Frida JavaScript 使用举例

如何加载脚本

frida -U -f [包名] g -l [脚本路径]

frida -U -f com.primer.gamecerter -l hookStartActivity.js

1、权限申请

Java.perform(function x() {

    console.log('重新加载脚本');

    var ActivityCompat = Java.use("android.app.Activity")
    ActivityCompat.requestPermissions.overload("[Ljava.lang.String;", "int")
        .implementation = function (permissions, requestCode) {
            console.log("requestPermissions 2 requestCode = " + requestCode + "  permissions = " + permissions)

            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
            this.requestPermissions(permissions, requestCode)
        }
        
    var Fragment = Java.use("android.app.Fragment")
    Fragment.requestPermissions.implementation = function (permissions, code) {
        console.log('权限申请  android permissions = ' + permissions + "  code = " + code);
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

        this.requestPermissions(permissions,code)
    }

    var Fragmentx = Java.use("androidx.fragment.app.Fragment")
    Fragmentx.requestPermissions.implementation = function (permissions, code) {
        console.log('权限申请 androidx permissions = ' + permissions + "  code = " + code);
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

        this.requestPermissions(permissions,code)
    }
})

2、activity 启动

Java.perform(function () {
    var Instrumentation = Java.use('android.app.Instrumentation');
    //1
    Instrumentation.execStartActivity
        .overload(
            'android.content.Context',
            'android.os.IBinder',
            'android.os.IBinder',
            'android.app.Activity',
            'android.content.Intent',
            'int',
            'android.os.Bundle')
        .implementation =
        function (
            who, contextThread, token, target, intent, requestCode, options) {
            console.log(
                '【当前应用 1   Instrumentation】 启动 execStartActivity  intent = ' +
                intent);
            var pkg = intent.getPackage()
            console.log('pkg = ' + pkg)
            if (pkg != undefined && pkg != NULL && pkg == 'com.xiaomi.market') {
                intent.setPackage('com.heytap.market')
            }

            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

            return this.execStartActivity(
                who, contextThread, token, target, intent, requestCode, options);
        }

    //2
    Instrumentation.execStartActivity
        .overload(
            'android.content.Context',
            'android.os.IBinder',
            'android.os.IBinder',
            "java.lang.String",
            'android.content.Intent',
            'int',
            'android.os.Bundle')
        .implementation =
        function (
            who, contextThread, token, target, intent, requestCode, options) {
            console.log(
                '【当前应用 2   Instrumentation】 启动 execStartActivity  intent = ' +
                intent);
            var pkg = intent.getPackage()
            console.log('pkg = ' + pkg)
            if (pkg != undefined && pkg != NULL && pkg == 'com.xiaomi.market') {
                intent.setPackage('com.heytap.market')
            }

            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

            return this.execStartActivity(
                who, contextThread, token, target, intent, requestCode, options);
        }


    //3
    Instrumentation.execStartActivity
        .overload(
            'android.content.Context',
            'android.os.IBinder',
            'android.os.IBinder',
            "java.lang.String",
            'android.content.Intent',
            'int',
            'android.os.Bundle',
            "android.os.UserHandle"
        )
        .implementation =
        function (
            who, contextThread, token, resultWho, intent, requestCode, options, user) {
            console.log(
                '【当前应用 3   Instrumentation】 启动 execStartActivity  intent = ' +
                intent);
            var pkg = intent.getPackage()
            console.log('pkg = ' + pkg)
            if (pkg != undefined && pkg != NULL && pkg == 'com.xiaomi.market') {
                intent.setPackage('com.heytap.market')
            }

            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

            return this.execStartActivity(who, contextThread, token, resultWho, intent, requestCode, options, user)
        }

    Instrumentation.checkStartActivityResult.implementation = function (res, intent) {
        console.log('【checkStartActivityResult 启动  intent = ' + intent);

        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

        return this.checkStartActivityResult(res, intent)
    }
})

3、AndroidID、IMEI、Mac、oaid 获取

Java.perform(function x() {

    console.log('重新加载脚本');

    //androidid
    var ANDROID_ID = "android_id"
    var Secure = Java.use("android.provider.Settings$Secure")
    Secure.getString.implementation = function (resolver, name) {
        var result = this.getString(resolver, name);
        console.log("getString  name = " + name + " val =" + result)
        if (ANDROID_ID == name) {
            console.log("getString 获取 androidID")
            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
        }
        return result;
    }

    var Secure = Java.use("android.provider.Settings$Secure")
    Secure.getStringForUser.implementation = function (resolver, name, userHandle) {
        var result = this.getStringForUser(resolver, name, userHandle);
        console.log("getStringForUser  name = " + name + " val =" + result)
        if (ANDROID_ID == name) {
            console.log("Secure getStringForUser 获取 androidID")
            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
        }
        return result;
    }

    var Secure = Java.use("android.provider.Settings$System")
    Secure.getStringForUser.implementation = function (resolver, name, userHandle) {
        var result = this.getStringForUser(resolver, name, userHandle);
        console.log("System getStringForUser  name = " + name + " val =" + result)
        if (ANDROID_ID == name) {
            console.log("System getStringForUser 获取 androidID")
            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
        }

        return result;
    }

    //获取 IMEI【卡槽】
    var TelephonyManager = Java.use("android.telephony.TelephonyManager")
    TelephonyManager.getDeviceId.overload("int").implementation = function (slotIndex) {
        var iemi = this.getDeviceId(slotIndex)
        console.log("TelephonyManager 获取 IMEI slotIndex = " + slotIndex + "  iemi = " + iemi)
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
        return iemi;
    }

    //获取 IMEI
    TelephonyManager.getDeviceId.overload().implementation = function () {
        var iemi = this.getDeviceId()
        console.log("TelephonyManager 获取 IMEI = " + iemi)
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
        return iemi;
    }

    //获取 Mac
    var NetworkInterface = Java.use("java.net.NetworkInterface")
    NetworkInterface.getHardwareAddress.implementation = function () {
        var mac = this.getHardwareAddress()
        console.log("NetworkInterface 获取 MAC = " + mac)
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
        return mac;
    }
    
    
    //OAID
    var OAID_LIST = ["com.bun.supplier.IdSupplier",
        "com.bun.miitmdid.provider.DefaultProvider",
        "com.bun.miitmdid.supplier.IdSupplier",
        "com.bun.miitmdid.interfaces.IdSupplier"]

    for (let index in OAID_LIST) {
        try {
            var oaid = Java.use(OAID_LIST[index])
            oaid.getOAID.implementation = function () {
                var result = this.getOAID()

                console.log('获取 oaid   = ' + result);
                console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
                return result
            }

        } catch (e) {

        }
    }
})

4、Dialog 关闭

var Dialog = Java.use("android.app.Dialog")
Dialog.dismiss.implementation = function () {
    console.log("Dialog dismiss");
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

    this.dismiss()
}

5、so 加载

var System = Java.use("java.lang.System")
System.load.implementation = function (libname) {

    console.log('【System load = ' + libname);
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

    this.load(libname)
}

System.loadLibrary.implementation = function (libname) {

    console.log('【System loadLibrary = ' + libname);
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));

    this.loadLibrary(libname)
}

待补充~~~