Frida API使用(2)

Frida输出打印

console

setTimeout(function (){
    Java.perform(function (){
      console.log("n[*] enumerating classes...");
      console.log("Frida version:"+Frida.version);
      console.log("Frida heapsize:"+Frida.heapSize);
      console.log("Script runtime:"+Script.runtime);
      console.warn("warn");
      console.error("error");
      Java.choose("android.bluetooth.BluetoothDevice",{
        onMatch: function (instance){
          console.log("[*] "+" android.bluetooth.BluetoothDevice instance found"+" :=> '"+instance+"'");
       //   console.log(Java.cast(instance,Java.use("android.bluetooth.BluetoothDevice") ).getName());
          console.log(instance.getName());
        //  bluetoothDeviceInfo(instance);
        },
        onComplete: function() { console.log("[*] -----");}
      });

    });
  });

通过下面的命令运行程序

frida -U -l hello.js android.process.media –debug --runtime=v8

在这里对console.log，console.warn，console.error进行了介绍，望文也可生义。

Frida.version: property containing the current Frida version, as a string.

Frida.heapSize: dynamic property containing the current size of Frida’s private heap, shared by all scripts and Frida’s own runtime. This is useful for keeping an eye on how much memory your instrumentation is using out of the total consumed by the hosting process.

Script.runtime: string property containing the runtime being used. Either DUK or V8.

hexdump

hexdump(target[, options]): generate a hexdump from the provided ArrayBuffer or NativePointer target, optionally with options for customizing the output.

添加如下的代码：

var libc = Module.findBaseAddress('libc.so');
    console.log(hexdump(libc, {
    offset: 0,
    length: 64,
    header: true,
    ansi: true
  }));

运行：

send

send(message[, data]): send the JavaScript object message to your Frida-based application (it must be serializable to JSON).

# -*- coding: utf-8 -*-
import frida
import sys

def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

jscode = """
    Java.perform(function () 
    {
        var jni_env = Java.vm.getEnv();
        console.log(jni_env);
        send(jni_env);
    });
 """

process = frida.get_usb_device().attach('android.process.media')
script = process.create_script(jscode)
script.on('message', on_message)
script.load()
sys.stdin.read()

通过下面的结果可以看出，send输出的是json格式。

Frida变量类型

API	含义
new Int64(v)	create a new Int64 from v
new UInt64(v)	create a new UInt64 from v
NativePointer	creates a new NativePointer from the string s
wrap(address, size)	creates an ArrayBuffer backed by an existing memory region
new NativeFunction(address, returnType, argTypes[, abi])	create a new NativeFunction to call the function at address
new NativeCallback(func, returnType, argTypes[, abi])	create a new NativeCallback implemented by the JavaScript function func
new SystemFunction(address, returnType, argTypes[, abi])	just like NativeFunction, but also provides a snapshot of the thread’s last error status
ptr(s)	short-hand for new NativePointer(s)
NULL	short-hand for ptr(“0”)

添加如下代码：

        console.log("new Int64(1):"+new Int64(1));
        console.log("new UInt64(1):"+new UInt64(1));
        console.log("new NativePointer(0xEC644071):"+new NativePointer(0x123456));
        console.log("new ptr('0xEC644071'):"+new ptr(0x123456));
        console.log("null point:"+ptr('0'));

运行结果如下：

对于 Int64一些简单的运算

        console.log("8888 + 1:"+new Int64("8888").add(1));
        //8888 - 1 = 8887
        console.log("8888 - 1:"+new Int64("8888").sub(1));
        //8888 << 1 = 4444
        console.log("8888 << 1:"+new Int64("8888").shr(1));
        //8888 == 22 = 1 1是false
        console.log("8888 == 22:"+new Int64("8888").compare(22));
        //转string
        console.log("8888 toString:"+new Int64("8888").toString());

注释写的很清楚了：

RPC远程调用

Empty object that you can either replace or insert into to expose an RPC-style API to your application. The key specifies the method name and the value is your exported function.

# -*- coding: utf-8 -*-
import frida
import sys

def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

jscode = """
    Java.perform(function () 
    {
        var jni_env = Java.vm.getEnv();
        console.log(jni_env);
        send(jni_env);
    });
    rpc.exports = {
    add: function (a, b) {
        return a + b;
    },
    sub: function (a, b) {
        return new Promise(function (resolve) {
        setTimeout(function () {
            resolve(a - b);
        }, 100);
        });
    }
    };
 """

process = frida.get_usb_device().attach('android.process.media')
script = process.create_script(jscode)
script.on('message', on_message)
script.load()
print(script.exports.sub(2, 3))
process.detach()

script.on(‘message’, on_message) is used to monitor for any messages from the injected process, JavaScript side.

Process

通过如下的代码获取进程相关信息：

 		console.log("目标进程的PID:"+Process.id);
        console.log("调试器是否附加到目标进程:"+Process.isDebuggerAttached())
        //枚举进程加载的模块
        var process_Obj_Module_Arr = Process.enumerateModules();
        for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
            console.log("",process_Obj_Module_Arr[i].name);
        }
        //枚举当前所有的线程
        var enumerateThreads =  Process.enumerateThreads();
        for(var i = 0; i < enumerateThreads.length; i++) {
            console.log("");
            console.log("id:",enumerateThreads[i].id);
            console.log("state:",enumerateThreads[i].state);
            console.log("context:",JSON.stringify(enumerateThreads[i].context));
         }
         //this thread’s OS-specific id as a number
         console.log("this thread’s OS-specific id as a number:"+Process.getCurrentThreadId());

运行上面的程序，可以获取到进程相关的信息。

这里说一下线程：
Process.enumerateThreads()：枚举当前所有的线程，返回包含以下属性的对象数组：

• id: OS-specific id
• state: string specifying either running, stopped, waiting, uninterruptible or halted
• context: object with the keys pc and sp, which are NativePointer objects specifying EIP/RIP/PC and ESP/RSP/SP, respectively, for ia32/x64/arm. Other processor-specific keys are also available, e.g. eax, rax, r0, x0, etc.

完整代码

setTimeout(function (){
    Java.perform(function (){
      console.log("n[*] enumerating classes...");
      console.log("Frida version:"+Frida.version);
      console.log("Frida heapsize:"+Frida.heapSize);
      console.log("Script runtime:"+Script.runtime);
      console.warn("warn");
      console.error("error");
      Java.choose("android.bluetooth.BluetoothDevice",{
        onMatch: function (instance){
          console.log("[*] "+" android.bluetooth.BluetoothDevice instance found"+" :=> '"+instance+"'");
       //   console.log(Java.cast(instance,Java.use("android.bluetooth.BluetoothDevice") ).getName());
          console.log(instance.getName());
        //  bluetoothDeviceInfo(instance);
        },
        onComplete: function() { console.log("[*] -----");}
      });
      var libc = Module.findBaseAddress('libc.so');
          console.log(hexdump(libc, {
          offset: 0,
          length: 64,
          header: true,
          ansi: true
        }));
        console.log("");
        console.log("new Int64(1):"+new Int64(1));
        console.log("new UInt64(1):"+new UInt64(1));
        console.log("new NativePointer(0xEC644071):"+new NativePointer(0x123456));
        console.log("new ptr('0xEC644071'):"+new ptr(0x123456));
        console.log("null point:"+ptr('0'));

        console.log("");
        //8888 + 1 = 8889
        console.log("8888 + 1:"+new Int64("8888").add(1));
        //8888 - 1 = 8887
        console.log("8888 - 1:"+new Int64("8888").sub(1));
        //8888 << 1 = 4444
        console.log("8888 << 1:"+new Int64("8888").shr(1));
        //8888 == 22 = 1 1是false
        console.log("8888 == 22:"+new Int64("8888").compare(22));
        //转string
        console.log("8888 toString:"+new Int64("8888").toString());

        console.log("目标进程的PID:"+Process.id);
        console.log("调试器是否附加到目标进程:"+Process.isDebuggerAttached())
        //枚举进程加载的模块
        var process_Obj_Module_Arr = Process.enumerateModules();
        for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
            console.log("",process_Obj_Module_Arr[i].name);
        }
        //枚举当前所有的线程
        var enumerateThreads =  Process.enumerateThreads();
        for(var i = 0; i < enumerateThreads.length; i++) {
            console.log("");
            console.log("id:",enumerateThreads[i].id);
            console.log("state:",enumerateThreads[i].state);
            console.log("context:",JSON.stringify(enumerateThreads[i].context));
         }
         //this thread’s OS-specific id as a number
         console.log("this thread’s OS-specific id as a number:"+Process.getCurrentThreadId());
    });
  });

定义任意类型数组

Java.perform(function () {
        //定义一个int数组、值是1003, 1005, 1007
        var intarr = Java.array('int', [ 1003, 1005, 1007 ]);
        //定义一个byte数组、值是0x48, 0x65, 0x69
        var bytearr = Java.array('byte', [ 0x48, 0x65, 0x69 ]);
        for(var i=0;i<bytearr.length;i++)
        {
            //输出每个byte元素
            console.log(bytearr[i])
        }
});

定义格式为Java.array('type',[value1,value2,....])
关于type的类型:
1 Z boolean
2 B byte
3 C char
4 S short
5 I int
6 J long
7 F float
8 D double
9 V void

上面的定义是基本的数据类型，如果是对象怎么办，比如一个Object数组:

var arr = new Array();
var string = Java.use("java.lang.String");
var ele = Java.cast(string.$new("无情剑客"), Java.use("java.lang.Object"));
arr.push(ele)

公众号

更多Frida相关内容，欢迎关注我的公众号：无情剑客。