要hook的目标
这是个frida教程的一个简单的apk.
URL: https://11x256.github.io/Frida-hooking-android-part-1/
Apk的源码如下：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
| package com.example.a11x256.frida_test;
import android.os.Bundle;
import android.support.v7.app.AppCompatActivity;
import android.util.Log;
import android.util.Base64;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Random;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
public class my_activity extends AppCompatActivity {
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_my_activity);
while (true){
try {
Thread.sleep(1000);
} catch (InterruptedException e) {
e.printStackTrace();
}
fun(50,30);
}
}
void fun(int x , int y ){
Log.d("Sum" , String.valueOf(x+y));
}
}
|
我们要Hook fun这个方法。
新建类
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
| package com.example.michael.xposed_1;
import de.robv.android.xposed.IXposedHookLoadPackage;
import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam;
import android.util.Log;
public class test implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(LoadPackageParam lpparam) throws Throwable{
if (lpparam.packageName.equals("com.example.a11x256.frida_test")) {
findAndHookMethod("com.example.a11x256.frida_test.my_activity", lpparam.classLoader,"fun", int.class, int.class, new XC_MethodHook(){
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
Log.e("Xposed", "Xposed Hooked");
}
});
}
}
}
|
配置xposed
在如下的目录中新建如图所示的文件夹与文件。
xposed_init中的内容为完整的实现hook的类名(前面为包名)：
1
| com.example.michael.xposed_1.test
|
Build APK
安装、运行frida-test（这就是要hook的apk），查看logcat。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
| 12-04 17:48:55.688 24664 24664 E Xposed : Xposed Hooked
12-04 17:48:55.688 24664 24664 D Sum : 80
12-04 17:48:56.503 21811 21827 D PhoneInterfaceManager: [PhoneIntfMgr] getDataEnabled: subId=2 phoneId=0
12-04 17:48:56.504 21811 21827 D PhoneInterfaceManager: [PhoneIntfMgr] getDataEnabled: subId=2 retVal=false
12-04 17:48:56.504 24040 24040 D TelephonyManager: getDataEnabled: retVal=false
12-04 17:48:56.689 24664 24664 E Xposed : Xposed Hooked
12-04 17:48:56.690 24664 24664 D Sum : 80
12-04 17:48:56.854 22435 22840 I CheckinRequestBuilder: Classify the device as Phone.
12-04 17:48:57.636 21811 22233 D PhoneInterfaceManager: [PhoneIntfMgr] getDataEnabled: subId=2 phoneId=0
12-04 17:48:57.637 21811 22233 D PhoneInterfaceManager: [PhoneIntfMgr] getDataEnabled: subId=2 retVal=false
12-04 17:48:57.640 24040 24040 D TelephonyManager: getDataEnabled: retVal=false
12-04 17:48:57.690 24664 24664 E Xposed : Xposed Hooked
12-04 17:48:57.691 24664 24664 D Sum : 80
12-04 17:48:58.692 24664 24664 E Xposed : Xposed Hooked
12-04 17:48:58.694 24664 24664 D Sum : 80
12-04 17:48:58.768 21811 22246 D PhoneInterfaceManager: [PhoneIntfMgr] getDataEnabled: subId=2 phoneId=0
12-04 17:48:58.770 21811 22246 D PhoneInterfaceManager: [PhoneIntfMgr] getDataEnabled: subId=2 retVal=false
12-04 17:48:58.771 24040 24040 D TelephonyManager: getDataEnabled: retVal=false
12-04 17:48:59.695 24664 24664 E Xposed : Xposed Hooked
12-04 17:48:59.696 24664 24664 D Sum : 80
|
参考
https://www.cnblogs.com/yhjoker/p/8653020.html