frida 命令参数作用

最新推荐文章于 2025-03-06 17:37:08 发布

原创最新推荐文章于 2025-03-06 17:37:08 发布

· 702 阅读

0 ·

版权

文章标签：

#frida

frida-traces是一个动态跟踪函数调用的工具。

# 在Safari中跟踪recv*和send*API，在日志记录中插入库名称
frida-trace --decorate -i "recv*" -i "send*" Safari

# 跟踪Safari中的ObjC方法调用
frida-trace -m "-[NSView drawRect:]" Safari

# 在您的iPhone上启动SnapChat并跟踪加密API调用
frida-trace -U -f com.toyopagroup.picaboo -I "libcommonCrypto*"

# 在您的Android设备上启动YouTube并跟踪签名中带有“证书”的Java方法，
# 忽略大小写（i）并仅在用户定义的类中搜索（u）
frida-trace -U -f com.google.android.youtube --runtime=v8 -j '*!*certificate*/isu'

# 在Android上跟踪三星FaceService应用程序中的所有JNI功能
frida-trace -U -i "Java_*" com.samsung.faceservice

# 跟踪Windows进程对msvcrt. dll中“mem*”函数的调用
frida-trace -p 1372 -i "msvcrt.dll!*mem*"

# 跟踪进程中除msvcrt. dll之外的所有匹配“*open*”的函数
frida-trace -p 1372 -i "*open*" -x "msvcrt.dll!*open*"

# 跟踪libjpeg.so中未导出的函数
frida-trace -p 1372 -a "libjpeg.so!0x4793c"

`frida -h`参数

usage: frida [options] target

positional arguments:
  args                  extra arguments and/or target

options:
  -h, --help            展示参数解释（帮助）
  -D ID, --device ID    通过设备ID连接
  -U, --usb             连接USB设备
  -R, --remote          连接远程 frida-server
  -H HOST, --host HOST  通过HOST连接远程frida-server
  --certificate CERTIFICATE
                        TLS证书文件路径
  --origin ORIGIN       设置 header 为“Origin”来连接远程frida-server
  --token TOKEN         authenticate with HOST using TOKEN
  --keepalive-interval INTERVAL
                        set keepalive interval in seconds, or 0 to disable (defaults to -1 to auto-select based on
                        transport)
  --p2p                 与目标建立点对点连接
  --stun-server ADDRESS
                        set STUN server ADDRESS to use with --p2p
  --relay address,username,password,turn-{udp,tcp,tls}
                        add relay to use with --p2p
  -f TARGET, --file TARGET
                        指定app包名
  -F, --attach-frontmost
                        连接当前打开的app
  -n NAME, --attach-name NAME
                        attach to NAME
  -N IDENTIFIER, --attach-identifier IDENTIFIER
                        attach to IDENTIFIER
  -p PID, --attach-pid PID
                        attach to PID
  -W PATTERN, --await PATTERN
                        await spawn matching PATTERN
  --stdio {inherit,pipe}
                        stdio behavior when spawning (defaults to “inherit”)
  --aux option          set aux option when spawning, such as “uid=(int)42” (supported types are: string, bool, int)
  --realm {native,emulated}
                        realm to attach in
  --runtime {qjs,v8}    script runtime to use
  --debug               enable the Node.js compatible script debugger
  --squelch-crash       if enabled, will not dump crash report to console
  -O FILE, --options-file FILE
                        text file containing additional command line options
  --version             show program`s version number and exit
  -l SCRIPT, --load SCRIPT
                        load SCRIPT
  -P PARAMETERS_JSON, --parameters PARAMETERS_JSON
                        parameters as JSON, same as Gadget
  -C USER_CMODULE, --cmodule USER_CMODULE
                        load CMODULE
  --toolchain {any,internal,external}
                        CModule toolchain to use when compiling from source code
  -c CODESHARE_URI, --codeshare CODESHARE_URI
                        load CODESHARE_URI
  -e CODE, --eval CODE  evaluate CODE
  -q                    quiet mode (no prompt) and quit after -l and -e
  -t TIMEOUT, --timeout TIMEOUT
                        seconds to wait before terminating in quiet mode
  --pause               leave main thread paused after spawning program
  -o LOGFILE, --output LOGFILE
                        output to log file
  --eternalize          eternalize the script before exit
  --exit-on-error       exit with code 1 after encountering any exception in the SCRIPT
  --kill-on-exit        kill the spawned program when Frida exits
  --auto-perform        wrap entered code with Java.perform
  --auto-reload         Enable auto reload of provided scripts and c module (on by default, will be required in the
                        future)
  --no-auto-reload      Disable auto reload of provided scripts and c module

frida-trace -h 管方

Usage: frida-trace [options] target

Options:
  --version             显示程序的版本号并退出
  -h, --help            显示此帮助消息并退出
  -D ID, --device=ID    连接到具有给定ID的设备
  -U, --usb             连接到USB设备
  -R, --remote          连接到远程frida-server
  -H HOST, --host=HOST  连接到HOST上的远程frida-server
  -f FILE, --file=FILE  指定app包名
  -F, --attach-frontmost
                        连接到当前打开的app
  -n NAME, --attach-name=NAME
                        连接到进程名称
  -p PID, --attach-pid=PID
                        连接到进程id
  --stdio=inherit|pipe  stdio behavior when spawning (defaults
                        to “inherit”)
  --aux=option          set aux option when spawning, such as
                        “uid=(int)42” (supported types are:
                        string, bool, int)
  --runtime=duk|v8      script runtime to use
  --debug               启用Node. js兼容脚本调试器
  --squelch-crash       如果启用，将不会输出崩溃报告
  -O FILE, --options-file=FILE
                        通过文本文件传递命令行选项
  -I MODULE, --include-module=MODULE
                        操作模块
  -X MODULE, --exclude-module=MODULE
                        排除模块
  -i FUNCTION, --include=FUNCTION
                        操作函数/模块 [MODULE]![FUNCTION]
  -x FUNCTION, --exclude=FUNCTION
                        排除函数/模块 [MODULE]![FUNCTION]
  -a MODULE!OFFSET, --add=MODULE!OFFSET
                        add MODULE!OFFSET
  -T, --include-imports
                        包括程序的导入
  -t MODULE, --include-module-imports=MODULE
                        包括模块的导入
  -m OBJC_METHOD, --include-objc-method=OBJC_METHOD
                        include OBJC_METHOD
  -M OBJC_METHOD, --exclude-objc-method=OBJC_METHOD
                        exclude OBJC_METHOD
  -j JAVA_METHOD, --include-java-method=JAVA_METHOD
                        include JAVA_METHOD
  -J JAVA_METHOD, --exclude-java-method=JAVA_METHOD
                        exclude JAVA_METHOD
  -s DEBUG_SYMBOL, --include-debug-symbol=DEBUG_SYMBOL
                        include DEBUG_SYMBOL
  -q, --quiet           do not format output messages
  -d, --decorate        将模块名称添加到生成的onEnter日志语句
  -S PATH, --init-session=PATH
                        用于初始化session(会话)的JavaScript文件的路径
  -P PARAMETERS_JSON, --parameters=PARAMETERS_JSON
                        parameters as JSON, exposed as a global named
                        'parameters'
  -o OUTPUT, --output=OUTPUT
                        将消息转储到文件