Frida入門

Frida 安裝

pyenv

參考這個鏈接即可：https://gist.github.com/cedricbonhomme/ababe00d0a675ea5c69d777276e8f375

# Installation of a decent editor, emacs
$ sudo apt install emacs

# Prerequisites to build Python
$ sudo apt install make build-essential libssl-dev zlib1g-dev libbz2-dev \
libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev libncursesw5-dev \
xz-utils tk-dev libffi-dev liblzma-dev python-openssl

# Installation of pyenv
$ curl https://pyenv.run | bash

# Always use the latest stable version of Python
$ pyenv install 3.8.0
$ pyenv global 3.8.0

# Installation of pipx
$ python -m pip install --user pipx
$ python -m userpath append ~/.local/bin

# Installation of poetry
$ curl -sSL https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py | python

新建一個Android項目

package myapplication.example.com.frida_demo;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Log;

public class MainActivity extends AppCompatActivity {

    private String total = "@@@###@@@";

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        while(true){
            try {
                Thread.sleep(1000);
            }catch (InterruptedException e){
                e.printStackTrace();
            }
            fun(50, 30);
            Log.d("T.G.string", fun("LoWeRcAsE Me!!!!!!!!"));
        }
    }
    void fun(int x,int y){
        Log.d("T.G.Sum", String.valueOf(x + y));
    }

    String fun(String x){
        total += x;
        return total.toLowerCase();
    }

    String secret(){
        return total;
    }
}

功能主要是打印日誌。

執行命令即可看到

adb logcat | grep T.G.string

Frida使用

首先需要在firda的releases界面中找到測試機的abi版本注意需要是server端。

firda releases：https://github.com/frida/frida/releases

將下載好的frida-server push到手機上

adb push frida-server /data/local/tmp/

frida的開發環境：https://github.com/oleavr/frida-agent-example

按照官方中的教程：

$ git clone git://github.com/oleavr/frida-agent-example.git
$ cd frida-agent-example/
$ npm install
$ frida -U -f com.example.android --no-pause -l _agent.js

在agent目錄下創建s1.js

console.log("Script loaded successfully ");
Java.perform(function x() {
    console.log("Inside java perform function");
    //定位類
    var my_class = Java.use("myapplication.example.com.frida_demo.MainActivity");
    console.log("Java.Use.Successfully!");//定位類成功！
    var string_class = Java.use("java.lang.String"); //獲取String類型

    my_class.fun.overload("java.lang.String").implementation = function (x) {
        console.log("*************************************");
        var my_string = string_class.$new("My TeSt String#####"); //new一個新字符串
        console.log("Original arg: " + x);
        var ret = this.fun(my_string); // 用新的參數替換舊的參數，然後調用原函數獲取結果
        console.log("Return value: " + ret);
        console.log("*************************************");
        return ret;
    };
    //在這裏更改類的方法的實現（implementation）
    my_class.fun.implementation = function (x, y) {
        //打印替換前的參數
        console.log("original call: fun(" + x + ", " + y + ")");
        //把參數替換成2和5，依舊調用原函數
        var ret_value = this.fun(2, 5);
        return ret_value;
    }
});

調用js腳本的loader.py：

import time
import frida

def my_message_handler(message , payload): #定義錯誤處理
	print(message)
	print(payload)

# 連接安卓機上的frida-server
device = frida.get_usb_device()
# 啓動`demo02`這個app
pid = device.spawn(["myapplication.example.com.frida_demo"])
device.resume(pid)
time.sleep(1)
session = device.attach(pid)
# 加載s1.js腳本
with open("s1.js") as f:
    script = session.create_script(f.read())
script.on("message", my_message_handler)
script.load()

# 腳本會持續運行等待輸入
input()

然後adb shell 進入手機，不過frida需要root，需要事先root的手機。

執行命令：

chmod +x frida-server

./frida-server

在客戶端（也就是自己的電腦）輸入frida-ps U 檢測frida-server是否運行成功。

運行python3 loader.py