Frida API使用(2)
Frida输出打印
console
setTimeout(function (){
Java.perform(function (){
console.log("n[*] enumerating classes...");
console.log("Frida version:"+Frida.version);
console.log("Frida heapsize:"+Frida.heapSize);
console.log("Script runtime:"+Script.runtime);
console.warn("warn");
console.error("error");
Java.choose("android.bluetooth.BluetoothDevice",{
onMatch: function (instance){
console.log("[*] "+" android.bluetooth.BluetoothDevice instance found"+" :=> '"+instance+"'");
// console.log(Java.cast(instance,Java.use("android.bluetooth.BluetoothDevice") ).getName());
console.log(instance.getName());
// bluetoothDeviceInfo(instance);
},
onComplete: function() { console.log("[*] -----");}
});
});
});
通过下面的命令运行程序
frida -U -l hello.js android.process.media –debug --runtime=v8
在这里对console.log，console.warn，console.error进行了介绍，望文也可生义。
Frida.version: property containing the current Frida version, as a string.
Frida.heapSize: dynamic property containing the current size of Frida’s private heap, shared by all scripts and Frida’s own runtime. This is useful for keeping an eye on how much memory your instrumentation is using out of the total consumed by the hosting process.
Script.runtime: string property containing the runtime being used. Either DUK or V8.
hexdump
hexdump(target[, options]): generate a hexdump from the provided ArrayBuffer or NativePointer target, optionally with options for customizing the output.
添加如下的代码：
var libc = Module.findBaseAddress('libc.so');
console.log(hexdump(libc, {
offset: 0,
length: 64,
header: true,
ansi: true
}));
运行：
send
send(message[, data]): send the JavaScript object message to your Frida-based application (it must be serializable to JSON).
# -*- coding: utf-8 -*-
import frida
import sys
def on_message(message, data):
if message['type'] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
jscode = """
Java.perform(function ()
{
var jni_env = Java.vm.getEnv();
console.log(jni_env);
send(jni_env);
});
"""
process = frida.get_usb_device().attach('android.process.media')
script = process.create_script(jscode)
script.on('message', on_message)
script.load()
sys.stdin.read()
通过下面的结果可以看出，send输出的是json格式。
Frida变量类型
| API | 含义 |
|---|---|
| new Int64(v) | create a new Int64 from v |
| new UInt64(v) | create a new UInt64 from v |
| NativePointer | creates a new NativePointer from the string s |
| wrap(address, size) | creates an ArrayBuffer backed by an existing memory region |
| new NativeFunction(address, returnType, argTypes[, abi]) | create a new NativeFunction to call the function at address |
| new NativeCallback(func, returnType, argTypes[, abi]) | create a new NativeCallback implemented by the JavaScript function func |
| new SystemFunction(address, returnType, argTypes[, abi]) | just like NativeFunction, but also provides a snapshot of the thread’s last error status |
| ptr(s) | short-hand for new NativePointer(s) |
| NULL | short-hand for ptr(“0”) |
添加如下代码：
console.log("new Int64(1):"+new Int64(1));
console.log("new UInt64(1):"+new UInt64(1));
console.log("new NativePointer(0xEC644071):"+new NativePointer(0x123456));
console.log("new ptr('0xEC644071'):"+new ptr(0x123456));
console.log("null point:"+ptr('0'));
运行结果如下：
对于 Int64一些简单的运算
console.log("8888 + 1:"+new Int64("8888").add(1));
//8888 - 1 = 8887
console.log("8888 - 1:"+new Int64("8888").sub(1));
//8888 << 1 = 4444
console.log("8888 << 1:"+new Int64("8888").shr(1));
//8888 == 22 = 1 1是false
console.log("8888 == 22:"+new Int64("8888").compare(22));
//转string
console.log("8888 toString:"+new Int64("8888").toString());
注释写的很清楚了：
RPC远程调用
Empty object that you can either replace or insert into to expose an RPC-style API to your application. The key specifies the method name and the value is your exported function.
# -*- coding: utf-8 -*-
import frida
import sys
def on_message(message, data):
if message['type'] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
jscode = """
Java.perform(function ()
{
var jni_env = Java.vm.getEnv();
console.log(jni_env);
send(jni_env);
});
rpc.exports = {
add: function (a, b) {
return a + b;
},
sub: function (a, b) {
return new Promise(function (resolve) {
setTimeout(function () {
resolve(a - b);
}, 100);
});
}
};
"""
process = frida.get_usb_device().attach('android.process.media')
script = process.create_script(jscode)
script.on('message', on_message)
script.load()
print(script.exports.sub(2, 3))
process.detach()
script.on(‘message’, on_message) is used to monitor for any messages from the injected process, JavaScript side.
Process
通过如下的代码获取进程相关信息：
console.log("目标进程的PID:"+Process.id);
console.log("调试器是否附加到目标进程:"+Process.isDebuggerAttached())
//枚举进程加载的模块
var process_Obj_Module_Arr = Process.enumerateModules();
for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
console.log("",process_Obj_Module_Arr[i].name);
}
//枚举当前所有的线程
var enumerateThreads = Process.enumerateThreads();
for(var i = 0; i < enumerateThreads.length; i++) {
console.log("");
console.log("id:",enumerateThreads[i].id);
console.log("state:",enumerateThreads[i].state);
console.log("context:",JSON.stringify(enumerateThreads[i].context));
}
//this thread’s OS-specific id as a number
console.log("this thread’s OS-specific id as a number:"+Process.getCurrentThreadId());
运行上面的程序，可以获取到进程相关的信息。
这里说一下线程：
Process.enumerateThreads()：枚举当前所有的线程，返回包含以下属性的对象数组：
- id: OS-specific id
- state: string specifying either running, stopped, waiting, uninterruptible or halted
- context: object with the keys pc and sp, which are NativePointer objects specifying EIP/RIP/PC and ESP/RSP/SP, respectively, for ia32/x64/arm. Other processor-specific keys are also available, e.g. eax, rax, r0, x0, etc.
完整代码
setTimeout(function (){
Java.perform(function (){
console.log("n[*] enumerating classes...");
console.log("Frida version:"+Frida.version);
console.log("Frida heapsize:"+Frida.heapSize);
console.log("Script runtime:"+Script.runtime);
console.warn("warn");
console.error("error");
Java.choose("android.bluetooth.BluetoothDevice",{
onMatch: function (instance){
console.log("[*] "+" android.bluetooth.BluetoothDevice instance found"+" :=> '"+instance+"'");
// console.log(Java.cast(instance,Java.use("android.bluetooth.BluetoothDevice") ).getName());
console.log(instance.getName());
// bluetoothDeviceInfo(instance);
},
onComplete: function() { console.log("[*] -----");}
});
var libc = Module.findBaseAddress('libc.so');
console.log(hexdump(libc, {
offset: 0,
length: 64,
header: true,
ansi: true
}));
console.log("");
console.log("new Int64(1):"+new Int64(1));
console.log("new UInt64(1):"+new UInt64(1));
console.log("new NativePointer(0xEC644071):"+new NativePointer(0x123456));
console.log("new ptr('0xEC644071'):"+new ptr(0x123456));
console.log("null point:"+ptr('0'));
console.log("");
//8888 + 1 = 8889
console.log("8888 + 1:"+new Int64("8888").add(1));
//8888 - 1 = 8887
console.log("8888 - 1:"+new Int64("8888").sub(1));
//8888 << 1 = 4444
console.log("8888 << 1:"+new Int64("8888").shr(1));
//8888 == 22 = 1 1是false
console.log("8888 == 22:"+new Int64("8888").compare(22));
//转string
console.log("8888 toString:"+new Int64("8888").toString());
console.log("目标进程的PID:"+Process.id);
console.log("调试器是否附加到目标进程:"+Process.isDebuggerAttached())
//枚举进程加载的模块
var process_Obj_Module_Arr = Process.enumerateModules();
for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
console.log("",process_Obj_Module_Arr[i].name);
}
//枚举当前所有的线程
var enumerateThreads = Process.enumerateThreads();
for(var i = 0; i < enumerateThreads.length; i++) {
console.log("");
console.log("id:",enumerateThreads[i].id);
console.log("state:",enumerateThreads[i].state);
console.log("context:",JSON.stringify(enumerateThreads[i].context));
}
//this thread’s OS-specific id as a number
console.log("this thread’s OS-specific id as a number:"+Process.getCurrentThreadId());
});
});
公众号
更多Frida相关内容，欢迎关注我的公众号：无情剑客。
