invoker | 技不如人，甘拜下风
2017-12-30 | 折腾

frida

http://frida.re/
Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

  1. 安装 frida -> here

  2. run frida-server
    解压 frida-server-10.6.28-android-arm64.xz ，然后在 android 设备上运行 frida-server

    1
    2
    3
    4
    5
    adb root
    adb remount
    adb push frida-server /data/local/tmp/ 
    adb shell "chmod 755 /data/local/tmp/frida-server"
    adb shell "/data/local/tmp/frida-server &"

    总之就是在手机上运行 frida-server 啦，跑起来就成。sd 卡目录有权限限制，所以建议按教程上写的走

  3. 跑个脚本
    save -> request.js

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    // frida -U ${packageName} -l  request.js
    Java.perform(function () {
    	    var OkHttpClient = Java.use("okhttp3.OkHttpClient");
    	    var RealCall = Java.use("okhttp3.RealCall");
    	
    	    OkHttpClient.newCall.implementation = function (request) {
    	        result = this.newCall(request)
    	        console.log(request.toString())
    	        return result
    	    };
    	
    	    RealCall.getResponseWithInterceptorChain.implementation = function () {
    	        response = this.getResponseWithInterceptorChain()
    	        console.log(response.toString())
    	        return response
    	    }
    });

    在电脑上执行 frida -U ${packageName} -l request.js 就可以看到指定包名的应用使用 okhttp3 进行的 http 请求了

  4. 更多资源