whatsapp 相关(六) -frida hook file
whatsapp 相关(六) -frida hook file
本文主要讲述下frida 下对文件的监听. 从而可以明确的获取到相关的文件存储路径等.
1: 脚本
代码如下:
Java.perform(function() {
var File = Java.use("java.io.File");
var FileInputStream = Java.use("java.io.FileInputStream");
var FileOutputStream = Java.use("java.io.FileOutputStream");
// Hook File类的构造函数
File.$init.overload('java.lang.String').implementation = function (path) {
console.log("文件路径：" + path);
// 调用原始的构造函数
this.$init(path);
};
// 监听文件的读取操作
FileInputStream.read.overload('[B').implementation = function(buffer) {
var result = this.read(buffer);
console.log("File read: " + buffer.length + " bytes");
return result;
};
// 监听文件的写入操作
FileOutputStream.write.overload('[B').implementation = function(buffer) {
console.log("File write: " + buffer.length + " bytes");
return this.write(buffer);
};
// 监听文件的创建操作
File.createNewFile.implementation = function() {
console.log("File created: " + this.getAbsolutePath());
return this.createNewFile();
};
// 监听文件的删除操作
File.delete.implementation = function() {
console.log("File deleted: " + this.getAbsolutePath());
return this.delete();
};
});
2: 测试
我们还已whatsapp为例.
frida -U -f com.whatsapp -l /home/zh/workSpace/test/Xpose/app/src/main/java/com/zh/xpose/js/file.js
____
/ _ | Frida 16.0.2 - A world-class dynamic instrumentation toolkit
| (_| |
> _ | Commands:
/_/ |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://frida.re/docs/home/
. . . .
. . . . Connected to LEX820 (id=6b4a96b2)
Spawned `com.whatsapp`. Resuming main thread!
file 的create与delete操作频繁, 我们来测试发送多媒体消息为例:
-
点击表情-加载gif ,可以看到控制台输出如下:
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/5d8ff0ffa4fb72c36b1a7674de1940a9.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/5d8ff0ffa4fb72c36b1a7674de1940a9.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6b4d76fec710b0e88e1d5c6072905712.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6b4d76fec710b0e88e1d5c6072905712.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6bf2d6d0123e4a8e1221590d3ed3653f.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6bf2d6d0123e4a8e1221590d3ed3653f.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bffa199d5eab481d05d52a466fdfb10c.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bffa199d5eab481d05d52a466fdfb10c.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/5d8ff0ffa4fb72c36b1a7674de1940a9.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6b4d76fec710b0e88e1d5c6072905712.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6bf2d6d0123e4a8e1221590d3ed3653f.gif 文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bffa199d5eab481d05d52a466fdfb10c.gif可以看到,当我们加载完gif的请求接口后, 会将所有的gif缓存下来.
-
发送对应的gif后:
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bb01ee5d786c0005d5661fb48515ceca.gif 文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4 File deleted: /data/user/0/com.whatsapp/shared_prefs/time_spent_logging_prefs.xml.bak File created: /storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/9c3b7e6d-707e-4aa4-8a5d-e9efd875f343 文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4 文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4 文件路径：/storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/9c3b7e6d-707e-4aa4-8a5d-e9efd875f343 文件路径：/storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/9c3b7e6d-707e-4aa4-8a5d-e9efd875f343 File created: /storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/6579b4e1-31aa-4594-a086-f9b908b80298 File deleted: /storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/6579b4e1-31aa-4594-a086-f9b908b80298 文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4 文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4 文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4 文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4 File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/129f22f2-f580-4123-babf-d99a796f2870 File write: 345 bytes File deleted: /data/user/0/com.whatsapp/files/network_statistics.json File deleted: /data/user/0/com.whatsapp/shared_prefs/com.whatsapp_preferences_light.xml.bak可以看到点击gif后, 在图片预览页面, whatsapp 将图片切换成了mp4文件.
点击发送按钮:
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/2e7909f3-2262-4a93-97cc-4512f6f3b4b9 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/2e7909f3-2262-4a93-97cc-4512f6f3b4b9 文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/2e7909f3-2262-4a93-97cc-4512f6f3b4b9 File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/cc8c524c-30b9-4925-b3f9-3a44cdda4530 File deleted: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/cc8c524c-30b9-4925-b3f9-3a44cdda4530 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 File deleted: /data/user/0/com.whatsapp/files/crash_in_video_sentinel 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4 File deleted: /storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4 文件路径：/proc/self 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/storage/emulated/0 文件路径：/storage/emulated/0 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4 File deleted: /data/user/0/com.whatsapp/shared_prefs/com.whatsapp_preferences.xml.bak 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4 File deleted: /data/user/0/com.whatsapp/shared_prefs/media_engagement_daily_preferences_v1.xml.bak File deleted: /data/user/0/com.whatsapp/shared_prefs/media_daily_usage_preferences_v1.xml.bak 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4 File deleted: /data/user/0/com.whatsapp/shared_prefs/route_selector_prefs.xml.bak File deleted: /data/user/0/com.whatsapp/shared_prefs/time_spent_logging_prefs.xml.bak File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/a64db587-2f7c-4030-8d9e-2d12abf222bb File write: 549 bytes File deleted: /data/user/0/com.whatsapp/files/statistics.json File deleted: /data/user/0/com.whatsapp/files/statistics File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/6192ed6e-70d1-4c47-846b-161ab6f9eb18 File write: 345 bytes File deleted: /data/user/0/com.whatsapp/files/network_statistics.json 文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4最终whatsapp自带的gif图片,在发送成功后,文件存储在了
/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent