Frida \u662f\u4e00\u6b3e\u8de8\u5e73\u53f0\u7684\u52a8\u6001\u4e8c\u8fdb\u5236\u63d2\u6869\u5de5\u5177，\u51ed\u501f JavaScript \u811a\u672c\u5316\u3001\u8f7b\u91cf\u7075\u6d3b\u3001\u5168\u5e73\u53f0\u8986\u76d6\u7684\u7279\u6027，\u6210\u4e3a\u79fb\u52a8\u7aef\u9006\u5411\u5206\u6790\u3001\u5b89\u5168\u6d4b\u8bd5\u9886\u57df\u7684\u6807\u914d\u5de5\u5177\u3002\u65e0\u8bba\u662f Java \u5c42\u7684\u4e1a\u52a1\u903b\u8f91 Hook，\u8fd8\u662f so \u539f\u751f\u5c42\u7684\u7b97\u6cd5\u5206\u6790，Frida \u90fd\u80fd\u63d0\u4f9b\u7edf\u4e00\u7684\u64cd\u4f5c\u8303\u5f0f\u3002\u672c\u6587\u5c06\u4ece\u57fa\u7840\u73af\u5883\u642d\u5efa\u51fa\u53d1，\u7cfb\u7edf\u603b\u7ed3 Java \u5c42\u4e0e so \u5c42\u7684\u5e38\u7528 Hook \u59ff\u52bf，\u7ed3\u5408\u5b9e\u6218\u6848\u4f8b\u68b3\u7406\u5b8c\u6574\u7684\u5206\u6790\u94fe\u8def，\u5e2e\u52a9\u8bfb\u8005\u5feb\u901f\u638c\u63e1 Frida \u7684\u6838\u5fc3\u7528\u6cd5\u3002<\/p>\n
Frida \u672c\u8d28\u662f\u4e00\u4e2a\u6ce8\u5165\u5f0f\u8c03\u8bd5\u6846\u67b6，\u5b83\u5411\u76ee\u6807\u8fdb\u7a0b\u6ce8\u5165 frida-gum \u5f15\u64ce，\u5141\u8bb8\u5f00\u53d1\u8005\u901a\u8fc7 JavaScript \u811a\u672c\u76f4\u63a5\u64cd\u4f5c\u8fdb\u7a0b\u5185\u5b58\u3001Hook \u51fd\u6570\u3001\u8c03\u7528\u539f\u751f\u65b9\u6cd5\u3002\u5b83\u652f\u6301 Android\u3001iOS\u3001Linux\u3001Windows\u3001macOS \u7b49\u4e3b\u6d41\u5e73\u53f0，\u5c24\u5176\u5728 Android \u9006\u5411\u573a\u666f\u4e2d，Frida \u53ef\u4ee5\u65e0\u7f1d\u5de5\u4f5c\u5728 Java \u865a\u62df\u673a\u5c42\u4e0e Native \u539f\u751f\u5c42，\u662f\u5206\u6790 APP \u903b\u8f91\u3001\u7834\u89e3\u9a8c\u8bc1\u3001\u9006\u5411\u7b97\u6cd5\u7684\u6838\u5fc3\u5de5\u5177\u3002<\/p>\n
Frida \u6709\u4e24\u79cd\u6838\u5fc3\u8fd0\u884c\u6a21\u5f0f，\u5bf9\u5e94\u4e0d\u540c\u5206\u6790\u573a\u666f：<\/p>\n
\u57fa\u7840\u811a\u672c\u7684\u901a\u7528\u7ed3\u6784\u5982\u4e0b：<\/p>\n
\/\/ Java \u5c42\u64cd\u4f5c\u5fc5\u987b\u5305\u88f9\u5728 Java.perform \u4e2d，\u786e\u4fdd\u5728 Java \u7ebf\u7a0b\u6267\u884c
\nJava.perform(function () {
\n \/\/ Java \u5c42 Hook \u903b\u8f91\u5199\u5728\u8fd9\u91cc
\n});<\/p>\n
\/\/ Native \u5c42\u64cd\u4f5c\u53ef\u76f4\u63a5\u5168\u5c40\u6267\u884c
\nInterceptor.attach(\u76ee\u6807\u51fd\u6570\u5730\u5740, {
\n onEnter: function(args) {
\n \/\/ \u51fd\u6570\u8fdb\u5165\u65f6\u89e6\u53d1，\u7528\u4e8e\u8bfb\u53d6\u53c2\u6570
\n },
\n onLeave: function(retval) {
\n \/\/ \u51fd\u6570\u8fd4\u56de\u65f6\u89e6\u53d1，\u7528\u4e8e\u8bfb\u53d6\/\u4fee\u6539\u8fd4\u56de\u503c
\n }
\n});<\/p>\n
\u8fd0\u884c\u811a\u672c\u7684\u57fa\u7840\u547d\u4ee4：<\/p>\n
# Attach \u6a21\u5f0f：\u9644\u52a0\u5230\u8fd0\u884c\u4e2d\u7684\u8fdb\u7a0b
\nfrida -U \u5e94\u7528\u5305\u540d -l script.js<\/p>\n
# Spawn \u6a21\u5f0f：\u51b7\u542f\u52a8\u5e94\u7528\u5e76\u6ce8\u5165\u811a\u672c
\nfrida -U -f \u5e94\u7528\u5305\u540d -l script.js<\/p>\n
Java \u5c42 Hook \u662f Frida \u6700\u5e38\u7528\u7684\u573a\u666f，\u6838\u5fc3\u56f4\u7ed5 Java.use() \u83b7\u53d6\u7c7b\u5f15\u7528，\u901a\u8fc7\u91cd\u5199\u65b9\u6cd5\u5b9e\u73b0\u62e6\u622a\u3002<\/p>\n
\u6700\u5e38\u89c4\u7684\u573a\u666f\u662f\u62e6\u622a\u6307\u5b9a\u7c7b\u7684\u666e\u901a\u65b9\u6cd5，\u8bfb\u53d6\u53c2\u6570\u3001\u4fee\u6539\u8fd4\u56de\u503c\u6216\u76f4\u63a5\u66ff\u6362\u903b\u8f91\u3002<\/p>\n
\u793a\u4f8b：Hook \u767b\u5f55\u6821\u9a8c\u65b9\u6cd5，\u6253\u5370\u8f93\u5165\u5bc6\u7801\u4e0e\u8fd4\u56de\u7ed3\u679c<\/p>\n
Java.perform(function () {
\n \/\/ \u901a\u8fc7\u5b8c\u6574\u7c7b\u540d\u83b7\u53d6\u76ee\u6807\u7c7b\u5f15\u7528
\n var LoginManager = Java.use("com.example.app.LoginManager");<\/p>\n
\/\/ \u91cd\u5199\u65b9\u6cd5\u5b9e\u73b0
\n LoginManager.verifyPassword.implementation = function (inputPwd) {
\n \/\/ \u6253\u5370\u5165\u53c2
\n console.log("[Java Hook] \u8f93\u5165\u5bc6\u7801：" + inputPwd);<\/p>\n
\/\/ \u8c03\u7528\u539f\u65b9\u6cd5，\u4fdd\u7559\u539f\u6709\u903b\u8f91
\n var result = this.verifyPassword(inputPwd);
\n console.log("[Java Hook] \u6821\u9a8c\u7ed3\u679c：" + result);<\/p>\n
\/\/ \u4e5f\u53ef\u76f4\u63a5\u8fd4\u56de true \u7ed5\u8fc7\u6821\u9a8c
\n \/\/ return true;
\n return result;
\n };
\n});<\/p>\n
\u793a\u4f8b：Hook \u91cd\u8f7d\u65b9\u6cd5\u4e0e\u6784\u9020\u51fd\u6570<\/p>\n
var UserInfo = Java.use("com.example.app.UserInfo");<\/p>\n
\/\/ Hook \u5e26\u4e24\u4e2a\u53c2\u6570\u7684\u6784\u9020\u65b9\u6cd5
\nUserInfo.$init.overload("java.lang.String", "int").implementation = function (name, age) {
\n console.log("[\u6784\u9020] \u521b\u5efa\u7528\u6237：" + name + "，\u5e74\u9f84：" + age);
\n this.$init(name, age); \/\/ \u5fc5\u987b\u8c03\u7528\u539f\u6784\u9020，\u5426\u5219\u5bf9\u8c61\u65e0\u6cd5\u521d\u59cb\u5316
\n};<\/p>\n
\/\/ Hook \u91cd\u8f7d\u7684 getSign \u65b9\u6cd5（String + int \u53c2\u6570\u7248\u672c）
\nUserInfo.getSign.overload("java.lang.String", "int").implementation = function (data, type) {
\n console.log("[\u91cd\u8f7d] data=" + data + "，type=" + type);
\n return this.getSign(data, type);
\n};<\/p>\n
\u793a\u4f8b：\u4fee\u6539\u5b57\u6bb5\u4e0e Hook \u533f\u540d\u5185\u90e8\u7c7b<\/p>\n
var MainActivity = Java.use("com.example.app.MainActivity");<\/p>\n
\/\/ Hook \u6309\u94ae\u70b9\u51fb\u7684\u533f\u540d\u5185\u90e8\u7c7b
\nvar ClickListener = Java.use("com.example.app.MainActivity$1");
\nClickListener.onClick.implementation = function (v) {
\n console.log("[\u5185\u90e8\u7c7b] \u767b\u5f55\u6309\u94ae\u88ab\u70b9\u51fb");
\n this.onClick(v);
\n};<\/p>\n
\/\/ \u4fee\u6539\u9759\u6001\u5b57\u6bb5，\u5f3a\u5236\u5f00\u542f\u8c03\u8bd5\u6a21\u5f0f
\nMainActivity.IS_DEBUG.value = true;
\nconsole.log("[\u5b57\u6bb5] \u8c03\u8bd5\u6a21\u5f0f\u72b6\u6001：" + MainActivity.IS_DEBUG.value);<\/p>\n
Frida \u4e0d\u4ec5\u80fd\u88ab\u52a8\u62e6\u622a，\u8fd8\u53ef\u4ee5\u4e3b\u52a8\u8c03\u7528\u7c7b\u7684\u9759\u6001 \/ \u5b9e\u4f8b\u65b9\u6cd5；\u6279\u91cf Hook \u5219\u9002\u5408\u5feb\u901f\u5b9a\u4f4d\u76ee\u6807\u51fd\u6570\u3002<\/p>\n
\u793a\u4f8b：\u4e3b\u52a8\u8c03\u7528\u9759\u6001\u52a0\u5bc6\u65b9\u6cd5<\/p>\n
Java.perform(function () {
\n var SignUtils = Java.use("com.example.app.utils.SignUtils");
\n \/\/ \u4e3b\u52a8\u8c03\u7528 md5 \u52a0\u5bc6\u65b9\u6cd5
\n var sign = SignUtils.md5Encrypt("test123456");
\n console.log("[\u4e3b\u52a8\u8c03\u7528] \u52a0\u5bc6\u7ed3\u679c：" + sign);
\n});<\/p>\n
\u6279\u91cf Hook \u76ee\u6807\u7c7b\u7684\u6240\u6709\u65b9\u6cd5，\u7528\u4e8e\u5feb\u901f\u5b9a\u4f4d\u5173\u952e\u903b\u8f91：<\/p>\n
var targetClass = Java.use("com.example.app.utils.SecurityUtils");
\nvar methods = targetClass.class.getDeclaredMethods();<\/p>\n
methods.forEach(function (method) {
\n var methodName = method.getName();
\n targetClass[methodName].implementation = function () {
\n console.log("[\u6279\u91cfHook] \u8c03\u7528\u65b9\u6cd5：" + methodName);
\n return this[methodName].apply(this, arguments);
\n };
\n});<\/p>\n
so \u5c42 Hook \u9488\u5bf9 Native \u4ee3\u7801，\u6838\u5fc3\u4f9d\u8d56 Interceptor \u62e6\u622a\u6a21\u5757\u4e0e Module \u5185\u5b58\u5b9a\u4f4d\u6a21\u5757\u3002<\/p>\n
so \u5c42 Hook \u4e3b\u8981\u8986\u76d6\u4e24\u7c7b\u573a\u666f：<\/p>\n
\u5bfc\u51fa\u51fd\u6570\u662f so \u5bf9\u5916\u66b4\u9732\u7684\u63a5\u53e3，\u53ef\u4ee5\u76f4\u63a5\u901a\u8fc7 Module.findExportByName() \u5b9a\u4f4d\u5185\u5b58\u5730\u5740\u3002<\/p>\n
\u793a\u4f8b 1：Hook Java Native \u65b9\u6cd5（so \u5c42\u89c6\u89d2）<\/p>\n
\/\/ \u786e\u4fdd\u76ee\u6807 so \u5df2\u52a0\u8f7d\u5b8c\u6210
\nModule.ensureInitialized("libsecurity.so");<\/p>\n
\/\/ \u6309 JNI \u547d\u540d\u89c4\u5219\u67e5\u627e\u5bfc\u51fa\u51fd\u6570
\nvar nativeSign = Module.findExportByName("libsecurity.so",
\n "Java_com_example_app_utils_SignUtils_nativeSign");<\/p>\n
Interceptor.attach(nativeSign, {
\n onEnter: function (args) {
\n \/\/ JNI \u51fd\u6570\u524d\u4e24\u4e2a\u53c2\u6570\u56fa\u5b9a\u4e3a JNIEnv* \u548c jobject
\n \/\/ args[2] \u624d\u5bf9\u5e94 Java \u5c42\u4f20\u5165\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570
\n var input = Memory.readCString(args[2]);
\n console.log("[so Hook] \u7b7e\u540d\u8f93\u5165：" + input);
\n },
\n onLeave: function (retval) {
\n var result = Memory.readCString(retval);
\n console.log("[so Hook] \u7b7e\u540d\u7ed3\u679c：" + result);
\n }
\n});<\/p>\n
\u793a\u4f8b 2：Hook \u7cfb\u7edf libc \u7684 strcmp \u51fd\u6570<\/p>\n
\/\/ \u5e38\u7528\u4e8e\u7ed5\u8fc7\u5b57\u7b26\u4e32\u6bd4\u8f83\u6821\u9a8c
\nvar strcmp = Module.findExportByName("libc.so", "strcmp");
\nInterceptor.attach(strcmp, {
\n onEnter: function (args) {
\n var str1 = Memory.readCString(args[0]);
\n var str2 = Memory.readCString(args[1]);
\n console.log("[strcmp] \u6bd4\u8f83：" + str1 + " vs " + str2);
\n },
\n onLeave: function (retval) {
\n \/\/ \u4fee\u6539\u8fd4\u56de\u503c\u4e3a 0，\u5f3a\u5236\u5224\u5b9a\u5b57\u7b26\u4e32\u76f8\u7b49
\n retval.replace(0);
\n }
\n});<\/p>\n
\u6838\u5fc3\u7b97\u6cd5\u51fd\u6570\u901a\u5e38\u4e0d\u4f1a\u5bfc\u51fa，\u9700\u8981\u5148\u901a\u8fc7 IDA Pro \u7b49\u9759\u6001\u5206\u6790\u5de5\u5177\u5f97\u5230\u51fd\u6570\u5728 so \u6587\u4ef6\u4e2d\u7684\u504f\u79fb，\u518d\u52a0\u4e0a\u5185\u5b58\u52a0\u8f7d\u57fa\u5740，\u8ba1\u7b97\u51fa\u8fd0\u884c\u65f6\u5730\u5740\u3002<\/p>\n
\u793a\u4f8b：\u901a\u8fc7\u57fa\u5740 + \u504f\u79fb Hook \u672a\u5bfc\u51fa\u7b97\u6cd5\u51fd\u6570<\/p>\n
\/\/ \u83b7\u53d6 so \u5728\u5185\u5b58\u4e2d\u7684\u52a0\u8f7d\u57fa\u5740
\nvar baseAddr = Module.findBaseAddress("libnative.so");
\nif (!baseAddr) {
\n console.log("[-] libnative.so \u5c1a\u672a\u52a0\u8f7d");
\n return;
\n}<\/p>\n
\/\/ IDA \u4e2d\u5206\u6790\u5f97\u5230\u7684\u51fd\u6570\u6587\u4ef6\u504f\u79fb（\u793a\u4f8b\u503c）
\nvar funcOffset = 0x3F2C;
\n\/\/ \u8ba1\u7b97\u8fd0\u884c\u65f6\u7684\u51fd\u6570\u5730\u5740
\nvar targetFunc = baseAddr.add(funcOffset);<\/p>\n
Interceptor.attach(targetFunc, {
\n onEnter: function (args) {
\n console.log("[\u672a\u5bfc\u51fa\u51fd\u6570] \u8fdb\u5165\u76ee\u6807\u51fd\u6570，\u53c2\u65701：" + args[0]);
\n this.arg1 = args[0]; \/\/ \u4fdd\u5b58\u4e0a\u4e0b\u6587，onLeave \u4e2d\u4f7f\u7528
\n },
\n onLeave: function (retval) {
\n console.log("[\u672a\u5bfc\u51fa\u51fd\u6570] \u8fd4\u56de\u503c：" + retval.toInt32());
\n }
\n});<\/p>\n
Native \u5c42\u53c2\u6570\u591a\u4e3a\u6307\u9488\u7c7b\u578b，\u9700\u8981\u901a\u8fc7 Memory \u6a21\u5757\u8bfb\u5199\u5185\u5b58\u5185\u5bb9，\u5e38\u7528 API \u5305\u62ec：<\/p>\n
\u793a\u4f8b：\u89e3\u6790\u7ed3\u6784\u4f53\u7c7b\u578b\u53c2\u6570<\/p>\n
Interceptor.attach(targetFunc, {
\n onEnter: function (args) {
\n \/\/ args[1] \u4e3a\u7ed3\u6784\u4f53\u6307\u9488，\u504f\u79fb 0x8 \u5904\u662f int \u7c7b\u578b\u7684\u957f\u5ea6\u5b57\u6bb5
\n var dataPtr = Memory.readPointer(args[1]);
\n var dataLen = Memory.readInt(args[1].add(8));
\n var data = Memory.readByteArray(dataPtr, dataLen);<\/p>\n
console.log("[\u7ed3\u6784\u4f53] \u6570\u636e\u957f\u5ea6：" + dataLen);
\n console.log(hexdump(data, { length: dataLen }));
\n }
\n});<\/p>\n
\u573a\u666f：\u67d0 APP \u767b\u5f55\u5bc6\u7801\u5728 Java \u5c42\u505a\u4e86\u52a0\u5bc6\u540e\u4f20\u8f93，\u9700\u8981\u83b7\u53d6\u7528\u6237\u8f93\u5165\u7684\u539f\u59cb\u660e\u6587\u5bc6\u7801\u3002<\/p>\n
\u5206\u6790\u601d\u8def：\u53cd\u7f16\u8bd1 APK \u5b9a\u4f4d\u767b\u5f55\u6309\u94ae\u70b9\u51fb\u4e8b\u4ef6，\u8ffd\u8e2a\u5230\u5bc6\u7801\u5904\u7406\u7c7b LoginHelper \u7684 encryptPassword \u65b9\u6cd5，Hook \u8be5\u65b9\u6cd5\u7684\u5165\u53c2\u5373\u53ef\u5f97\u5230\u660e\u6587\u3002<\/p>\n
\u5b8c\u6574\u811a\u672c：<\/p>\n
Java.perform(function () {
\n var LoginHelper = Java.use("com.example.app.login.LoginHelper");<\/p>\n
LoginHelper.encryptPassword.overload("java.lang.String").implementation = function (pwd) {
\n console.log("========== \u767b\u5f55\u660e\u6587\u6293\u53d6 ==========");
\n console.log("\u539f\u59cb\u660e\u6587\u5bc6\u7801：" + pwd);
\n var encrypted = this.encryptPassword(pwd);
\n console.log("\u52a0\u5bc6\u540e\u5bc6\u7801：" + encrypted);
\n console.log("==================================");
\n return encrypted;
\n };
\n});<\/p>\n
\u6267\u884c\u547d\u4ee4 frida -U -f com.example.app -l login_hook.js，\u542f\u52a8 APP \u8f93\u5165\u5bc6\u7801\u540e，\u63a7\u5236\u53f0\u5373\u53ef\u8f93\u51fa\u539f\u59cb\u660e\u6587\u3002<\/p>\n
\u573a\u666f：\u67d0 APP \u7684\u6838\u5fc3\u7b7e\u540d\u7b97\u6cd5\u653e\u5728 so \u5c42，Java \u5c42\u8c03\u7528 nativeGetSign(String data) \u8fd4\u56de\u7b7e\u540d\u5b57\u7b26\u4e32，\u9700\u8981\u6df1\u5165\u5206\u6790\u7b97\u6cd5\u7684\u8f93\u5165\u8f93\u51fa\u3002<\/p>\n
\u5206\u6790\u601d\u8def：<\/p>\n
\u5b8c\u6574\u811a\u672c：<\/p>\n
\/\/ 1. Java \u5c42：\u786e\u8ba4 native \u65b9\u6cd5\u8c03\u7528\u65f6\u673a
\nJava.perform(function () {
\n var SignUtils = Java.use("com.example.app.utils.SignUtils");
\n SignUtils.nativeGetSign.implementation = function (data) {
\n console.log("[Java] \u8c03\u7528 nativeGetSign，\u5165\u53c2：" + data);
\n var result = this.nativeGetSign(data);
\n console.log("[Java] \u8fd4\u56de\u7ed3\u679c：" + result);
\n return result;
\n };
\n});<\/p>\n
\/\/ 2. so \u5c42：\u76d1\u542c so \u52a0\u8f7d\u5e76 Hook \u6838\u5fc3\u51fd\u6570
\nsetImmediate(function () {
\n var base = Module.findBaseAddress("libsign.so");
\n if (!base) {
\n \/\/ so \u672a\u52a0\u8f7d\u65f6，Hook dlopen \u76d1\u542c\u52a0\u8f7d\u4e8b\u4ef6
\n var dlopen = Module.findExportByName(null, "dlopen");
\n Interceptor.attach(dlopen, {
\n onEnter: function (args) {
\n this.soPath = Memory.readCString(args[0]);
\n },
\n onLeave: function () {
\n if (this.soPath && this.soPath.indexOf("libsign.so") !== -1) {
\n console.log("[so] libsign.so \u52a0\u8f7d\u5b8c\u6210，\u5f00\u59cbHook\u6838\u5fc3\u51fd\u6570");
\n hookCoreFunc();
\n }
\n }
\n });
\n } else {
\n hookCoreFunc();
\n }
\n});<\/p>\n
function hookCoreFunc() {
\n var baseAddr = Module.findBaseAddress("libsign.so");
\n var coreFunc = baseAddr.add(0x256C); \/\/ IDA \u5206\u6790\u5f97\u5230\u7684\u51fd\u6570\u504f\u79fb<\/p>\n
Interceptor.attach(coreFunc, {
\n onEnter: function (args) {
\n this.inputBuf = args[0];
\n this.inputLen = args[1].toInt32();
\n console.log("[so\u6838\u5fc3] \u8f93\u5165\u6570\u636e\u957f\u5ea6：" + this.inputLen);
\n console.log(hexdump(this.inputBuf, { length: this.inputLen }));
\n },
\n onLeave: function (retval) {
\n console.log("[so\u6838\u5fc3] \u8f93\u51fa\u7b7e\u540d：" + Memory.readCString(retval));
\n }
\n });
\n}<\/p>\n
\u5f88\u591a APP \u4f1a\u68c0\u6d4b Frida \u7279\u5f81，\u5e38\u7528\u5bf9\u6297\u624b\u6bb5：<\/p>\n
Frida \u7684\u6838\u5fc3\u4ef7\u503c\u5728\u4e8e\u6253\u901a\u4e86 Java \u5c42\u4e0e Native \u5c42\u7684\u5206\u6790\u58c1\u5792：Java \u5c42 Hook \u9002\u5408\u5feb\u901f\u5b9a\u4f4d\u4e1a\u52a1\u903b\u8f91\u3001\u9501\u5b9a\u5173\u952e\u51fd\u6570\u5165\u53e3；so \u5c42 Hook \u5219\u6df1\u5165\u5e95\u5c42，\u7528\u4e8e\u8fd8\u539f\u52a0\u5bc6\u7b97\u6cd5\u3001\u7ed5\u8fc7 native \u6821\u9a8c\u3002<\/p>\n
\u5b9e\u9645\u9006\u5411\u5206\u6790\u4e2d，\u901a\u5e38\u9075\u5faa \u201c\u5148 Java \u540e so，\u5148\u5bfc\u51fa\u540e\u672a\u5bfc\u51fa\u201d \u7684\u601d\u8def：\u4ece\u4e0a\u5c42\u4e1a\u52a1\u903b\u8f91\u9010\u6b65\u8ffd\u8e2a\u5230\u5e95\u5c42\u7b97\u6cd5，\u7ed3\u5408\u9759\u6001\u5206\u6790\u4e0e\u52a8\u6001\u8c03\u8bd5，\u5f62\u6210\u5b8c\u6574\u7684\u5206\u6790\u94fe\u8def\u3002\u638c\u63e1\u672c\u6587\u7684\u57fa\u7840\u59ff\u52bf\u4e0e\u5b9e\u6218\u6280\u5de7，\u8db3\u4ee5\u5e94\u5bf9\u7edd\u5927\u591a\u6570 APP \u7684\u9006\u5411\u5206\u6790\u573a\u666f\u3002\u5728\u6b64\u57fa\u7840\u4e0a，\u8fd8\u53ef\u4ee5\u8fdb\u4e00\u6b65\u5b66\u4e60 Frida RPC\u3001Stalker \u4ee3\u7801\u8ffd\u8e2a\u3001\u5185\u5b58\u6f2b\u6e38\u7b49\u8fdb\u9636\u529f\u80fd，\u5411\u66f4\u6df1\u5ea6\u7684\u9006\u5411\u5206\u6790\u65b9\u5411\u8fdb\u9636\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
Frida \u662f\u4e00\u6b3e\u8de8\u5e73\u53f0\u7684\u52a8\u6001\u4e8c\u8fdb\u5236\u63d2\u6869\u5de5\u5177，\u51ed\u501f JavaScript \u811a\u672c\u5316\u3001\u8f7b\u91cf\u7075\u6d3b\u3001\u5168\u5e73\u53f0\u8986\u76d6\u7684\u7279\u6027，\u6210\u4e3a\u79fb\u52a8\u7aef\u9006\u5411\u5206\u6790\u3001\u5b89\u5168\u6d4b\u8bd5\u9886\u57df\u7684\u6807\u914d\u5de5\u5177\u3002\u65e0\u8bba\u662f Java \u5c42\u7684\u4e1a\u52a1\u903b\u8f91 Hook，\u8fd8\u662f so \u539f\u751f\u5c42\u7684\u7b97\u6cd5\u5206\u6790，Frida \u90fd\u80fd\u63d0\u4f9b\u7edf\u4e00\u7684\u64cd\u4f5c\u8303\u5f0f\u3002\u672c\u6587\u5c06\u4ece\u57fa\u7840\u73af\u5883\u642d\u5efa\u51fa\u53d1，\u7cfb\u7edf\u603b\u7ed3 Java \u5c42\u4e0e so \u5c42\u7684\u5e38\u7528 Hook \u59ff\u52bf，\u7ed3\u5408\u5b9e\u6218\u6848\u4f8b\u68b3\u7406\u5b8c\u6574\u7684\u5206\u6790\u94fe\u8def，\u5e2e\u52a9<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[9210,677],"topic":[],"class_list":["post-113788","post","type-post","status-publish","format-standard","hentry","category-server","tag-frida","tag-677"],"yoast_head":"\n