\u53ef\u4ee5\u770b\u5230\u5728onLeave\u4e2d\u6709\u4e00\u4e2a\u53c2\u6570retval\uff0c\u8fd9\u4e2aretval\uff0c\u5c31\u662f\u6211\u4eechook\u4e0a\u7684\u7a0b\u5e8f\u7684\u8fd4\u56de\u503c\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528retval.replace(val)\u6765\u4fee\u6539\u8fd4\u56de\u503c\u3002<\/p>\n<h3>\u4f8b\u9898 Frida-labs 0x9<\/h3>\n<h4>MainActivity<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709722698157.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709722698157.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u53ef\u4ee5\u53d1\u73b0\u7a0b\u5e8f\u6839\u636enative\u5c42\u7684check_flag \u65b9\u6cd5\u7684\u8fd4\u56de\u503c<\/p>\n<h4>check_flag<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709723315706.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709723315706.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u53ea\u662f\u7b80\u7b80\u5355\u5355\u7684\u8fd4\u56de\u4e86\u4e00\u4e2a1<\/p>\n<h4>hookbegin<\/h4>\n<p>\u9996\u5148\u4f7f\u7528Module.enumerateExports(&quot;liba0x9.so&quot;)\uff0c\u67e5\u770b\u5bfc\u51fa\u8868\uff0c\u770b\u770bcheck_flag\u65b9\u6cd5\u7684\u504f\u79fb\u5730\u5740<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709723670416.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709723670416.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u7136\u540e\u5c31\u53ef\u4ee5\u4f7f\u7528\u6a21\u677f\u4e00\u628a\u68ad\u4e86<\/p>\n<h4>hook\u4ee3\u7801<\/h4>\n<pre><code class=\"language-javascript\">function hook(){\n    var check_flag = Module.enumerateExports(&quot;liba0x9.so&quot;)[0][&quot;address&quot;];\n    console.log(&quot;Func address = &quot;,check_flag);\n    Interceptor.attach(check_flag,{\n        onEnter:function (args){\n\n        },onLeave:function (retval){\n            console.log(&quot;Origin retval : &quot;,retval);\n            retval.replace(1337);\n        }\n    })\n}\nfunction main(){\n    Java.perform(function (){\n        hook();\n    })\n}\nsetImmediate(hook);\n<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709724493950.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709724493950.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h2>3\u3001\u8c03\u7528native\u5c42\u4e2d\u672a\u88ab\u8c03\u7528\u7684\u65b9\u6cd5<\/h2>\n<p>\u8ba9\u6211\u63d0\u4f9b\u4e00\u4e2a\u6a21\u677f\u3002<\/p>\n<pre><code class=\"language-javascript\">var native_adr = new NativePointer(&lt;address_of_the_native_function&gt;);\nconst native_function = new NativeFunction(native_adr, &#039;&lt;return type&gt;&#039;, [&#039;argument_data_type&#039;]);\nnative_function(&lt;arguments&gt;);<\/code><\/pre>\n<p>\u8ba9\u6211\u9010\u884c\u89e3\u91ca\u3002<\/p>\n<pre><code class=\"language-javascript\">var native_adr = new NativePointer(&lt;address_of_the_native_function&gt;);<\/code><\/pre>\n<p>\u8981\u5728 Frida \u4e2d\u8c03\u7528\u4e00\u4e2a\u672c\u5730\u51fd\u6570\uff0c\u6211\u4eec\u9700\u8981\u4e00\u4e2a <code>NativePointer<\/code> \u5bf9\u8c61\u3002\u6211\u4eec\u5e94\u8be5\u5c06\u8981\u8c03\u7528\u7684\u672c\u5730\u51fd\u6570\u7684\u5730\u5740\u4f20\u9012\u7ed9 <code>NativePointer<\/code> \u6784\u9020\u51fd\u6570\u3002\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u5c06\u521b\u5efa <code>NativeFunction<\/code> \u5bf9\u8c61\uff0c\u5b83\u8868\u793a\u6211\u4eec\u60f3\u8981\u8c03\u7528\u7684\u5b9e\u9645\u672c\u5730\u51fd\u6570\u3002\u5b83\u5728\u672c\u5730\u51fd\u6570\u5468\u56f4\u521b\u5efa\u4e00\u4e2a JavaScript \u5305\u88c5\u5668\uff0c\u5141\u8bb8\u6211\u4eec\u4ece Frida \u8c03\u7528\u8be5\u672c\u5730\u51fd\u6570\u3002<\/p>\n<pre><code class=\"language-javascript\">const native_function = new NativeFunction(native_adr, &#039;&lt;return type&gt;&#039;, [&#039;argument_data_type&#039;]);<\/code><\/pre>\n<p>\u7b2c\u4e00\u4e2a\u53c2\u6570\u5e94\u8be5\u662f <code>NativePointer<\/code> \u5bf9\u8c61\uff0c\u7b2c\u4e8c\u4e2a\u53c2\u6570\u662f\u672c\u5730\u51fd\u6570\u7684\u8fd4\u56de\u7c7b\u578b\uff0c\u7b2c\u4e09\u4e2a\u53c2\u6570\u662f\u8981\u4f20\u9012\u7ed9\u672c\u5730\u51fd\u6570\u7684\u53c2\u6570\u7684\u6570\u636e\u7c7b\u578b\u5217\u8868\u3002\u73b0\u5728\u6211\u4eec\u53ef\u4ee5\u50cf\u5728 Java \u7a7a\u95f4\u4e2d\u90a3\u6837\u8c03\u7528\u8be5\u65b9\u6cd5\u4e86\u3002<\/p>\n<pre><code class=\"language-javascript\">native_function(&lt;arguments&gt;);<\/code><\/pre>\n<p>\u597d\u7684\uff0c\u6211\u4eec\u660e\u767d\u4e86\u3002\u8ba9\u6211\u4eec\u6765\u770b\u770b\u4f8b\u9898\u3002<\/p>\n<h3>\u4f8b\u9898Frida-labs 0xA<\/h3>\n<h4>MainActivity<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709727833603.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709727833603.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u53d1\u73b0\u5c31\u662f\u5728\u4e3b\u51fd\u6570\u4e2d\u52a0\u8f7d\u4e86stringFromJNI<\/p>\n<h4>native<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709728135106.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709728135106.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u6ca1\u6709\u5173\u4e8eflag\u7684\u4fe1\u606f\uff0c\u4f46\u662f\u6709\u672a\u88ab\u8c03\u7528\u7684flag\u51fd\u6570\uff0c\u6211\u4eec\u76f4\u63a5\u4f7f\u7528hook\u8c03\u7528\u5b83\u8f93\u51falog<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709728210016.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709728210016.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h4>hook\u4ee3\u7801<\/h4>\n<pre><code class=\"language-javascript\">function hook(){\n    var a = Module.findBaseAddress(&quot;libfrida0xa.so&quot;);\n    var b = Module.enumerateExports(&quot;libfrida0xa.so&quot;);\n    var get_flagaddress = null;\n    var mvaddress = null;\n    for(var i = 0 ; b[i]!= null ; i ++ ){\n        \/\/ console.log(b[i][&quot;name&quot;])\n        if(b[i][&quot;name&quot;] == &quot;_Z8get_flagii&quot;){\n            console.log(&quot;function get_flag : &quot;,b[i][&quot;address&quot;]);\n            console.log((b[i][&quot;address&quot;] - a).toString(16));\n     \/\/       mvaddress = b[i][&quot;address&quot;] - a;\n            get_flagaddress = b[i][&quot;address&quot;];\n        }\n    }\n    console.log(ptr.toString(16));\n\n    var get_flag_ptr = new NativePointer(get_flagaddress);\n    const get_flag = new NativeFunction(get_flag_ptr,&#039;char&#039;,[&#039;int&#039;,&#039;int&#039;]);\n    var flag = get_flag(1,2);\n    console.log(flag)\n    \/\/console.log(b);\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook();\n    })\n}\nsetImmediate(main)<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709728259975.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709728259975.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n<h2>4\u3001\u66f4\u6539Native\u5c42\u65b9\u6cd5\u7684\u6c47\u7f16\u6307\u4ee4<\/h2>\n<p>\u9996\u5148\u6211\u4eec\u5148\u770b\u6765\u81eax86\u6307\u4ee4\u96c6\u7684frida\u4f7f\u7528\u6a21\u677f<\/p>\n<pre><code class=\"language-javascript\">var writer = new X86Writer(opcodeaddr);\nMemory.protect(opcodeaddr, 0x1000, &quot;rwx&quot;);\ntry {\n\n  writer.flush();\n\n} finally {\n\n  writer.dispose();\n}<\/code><\/pre>\n<p><strong><code>X86Writer<\/code>\u7684\u5b9e\u4f8b\u5316\uff1a<\/strong><\/p>\n<ul>\n<li><code>var writer = new X86Writer(&lt;\u6307\u4ee4\u7684\u5730\u5740&gt;);<\/code><\/li>\n<li>\u8fd9\u5c06\u521b\u5efa\u4e00\u4e2a<code>X86Writer<\/code>\u7c7b\u7684\u5b9e\u4f8b\uff0c\u5e76\u6307\u5b9a\u6211\u4eec\u8981\u4fee\u6539\u7684\u6307\u4ee4\u7684\u5730\u5740\u3002\u8fd9\u8bbe\u7f6e\u4e86\u5199\u5165\u5668\u4ee5\u64cd\u4f5c\u6307\u5b9a\u7684\u5185\u5b58\u4f4d\u7f6e\u3002<\/li>\n<\/ul>\n<p><strong>\u63d2\u5165\u6307\u4ee4 <\/strong><\/p>\n<ul>\n<li><code>try { \/* \u5728\u6b64\u5904\u63d2\u5165\u6307\u4ee4 *\/ }<\/code><\/li>\n<li>\u5728<code>try<\/code>\u5757\u5185\uff0c\u6211\u4eec\u53ef\u4ee5\u63d2\u5165\u8981\u4fee\u6539\/\u6dfb\u52a0\u7684x86\u6307\u4ee4\u3002<code>X86Writer<\/code>\u5b9e\u4f8b\u63d0\u4f9b\u4e86\u5404\u79cd\u65b9\u6cd5\u6765\u63d2\u5165\u5404\u79cdx86\u6307\u4ee4\u3002\u6211\u4eec\u53ef\u4ee5\u67e5\u9605\u6587\u6863\u4ee5\u4e86\u89e3\u8be6\u60c5\u3002<\/li>\n<\/ul>\n<p><strong>\u5237\u65b0\u66f4\u6539\uff1a<\/strong><\/p>\n<ul>\n<li><code>writer.flush();<\/code><\/li>\n<li>\u63d2\u5165\u6307\u4ee4\u540e\uff0c\u8c03\u7528<code>flush<\/code>\u65b9\u6cd5\u5c06\u66f4\u6539\u5e94\u7528\u5230\u5185\u5b58\u4e2d\u3002\u8fd9\u786e\u4fdd\u4fee\u6539\u540e\u7684\u6307\u4ee4\u88ab\u5199\u5165\u5185\u5b58\u4f4d\u7f6e\u3002<\/li>\n<\/ul>\n<p><strong>\u6e05\u7406\uff1a<\/strong><\/p>\n<ul>\n<li><code>finally { \/* \u91ca\u653eX86Writer\u4ee5\u91ca\u653e\u8d44\u6e90 *\/ writer.dispose(); }<\/code><\/li>\n<li><code>finally<\/code>\u5757\u7528\u4e8e\u786e\u4fdd<code>X86Writer<\/code>\u8d44\u6e90\u5f97\u5230\u9002\u5f53\u6e05\u7406\u3002\u8c03\u7528<code>dispose<\/code>\u65b9\u6cd5\u91ca\u653e\u4e0e<code>X86Writer<\/code>\u5b9e\u4f8b\u5173\u8054\u7684\u8d44\u6e90\u3002<\/li>\n<\/ul>\n<p><strong>\u89e3\u9664\u6bb5\u53ea\u8bfb\u6743\u9650<\/strong><br \/>\n<code>Memory.protect<\/code> \u3002\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528\u8fd9\u4e2a\u51fd\u6570\u6765\u4fee\u6539\u5185\u5b58\u533a\u57df\u7684\u4fdd\u62a4\u5c5e\u6027\u3002<code>Memory.protect<\/code> \u51fd\u6570\u7684\u8bed\u6cd5\u5982\u4e0b\uff1a<\/p>\n<pre><code>Memory.protect(\u5730\u5740, \u5927\u5c0f, \u4fdd\u62a4\u5c5e\u6027);<\/code><\/pre>\n<ul>\n<li><code>\u5730\u5740<\/code>\uff1a\u8981\u66f4\u6539\u4fdd\u62a4\u7684\u5185\u5b58\u533a\u57df\u7684\u8d77\u59cb\u5730\u5740\u3002<\/li>\n<li><code>\u5927\u5c0f<\/code>\uff1a\u5185\u5b58\u533a\u57df\u7684\u5927\u5c0f\uff0c\u4ee5\u5b57\u8282\u4e3a\u5355\u4f4d\u3002<\/li>\n<li><code>\u4fdd\u62a4\u5c5e\u6027<\/code>\uff1a\u5185\u5b58\u533a\u57df\u7684\u4fdd\u62a4\u5c5e\u6027\u3002<\/li>\n<\/ul>\n<p>\u90a3\u4e48\u5982\u4f55\u4f7f\u7528\u8fdb\u884c\u8986\u5199\u5462<br \/>\n\u5bf9\u4e8ex86\u7cfb\u7edf\u800c\u8a00\u6211\u4eec\u9996\u5148\u9700\u8981\u67e5\u770b\u5b98\u65b9\u6587\u6863\u4e2d\u7684\u4f7f\u7528\u65b9\u6cd5<br \/>\n<a href=\"https:\/\/frida.re\/docs\/javascript-api\/#x86writer\">https:\/\/frida.re\/docs\/javascript-api\/#x86writer<\/a><\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709812455381.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709812455381.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u5bf9\u4e0earm64\u7cfb\u7edf\u800c\u8a00\uff0c\u6211\u4eec\u4f7f\u7528\u5982\u4e0bapi<br \/>\n<a href=\"https:\/\/frida.re\/docs\/javascript-api\/#arm64writer\">https:\/\/frida.re\/docs\/javascript-api\/#arm64writer<\/a><\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709813029632.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709813029632.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u63a5\u4e0b\u6765\u8ba9\u6211\u7528\u4e00\u4e2a\u7528\u4f8b\u7a0b\u5e8f\u6765\u8bb2\u4e00\u4e0b\u8fd9\u4e2a\u6307\u4ee4\u7684\u7528\u6cd5\uff0c\u6211\u4eec\u793a\u8303\u7684\u5185\u5bb9\u4e3aarm64\u67b6\u6784<\/p>\n<h3>\u4f8b\u9898Frida-labs 0xB<\/h3>\n<h4>MainActivity<\/h4>\n<p>\u9996\u5148\u6211\u4eec\u770b\u5230MainActivity\u51fd\u6570\u5185\u5bb9<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709813133920.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709813133920.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u53d1\u73b0MainActivity\u5c31\u662f\u5728\u7528\u6237\u70b9\u51fb\u6309\u94ae\u540e\u8c03\u7528\u4e86getflag\u65b9\u6cd5\uff0c\u4f46\u662f\u6b63\u5e38\u70b9\u51fbgetflag\u65b9\u6cd5\u5e76\u4e0d\u4f1a\u8fd4\u56deflag\u503c\u3002<\/p>\n<h4>Native\u5c42\u5185\u5bb9<\/h4>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709813691637.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709813691637.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u60ca\u8bb6\u7684\u53d1\u73b0MainActivity\u4e2d\u4ec0\u4e48\u90fd\u6ca1\u6709\uff0c\u663e\u7136\u8fd9\u662f\u4e0d\u5b58\u5728\u7684\u3002\u63a5\u4e0b\u6765\u6211\u4eec\u5230\u63a7\u5236\u6d41\u7a97\u53e3\u4e2d\u67e5\u770b\u3002<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709813758812.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709813758812.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u67e5\u770b\u63a7\u5236\u6d41\u53d1\u73b0\u7a0b\u5e8f\u51fa\u73b0\u4e86\u6c38\u5047\u6761\u4ef6\u8df3\u8f6c\u3002\u5bfc\u81f4\u5bfc\u81f4ida\u8bc6\u522b\u4e0d\u5230\u8f93\u51faflag\u7684\u529f\u80fd\u3002\u90a3\u4e48\u6211\u4eec\u53ef\u4ee5\u628a\u8fd9\u4e2aB.NE\u7ed9Nop\u6389\u5373\u53ef<br \/>\n\u9996\u5148\u6211\u4eec\u9700\u8981\u8ba1\u7b97B.NE\u7684\u504f\u79fb\u5730\u5740<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709814668705.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709814668705.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><br \/>\n\u53ef\u4ee5\u53d1\u73b0\u5c31\u662f\u57fa\u5730\u5740\u589e\u52a015248\uff0c\u7136\u540e\u6211\u4eec\u8986\u5199\u4e3aNop\u5c31\u53ef\u4ee5\u4e86<\/p>\n<h4>Hook\u4ee3\u7801<\/h4>\n<pre><code class=\"language-javascript\">function hook(){\n    var Base =  Module.getBaseAddress(&quot;libfrida0xb.so&quot;);\n    console.log(&quot;Base address : &quot;,Base);\n    var BNE = Base.add(0x15248);\n    Memory.protect(Base,0x1000,&quot;rwx&quot;);\n    var writer = new Arm64Writer(BNE);\n    try{\n        writer.putNop();\n        writer.flush();\n        console.log(&quot;Success!!&quot;);\n    }finally {\n        writer.dispose();\n    }\n}\n\nfunction main(){\n    Java.perform(function (){\n        hook();\n    })\n}\n\nsetTimeout(main,1000);\n<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709817050080.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/shangwendada.top\/wp-content\/uploads\/2024\/03\/image-1709817050080.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"file\" \/><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u9644\u4ef6\u4e0b\u8f7d https:\/\/github.com\/DERE-ad2001\/Frida-Labs Java\u5c42 \u524d\u671f [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":664,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,1],"tags":[],"class_list":["post-796","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/796","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=796"}],"version-history":[{"count":61,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/796\/revisions"}],"predecessor-version":[{"id":900,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/796\/revisions\/900"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media\/664"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}