利用Frida得到类加载器里面加载的类

function ClassOfClassLoader(classloaderobj) {
    Java.perform(function() {
        try {
            var BaseDexClassLoaderClass = Java.use("dalvik.system.BaseDexClassLoader");
            var DexPathListClass = Java.use("dalvik.system.DexPathList");
            var ElementClass = Java.use("dalvik.system.DexPathList$Element");
            var DexFileClass = Java.use("dalvik.system.DexFile");
            // 将 classloaderobj 转换为 BaseDexClassLoader
            var basedexclassloaderobj = Java.cast(classloaderobj, BaseDexClassLoaderClass);
            // 获取 pathList
            var tmpobj = basedexclassloaderobj.pathList.value;
            var pathlistobj = Java.cast(tmpobj, DexPathListClass);
            // 获取 dexElements
            var dexelementsobj = pathlistobj.dexElements.value;

            // 遍历 dexElements 数组
            for (var i = 0; i < dexelementsobj.length; i++) {
                var obj = dexelementsobj[i];
                var elementobj = Java.cast(obj, ElementClass);
                var tmp = elementobj.dexFile.value;
                var dexfileobj = Java.cast(tmp, DexFileClass);
                
                // 枚举 DexFile 中的类名
                var enumeratorClassNames = dexfileobj.entries();
                while (enumeratorClassNames.hasMoreElements()) {
                    var classname = enumeratorClassNames.nextElement().toString();
                    console.log("start loadclass->" + classname);
                }
            }
        } catch (e) {
            console.log(e);
        }
    });
}


function hook_classloader(){
    Java.perform(function () {
        // 获取 Java 虚拟机中的所有类加载器，并将它们作为数组返回。
        var classloaders = Java.enumerateClassLoadersSync();
        var i = 0;
        for (i;i<classloaders.length;i++){
            console.log("classloader:",classloaders[i])
            if(classloaders[i].toString().indexOf("DexClassLoader")!=-1){
                ClassOfClassLoader(classloaders[i]);
            }
        }
    });
}