写了一个frida快速启动脚本

frida-start.sh 服务端端启动

#!/bin/bash
handle_int() {
    echo "捕获到ctrl+c操作"
	  adb shell "su 0 -c kill -9 $(adb shell ps | grep 'h16' | awk '{print $2}')"
}

# 使用 trap 命令设置 SIGINT 信号的处理函数
trap 'handle_int' SIGINT

adb shell "su -s /bin/sh -c 'cd /data/local/lingdian/ && ls && ./16.sh'"

frida-txt.sh 客户端启动

#!/bin/bash
execute_frida(){
      # 检查是否提供了参数，否则使用默认值
    local param1=${1:-$default_param1}
    local param2=${2:-$default_param2}
    local param3=${3:-$default_param3}
    echo "参数1：启动方式" $param1
    echo "参数2：包名" $param2
    echo "参数3：文件名" $param3
    port_num=27042
    # 根据param1的值执行不同的操作
    case $param1 in
        1)
            echo "参数是 1，自己启动"
            frida -H 127.0.0.1:$port_num -f $param2 -l $param3.js -o 1.txt
            ;;
        2)
            echo "参数是 2，当前页面hook"
            frida -H 127.0.0.1:$port_num -F -l $param3.js -o 1.txt
            ;;
        *)
            echo "未知参数 $param1，执行默认操作或退出"
            # 这里可以放置默认需要执行的命令，或者选择退出脚本
            # exit 1  # 如果想要在遇到未知参数时退出脚本，可以取消注释这行代码
            ;;
    esac
}
for line in `cat app.txt`
do
    array=(${line//==/ })
    if [[ "${array[4]}" == "开启" ]]; then
         execute_frida "${array[3]}" "${array[1]}" "${array[2]}"
    fi
done

app.txt

#app名称==包名==文件名==启动方式=开启frida（启动方式1是自己启动，2是附加）
大姨妈==com.yoloho.dayima==dayimi==2
b站==tv.danmaku.bili==bibi==2==开启==

示例.js

Java.perform(function () {
    //打印所有堆栈信息
    function showStacks() {
        console.log(Java.use("android.util.Log").getStackTraceString(
            Java.use("java.lang.Throwable").$new())
        );
    }
});
//todo 1 hashMap的hook
var HashMapClass = Java.use('java.util.HashMap');
HashMapClass.put.overload('java.lang.Object', 'java.lang.Object').implementation = function (key, value) {
    if (key === "time") {
        console.log("    Key: ", key);
        console.log("    Value: ", value);
    }
    return this.put(key, value);
};
//todo 2 string的hook
var mapClass = Java.use("java.lang.String")
mapClass.toString.implementation = function () {
    var originalResult = this.toString();
    if (typeof originalResult === 'string' && originalResult.includes("卡密不存在")) {
        console.log("key2:" + originalResult)
        showStacks()
    return originalResult;
}

// todo 3 StringBuffer的append方法StringBuilder的append方法
var StringBufferClass = Java.use('java.lang.StringBuffer');
var StringBuilderClass = Java.use('java.lang.StringBuilder');


StringBufferClass.append.overload('java.lang.String').implementation = function (time) {
    console.log("[StringBuffer.append] Intercepted time: " + time);
    return this.append(time);
};

StringBuilderClass.append.overload('java.lang.String').implementation = function (time) {
    console.log("[StringBuilder.append] Intercepted time: " + time);
    return this.append(time);
};
//todo 4 打印对象和map的值
var EncryptUtilsClass = Java.use('com.gacne.www.network.EncryptUtils');
var originalAWithMap = EncryptUtilsClass.a.overload('android.content.Context', 'java.util.Map');
originalAWithMap.implementation = function (context, paramMap) {
    const objClass = Java.use("java.lang.Object").getClass.apply(context);
    const className = Java.use("java.lang.Class").getName.apply(objClass).toString();
    const currentApplication = Java.use(className);
    const fieldNames = currentApplication.class.getDeclaredFields();
    for (let i = 0; i < fieldNames.length; i++) {
        const fieldName = fieldNames[i].toString();
        try {
            fieldNames[i].setAccessible(true);
            const value = fieldNames[i].get(context);
            console.log("属性名称:"+fieldName + ": " + value);
        } catch (error) {
            console.error("Error" + fieldName);
        }
    }
    var HashMap = Java.use('java.util.HashMap');
    console.log("map：" + Java.cast(paramMap, HashMap).toString());
    return originalAWithMap.call(this, context, paramMap);
};

//todo 5 优化打印对象
function printObject(context) {
    const objClass = Java.use("java.lang.Object").getClass.apply(context);
    const className = Java.use("java.lang.Class").getName.apply(objClass).toString();
    const currentApplication = Java.use(className);
    const fieldNames = currentApplication.class.getDeclaredFields();
    for (let i = 0; i < fieldNames.length; i++) {
        const fieldName = fieldNames[i].toString();
        try {
            fieldNames[i].setAccessible(true);
            const value = fieldNames[i].get(context);
            console.log("属性名称:"+fieldName + ": " + value);
        } catch (error) {
            console.error("Error" + fieldName);
        }
    }
}
//todo 6 优化打印Map
function printMap(paramMap) {
    var HashMap = Java.use('java.util.HashMap');
    console.log("map：" + Java.cast(paramMap, HashMap).toString());
}