Android逆向之旅—Frida Hook教程.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Frida 教程(一)\n",
    "　　参考：[Frida 官方文档](https://frida.re/docs/home/)<br>\n",
    "　　　　　[Frida发行版](https://github.com/frida/frida/releases)  \n",
    "　　　　　[Frida操作手册](https://github.com/hookmaster/frida-all-in-one)<br>\n",
    "　　　　　[Frida Android hook](https://eternalsakura13.com/2020/07/04/frida/)  \n",
    "　　　　　[win10系统下-frida环境安装](https://www.52pojie.cn/thread-1100931-1-1.html)<br>\n",
    "　　　　　[Android模拟器安装arm支持](https://my.oschina.net/sannychan/blog/647564)<br>\n",
    "　　　　　[Frida&FART Git教程](https://github.com/r0ysue/AndroidSecurityStudy)<br>\n",
    "　　　　　[Frida 脚本系列1-4[《 FRIDA系列文章》](https://github.com/r0ysue/AndroidSecurityStudy)](https://www.anquanke.com/member/131652)<br>\n",
    "　　　　　[Frida教程](https://blog.csdn.net/qingemengyue/article/details/80061491)<br>\n",
    "　　　　　[最详细的Frida笔记](https://blog.csdn.net/qq_40827990/article/details/107363037)<br>\n",
    "　　　　　[实用frida进阶：内存漫游、hook anywhere、抓包](https://blog.csdn.net/weixin_44032232/article/details/111402600)<br>\n",
    "　　　　　[android frida 检测_对抗Android应用HTTPS通信](https://blog.csdn.net/weixin_30220177/article/details/112323503)<br>\n",
    "　　　　　[frida 实战_Android安全指南 之 Frida脱壳实战](https://blog.csdn.net/weixin_34614567/article/details/113018729)<br>\n",
    "　　　　　[使用frida绕过安卓ssl pinning](https://blog.csdn.net/w1590191166/article/details/106308028)<br>\n",
    "　　　　　[安卓逆向|菜鸟的FRIDA学习笔记:如何让TracerPid恒为0?](https://blog.csdn.net/qq523176585/article/details/109508055)<br>\n",
    "　　　　　[进阶Frida--Android逆向之动态加载dex Hook](https://blog.csdn.net/omnispace/article/details/81529686)<br>\n",
    "　　　　　[抖音数据采集教程，一篇文章带你领悟Frida的精髓](https://blog.csdn.net/weixin_52148451/article/details/112644922)<br>\n",
    "　　　　　[Android逆向之旅---Hook神器家族的Frida工具使用详解](https://blog.csdn.net/F0ED9cZN4Ly992G/article/details/80906101)<br>\n",
    "　　　　　[Frida Java Hook 详解（安卓9）：代码及示例（上）](https://mp.weixin.qq.com/s/2BdX-rtAu8WZuzY3pK94NQ)<br>\n",
    "　　　　　[frida的用法--Hook Java代码篇](https://www.cnblogs.com/luoyesiqiu/p/10718997.html)<br>\n",
    "　　　　　[Frida详细安装教程](https://www.jianshu.com/p/c349471bdef7)  \n",
    "　　　　　[roysue大佬专栏](https://www.anquanke.com/member.html?memberId=131652)   \n",
    "　　　　　[进阶Frida--Android逆向之动态加载dex Hook（三）](https://bbs.pediy.com/thread-229657.htm)   \n",
    "　　　　　[Frida常用方法 ](https://www.cnblogs.com/coffee520/p/14734353.html)    \n",
    "　　　　　[frida-js调试记录](https://blog.csdn.net/mingshao104/article/details/111358819)        \n",
    "　　　　　[]()   \n",
    "　　　　　[]()   \n",
    "　　　　　[]()   \n",
    "　　　　　[]()   \n",
    "　　　　　[]()   \n",
    "     \n",
    "# 一、Frida简介\n",
    "　　Frida是一款基于Python + JavaScript 的hook框架，本质是一种动态插桩技术。可以用于Android、Windows、iOS等各大平台，其执行脚本基于Python或者Node.js写成，而注入代码用JavaScript写成，所以有必要了解一些这些语言的语法。  \n",
    "  \n",
    "# 二、Frida 环境搭建\n",
    "　　Frida环境需求：Python、Frida、Frida-tools、objection、adb、手机模拟器等。  \n",
    "　　注意：无论使用怎样的环境，以上环境需求的版本以及SDK版本必须依赖一致，比如：python3.7.7 安装frida12.8.0、frida-tools5.3.0、模拟器android版本为7。  \n",
    "  \n",
    "## 2.1、PC端安装Frida\n",
    "    注意：PC端可以通过直接执行安装 pip install frida-tools ，同时安装 Frida 与 Frida-tools，不过此安装是安装的 Frida 最新版本，未必匹配本地的Python版本与Android版本，使用时会导致一些报错产生。\n",
    "### 2.1.1、安装Frida\n",
    "　　　注意：Frida 需要本地pc上已安装Python环境，且需要python3.7及以上环境<br>\n",
    "> pip install frida==12.8.0<br>\n",
    "pip install frida==12.8.0 -i https://pypi.tuna.tsinghua.edu.cn/simple/<br>\n",
    "\n",
    "### 2.1.2、安装frida-tools\n",
    "　　这里给出的是python的安装指令: <br>\n",
    ">pip install frida-tools    # 安装 Frida 后，直接安装 Frida-tools就是与Frida匹配的版本；也可以 frida-tools==5.3.0 安装<br>\n",
    "frida --version<br>\n",
    "frida-ps --version<br>\n",
    "\n",
    "## 2.2 安装 adb 调试工具\n",
    "　　(已安装的话，可跳过该步骤)<br>\n",
    "　　在终端中执行指令:\n",
    ">brew cask install android-platform-tools<br>\n",
    "\n",
    "　　windows中则推荐到http://adbshell.com/downloads下载ADB Kits，解压后得到adb.exe、AdbWinApi.dll、AdbWinUsbApi.dll三个文件，然后将这三个文件拷贝到C:\\Windows\\System32\\目录下，保险起见，同时拷贝这三个文件到C盘中的Windows/System/目录下 及Windows/SysWOW64/；如果不拷贝到System/目录下有可能执行adb时会出错：\"找不到AdbWinApi.dll文件\" 如果不拷贝到Windows/SysWOW64/有可能执行adb时会出错\"CreateProcess failure. error 2\"<br>\n",
    "　　Windows安装方法参考: windows安装adb方法及问题解决<br>\n",
    "　　然后测试是否安装成功: adb devices, 出现以下形式内容则说明安装成功<br>\n",
    ">List of devices attached<br>\n",
    "e312073d    device\n",
    "### 2.2.1、真机模拟器\n",
    "　　到Android开发官网下载Android Platform Tools并解压，解压后可以看到文件夹platform-tools，里面包含adb调试工具。  \n",
    "　　环境变量设置：打开“我的电脑->属性->系统高级设置->环境变量”，在Path变量中添加platform-tools文件夹的路径。  \n",
    "### 2.2.2、PC端模拟器\n",
    "　　此处以夜神模拟器为例： 在夜神模拟器的安装目录 ...\\Nox\\bin 目录下，有 adb 工具，使系统环境 adb 工具与模拟器匹配即可（即安装特定版本的adb工具）。\n",
    "\n",
    "### 2.2.3、adb的使用\n",
    "```shell\n",
    "adb.exe devices   # (查看设备连接情况)  \n",
    "adb kill-server  \n",
    "adb start-server  \n",
    "adb remount   \n",
    "  \n",
    "netstat   # 这个命令也能获得端⼝号\n",
    "netstat | findstr 127.0.0.1    # (⽤这个直接输出需要的⼏⾏）  \n",
    "```\n",
    "\n",
    "　　常⽤adb操作\n",
    "　　1、如何把电脑上的⽂件或⽂件夹传到模拟器⾥⾯？\n",
    ">adb push D:/1.avi /mnt/avi/\n",
    "\n",
    "　　2、如何把模拟器⾥⾯的⽂件或⽂件夹传到电脑上？\n",
    ">adb pull /mnt/avi/sex.avi D:/avi/\n",
    "\n",
    "　　3、安装APK\n",
    ">adb install d:\\\\qq.apk\n",
    "\n",
    "　　4、卸载APK\n",
    ">adb uninstall 包名      # ⽐如卸载QQ：adb uninstall com.tencent.mobileqq\n",
    "\n",
    "　　5、PM包命令  \n",
    "　　　1）获取模拟器所有包名\n",
    ">adb shell pm list packages\n",
    "\n",
    "　　　2）获取模拟器所有包名并且包括APK路径\n",
    ">adb shell pm list packages -f\n",
    "\n",
    "　　　3）获取包名对应的APK路径\n",
    ">adb shell pm path packageName\n",
    "\n",
    "　　　4）清理应⽤数据\n",
    ">adb shell pm clear packageName\n",
    "\n",
    "　　6、启动应⽤\n",
    ">adb shell am start -n 包名/Activity类名  \n",
    "adb shell am start -n com.tencent.android.qqdownloader/com.tencent.assistant.activity.SplashActivity     # 启动应⽤宝\n",
    "adb -s 127.0.0.1:5555 shell am start -n com.tencent.android.qqdownloader/com.tencent.assistant.activity.SplashActivity    # 指定模拟器启动动应⽤宝\n",
    "\n",
    "　　7、关闭应⽤\n",
    ">adb shell am force-stop 包名\n",
    "\n",
    "　　8、模拟输⼊\n",
    ">adb shell input text 字符串(不⽀持中⽂)\n",
    "\n",
    "  \n",
    "## 2.3、安装Frida-server(模拟器)\n",
    "　　Frida-server的安装需要与模拟器的系统类型、版本、CPU内核以及为数相关，比如 Android真机模拟器需安装 android的 arm CPU的64位（或32位）的frida-server，同时版本选择上需匹配android版本。\n",
    "　　注意：需PC端已安装adb,并连接到模拟器。\n",
    "\n",
    "### 2.3.1、查看模拟器CPU内核架构\n",
    "　　查看CPU内核(根据内核版本去下载相应frida-server)：<br>\n",
    "> su cat /proc/cpuinfo　　　# linux查看内核\n",
    "\n",
    "### 2.3.2、adb 链接到模拟器\n",
    "　　主要针对PC端模拟器： adb connect 127.0.0.1:模拟器端口  \n",
    "　　不同模拟器对应不同端口:\n",
    "\n",
    "|模拟器|端口|\n",
    "|:---|:---:|\n",
    "|逍遥游|21503|\n",
    "|夜神模拟器| 62001 |\n",
    "|海马玩模拟器 | 26944 |\n",
    "|mumu模拟器|7555| \n",
    "|天天模拟器 | 6555|\n",
    "|BlueStacks | 5555|\n",
    "|雷电安卓模拟器|5555|\n",
    "|天天安卓模拟器|5037|\n",
    "|安卓模拟器⼤师|54001|\n",
    "|Genymotion|5555|\n",
    "\n",
    "\n",
    "### 2.3.3、安装Frida-server\n",
    "　　到github/frida下载[frida-server](https://github.com/frida/frida/releases), 选择自己本地frida版本所对应的应版本的server就可以了, 安卓设备还需注意对应自己设备的架构(例如arm, arm64, x86等等, 安装了xposed可以在xposed中看到自己设备对应的架构)<br>\n",
    "　　**注意:** 一定要把frida-server版本和上面PC端安装的frida版本一致，不然运行报错的。<br>\n",
    "\n",
    "　　查看设备架构：<br>\n",
    ">adb shell getprop ro.product.cpu.abi 查看 CPU 架构<br>\n",
    ">cat /proc/cpuinfo　　　# 查看CPU信息（参考：[查看Android设备的CPU架构信息\n",
    "](https://www.jianshu.com/p/d65885e1664c)）<br><br>\n",
    "armeabiv-v7a: 第7代及以上的 ARM 处理器。2011年15月以后的生产的大部分Android设备都使用它。<br>\n",
    "arm64-v8a: 第8代、64位ARM处理器，很少设备。<br>\n",
    "x86: 平板、模拟器用得比较多。<br>\n",
    "x86_64: 64位的平板。<br>\n",
    "\n",
    "　　下载完成后将文件名改为frida-server(改成自己想要的名称都可以), 然后放到指定目录下, 一般安卓手机或模拟器放在/data/local/tmp/目录下<br>\n",
    ">adb push frida-server-12.11.18-android-arm64 /data/local/tmp/frida-server\n",
    "\n",
    "### 2.3.4、启动frida-server\n",
    "　　首先连接安装有frida的设备(需打开USB调试), 终端运行指令: <br>\n",
    "> adb root　　　　# 以root运行adb<br>\n",
    "\n",
    "　　查看设备是否连接:<br> \n",
    "> adb devices<br>\n",
    "\n",
    "　　进入adb shell: <br>\n",
    "> adb shell<br>\n",
    "\n",
    "　　在adb shell中执行frida-server运行指令(首次执行前最好先修改frida-server文件的权限):<br>\n",
    "> adb root<br>\n",
    "adb push frida-server /data/local/tmp    # 该步骤之前已上传<br>\n",
    "adb shell<br>\n",
    "su<br>\n",
    "cd /data/local/tmp/<br>\n",
    "chmod 755(777) /data/local/tmp/frida-server<br>\n",
    "chmod +x fs　或　\n",
    "./frida-server & 　　　　# 后面加上&使其在后台执行, 目录即为frida-server的存放目录。<br>\n",
    "\n",
    "\n",
    "### 2.3.5、将模拟器端口转发到PC端口进行通信\n",
    "　　如果需要调试的，启动frida-server后，一定要设置端口转发到pc端<br>\n",
    ">adb forward tcp:27042 tcp:27042<br>\n",
    "adb forward tcp:27043 tcp:27043<br>\n",
    "\n",
    "　　若指定手机的端口转发到PC，如：97dc2d9为手机driver名称  \n",
    ">adb -s 97dc2d9 forward tcp:27042 tcp:27042  \n",
    "adb -s 97dc2d9 forward tcp:27043 tcp:27043  \n",
    "\n",
    "　　错误“Unable to start: Error binding to address 127.0.0.1:27042: Address already in use”(通常firda-server重启会导致)，是因为27042端口被占用，这是按如下操作可解决：  \n",
    "　　1、列出端口转发列表：\n",
    " >adb forward --list    # 查看使用中的端口\n",
    " ps -e | grep frida    # 查看使用端口的进程状态\n",
    " \n",
    "\n",
    "　　2、移除占用端口：\n",
    ">adb forward --remove tcp：27042  \n",
    "\n",
    "### 2.3.6、验证安装成功\n",
    "　　命令行执行frida-ps，验证是否安装成功：<br>\n",
    ">frida-ps -U 　　　　　# PC端执行，如果出现Android的进程，则代表安装成功(-U 代表着 USB，并且让 Frida 检查 USB-Device真机上的进程！)。\n",
    "\n",
    "　　注意：入口看到下面这样“frida-ps 不是内部或外部命令” ，需要再安装frida-tools<br>\n",
    "\n",
    "　　运行完成后可通过exit;退出adb shell<br>\n",
    "\n",
    "### 2.3.7、Frida 监听端口\n",
    ">./frida-server -l 0.0.0.0:8888\n",
    "\n",
    "\n",
    "## 2.4、安装objection\n",
    ">pyenv local 3.8.2(使用pyenv 管理Python环境)<br>\n",
    "pip install objection<br>\n",
    "objection -h<br>\n",
    "pyenv local 3.7.7　　　# python3.7 环境安装objection 1.8.4 版本  \n",
    "pip install objection==1.8.4  \n",
    "objection -h  \n",
    "\n",
    "## 2.5、Frida命令\n",
    "```shell\n",
    "# 转发端口\n",
    "adb forward tcp:27042 tcp:27042\n",
    "adb forward tcp:27043 tcp:27043\n",
    "\n",
    "# 列举出来所有连接到电脑上的设备\n",
    "frida-ls-devices\n",
    "\n",
    "# 连接到指定设备\n",
    "frida-ps -D tcp\n",
    "\n",
    "# 列举出来设备上的所有进程\n",
    "frida-ps -U\n",
    "\n",
    "# 列举出来设备上的所有应用程序\n",
    "frida-ps -Ua\n",
    "\n",
    "# 列举出来设备上的所有已安装应用程序和对应的名字\n",
    "frida-ps -Uai\n",
    "\n",
    "# 跟踪某个函数\n",
    "frida-trace -U -f Name -i \"函数名\"\n",
    "# frida-trace -U -f com.autonavi.minimap -i \"getRequestParams\"\n",
    "\n",
    "# 跟踪某个方法\n",
    "frida-trace -U -f Name -m \"方法名\"\n",
    "# frida-trace -U -f com.autonavi.minimap -m \"MapLoader\"\n",
    "```\n",
    "\n",
    "\n",
    "## 2.6、Frida开发环境搭建\n",
    "　　1、安装\n",
    ">git clone https://github.com/oleavr/frida-agent-example.git  \n",
    "cd frida-agent-example/  \n",
    "npm install  \n",
    "\n",
    "　　2、使用vscode打开此工程，在agent文件夹下编写js，会有智能提示。  \n",
    "　　3、npm run watch会监控代码修改自动编译生成js文件  \n",
    "　　4、python脚本或者cli加载_agent.js  \n",
    ">frida -U -f com.example.android --no-pause -l _agent.js  \n",
    "\n",
    "　　下面是测试脚本:  \n",
    "  s1.js  \n",
    "\n",
    "```javascript  \n",
    "function main() {  \n",
    "　　Java.perform(function x() {  \n",
    "　　　　console.log(\"sakura\")  \n",
    "　　})  \n",
    "}  \n",
    "setImmediate(main)  \n",
    "```\n",
    "loader.py  \n",
    "\n",
    "```python\n",
    "import time  \n",
    "import frida  \n",
    "  \n",
    "device8 = frida.get_device_manager().add_remote_device(\"192.168.0.9:8888\")  \n",
    "pid = device8.spawn(\"com.android.settings\")  \n",
    "device8.resume(pid)  \n",
    "time.sleep(1)  \n",
    "session = device8.attach(pid)  \n",
    "with open(\"si.js\") as f:  \n",
    "    script = session.create_script(f.read())  \n",
    "script.load()  \n",
    "input() #等待输入  \n",
    "```\n",
    "　　解释一下，这个脚本就是先通过frida.get_device_manager().add_remote_device来找到device,然后spawn方式启动settings，然后attach到上面，并执行frida脚本。\n",
    "\n",
    "# 三、Frida基础-Java层hook\n",
    "## 3.1、frida查看当前存在的进程\n",
    "　　frida-ps -U 查看通过usb连接的android手机上的进程。  \n",
    "```shell  \n",
    "sakura@sakuradeMacBook-Pro:~$ frida-ps --help  \n",
    "Usage: frida-ps [options]  \n",
    "  \n",
    "Options:  \n",
    "  --version             show program's version number and exit  \n",
    "  -h, --help            show this help message and exit  \n",
    "  -D ID, --device=ID    connect to device with the given ID  \n",
    "  -U, --usb             connect to USB device  \n",
    "  -R, --remote          connect to remote frida-server  \n",
    "  -H HOST, --host=HOST  connect to remote frida-server on HOST  \n",
    "  -a, --applications    list only applications  \n",
    "  -i, --installed       include all installed applications  \n",
    "sakura@sakuradeMacBook-Pro:~$ frida-ps -U  \n",
    "  PID  Name  \n",
    "-----  ---------------------------------------------------  \n",
    " 3640  ATFWD-daemon  \n",
    "  707  adbd  \n",
    "  728  adsprpcd  \n",
    "26041  android.hardware.audio@2.0-service  \n",
    "  741  android.hardware.biometrics.fingerprint@  \n",
    "```\n",
    "　　通过grep过滤就可以找到我们想要的包名。\n",
    "\n",
    "## 3.2、frida打印参数和修改返回值\n",
    "```android\n",
    "package myapplication.example.com.frida_demo;  \n",
    "  \n",
    "import android.support.v7.app.AppCompatActivity;  \n",
    "import android.os.Bundle;  \n",
    "import android.util.Log;  \n",
    "\n",
    "public class MainActivity extends AppCompatActivity {  \n",
    "  \n",
    "    private String total = \"@@@###@@@\";  \n",
    "  \n",
    "    @Override  \n",
    "    protected void onCreate(Bundle savedInstanceState) {  \n",
    "        super.onCreate(savedInstanceState);  \n",
    "        setContentView(R.layout.activity_main);  \n",
    "  \n",
    "        while (true){  \n",
    "  \n",
    "            try {  \n",
    "                Thread.sleep(1000);  \n",
    "            } catch (InterruptedException e) {  \n",
    "                e.printStackTrace();  \n",
    "            }  \n",
    "  \n",
    "            fun(50,30);  \n",
    "            Log.d(\"sakura.string\" , fun(\"LoWeRcAsE Me!!!!!!!!!\"));  \n",
    "        }  \n",
    "    }  \n",
    "  \n",
    "    void fun(int x , int y ){  \n",
    "        Log.d(\"sakura.Sum\" , String.valueOf(x+y));  \n",
    "    }  \n",
    "  \n",
    "    String fun(String x){  \n",
    "        total +=x;  \n",
    "        return x.toLowerCase();  \n",
    "    }  \n",
    "  \n",
    "    String secret(){  \n",
    "        return total;  \n",
    "    }  \n",
    "}  \n",
    "```\n",
    "```js\n",
    "function main() {  \n",
    "    console.log(\"Enter the Script!\");  \n",
    "    Java.perform(function x() {  \n",
    "        console.log(\"Inside Java perform\");  \n",
    "        var MainActivity = Java.use(\"myapplication.example.com.frida_demo.MainActivity\");  \n",
    "        // 重载找到指定的函数  \n",
    "        MainActivity.fun.overload('java.lang.String').implementation = function (str) {  \n",
    "            //打印参数  \n",
    "            console.log(\"original call : str:\" + str);  \n",
    "            //修改结果  \n",
    "            var ret_value = \"sakura\";  \n",
    "            return ret_value;  \n",
    "        };  \n",
    "    })  \n",
    "}  \n",
    "setImmediate(main);  \n",
    "```\n",
    "```shell\n",
    "sakura@sakuradeMacBook-Pro:~$ frida-ps -U | grep frida  \n",
    "8738  frida-helper-32  \n",
    "8897  myapplication.example.com.frida_demo  \n",
    "  \n",
    "// -f是通过spawn，也就是重启apk注入js  \n",
    "sakura@sakuradeMacBook-Pro:~$ frida -U -f myapplication.example.com.frida_demo -l frida_demo.js  \n",
    "...  \n",
    "original call : str:LoWeRcAsE Me!!!!!!!!!  \n",
    "12-21 04:46:49.875 9594-9594/myapplication.example.com.frida_demo D/sakura.string: sakura  \n",
    "```\n",
    "## 3.3、frida寻找instance主动调用\n",
    "```js\n",
    "function main() {  \n",
    "    console.log(\"Enter the Script!\");  \n",
    "    Java.perform(function x() {  \n",
    "        console.log(\"Inside Java perform\");  \n",
    "        var MainActivity = Java.use(\"myapplication.example.com.frida_demo.MainActivity\");  \n",
    "        //overload 选择被重载的对象  \n",
    "        MainActivity.fun.overload('java.lang.String').implementation = function (str) {  \n",
    "            //打印参数  \n",
    "            console.log(\"original call : str:\" + str);  \n",
    "            //修改结果  \n",
    "            var ret_value = \"sakura\";  \n",
    "            return ret_value;  \n",
    "        };  \n",
    "        // 寻找类型为classname的实例  \n",
    "        Java.choose(\"myapplication.example.com.frida_demo.MainActivity\", {  \n",
    "            onMatch: function (instance) {  \n",
    "                console.log(\"find instance :\" + instance); \n",
    "                console.log(\"priproties of instance :\" + instance.a.value);  \n",
    "                console.log(\"result of secret func:\" + instance.secret());  \n",
    "            },  \n",
    "            onComplete: function () {  \n",
    "                console.log(\"end\");  \n",
    "            }  \n",
    "        });  \n",
    "    });  \n",
    "}  \n",
    "setImmediate(main);  \n",
    "```\n",
    "## 3.4、Frida RPC\n",
    "```js\n",
    "function callFun() {  \n",
    "    Java.perform(function fn() {  \n",
    "        console.log(\"begin\");  \n",
    "        Java.choose(\"myapplication.example.com.frida_demo.MainActivity\", {  \n",
    "            onMatch: function (x) {  \n",
    "                console.log(\"find instance :\" + x);  \n",
    "                console.log(\"result of fun(string) func:\" + x.fun(Java.use(\"java.lang.String\").$new(\"sakura\")));  \n",
    "            },  \n",
    "            onComplete: function () {  \n",
    "                console.log(\"end\");  \n",
    "            }  \n",
    "        })  \n",
    "    })  \n",
    "}  \n",
    "rpc.exports = {  \n",
    "    callfun: callFun  \n",
    "};  \n",
    "```\n",
    "```py\n",
    "import time  \n",
    "import frida  \n",
    "  \n",
    "device = frida.get_usb_device()  \n",
    "pid = device.spawn([\"myapplication.example.com.frida_demo\"])  \n",
    "device.resume(pid)  \n",
    "time.sleep(1)  \n",
    "session = device.attach(pid)  \n",
    "with open(\"frida_demo_rpc_call.js\") as f:  \n",
    "    script = session.create_script(f.read())  \n",
    "  \n",
    "def my_message_handler(message, payload):  \n",
    "    print(message)  \n",
    "    print(payload)  \n",
    "\n",
    "script.on(\"message\", my_message_handler)  \n",
    "script.load()  \n",
    "  \n",
    "script.exports.callfun()  \n",
    "```\n",
    "```shell\n",
    "sakura@sakuradeMacBook-Pro:~/gitsource/frida-agent-example/agent$ python frida_demo_rpc_loader.py   \n",
    "begin  \n",
    "find instance :myapplication.example.com.frida_demo.MainActivity@1d4b09d  \n",
    "result of fun(string):sakura  \n",
    "end  \n",
    "```\n",
    "## 3.5、frida动态修改\n",
    "　　即将手机上的app的内容发送到PC上的frida python程序，然后处理后返回给app，然后app再做后续的流程，核心是理解send/recv函数  \n",
    "```android\n",
    "<TextView  \n",
    "        android:id=\"@+id/textView\"  \n",
    "        android:layout_width=\"wrap_content\"  \n",
    "        android:layout_height=\"wrap_content\"  \n",
    "        android:text=\"please input username and password\"  \n",
    "        app:layout_constraintBottom_toBottomOf=\"parent\"  \n",
    "        app:layout_constraintLeft_toLeftOf=\"parent\"  \n",
    "        app:layout_constraintRight_toRightOf=\"parent\"  \n",
    "        app:layout_constraintTop_toTopOf=\"parent\" />  \n",
    "  \n",
    "  \n",
    "    <EditText  \n",
    "        android:id=\"@+id/editText\"  \n",
    "        android:layout_width=\"fill_parent\"  \n",
    "        android:layout_height=\"40dp\"  \n",
    "        android:hint=\"username\"  \n",
    "        android:maxLength=\"20\"  \n",
    "        app:layout_constraintBottom_toBottomOf=\"parent\"  \n",
    "        app:layout_constraintEnd_toEndOf=\"parent\"  \n",
    "        app:layout_constraintHorizontal_bias=\"1.0\"  \n",
    "        app:layout_constraintStart_toStartOf=\"parent\"  \n",
    "        app:layout_constraintTop_toTopOf=\"parent\"  \n",
    "        app:layout_constraintVertical_bias=\"0.095\" />  \n",
    "  \n",
    "    <EditText  \n",
    "        android:id=\"@+id/editText2\"  \n",
    "        android:layout_width=\"fill_parent\"  \n",
    "        android:layout_height=\"40dp\"  \n",
    "        android:hint=\"password\"  \n",
    "        android:maxLength=\"20\"  \n",
    "        app:layout_constraintBottom_toBottomOf=\"parent\"  \n",
    "        app:layout_constraintTop_toTopOf=\"parent\"  \n",
    "        app:layout_constraintVertical_bias=\"0.239\" />  \n",
    "  \n",
    "    <Button  \n",
    "        android:id=\"@+id/button\"  \n",
    "        android:layout_width=\"100dp\"  \n",
    "        android:layout_height=\"35dp\"  \n",
    "        android:layout_gravity=\"right|center_horizontal\"  \n",
    "        android:text=\"提交\"  \n",
    "        android:visibility=\"visible\"  \n",
    "        app:layout_constraintBottom_toBottomOf=\"parent\"  \n",
    "        app:layout_constraintEnd_toEndOf=\"parent\"  \n",
    "        app:layout_constraintStart_toStartOf=\"parent\"  \n",
    "        app:layout_constraintTop_toTopOf=\"parent\"  \n",
    "        app:layout_constraintVertical_bias=\"0.745\" />  \n",
    "```\n",
    "```android\n",
    "public class MainActivity extends AppCompatActivity {  \n",
    "  \n",
    "    EditText username_et;  \n",
    "    EditText password_et;  \n",
    "    TextView message_tv;  \n",
    "  \n",
    "    @Override  \n",
    "    protected void onCreate(Bundle savedInstanceState) {  \n",
    "        super.onCreate(savedInstanceState);  \n",
    "        setContentView(R.layout.activity_main);  \n",
    "  \n",
    "        password_et = (EditText) this.findViewById(R.id.editText2);  \n",
    "        username_et = (EditText) this.findViewById(R.id.editText);  \n",
    "        message_tv = ((TextView) findViewById(R.id.textView));  \n",
    "  \n",
    "        this.findViewById(R.id.button).setOnClickListener(new View.OnClickListener() {  \n",
    "            @Override  \n",
    "            public void onClick(View v) {  \n",
    "  \n",
    "                if (username_et.getText().toString().compareTo(\"admin\") == 0) {  \n",
    "                    message_tv.setText(\"You cannot login as admin\");  \n",
    "                    return;  \n",
    "                }  \n",
    "                //hook target  \n",
    "                message_tv.setText(\"Sending to the server :\" + Base64.encodeToString((username_et.getText().toString() + \":\" + password_et.getText().toString()).getBytes(), Base64.DEFAULT));  \n",
    "            }  \n",
    "        });  \n",
    "    }  \n",
    "}  \n",
    "```\n",
    "\n",
    "　　先分析问题，最终目标是让message_tv.setText可以”发送”username为admin的base64字符串，那肯定是hook TextView.setText这个函数。　　\n",
    "```js\n",
    "console.log(\"Script loaded successfully \");  \n",
    "Java.perform(function () {  \n",
    "    var tv_class = Java.use(\"android.widget.TextView\");  \n",
    "    tv_class.setText.overload(\"java.lang.CharSequence\").implementation = function (x) {  \n",
    "        var string_to_send = x.toString();  \n",
    "        var string_to_recv;  \n",
    "        send(string_to_send); // send data to python code  \n",
    "        recv(function (received_json_object) {  \n",
    "            string_to_recv = received_json_object.my_data  \n",
    "            console.log(\"string_to_recv: \" + string_to_recv);  \n",
    "        }).wait(); //block execution till the message is received  \n",
    "        var my_string = Java.use(\"java.lang.String\").$new(string_to_recv);  \n",
    "        this.setText(my_string);  \n",
    "    }  \n",
    "});  \n",
    "```\n",
    "```py\n",
    "import time  \n",
    "import frida  \n",
    "import base64  \n",
    "  \n",
    "def my_message_handler(message, payload):  \n",
    "    print(message)  \n",
    "    print(payload)  \n",
    "    if message[\"type\"] == \"send\":  \n",
    "        print(message[\"payload\"])  \n",
    "        data = message[\"payload\"].split(\":\")[1].strip()  \n",
    "        print( 'message:', message)  \n",
    "        #data = data.decode(\"base64\")  \n",
    "        #data = data  \n",
    "        data = str(base64.b64decode(data))  \n",
    "        print( 'data:',data)  \n",
    "        user, pw = data.split(\":\")  \n",
    "        print( 'pw:',pw)  \n",
    "        #data = (\"admin\" + \":\" + pw).encode(\"base64\")  \n",
    "        data = str(base64.b64encode((\"admin\" + \":\" + pw).encode()))  \n",
    "        print( \"encoded data:\", data)  \n",
    "        script.post({\"my_data\": data})  # send JSON object  \n",
    "        print( \"Modified data sent\")  \n",
    "  \n",
    "device = frida.get_usb_device()  \n",
    "pid = device.spawn([\"myapplication.example.com.frida_demo\"])  \n",
    "device.resume(pid)  \n",
    "time.sleep(1)  \n",
    "session = device.attach(pid)  \n",
    "with open(\"frida_demo2.js\") as f:  \n",
    "    script = session.create_script(f.read())  \n",
    "script.on(\"message\", my_message_handler)  \n",
    "script.load()  \n",
    "input()  \n",
    "```\n",
    "```shell\n",
    "sakura@sakuradeMacBook-Pro:~/gitsource/frida-agent-example/agent$ python frida_demo_rpc_loader2.py   \n",
    "Script loaded successfully   \n",
    "{'type': 'send', 'payload': 'Sending to the server :c2FrdXJhOjEyMzQ1Ng==\\n'}  \n",
    "None  \n",
    "Sending to the server :c2FrdXJhOjEyMzQ1Ng==  \n",
    "  \n",
    "message: {'type': 'send', 'payload': 'Sending to the server :c2FrdXJhOjEyMzQ1Ng==\\n'}  \n",
    "data: b'sakura:123456'  \n",
    "pw: 123456'  \n",
    "encoded data: b'YWRtaW46MTIzNDU2Jw=='  \n",
    "Modified data sent  \n",
    "string_to_recv: b'YWRtaW46MTIzNDU2Jw=='  \n",
    "```\n",
    "参考链接：https://github.com/Mind0xP/Frida-Python-Binding\n",
    "\n",
    "## 3.6、API List\n",
    "1、Java.choose(className: string, callbacks: Java.ChooseCallbacks): void  \n",
    "通过扫描Java VM的堆来枚举className类的live instance。  \n",
    "  \n",
    "2、Java.use(className: string): Java.Wrapper<{}>  \n",
    "动态为className生成JavaScript Wrapper，可以通过调用$new()来调用构造函数来实例化对象。  \n",
    "在实例上调用$dispose()以对其进行显式清理，或者等待JavaScript对象被gc。  \n",
    "  \n",
    "3、Java.perform(fn: () => void): void  \n",
    "Function to run while attached to the VM.  \n",
    "Ensures that the current thread is attached to the VM and calls fn. (This isn’t necessary in callbacks from Java.)  \n",
    "Will defer calling fn if the app’s class loader is not available yet. Use Java.performNow() if access to the app’s classes is not needed.  \n",
    "  \n",
    "4、send(message: any, data?: ArrayBuffer | number[]): void  \n",
    "任何JSON可序列化的值。  \n",
    "将JSON序列化后的message发送到您的基于Frida的应用程序，并包含(可选)一些原始二进制数据。  \n",
    "The latter is useful if you e.g. dumped some memory using NativePointer#readByteArray().  \n",
    "\n",
    "5、recv(callback: MessageCallback): MessageRecvOperation  \n",
    "Requests callback to be called on the next message received from your Frida-based application.  \n",
    "This will only give you one message, so you need to call recv() again to receive the next one.  \n",
    "  \n",
    "6、wait(): void  \n",
    "堵塞，直到message已经receive并且callback已经执行完毕并返回  \n",
    "  \n",
    "# 四、Frida基础-Java层hook进阶\n",
    "\n",
    "\n",
    "## 四、Frida动静态结合分析\n",
    "\n",
    "|符号\t|作用|\n",
    "|:---|:---|\n",
    "|\\$init\t|构造方法 Hook 的时候用|\n",
    "|\\$new()\t|实例化对象的时候用|\n",
    "   \n",
    "<br>\n",
    "\n",
    "|Hook重载|语法|\n",
    "|:---:|:---|\n",
    "|int类型|int|\n",
    "|float类型|float|\n",
    "|boolean类型|boolean|\n",
    "|string类型|java.lang.String|\n",
    "|byte类型|[B|\n",
    "|char类型|[C|\n",
    "|list结构|java.util.List|\n",
    "|安卓上下文结构|android.content.Context|\n",
    "\n",
    "### 4.1、Objection\n",
    "参考这篇文章：[RIDA进阶：内存漫游、hook anywhere、抓包](https://www.anquanke.com/post/id/197657)  \n",
    "objection : https://pypi.org/project/objection/  \n",
    "\n",
    "### 4.1.1、objection启动并注入内存\n",
    ">objection -d -g package_name explore\n",
    "\n",
    "### 4.1.2、objection memory\n",
    "#### 4.1.2.1、查看内存中加载的module   \n",
    ">memory list modules  \n",
    "```shell  \n",
    "com.android.settings on (google: 8.1.0) [usb] # memory list modules  \n",
    "Save the output by adding `--json modules.json` to this command  \n",
    "Name                                             Base          Size                  Path  \n",
    "app_process64                                    0x64ce143000  32768 (32.0 KiB)      /system/bin/app_process64  \n",
    "libandroid_runtime.so                            0x7a90bc3000  1990656 (1.9 MiB)     /system/lib64/libandroid_runtime.so  \n",
    "libbinder.so                                     0x7a9379f000  557056 (544.0 KiB)    /system/lib64/libbinder.so  \n",
    "```\n",
    "#### 4.1.2.2、查看库的导出函数   \n",
    ">memory list exports libssl.so  \n",
    "```shell\n",
    "com.android.settings on (google: 8.1.0) [usb] # memory list exports libssl.so\n",
    "Save the output by adding `--json exports.json` to this command\n",
    "Type      Name                                                   Address\n",
    "function  SSL_use_certificate_ASN1                               0x7c8ff006f8\n",
    "function  SSL_CTX_set_dos_protection_cb                          0x7c8ff077b8\n",
    "function  SSL_SESSION_set_ex_data                                0x7c8ff098f4\n",
    "function  SSL_CTX_set_session_psk_dhe_timeout                    0x7c8ff0a754\n",
    "function  SSL_CTX_sess_accept                                    0x7c8ff063b8\n",
    "function  SSL_select_next_proto                                  0x7c8ff06a74\n",
    "```\n",
    "#### 4.1.2.3、dump内存空间\n",
    ">memory dump all 文件名  \n",
    "memory dump from_base 起始地址 字节数 文件名  \n",
    "\n",
    "#### 4.1.2.4、搜索内存空间\n",
    "Usage: memory search \"<pattern eg: 41 41 41 ?? 41>\" (--string) (--offsets-only)  \n",
    "\n",
    "### 4.1.3、objection android\n",
    "#### 4.1.3.1、内存堆搜索实例\n",
    "> android heap search instances 类名\n",
    "\n",
    "　　在堆上搜索类的实例\n",
    "```shell\n",
    "sakura@sakuradeMacBook-Pro: objection -g myapplication.example.com.frida_demo explore\n",
    "Using USB device `Google Pixel`\n",
    "Agent injected and responds ok!\n",
    "\n",
    "[usb] # android heap search instances myapplication.example.com.frida_demo\n",
    ".MainActivity\n",
    "Class instance enumeration complete for myapplication.example.com.frida_demo.MainActivity\n",
    "Handle    Class                                              toString()\n",
    "--------  -------------------------------------------------  ---------------------------------------------------------\n",
    "0x2102    myapplication.example.com.frida_demo.MainActivity  myapplication.example.com.frida_demo.MainActivity@5b1b0af  \n",
    "```\n",
    "#### 4.1.3.2、调用实例的方法\n",
    ">android heap execute 实例ID 实例方法\n",
    "\n",
    "#### 4.1.3.3、查看当前可用的activity或者service \n",
    ">android hooking list activities/services  \n",
    "\n",
    "#### 4.1.3.4、直接启动activity或者服务 \n",
    ">android intent launch_activity/launch_service activity/服务\n",
    "\n",
    "android intent launch_activity com.android.settings.DisplaySettings  \n",
    "这个命令比较有趣的是用在如果有些设计的不好，可能就直接绕过了密码锁屏等直接进去。  \n",
    "```shell\n",
    "com.android.settings on (google: 8.1.0) [usb] # android hooking list services\n",
    "com.android.settings.SettingsDumpService\n",
    "com.android.settings.TetherService\n",
    "com.android.settings.bluetooth.BluetoothPairingService\n",
    "```\n",
    "\n",
    "#### 4.1.3.5、列出内存中所有的类\n",
    ">android hooking list classes\n",
    "\n",
    "\n",
    "#### 4.1.3.6、在内存中所有已加载的类中搜索包含特定关键词的类。\n",
    ">android hooking search classes display\n",
    "\n",
    "```shell\n",
    "com.android.settings on (google: 8.1.0) [usb] # android hooking search classes display\n",
    "[Landroid.icu.text.DisplayContextType;\n",
    "[Landroid.icu.text.DisplayContext;\n",
    "[Landroid.view.DisplayMode;\n",
    "android.hardware.display.DisplayManager\n",
    "android.hardware.display.DisplayManagerDisplayListener\n",
    "android.hardware.display.DisplayManagerGlobal\n",
    "```\n",
    "#### 4.1.3.7、内存中搜索指定类的所有方法\n",
    ">android hooking list class_methods 类名\n",
    "```shell\n",
    "com.android.settings on (google: 8.1.0) [usb] # android hooking list class_methods java.nio.charset.Charset\n",
    "private static java.nio.charset.Charset java.nio.charset.Charset.lookup(java.lang.String)\n",
    "private static java.nio.charset.Charset java.nio.charset.Charset.lookup2(java.lang.String)\n",
    "private static java.nio.charset.Charset java.nio.charset.Charset.lookupViaProviders(java.lang.String)\n",
    "```\n",
    "\n",
    "#### 4.1.3.8、在内存中所有已加载的类的方法中搜索包含特定关键词的方法\n",
    ">android hooking search methods display\n",
    "\n",
    "知道名字开始在内存里搜就很有用\n",
    "```shell\n",
    "com.android.settings on (google: 8.1.0) [usb] # android hooking search methods display\n",
    "Warning, searching all classes may take some time and in some cases, crash the target application.\n",
    "Continue? [y/N]: y\n",
    "Found 5529 classes, searching methods (this may take some time)...\n",
    "android.app.ActionBar.getDisplayOptions\n",
    "android.app.ActionBar.setDefaultDisplayHomeAsUpEnabled\n",
    "android.app.ActionBar.setDisplayHomeAsUpEnabled\n",
    "```\n",
    "\n",
    "#### 4.1.3.9 hook类的方法（hook类里的所有方法/具体某个方法）\n",
    "1、android hooking watch class 类名  \n",
    "　　这样就可以hook这个类里面的所有方法，每次调用都会被log出来。  \n",
    "2、android hooking watch class 类名 --dump-args --dump-backtrace --dump-return\n",
    "　　在上面的基础上，额外dump参数，栈回溯，返回值　　　　\n",
    "　　android hooking watch class xxx.MainActivity --dump-args --dump-backtrace --dump-return　　\n",
    "3、android hooking watch class_method 方法名　　\n",
    "　　//可以直接hook到所有重载　　\n",
    "　　android hooking watch class_method xxx.MainActivity.fun --dump-args --dump-backtrace --dump-return　　\n",
    "\n",
    "#### 4.1.3.10、Hook 重载方法\n",
    "apply arguments\n",
    "```js\n",
    "MyClass.MyFunc.overload(\"java.util.List\").implementation = function() {\n",
    "  this.MyFunc.overload(\"java.util.List\").apply(this, arguments);\n",
    "}\n",
    "```\n",
    "argments下标\n",
    "```js\n",
    "MyClass.MyFunc.overload(\"java.util.List\").implementation = function () {\n",
    "    this.MyFunc(arguments[0]);\n",
    "};\n",
    "\n",
    "```\n",
    "整数\n",
    "```js\n",
    "MyClass.MyFuncs.overload(\"int\", \"int\").implementation = function (s1, s2) {\n",
    "    var ret = this.MyFuncs(s1, s2);\n",
    "}\n",
    "```\n",
    "call\n",
    "```js\n",
    "var Handler = classFactory.use(\"android.os.Handler\");\n",
    "var Looper = classFactory.use(\"android.os.Looper\");\n",
    "\n",
    "var looper = Looper.getMainLooper();\n",
    "var handler = Handler.￥new.overload(\"android.os.Looper\").call(Handler, looper);\n",
    "\n",
    "\n",
    "MyClass.MyFunc.overload(\"java.lang.String;\").implementation = {\n",
    "     this.MyFunc.overload(\"java.lang.String\").call(this, args[1])\n",
    "     MyClass.MyFunc.overload(\"java.lang.String\").call()\n",
    "}\n",
    "\n",
    "```\n",
    "\n",
    "\n",
    "### 4.1.4、grep trick和文件保存\n",
    "　　objection log默认是不能用grep过滤的，但是可以通过objection run xxx | grep yyy的方式，从终端通过管道来过滤。　　\n",
    "　　用法如下　　\n",
    "```shell\n",
    "sakura@sakuradeMacBook-Pro: objection -g com.android.settings run memory list modules | grep libc\n",
    "Warning: Output is not to a terminal (fd=1).\n",
    "libcutils.so                                     0x7a94a1c000  81920 (80.0 KiB)      /system/lib64/libcutils.so\n",
    "libc++.so                                        0x7a9114e000  983040 (960.0 KiB)    /system/lib64/libc++.so\n",
    "libc.so                                          0x7a9249d000  892928 (872.0 KiB)    /system/lib64/libc.so\n",
    "libcrypto.so                                     0x7a92283000  1155072 (1.1 MiB)     /system/lib64/libcrypto.so\n",
    "```\n",
    "　　有的命令后面可以通过--json logfile来直接保存结果到文件里。  \n",
    "　　有的可以通过查看.objection文件里的输出log来查看结果。  \n",
    "```shell\n",
    "sakura@sakuradeMacBook-Pro:~/.objection # cat *log | grep -i display\n",
    "android.hardware.display.DisplayManager\n",
    "android.hardware.display.DisplayManagerDisplayListener\n",
    "android.hardware.display.DisplayManagerGlobal\n",
    "```\n",
    "### 4.2、案例学习\n",
    "　　案例学习case1:《仿VX数据库原型取证逆向分析》  \n",
    "　　[附件链接](https://www.52pojie.cn/forum.php?mod=viewthread&tid=1082706)  \n",
    "　　[android-backup-extractor工具链接](https://github.com/nelenkov/android-backup-extractor)\n",
    "\n",
    "\n",
    "## 五、Frida hook基础(一)\n",
    "　　1、调用静态函数和调用非静态函数  \n",
    "　　2、设置(同名)成员变量  \n",
    "　　3、内部类，枚举类的函数并hook，trace原型1  \n",
    "　　4、查找接口，hook动态加载dex  \n",
    "　　5、枚举class，trace原型2  \n",
    "　　6、objection不能切换classloader   \n",
    "\n",
    "### 5.1、打印参数、返回值/设置返回值/主动调用\n",
    "　　先定位登录失败点，然后搜索字符串。\n",
    "```android\n",
    "public class LoginActivity extends AppCompatActivity {\n",
    "    /* access modifiers changed from: private */\n",
    "    public Context mContext;\n",
    "\n",
    "    public void onCreate(Bundle bundle) {\n",
    "        super.onCreate(bundle);\n",
    "        this.mContext = this;\n",
    "        setContentView((int) R.layout.activity_login);\n",
    "        final EditText editText = (EditText) findViewById(R.id.username);\n",
    "        final EditText editText2 = (EditText) findViewById(R.id.password);\n",
    "        ((Button) findViewById(R.id.login)).setOnClickListener(new View.OnClickListener() {\n",
    "            public void onClick(View view) {\n",
    "                String obj = editText.getText().toString();\n",
    "                String obj2 = editText2.getText().toString();\n",
    "                if (TextUtils.isEmpty(obj) || TextUtils.isEmpty(obj2)) {\n",
    "                    Toast.makeText(LoginActivity.this.mContext, \"username or password is empty.\", 1).show();\n",
    "                } else if (LoginActivity.a(obj, obj).equals(obj2)) {\n",
    "                    LoginActivity.this.startActivity(new Intent(LoginActivity.this.mContext, FridaActivity1.class));\n",
    "                    LoginActivity.this.finishActivity(0);\n",
    "                } else {\n",
    "                    Toast.makeText(LoginActivity.this.mContext, \"Login failed.\", 1).show();\n",
    "                }\n",
    "            }\n",
    "        });\n",
    "    }\n",
    "```\n",
    "　　LoginActivity.a(obj, obj).equals(obj2)分析之后可得obj2来自password，由从username得来的obj，经过a函数运算之后得到一个值，这两个值相等则登录成功。\n",
    "　　所以这里关键是hook a函数的参数，最简脚本如下。\n",
    "\n",
    "```js\n",
    "//打印参数、返回值\n",
    "function Login(){\n",
    "    Java.perform(function(){\n",
    "        Java.use(\"com.example.androiddemo.Activity.LoginActivity\").a.overload('java.lang.String', 'java.lang.String').implementation = function (str, str2){\n",
    "            var result = this.a(str, str2);\n",
    "            console.log(\"args0:\"+str+\" args1:\"+str2+\" result:\"+result);\n",
    "            return result;\n",
    "        }\n",
    "    })\n",
    "}\n",
    "setImmediate(Login)\n",
    "```\n",
    "　　观察输入和输出,这里也可以直接主动调用。\n",
    "```js\n",
    "function login() {\n",
    "    Java.perform(function () {\n",
    "        console.log(\"start\")\n",
    "        var login = Java.use(\"com.example.androiddemo.Activity.LoginActivity\")\n",
    "        var result = login.a(\"1234\",\"1234\")\n",
    "        console.log(result)\n",
    "    })\n",
    "}\n",
    "setImmediate(login)\n",
    "```\n",
    "```shell\n",
    "...\n",
    "start\n",
    "4e4feaea959d426155a480dc07ef92f4754ee93edbe56d993d74f131497e66fb\n",
    "然后\n",
    "adb shell input text \"4e4feaea959d426155a480dc07ef92f4754ee93edbe56d993d74f131497e66fb\"\n",
    "```\n",
    "\n",
    "接下来是第一关\n",
    "```android\n",
    "public abstract class BaseFridaActivity extends AppCompatActivity implements View.OnClickListener {\n",
    "    public Button mNextCheck;\n",
    "\n",
    "    public void CheckSuccess() {\n",
    "    }\n",
    "\n",
    "    public abstract String getNextCheckTitle();\n",
    "\n",
    "    public abstract void onCheck();\n",
    "\n",
    "    /* access modifiers changed from: protected */\n",
    "    public void onCreate(Bundle bundle) {\n",
    "        super.onCreate(bundle);\n",
    "        setContentView((int) R.layout.activity_frida);\n",
    "        this.mNextCheck = (Button) findViewById(R.id.next_check);\n",
    "        this.mNextCheck.setOnClickListener(this);\n",
    "        Button button = this.mNextCheck;\n",
    "        button.setText(getNextCheckTitle() + \"，点击进入下一关\");\n",
    "    }\n",
    "\n",
    "    public void onClick(View view) {\n",
    "        onCheck();\n",
    "    }\n",
    "\n",
    "    public void CheckFailed() {\n",
    "        Toast.makeText(this, \"Check Failed!\", 1).show();\n",
    "    }\n",
    "}\n",
    "...\n",
    "\n",
    "public class FridaActivity1 extends BaseFridaActivity {\n",
    "    private static final char[] table = {'L', 'K', 'N', 'M', 'O', 'Q', 'P', 'R', 'S', 'A', 'T', 'B', 'C', 'E', 'D', 'F', 'G', 'H', 'I', 'J', 'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'o', 'd', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'e', 'f', 'g', 'h', 'j', 'i', 'k', 'l', 'm', 'n', 'y', 'z', '0', '1', '2', '3', '4', '6', '5', '7', '8', '9', '+', '/'};\n",
    "\n",
    "    public String getNextCheckTitle() {\n",
    "        return \"当前第1关\";\n",
    "    }\n",
    "\n",
    "    public void onCheck() {\n",
    "        try {\n",
    "            if (a(b(\"请输入密码:\")).equals(\"R4jSLLLLLLLLLLOrLE7/5B+Z6fsl65yj6BgC6YWz66gO6g2t65Pk6a+P65NK44NNROl0wNOLLLL=\")) {\n",
    "                CheckSuccess();\n",
    "                startActivity(new Intent(this, FridaActivity2.class));\n",
    "                finishActivity(0);\n",
    "                return;\n",
    "            }\n",
    "            super.CheckFailed();\n",
    "        } catch (Exception e) {\n",
    "            e.printStackTrace();\n",
    "        }\n",
    "    }\n",
    "\n",
    "    public static String a(byte[] bArr) throws Exception {\n",
    "        StringBuilder sb = new StringBuilder();\n",
    "        for (int i = 0; i <= bArr.length - 1; i += 3) {\n",
    "            byte[] bArr2 = new byte[4];\n",
    "            byte b = 0;\n",
    "            for (int i2 = 0; i2 <= 2; i2++) {\n",
    "                int i3 = i + i2;\n",
    "                if (i3 <= bArr.length - 1) {\n",
    "                    bArr2[i2] = (byte) (b | ((bArr[i3] & 255) >>> ((i2 * 2) + 2)));\n",
    "                    b = (byte) ((((bArr[i3] & 255) << (((2 - i2) * 2) + 2)) & 255) >>> 2);\n",
    "                } else {\n",
    "                    bArr2[i2] = b;\n",
    "                    b = 64;\n",
    "                }\n",
    "            }\n",
    "            bArr2[3] = b;\n",
    "            for (int i4 = 0; i4 <= 3; i4++) {\n",
    "                if (bArr2[i4] <= 63) {\n",
    "                    sb.append(table[bArr2[i4]]);\n",
    "                } else {\n",
    "                    sb.append('=');\n",
    "                }\n",
    "            }\n",
    "        }\n",
    "        return sb.toString();\n",
    "    }\n",
    "\n",
    "    public static byte[] b(String str) {\n",
    "        try {\n",
    "            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();\n",
    "            GZIPOutputStream gZIPOutputStream = new GZIPOutputStream(byteArrayOutputStream);\n",
    "            gZIPOutputStream.write(str.getBytes());\n",
    "            gZIPOutputStream.finish();\n",
    "            gZIPOutputStream.close();\n",
    "            byte[] byteArray = byteArrayOutputStream.toByteArray();\n",
    "            try {\n",
    "                byteArrayOutputStream.close();\n",
    "                return byteArray;\n",
    "            } catch (Exception e) {\n",
    "                e.printStackTrace();\n",
    "                return byteArray;\n",
    "            }\n",
    "        } catch (Exception unused) {\n",
    "            return null;\n",
    "        }\n",
    "    }\n",
    "}\n",
    "```\n",
    "\n",
    "　　关键函数在a(b(\"请输入密码:\")).equals(\"R4jSLLLLLLLLLLOrLE7/5B+Z6fsl65yj6BgC6YWz66gO6g2t65Pk6a+P65NK44NNROl0wNOLLLL=\")。这里应该直接hook a，让其返回值为R4jSLLLLLLLLLLOrLE7/5B+Z6fsl65yj6BgC6YWz66gO6g2t65Pk6a+P65NK44NNROl0wNOLLLL=就可以进入下一关了。\n",
    "\n",
    "```js\n",
    "function ch1() {\n",
    "    Java.perform(function () {\n",
    "        console.log(\"start\")\n",
    "        Java.use(\"com.example.androiddemo.Activity.FridaActivity1\").a.implementation = function (x) {\n",
    "            return \"R4jSLLLLLLLLLLOrLE7/5B+Z6fsl65yj6BgC6YWz66gO6g2t65Pk6a+P65NK44NNROl0wNOLLLL=\"\n",
    "        }\n",
    "    })\n",
    "}\n",
    "```\n",
    "\n",
    "### 5.２、主动调用静态/非静态函数 以及 设置静态/非静态成员变量的值\n",
    "　　1、静态函数直接use class然后调用方法，非静态函数需要先choose实例然后调用  \n",
    "　　2、设置成员变量的值，写法是xx.value = yy，其他方面和函数一样。\n",
    "　　3、如果有一个成员变量和成员函数的名字相同，则在其前面加一个_，如_xx.value = yy\n",
    "　　然后是第二关\n",
    "```android\n",
    "public class FridaActivity2 extends BaseFridaActivity {\n",
    "    private static boolean static_bool_var = false;\n",
    "    private boolean bool_var = false;\n",
    "\n",
    "    public String getNextCheckTitle() {\n",
    "        return \"当前第2关\";\n",
    "    }\n",
    "\n",
    "    private static void setStatic_bool_var() {\n",
    "        static_bool_var = true;\n",
    "    }\n",
    "\n",
    "    private void setBool_var() {\n",
    "        this.bool_var = true;\n",
    "    }\n",
    "\n",
    "    public void onCheck() {\n",
    "        if (!static_bool_var || !this.bool_var) {\n",
    "            super.CheckFailed();\n",
    "            return;\n",
    "        }\n",
    "        CheckSuccess();\n",
    "        startActivity(new Intent(this, FridaActivity3.class));\n",
    "        finishActivity(0);\n",
    "    }\n",
    "}\n",
    "\n",
    "```\n",
    "　　这一关的关键在于下面的if判断要为false，则static_bool_var和this.bool_var都要为true。\n",
    "```ｊｓ\n",
    "if (!static_bool_var || !this.bool_var) {\n",
    "            super.CheckFailed();\n",
    "            return;\n",
    "        }\n",
    "```\n",
    "　　这样就要调用setBool_var和setStatic_bool_var两个函数了。\n",
    "```js\n",
    "function ch2() {\n",
    "    Java.perform(function () {\n",
    "        console.log(\"start\")\n",
    "        var FridaActivity2 = Java.use(\"com.example.androiddemo.Activity.FridaActivity2\")\n",
    "        //hook静态函数直接调用\n",
    "        FridaActivity2.setStatic_bool_var()\n",
    "        //hook动态函数，找到instance实例，从实例调用函数方法\n",
    "        Java.choose(\"com.example.androiddemo.Activity.FridaActivity2\", {\n",
    "            onMatch: function (instance) {\n",
    "                instance.setBool_var()\n",
    "            },\n",
    "            onComplete: function () {\n",
    "                console.log(\"end\")\n",
    "            }\n",
    "        })\n",
    "    })\n",
    "}\n",
    "setImmediate(ch2)\n",
    "```\n",
    "　　接下来是第三关\n",
    "```android    \n",
    "public class FridaActivity3 extends BaseFridaActivity {\n",
    "    private static boolean static_bool_var = false;\n",
    "    private boolean bool_var = false;\n",
    "    private boolean same_name_bool_var = false;\n",
    "\n",
    "    public String getNextCheckTitle() {\n",
    "        return \"当前第3关\";\n",
    "    }\n",
    "\n",
    "    private void same_name_bool_var() {\n",
    "        Log.d(\"Frida\", static_bool_var + \" \" + this.bool_var + \" \" + this.same_name_bool_var);\n",
    "    }\n",
    "\n",
    "    public void onCheck() {\n",
    "        if (!static_bool_var || !this.bool_var || !this.same_name_bool_var) {\n",
    "            super.CheckFailed();\n",
    "            return;\n",
    "        }\n",
    "        CheckSuccess();\n",
    "        startActivity(new Intent(this, FridaActivity4.class));\n",
    "        finishActivity(0);\n",
    "    }\n",
    "}\n",
    "```\n",
    "　　关键还是让if (!static_bool_var || !this.bool_var || !this.same_name_bool_var)为false，则三个变量都要为true\n",
    "```js\n",
    "function ch3() {\n",
    "    Java.perform(function () {\n",
    "        console.log(\"start\")\n",
    "        var FridaActivity3 = Java.use(\"com.example.androiddemo.Activity.FridaActivity3\")\n",
    "        FridaActivity3.static_bool_var.value = true\n",
    "        \n",
    "        Java.choose(\"com.example.androiddemo.Activity.FridaActivity3\", {\n",
    "            onMatch: function (instance) {\n",
    "                instance.bool_var.value = true\n",
    "                instance._same_name_bool_var.value = true\n",
    "            },\n",
    "            onComplete: function () {\n",
    "                console.log(\"end\")\n",
    "            }\n",
    "        })\n",
    "    })\n",
    "}\n",
    "```\n",
    "　　　这里要注意类里有一个成员函数和成员变量都叫做same_name_bool_var，这种时候在成员变量前加一个_，修改值的形式为xx.value = yy\n",
    "```js\n",
    "//hook类成员字段\n",
    "function hooktest8(){\n",
    "    Java.perform(function(){\n",
    "        //对于静态字段static\n",
    "        var myuser=Java.use(\"com.alex.javahooktarget.MyUser\");\n",
    "        myuser.flag.value=\"hell yeah!\";\n",
    "        send(myuser.flag.value);\n",
    "        console.log(JSON.stringify(myuser.flag.value));\n",
    "\n",
    "        //对于非静态字段\n",
    "        Java.choose(\"com.alex.javahooktarget.MyUser\",{\n",
    "            onMatch:function(obj){\n",
    "                obj.trueName.value=\"hahaha\";\n",
    "            },\n",
    "            onComplete:function(){\n",
    "\n",
    "            }\n",
    "        });\n",
    "    })\n",
    "}\n",
    "```\n",
    "\n",
    "### 5.３、内部类，枚举类的函数并hook，trace原型1\n",
    "　　1、对于内部类，通过类名$内部类名去use或者choose  \n",
    "　　2、对use得到的clazz应用反射，如clazz.class.getDeclaredMethods()可以得到类里面声明的所有方法，即可以枚举类里面的所有函数。\n",
    "　　3、声明为object/返回值为object类的实例对象，其方法和属性都无法确认，也无法通过.class获取其真是类型，此时可用.getClass()方法得到其类名，通过使用Java.use().getClass()取得真实类的类结构，然后在tar_class[i].get(tar_obj)传入实例对象，得到目标属性的值。  \n",
    "  \n",
    "　　接下来是第四关  \n",
    "```android\n",
    "public class FridaActivity4 extends BaseFridaActivity {\n",
    "    public String getNextCheckTitle() {\n",
    "        return \"当前第4关\";\n",
    "    }\n",
    "\n",
    "    private static class InnerClasses {\n",
    "        public static boolean check1() {\n",
    "            return false;\n",
    "        }\n",
    "\n",
    "        public static boolean check2() {\n",
    "            return false;\n",
    "        }\n",
    "\n",
    "        public static boolean check3() {\n",
    "            return false;\n",
    "        }\n",
    "\n",
    "        public static boolean check4() {\n",
    "            return false;\n",
    "        }\n",
    "\n",
    "        public static boolean check5() {\n",
    "            return false;\n",
    "        }\n",
    "\n",
    "        public static boolean check6() {\n",
    "            return false;\n",
    "        }\n",
    "\n",
    "        private InnerClasses() {\n",
    "        }\n",
    "    }\n",
    "\n",
    "    public void onCheck() {\n",
    "        if (!InnerClasses.check1() || !InnerClasses.check2() || !InnerClasses.check3() || !InnerClasses.check4() || !InnerClasses.check5() || !InnerClasses.check6()) {\n",
    "            super.CheckFailed();\n",
    "            return;\n",
    "        }\n",
    "        CheckSuccess();\n",
    "        startActivity(new Intent(this, FridaActivity5.class));\n",
    "        finishActivity(0);\n",
    "    }\n",
    "}\n",
    "```\n",
    "　　这一关的关键是让if (!InnerClasses.check1() || !InnerClasses.check2() || !InnerClasses.check3() || !InnerClasses.check4() || !InnerClasses.check5() || !InnerClasses.check6())中的所有check全部返回true。  \n",
    "  \n",
    "　　其实这里唯一的问题就是寻找内部类InnerClasses，对于内部类的hook，通过类名$内部类名去use。  \n",
    "```js\n",
    "function ch4() {\n",
    "    Java.perform(function () {\n",
    "        var InnerClasses = Java.use(\"com.example.androiddemo.Activity.FridaActivity4$InnerClasses\")\n",
    "        console.log(\"start\")\n",
    "        InnerClasses.check1.implementation = function () {\n",
    "            return true\n",
    "        }\n",
    "        InnerClasses.check2.implementation = function () {\n",
    "            return true\n",
    "        }\n",
    "        InnerClasses.check3.implementation = function () {\n",
    "            return true\n",
    "        }\n",
    "        InnerClasses.check4.implementation = function () {\n",
    "            return true\n",
    "        }\n",
    "        InnerClasses.check5.implementation = function () {\n",
    "            return true\n",
    "        }\n",
    "        InnerClasses.check6.implementation = function () {\n",
    "            return true\n",
    "        }\n",
    "    })\n",
    "}\n",
    "```\n",
    "　　利用反射，获取类中的所有method声明，然后字符串拼接去获取到方法名，例如下面的check1，然后就可以批量hook，而不用像我上面那样一个一个写。\n",
    "```js\n",
    "var inner_classes = Java.use(\"com.example.androiddemo.Activity.FridaActivity4$InnerClasses\")\n",
    "var all_methods = inner_classes.class.getDeclaredMethods();\n",
    "\n",
    "...\n",
    "public static boolean com.example.androiddemo.Activity.FridaActivity4$InnerClasses.check1(),public static boolean com.example.androiddemo.Activity.FridaActivity4$InnerClasses.check2(),public static boolean com.example.androiddemo.Activity.FridaActivity4$InnerClasses.check3(),public static boolean com.example.androiddemo.Activity.FridaActivity4$InnerClasses.check4(),public static boolean com.example.androiddemo.Activity.FridaActivity4$InnerClasses.check5(),public static boolean com.example.androiddemo.Activity.FridaActivity4$InnerClasses.check6()\n",
    "```\n",
    "### 5.４、hook动态加载的dex，与查找interface，\n",
    "　　1、通过enumerateClassLoaders来枚举加载进内存的classloader，再loader.findClass(xxx)寻找是否包括我们想要的interface的实现类，最后通过Java.classFactory.loader = loader来切换classloader，从而加载该实现类。  \n",
    "  \n",
    "　　第五关比较有趣，它的check函数是动态加载进来的。\n",
    "　　java里有interface的概念，是指一系列抽象的接口，需要类来实现。\n",
    "\n",
    "```java\n",
    "package com.example.androiddemo.Dynamic;\n",
    "\n",
    "public interface CheckInterface {\n",
    "    boolean check();\n",
    "}\n",
    "...\n",
    "\n",
    "public class DynamicCheck implements CheckInterface {\n",
    "    public boolean check() {\n",
    "        return false;\n",
    "    }\n",
    "}\n",
    "...\n",
    "public class FridaActivity5 extends BaseFridaActivity {\n",
    "    private CheckInterface DynamicDexCheck = null;\n",
    "    ...\n",
    "    public CheckInterface getDynamicDexCheck() {\n",
    "        if (this.DynamicDexCheck == null) {\n",
    "            loaddex();\n",
    "        }\n",
    "        return this.DynamicDexCheck;\n",
    "    }\n",
    "\n",
    "    /* access modifiers changed from: protected */\n",
    "    public void onCreate(Bundle bundle) {\n",
    "        super.onCreate(bundle);\n",
    "        loaddex();\n",
    "        //this.DynamicDexCheck = (CheckInterface) new DexClassLoader(str, filesDir.getAbsolutePath(), (String) null, getClassLoader()).loadClass(\"com.example.androiddemo.Dynamic.DynamicCheck\").newInstance();\n",
    "    }\n",
    "\n",
    "    public void onCheck() {\n",
    "        if (getDynamicDexCheck() == null) {\n",
    "            Toast.makeText(this, \"onClick loaddex Failed!\", 1).show();\n",
    "        } else if (getDynamicDexCheck().check()) {\n",
    "            CheckSuccess();\n",
    "            startActivity(new Intent(this, FridaActivity6.class));\n",
    "            finishActivity(0);\n",
    "        } else {\n",
    "            super.CheckFailed();\n",
    "        }\n",
    "    }\n",
    "}\n",
    "```\n",
    "　　这里有个loaddex其实就是先从资源文件加载classloader到内存里，再loadClass DynamicCheck，创建出一个实例，最终调用这个实例的check。  \n",
    "　　所以现在我们就要先枚举class loader，找到能实例化我们要的class的那个class loader，然后把它设置成Java的默认class factory的loader。  \n",
    "　　现在就可以用这个class loader来使用.use去import一个给定的类。  \n",
    "```js\n",
    "function ch5() {\n",
    "    Java.perform(function () {\n",
    "        // Java.choose(\"com.example.androiddemo.Activity.FridaActivity5\",{\n",
    "        //     onMatch:function(x){\n",
    "        //         console.log(x.getDynamicDexCheck().￥className)\n",
    "        //     },onComplete:function(){}\n",
    "        // })\n",
    "        console.log(\"start\")\n",
    "        Java.enumerateClassLoaders({\n",
    "            onMatch: function (loader) {\n",
    "                try {\n",
    "                    if(loader.findClass(\"com.example.androiddemo.Dynamic.DynamicCheck\")){\n",
    "                        console.log(\"Successfully found loader\")\n",
    "                        console.log(loader);\n",
    "                        Java.classFactory.loader = loader ;\n",
    "                    }\n",
    "                }\n",
    "                catch(error){\n",
    "                    console.log(\"find error:\" + error)\n",
    "                }\n",
    "            },\n",
    "            onComplete: function () {\n",
    "                console.log(\"end1\")\n",
    "            }\n",
    "        })\n",
    "        Java.use(\"com.example.androiddemo.Dynamic.DynamicCheck\").check.implementation = function () {\n",
    "            return true\n",
    "        }\n",
    "        console.log(\"end2\")\n",
    "    })\n",
    "}\n",
    "setImmediate(ch5)\n",
    "```\n",
    "　　todo有一个疑问: https://github.com/frida/frida/issues/1049  \n",
    "\n",
    "### 5.５、枚举class，trace原型2\n",
    "　　1、通过Java.enumerateLoadedClasses来枚举类，然后name.indexOf(str)过滤一下并hook。    \n",
    "  \n",
    "　　接下来是第六关    \n",
    "```android\n",
    "import com.example.androiddemo.Activity.Frida6.Frida6Class0;\n",
    "import com.example.androiddemo.Activity.Frida6.Frida6Class1;\n",
    "import com.example.androiddemo.Activity.Frida6.Frida6Class2;\n",
    "\n",
    "public class FridaActivity6 extends BaseFridaActivity {\n",
    "    public String getNextCheckTitle() {\n",
    "        return \"当前第6关\";\n",
    "    }\n",
    "\n",
    "    public void onCheck() {\n",
    "        if (!Frida6Class0.check() || !Frida6Class1.check() || !Frida6Class2.check()) {\n",
    "            super.CheckFailed();\n",
    "            return;\n",
    "        }\n",
    "        CheckSuccess();\n",
    "        startActivity(new Intent(this, FridaActivity7.class));\n",
    "        finishActivity(0);\n",
    "    }\n",
    "}\n",
    "```\n",
    "　　这关是import了一些类，然后调用类里的静态方法，所以我们枚举所有的类，然后过滤一下，并把过滤出来的结果hook上，改掉其返回值。\n",
    "```js\n",
    "function ch6() {\n",
    "    Java.perform(function () {\n",
    "        Java.enumerateLoadedClasses({\n",
    "            onMatch: function (name, handle){\n",
    "                if (name.indexOf(\"com.example.androiddemo.Activity.Frida6\") != -1) {\n",
    "                    console.log(\"name:\" + name + \" handle:\" + handle)\n",
    "                    Java.use(name).check.implementation = function () {\n",
    "                        return true\n",
    "                    }\n",
    "                }\n",
    "            },\n",
    "            onComplete: function () {\n",
    "                console.log(\"end\")\n",
    "            }\n",
    "        })\n",
    "    })\n",
    "}\n",
    "```\n",
    "### 5.６、搜索interface的具体实现类\n",
    "　　1、利用反射得到类里面实现的interface数组，并打印出来。\n",
    "```js\n",
    "function more() {\n",
    "    Java.perform(function () {\n",
    "        Java.enumerateLoadedClasses({\n",
    "            onMatch: function (class_name){\n",
    "                if (class_name.indexOf(\"com.example.androiddemo\") < 0) {\n",
    "                    return\n",
    "                }\n",
    "                else {\n",
    "                    var hook_cls = Java.use(class_name)\n",
    "                    var interfaces = hook_cls.class.getInterfaces()\n",
    "                    if (interfaces.length > 0) {\n",
    "                        console.log(class_name + \": \")\n",
    "                        for (var i in interfaces) {\n",
    "                            console.log(\"\\t\", interfaces[i].toString())\n",
    "                        }\n",
    "                    }\n",
    "                }\n",
    "            },\n",
    "            onComplete: function () {\n",
    "                console.log(\"end\")\n",
    "            }\n",
    "        })\n",
    "    })\n",
    "}\n",
    "```\n",
    "### 5.7、frida 遍历所有当前已经加载的类\n",
    "```js\n",
    "function(){\n",
    "    var imports = Module.enumerateImportsSync(\"libsoul-netsdk.so\");\n",
    "    for(var i = 0; i < imports.length; i++) {\n",
    "        if(imports[i].name == 'strncat'){\n",
    "            send(imports[i].name + \": \" + imports[i].170525\n",
    "            );\n",
    "            break;\n",
    "        }\n",
    "    }\n",
    "    var exports = Module.enumerateExportsSync(\"libsoul-netsdk.so\");\n",
    "    for(var i = 0; i < exports.length; i++) {\n",
    "        if(exports[i].name.indexOf('add') != -1){\n",
    "            send(exports[i].name + \": \" + exports[i].address);\n",
    "            break;\n",
    "        }\n",
    "    }\n",
    "    for(var i = 0; i < imports.length; i++) {\n",
    "            send(imports[i].name + \": \" + imports[i].address);\n",
    "        }\n",
    "        var exports = Module.enumerateExportsSync(\"libsoul-netsdk.so\");\n",
    "        for(var i = 0; i < exports.length; i++) {\n",
    "                send(exports[i].name + \": \" + exports[i].address);\n",
    "    }\n",
    "};\n",
    "function(){\n",
    "    Java.enumerateLoadedClasses({\n",
    "        onMatch: function(className) {\n",
    "            send(className);},\n",
    "        onComplete:function(){\n",
    "            send(\"done\");\n",
    "        }\n",
    "    });\n",
    "};\n",
    "```\n",
    "```python\n",
    "def message(message, data):\n",
    "    if message[\"type\"] == 'send':\n",
    "        print(u\"[*] {0}\".format(message['payload']))\n",
    "    else:\n",
    "        print(message)\n",
    " \n",
    "process = frida.get_remote_device().attach(\"cn.soulapp.android\")\n",
    "script= process.create_script(enumerateLoadedClasses_jsCode)\n",
    "script.on(\"message\", message)\n",
    "script.load()\n",
    "sys.stdin.read()\n",
    "\n",
    "```\n",
    "### 5.8、Hook 内部类\n",
    "#### 5.8.1、内部类的分类\n",
    "　　1、成员内部类，作为一个类成员，可以拥有private访问权限、protected访问权限、public访问权限及包访问权限。 \n",
    "　　2、局部内部类，作用域在一个方法或者一个作用域里面的类，就像是方法里面的一个局部变量一样，是不能有public、protected、private以及static修饰符的。  \n",
    "　　3、匿名内部类，没有构造器的类，大部分匿名内部类用于接口回调。匿名内部类在编译的时候由系统自动起名为Outter$1.class。一般来说，匿名内部类用于继承其他类或是实现接口，并不需要增加额外的方法，只是对继承方法的实现或是重写。匿名内部类也是不能有访问修饰符和static修饰符的。  \n",
    "　　4、静态内部类，类似成员内部类，只是声明为static，是不需要依赖于外部类的，这点和类的静态成员属性有点类似，并且它不能使用外部类的非static成员变量或者方法。($)  \n",
    "#### 5.8.2、内部类示例\n",
    "```java\n",
    "//内部类\n",
    "class UserAsserts{\n",
    "    public String getRMB() {\n",
    "        return RMB;\n",
    "    }\n",
    "\n",
    "    public void setRMB(String RMB) {\n",
    "        this.RMB = RMB;\n",
    "    }\n",
    "\n",
    "    public String getDollar() {\n",
    "        return Dollar;\n",
    "    }\n",
    "\n",
    "    public void setDollar(String dollar) {\n",
    "        Dollar = dollar;\n",
    "    }\n",
    "\n",
    "    String RMB;\n",
    "    String Dollar;\n",
    "}\n",
    "```\n",
    "　　这是内部类作为类成员的一种情况\n",
    "\n",
    "　　**hook示例**\n",
    "　　此时内部类必须依存于外部类，也就是必须先实例化这个外部类才能使用这个“类成员”内部类\n",
    "外部类想要调用成员内部类的类成员方法时，必须先获取这个内部类的实例\n",
    "\n",
    "```js\n",
    "//hook内部类\n",
    "function hooktest5(){\n",
    "    var assertsObj=Java.use(\"com.alex.javahooktarget.MyUser$UserAsserts\");\n",
    "    assertsObj.setRMB.implementation=function(str){\n",
    "        console.log(\"Hook 到 setRMB，传参：\",str);\n",
    "        this.setRMB(\"hooked!!!\");\n",
    "    }\n",
    "\n",
    "    assertsObj.setDollar.implementation=function(str){\n",
    "        console.log(\"Hook 到 setDollar，传参：\",str);\n",
    "        this.setDollar(\"23333333333\");\n",
    "    }\n",
    "}\n",
    "\n",
    "//hook static内部类\n",
    "function hooktest6(){\n",
    "    var staticClsObj=Java.use(\"com.alex.javahooktarget.MyUser$static_inner_cls\");\n",
    "    staticClsObj.setEducation.implementation=function(str){\n",
    "        console.log(\"Hook 到 setEducation，传参：\",str);\n",
    "        this.setEducation(\"hooked!!!\");\n",
    "    }\n",
    "}\n",
    "\n",
    "//hook 局部内部类，这个Hook提示找不到类……\n",
    "function hooktest7(){\n",
    "    var sub2ClsObj=Java.use(\"com.alex.javahooktarget.MyUser$Sub2\");\n",
    "    sub2ClsObj.setGreeting.implementation=function(str){\n",
    "        console.log(\"Hook 到 setGreeting，传参：\",str);\n",
    "        this.setGreeting(\"hooked!!!\");\n",
    "    }\n",
    "}\n",
    "\n",
    "//hook 匿名类\n",
    "function hooktest6_1(){\n",
    "    Java.perform(function(){\n",
    "        var nimingClsObj=Java.use(\"com.alex.javahooktarget.MyUser$1\");\n",
    "        nimingClsObj.sayYeah.implementation=function(){\n",
    "            console.log(\"Hook 到 sayYeah\");\n",
    "            this.sayYeah();\n",
    "        }\n",
    "    })\n",
    "}\n",
    "```\n",
    "\n",
    "　　要注意内部类的表示方法，是Class$inner$inner  \n",
    "　　原理上是可以有无限嵌套的内部类的。  \n",
    "　　匿名类一般是$1或者$2345……  \n",
    "\n",
    "### 5.9、Hook  对象参数\n",
    "```js\n",
    "function () {\n",
    "    var utils = Java.use('com.xiaojianbang.app.Utils');\n",
    "    var money = Java.use('com.xiaojianbang.app.Money');\n",
    "    utils.test.overload('com.xiaojianbang.app.Money').implementation = function (obj) {\n",
    "        send(\"Hook Start...\");\n",
    "        send(obj.getInfo());\n",
    "        var mon = money.￥new(2000,'港币');\n",
    "        send(mon.getInfo());\n",
    "        return this.test(mon);\n",
    "    }\n",
    "}\n",
    "```\n",
    "\n",
    "\n",
    "## 六、Frida hook基础（二)\n",
    "　　1、spawn/attach  \n",
    "　　2、各种主动调用  \n",
    "　　3、hook函数和hook构造函数  \n",
    "　　4、调用栈/简单脚本  \n",
    "　　5、动态加载自己的dex  \n",
    "  \n",
    "　　题目下载地址: https://github.com/tlamb96/kgb_messenger  \n",
    "\n",
    "### 6.1、spawn/attach\n",
    "　　firda的-f参数代表spawn启动\n",
    ">frida -U -f com.tlamb96.spetsnazmessenger -l frida_russian.js --no-pause\n",
    "\n",
    "```java\n",
    "    /* access modifiers changed from: protected */\n",
    "    public void onCreate(Bundle bundle) {\n",
    "        super.onCreate(bundle);\n",
    "        setContentView((int) R.layout.activity_main);\n",
    "        String property = System.getProperty(\"user.home\");\n",
    "        String str = System.getenv(\"USER\");\n",
    "        if (property == null || property.isEmpty() || !property.equals(\"Russia\")) {\n",
    "            a(\"Integrity Error\", \"This app can only run on Russian devices.\");\n",
    "        } else if (str == null || str.isEmpty() || !str.equals(getResources().getString(R.string.User))) {\n",
    "            a(\"Integrity Error\", \"Must be on the user whitelist.\");\n",
    "        } else {\n",
    "            a.a(this);\n",
    "            startActivity(new Intent(this, LoginActivity.class));\n",
    "        }\n",
    "    }\n",
    "}\n",
    "```\n",
    "　　这个题目比较简单，但是因为这个check是在onCreate里，所以app刚启动就自动检查，所以这里需要用spawn的方式去启动frida脚本hook，而不是attach。  \n",
    "　　这里有两个检查，一个是检查property的值，一个是检查str的值。  \n",
    "　　分别从System.getProperty和System.getenv里获取，hook住这两个函数就行。  \n",
    "　　这里要注意从资源文件里找到User的值。  \n",
    "```js\n",
    "function main() {\n",
    "    Java.perform(function () {\n",
    "        Java.use(\"java.lang.System\").getProperty.overload('java.lang.String').implementation = function (str) {\n",
    "            return \"Russia\";\n",
    "        }\n",
    "        Java.use(\"java.lang.System\").getenv.overload('java.lang.String').implementation = function(str){\n",
    "            return \"RkxBR3s1N0VSTDFOR180UkNIM1J9Cg==\";\n",
    "        }\n",
    "    })\n",
    "}\n",
    "setImmediate(main)\n",
    "```\n",
    "　　接下来进入到login功能  \n",
    "```java\n",
    "    public void onLogin(View view) {\n",
    "        EditText editText = (EditText) findViewById(R.id.login_username);\n",
    "        EditText editText2 = (EditText) findViewById(R.id.login_password);\n",
    "        this.n = editText.getText().toString();\n",
    "        this.o = editText2.getText().toString();\n",
    "        if (this.n != null && this.o != null && !this.n.isEmpty() && !this.o.isEmpty()) {\n",
    "            if (!this.n.equals(getResources().getString(R.string.username))) {\n",
    "                Toast.makeText(this, \"User not recognized.\", 0).show();\n",
    "                editText.setText(\"\");\n",
    "                editText2.setText(\"\");\n",
    "            } else if (!j()) {\n",
    "                Toast.makeText(this, \"Incorrect password.\", 0).show();\n",
    "                editText.setText(\"\");\n",
    "                editText2.setText(\"\");\n",
    "            } else {\n",
    "                i();\n",
    "                startActivity(new Intent(this, MessengerActivity.class));\n",
    "            }\n",
    "        }\n",
    "    }\n",
    "...\n",
    "    private boolean j() {\n",
    "        String str = \"\";\n",
    "        for (byte b : this.m.digest(this.o.getBytes())) {\n",
    "            str = str + String.format(\"%x\", new Object[]{Byte.valueOf(b)});\n",
    "        }\n",
    "        return str.equals(getResources().getString(R.string.password));\n",
    "    }\n",
    "...\n",
    "    private void i() {\n",
    "        char[] cArr = {'(', 'W', 'D', ')', 'T', 'P', ':', '#', '?', 'T'};\n",
    "        cArr[0] = (char) (cArr[0] ^ this.n.charAt(1));\n",
    "        cArr[1] = (char) (cArr[1] ^ this.o.charAt(0));\n",
    "        cArr[2] = (char) (cArr[2] ^ this.o.charAt(4));\n",
    "        cArr[3] = (char) (cArr[3] ^ this.n.charAt(4));\n",
    "        cArr[4] = (char) (cArr[4] ^ this.n.charAt(7));\n",
    "        cArr[5] = (char) (cArr[5] ^ this.n.charAt(0));\n",
    "        cArr[6] = (char) (cArr[6] ^ this.o.charAt(2));\n",
    "        cArr[7] = (char) (cArr[7] ^ this.o.charAt(3));\n",
    "        cArr[8] = (char) (cArr[8] ^ this.n.charAt(6));\n",
    "        cArr[9] = (char) (cArr[9] ^ this.n.charAt(8));\n",
    "        Toast.makeText(this, \"FLAG{\" + new String(cArr) + \"}\", 1).show();\n",
    "    }\n",
    "```\n",
    "　　从资源文件里找到username,密码则是要算一个j()函数，要让它返回true，顺便打印一下i函数toast到界面的flag。　　\n",
    "```js\n",
    "Java.use(\"com.tlamb96.kgbmessenger.LoginActivity\").j.implementation = function () {\n",
    "            return true\n",
    "        }\n",
    "...\n",
    "Java.use(\"android.widget.Toast\").makeText.overload('android.content.Context', 'java.lang.CharSequence', 'int').implementation = function (x, y, z) {\n",
    "    var flag = Java.use(\"java.lang.String\").￥new(y)\n",
    "    console.log(flag)\n",
    "}\n",
    "...\n",
    "[Google Pixel::com.tlamb96.spetsnazmessenger]-> FLAG{G&qG13     R0}\n",
    "```\n",
    "\n",
    "### 6.2、hook构造函数/打印栈回溯\n",
    "　　1、hook构造函数实现通过use取得类，然后clazz.$init.implementation = callback hook构造函数。  \n",
    "\n",
    "　　我们先学习一下怎么hook构造函数。  \n",
    "```java\n",
    "add(new com.tlamb96.kgbmessenger.b.a(R.string.katya, \"Archer, you up?\", \"2:20 am\", true));\n",
    "...\n",
    "package com.tlamb96.kgbmessenger.b;\n",
    "public class a {\n",
    "...\n",
    "    public a(int i, String str, String str2, boolean z) {\n",
    "        this.f448a = i;\n",
    "        this.b = str;\n",
    "        this.c = str2;\n",
    "        this.d = z;\n",
    "    }\n",
    "...\n",
    "}\n",
    "```\n",
    "　　用$init来hook构造函数\n",
    "```\n",
    "Java.use(\"com.tlamb96.kgbmessenger.b.a\").$init.implementation = function (i, str1, str2, z) {\n",
    "            this.$init(i, str1, str2, z)\n",
    "            console.log(i, str1, str2, z)\n",
    "            printStack(\"com.tlamb96.kgbmessenger.b.a\")\n",
    "        }\n",
    "```\n",
    "### 6.3、打印栈回溯\n",
    "　　打印栈回溯\n",
    "```js\n",
    "function printStack(name) {\n",
    "    Java.perform(function () {\n",
    "        var Exception = Java.use(\"java.lang.Exception\");\n",
    "        var ins = Exception.$new(\"Exception\");\n",
    "        var straces = ins.getStackTrace();\n",
    "        if (straces != undefined && straces != null) {\n",
    "            var strace = straces.toString();\n",
    "            var replaceStr = strace.replace(/,/g, \"\\\\n\");\n",
    "            console.log(\"=============================\" + name + \" Stack strat=======================\");\n",
    "            console.log(replaceStr);\n",
    "            console.log(\"=============================\" + name + \" Stack end=======================\\r\\n\");\n",
    "            Exception.$dispose();\n",
    "        }\n",
    "    });\n",
    "}\n",
    "```\n",
    "　　输出就是这样\n",
    "```shell\n",
    "[Google Pixel::com.tlamb96.spetsnazmessenger]-> 2131558449 111 02:27 下午 false\n",
    "=============================com.tlamb96.kgbmessenger.b.a Stack strat=======================\n",
    "com.tlamb96.kgbmessenger.b.a.<init>(Native Method)\n",
    "com.tlamb96.kgbmessenger.MessengerActivity.onSendMessage(Unknown Source:40)\n",
    "java.lang.reflect.Method.invoke(Native Method)\n",
    "android.support.v7.app.m￥a.onClick(Unknown Source:25)\n",
    "android.view.View.performClick(View.java:6294)\n",
    "android.view.View$PerformClick.run(View.java:24770)\n",
    "android.os.Handler.handleCallback(Handler.java:790)\n",
    "android.os.Handler.dispatchMessage(Handler.java:99)\n",
    "android.os.Looper.loop(Looper.java:164)\n",
    "android.app.ActivityThread.main(ActivityThread.java:6494)\n",
    "java.lang.reflect.Method.invoke(Native Method)\n",
    "com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:438)\n",
    "com.android.internal.os.ZygoteInit.main(ZygoteInit.java:807)\n",
    "=============================com.tlamb96.kgbmessenger.b.a Stack end=======================\n",
    "```\n",
    "### 6.4、手动加载dex并调用\n",
    "　　1、编译出dex之后，通过Java.openClassFile(\"xxx.dex\").load()加载，这样我们就可以正常通过Java.use调用里面的方法了。  \n",
    "  \n",
    "　　现在我们来继续解决这个问题。\n",
    "```java\n",
    "public void onSendMessage(View view) {\n",
    "    EditText editText = (EditText) findViewById(R.id.edittext_chatbox);\n",
    "    String obj = editText.getText().toString();\n",
    "    if (!TextUtils.isEmpty(obj)) {\n",
    "        this.o.add(new com.tlamb96.kgbmessenger.b.a(R.string.user, obj, j(), false));\n",
    "        this.n.c();\n",
    "        if (a(obj.toString()).equals(this.p)) {\n",
    "            Log.d(\"MessengerActivity\", \"Successfully asked Boris for the password.\");\n",
    "            this.q = obj.toString();\n",
    "            this.o.add(new com.tlamb96.kgbmessenger.b.a(R.string.boris, \"Only if you ask nicely\", j(), true));\n",
    "            this.n.c();\n",
    "        }\n",
    "        if (b(obj.toString()).equals(this.r)) {\n",
    "            Log.d(\"MessengerActivity\", \"Successfully asked Boris nicely for the password.\");\n",
    "            this.s = obj.toString();\n",
    "            this.o.add(new com.tlamb96.kgbmessenger.b.a(R.string.boris, \"Wow, no one has ever been so nice to me! Here you go friend: FLAG{\" + i() + \"}\", j(), true));\n",
    "            this.n.c();\n",
    "        }\n",
    "        this.m.b(this.m.getAdapter().a() - 1);\n",
    "        editText.setText(\"\");\n",
    "    }\n",
    "}\n",
    "```\n",
    "　　新的一关是一个聊天框，分析一下代码可知，obj是我们输入的内容，输入完了之后，加到一个this.o的ArrayList里。  \n",
    "　　关键的if判断就是if (a(obj.toString()).equals(this.p))和if (b(obj.toString()).equals(this.r))，所有hook a和b函数，让它们的返回值等于下面的字符串即可。  \n",
    "```java\n",
    "private String p = \"V@]EAASB\\u0012WZF\\u0012e,a￥7(&am2(3.\\u0003\";\n",
    "private String q;\n",
    "private String r = \"\\u0000dslp}oQ\\u0000 dks$|M\\u0000h +AYQg\\u0000P*!M$gQ\\u0000\";\n",
    "private String s;\n",
    "```\n",
    "　　但实际上这题比我想象中的还要麻烦，这题的逻辑上是如果通过了a和b这两个函数的计算，等于对应的值之后，会把用来计算的obj的值赋值给q和s，然后根据这个q和s来计算出最终的flag。  \n",
    "　　所以如果不逆向算法，通过hook的方式通过了a和b的计算，obj的值还是错误的，也计算不出正确的flag。  \n",
    "\n",
    "　　这样就逆向一下算法好了，先自己写一个apk，用java去实现注册机。  \n",
    "\n",
    "　　可以直接把class文件转成dex，不复述，我比较懒，所以我直接解压apk找到classes.dex，并push到手机上。  \n",
    "　　然后用frida加载这个dex，并调用里面的方法。  \n",
    "```js\n",
    "var dex = Java.openClassFile(\"/data/local/tmp/classes.dex\").load();\n",
    "        console.log(\"decode_P:\"+Java.use(\"myapplication.example.com.reversea.reverseA\").decode_P());\n",
    "        console.log(\"r_to_hex:\"+Java.use(\"myapplication.example.com.reversea.reverseA\").r_to_hex());\n",
    "...\n",
    "...\n",
    "decode_P:Boris, give me the password\n",
    "r_to_hex:0064736c707d6f510020646b73247c4d0068202b4159516700502a214d24675100\n",
    "```\n",
    "\n",
    "## 七、Frida打印与参数构造\n",
    "　　1、数组/(字符串)对象数组/gson/Java.array  \n",
    "　　2、对象/多态、强转Java.cast/接口Java.register  \n",
    "　　3、泛型、List、Map、Set、迭代打印  \n",
    "　　4、non-ascii 、 child-gating、rpc 上传到PC上打印  \n",
    "### 7.1、char[]/[Object Object]\n",
    "```js\n",
    "Log.d(\"SimpleArray\", \"onCreate: SImpleArray\");\n",
    "char arr[][] = new char[4][]; // 创建一个4行的二维数组\n",
    "arr[0] = new char[] { '春', '眠', '不', '觉', '晓' }; // 为每一行赋值\n",
    "arr[1] = new char[] { '处', '处', '闻', '啼', '鸟' };\n",
    "arr[2] = new char[] { '夜', '来', '风', '雨', '声' };\n",
    "arr[3] = new char[] { '花', '落', '知', '多', '少' };\n",
    "Log.d(\"SimpleArray\", \"-----横版-----\");\n",
    "for (int i = 0; i < 4; i++) { // 循环4行\n",
    "    Log.d(\"SimpleArraysToString\", Arrays.toString(arr[i]));\n",
    "    Log.d(\"SimpleStringBytes\", Arrays.toString (Arrays.toString (arr[i]).getBytes()));\n",
    "    for (int j = 0; j < 5; j++) { // 循环5列\n",
    "        Log.d(\"SimpleArray\", Character.toString(arr[i][j])); // 输出数组中的元素\n",
    "    }\n",
    "    if (i % 2 == 0) {\n",
    "        Log.d(\"SimpleArray\", \",\");// 如果是一、三句，输出逗号\n",
    "    } else {\n",
    "        Log.d(\"SimpleArray\", \"。\");// 如果是二、四句，输出句号\n",
    "    }\n",
    "}\n",
    "```\n",
    "```js\n",
    "Java.openClassFile(\"/data/local/tmp/r0gson.dex\").load();\n",
    "const gson = Java.use('com.r0ysue.gson.Gson');\n",
    "\n",
    "Java.use(\"java.lang.Character\").toString.overload('char').implementation = function(char){\n",
    "    var result = this.toString(char);\n",
    "    console.log(\"char,result\",char,result);\n",
    "    return result;\n",
    "}\n",
    "\n",
    "Java.use(\"java.util.Arrays\").toString.overload('[C').implementation = function(charArray){\n",
    "    var result = this.toString(charArray);\n",
    "    console.log(\"charArray,result:\",charArray,result)\n",
    "    console.log(\"charArray Object Object:\",gson.￥new().toJson(charArray));\n",
    "    return result;\n",
    "}\n",
    "```\n",
    "　　这里的[C是JNI函数签名\n",
    "\n",
    "|类型简写|Java类型|\n",
    "|:---:|:---|\n",
    "|Z|boolean|\n",
    "|B|byte|\n",
    "|C|char|\n",
    "|S|short|\n",
    "|I|int|\n",
    "|J|long|\n",
    "|F|float|\n",
    "|D|double|\n",
    "\n",
    "### 7.2、byte[]\n",
    "```js\n",
    "Java.openClassFile(\"/data/local/tmp/r0gson.dex\").load();\n",
    "const gson = Java.use('com.r0ysue.gson.Gson');\n",
    "\n",
    "Java.use(\"java.util.Arrays\").toString.overload('[B').implementation = function(byteArray){\n",
    "    var result = this.toString(byteArray);\n",
    "    console.log(\"byteArray,result):\",byteArray,result)\n",
    "    console.log(\"byteArray Object Object:\",gson.￥new().toJson(byteArray));\n",
    "    return result;\n",
    "}\n",
    "```\n",
    "\n",
    "### 7.3、java array构造\n",
    "　　　如果不只是想打印出结果，而是要替换原本的参数，就要先自己构造出一个charArray,使用Java.arrayAPI　　\n",
    "```js\n",
    "/**\n",
    " * Creates a Java array with elements of the specified `type`, from a\n",
    " * JavaScript array `elements`. The resulting Java array behaves like\n",
    " * a JS array, but can be passed by reference to Java APIs in order to\n",
    " * allow them to modify its contents.\n",
    " *\n",
    " * @param type Type name of elements.\n",
    " * @param elements Array of JavaScript values to use for constructing the\n",
    " *                 Java array.\n",
    " */\n",
    "function array(type: string, elements: any[]): any[];\n",
    "```\n",
    "```js\n",
    "Java.use(\"java.util.Arrays\").toString.overload('[C').implementation = function(charArray){\n",
    "    var newCharArray = Java.array('char', [ '一','去','二','三','里' ]);\n",
    "    var result = this.toString(newCharArray);\n",
    "    console.log(\"newCharArray,result:\",newCharArray,result)\n",
    "    console.log(\"newCharArray Object Object:\",gson.$new().toJson(newCharArray));\n",
    "    var newResult = Java.use('java.lang.String').$new(Java.array('char', [ '烟','村','四','五','家']))\n",
    "    return newResult;\n",
    "}\n",
    "```\n",
    "　　可以用来构造参数重发包，用在爬虫上。\n",
    "\n",
    "### 7.4、类的多态：转型/Java.cast\n",
    "　　可以通过getClass().getName().toString()来查看当前实例的类型。\n",
    "　　找到一个instance，通过Java.cast来强制转换对象的类型。\n",
    "```js\n",
    "/**\n",
    " * Creates a JavaScript wrapper given the existing instance at `handle` of\n",
    " * given class `klass` as returned from `Java.use()`.\n",
    " *\n",
    " * @param handle An existing wrapper or a JNI handle.\n",
    " * @param klass Class wrapper for type to cast to.\n",
    " */\n",
    "function cast(handle: Wrapper | NativePointerValue, klass: Wrapper): Wrapper;\n",
    "```\n",
    "```java\n",
    "public class Water { // 水 类\n",
    "    public static String flow(Water W) { // 水 的方法\n",
    "        // SomeSentence\n",
    "        Log.d(\"2Object\", \"water flow: I`m flowing\");\n",
    "        return \"water flow: I`m flowing\";\n",
    "    }\n",
    "\n",
    "    public String still(Water W) { // 水 的方法\n",
    "        // SomeSentence\n",
    "        Log.d(\"2Object\", \"water still: still water runs deep!\");\n",
    "        return \"water still: still water runs deep!\";\n",
    "    }\n",
    "}\n",
    "...\n",
    "public class Juice extends Water { // 果汁 类 继承了水类\n",
    "\n",
    "    public String fillEnergy(){\n",
    "        Log.d(\"2Object\", \"Juice: i`m fillingEnergy!\");\n",
    "        return \"Juice: i`m fillingEnergy!\";\n",
    "    }\n",
    "```\n",
    "```js\n",
    "var JuiceHandle = null ;\n",
    "Java.choose(\"com.r0ysue.a0526printout.Juice\",{\n",
    "    onMatch:function(instance){\n",
    "        console.log(\"found juice instance\",instance);\n",
    "        console.log(\"juice instance call fill\",instance.fillEnergy());\n",
    "        JuiceHandle = instance;\n",
    "    },onComplete:function(){\n",
    "        console.log(\"juice handle search completed!\")\n",
    "    }\n",
    "})\n",
    "console.log(\"Saved juice handle :\",JuiceHandle);\n",
    "var WaterHandle = Java.cast(JuiceHandle,Java.use(\"com.r0ysue.a0526printout.Water\"))\n",
    "console.log(\"call Waterhandle still method:\",WaterHandle.still(WaterHandle));\n",
    "```\n",
    "\n",
    "### 7.5、interface/Java.registerClass\n",
    "```java\n",
    "public interface liquid {\n",
    "    public String flow();\n",
    "}\n",
    "```\n",
    "　　frida提供能力去创建一个新的java class\n",
    "```java\n",
    "/**\n",
    "    * Creates a new Java class.\n",
    "    *\n",
    "    * @param spec Object describing the class to be created.\n",
    "    */\n",
    "function registerClass(spec: ClassSpec): Wrapper;\n",
    "```\n",
    "　　首先获取要实现的interface，然后调用registerClass来实现interface。\n",
    "```js\n",
    "    Java.perform(function(){\n",
    "        var liquid = Java.use(\"com.r0ysue.a0526printout.liquid\");\n",
    "        var beer = Java.registerClass({\n",
    "            name: 'com.r0ysue.a0526printout.beer',\n",
    "            implements: [liquid],\n",
    "            methods: {\n",
    "                flow: function () {\n",
    "                    console.log(\"look, beer is flowing!\")\n",
    "                    return \"look, beer is flowing!\";\n",
    "                }\n",
    "            }\n",
    "        });\n",
    "        console.log(\"beer.bubble:\",beer.￥new().flow())      \n",
    "    })\n",
    "}\n",
    "```\n",
    "\n",
    "### 7.6、成员内部类/匿名内部类\n",
    "　　看smali或者枚举出来的类。\n",
    "\n",
    "### 7.7、hook enum\n",
    "　　关于java枚举，从这篇文章了解。https://www.cnblogs.com/jingmoxukong/p/6098351.html\n",
    "```java\n",
    "enum Signal {\n",
    "    GREEN, YELLOW, RED\n",
    "}\n",
    "public class TrafficLight {\n",
    "    public static Signal color = Signal.RED;\n",
    "    public static void main() {\n",
    "        Log.d(\"4enum\", \"enum \"+ color.getClass().getName().toString());\n",
    "        switch (color) {\n",
    "            case RED:\n",
    "                color = Signal.GREEN;\n",
    "                break;\n",
    "            case YELLOW:\n",
    "                color = Signal.RED;\n",
    "                break;\n",
    "            case GREEN:\n",
    "                color = Signal.YELLOW;\n",
    "                break;\n",
    "        }\n",
    "    }\n",
    "}\n",
    "```\n",
    "```js\n",
    "Java.perform(function(){\n",
    "        Java.choose(\"com.r0ysue.a0526printout.Signal\",{\n",
    "            onMatch:function(instance){\n",
    "                console.log(\"instance.name:\",instance.name());\n",
    "                console.log(\"instance.getDeclaringClass:\",instance.getDeclaringClass());                \n",
    "            },onComplete:function(){\n",
    "                console.log(\"search completed!\")\n",
    "            }\n",
    "        })\n",
    "    })\n",
    "```\n",
    "\n",
    "### 7.8、Hook HashMap\n",
    "```js\n",
    "Java.perform(function(){\n",
    "        Java.choose(\"java.util.HashMap\",{\n",
    "            onMatch:function(instance){\n",
    "                if(instance.toString().indexOf(\"ISBN\")!= -1){\n",
    "                    console.log(\"instance.toString:\",instance.toString());\n",
    "                }\n",
    "            },onComplete:function(){\n",
    "                console.log(\"search complete!\")\n",
    "            }\n",
    "        })\n",
    "    })\n",
    "\n",
    "function () {\n",
    "   var linkerHashMap=Java.use('java.util.HashMap');\n",
    "    linkerHashMap.put.implementation = function(arg1,arg2){\n",
    "        send(\"=================linkerHashMap.put====================\");\n",
    "        var data=this.put(arg1,arg2);\n",
    "        send(arg1+\"-----\"+arg2);\n",
    "        console.log(Java.use(\"android.util.Log\").getStackTraceString(Java.use(\"java.lang.Throwable\").￥new()));\n",
    "        return data;\n",
    "    }   \n",
    "}\n",
    "\n",
    "```\n",
    "### 7.9、Hook JSONObject\n",
    "```js\n",
    "var JSONObject=Java.use('org.json.JSONObject');\n",
    "JSONObject.toString.overload().implementation = function(){\n",
    "    send(\"=================org.json.JSONObject.toString====================\");\n",
    "    send(Java.use(\"android.util.Log\").getStackTraceString(Java.use(\"java.lang.Throwable\").$new()));\n",
    "    var data=this.toString();\n",
    "    send(\"org.json.JSONObject.toString result:\"+data);\n",
    "    return data;\n",
    "}\n",
    "for(var i = 0; i < JSONObject.put.overloads.length; i++){\n",
    "    JSONObject.put.overloads[i].implementation = function(){\n",
    "        send(\"=================org.json.JSONObject.put====================\");\n",
    "        if(arguments.length == 2){\n",
    "            send(Java.use(\"android.util.Log\").getStackTraceString(Java.use(\"java.lang.Throwable\").$new()));\n",
    "            send(\"key:\"+arguments[0]);\n",
    "            send(\"value:\"+arguments[1]);\n",
    "            var data=this.put(arguments[0],arguments[1]);\n",
    "            return data;\n",
    "        }\n",
    "    }\n",
    "}\n",
    "for(var i = 0; i < JSONObject.$init.overloads.length; i++){\n",
    "    JSONObject.$init.overloads[i].implementation = function(){\n",
    "        send(\"=================org.json.JSONObject.$init====================\");\n",
    "        send(Java.use(\"android.util.Log\").getStackTraceString(Java.use(\"java.lang.Throwable\").$new()));\n",
    "        if(arguments.length == 1){//只有1个string参数\n",
    "            send(\"string:\"+arguments[0]);\n",
    "        }else if(arguments.length == 2){ //其他构造函数用到的时候可以继续添加\n",
    "            \n",
    "        }\n",
    "    }\n",
    "}\n",
    "```\n",
    "### 7.10、打印non-ascii\n",
    "　　https://api-caller.com/2019/03/30/frida-note/#non-ascii\n",
    "　　类名非ASCII字符串时，先编码打印出来, 再用编码后的字符串去 hook.\n",
    "```js\n",
    "//场景hook cls.forName寻找目标类的classloader。\n",
    "    cls.forName.overload('java.lang.String', 'boolean', 'java.lang.ClassLoader').implementation = function (arg1, arg2, arg3) {\n",
    "        var clsName = cls.forName(arg1, arg2, arg3);\n",
    "        console.log('oriClassName:' + arg1)\n",
    "        var base64Name = encodeURIComponent(arg1)\n",
    "        console.log('encodeName:' + base64Name);\n",
    "        //通过日志确认base64后的非ascii字符串，下面对比并打印classloader\n",
    "        //clsName为特殊字符o.ÎÉ«\n",
    "        if ('o.%CE%99%C9%AB' == base64Name) {\n",
    "            //打印classloader\n",
    "            console.log(arg3);\n",
    "        }\n",
    "        return clsName;\n",
    "    }\n",
    "```\n",
    "\n",
    "## 八、Frida native hook : NDK开发入门\n",
    "　　https://www.jianshu.com/p/87ce6f565d37\n",
    "\n",
    "　　1、extern “C”与名称修饰  \n",
    "　　　　a、通过c++filt工具可以直接还原得到原来的函数名  \n",
    "　　　　b、https://zh.wikipedia.org/zh-hans/%E5%90%8D%E5%AD%97%E4%BF%AE%E9%A5%B0  \n",
    "　　　　c、通过extern “C”导出的JNI函数不会被name mangling  \n",
    "　　2、JNI参数与基本类型  \n",
    "　　第一个NDK程序  \n",
    "\n",
    "\n",
    "JNI log\n",
    "\n",
    "```c\n",
    "#define TAG \"sakura1328\"\n",
    "#define LOGI(...) __android_log_print(ANDROID_LOG_INFO,TAG,__VA_ARGS__)\n",
    "#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG, TAG, __VA_ARGS__)\n",
    "#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR,TAG,__VA_ARGS__)\n",
    "\n",
    "extern \"C\" JNIEXPORT jstring JNICALL\n",
    "Java_myapplication_example_com_ndk_1demo_MainActivity_stringFromJNI(\n",
    "        JNIEnv *env,\n",
    "        jobject /* this */) {\n",
    "    std::string hello = \"Hello from C++\";\n",
    "    LOGD(\"sakura1328\");\n",
    "    return env->NewStringUTF(hello.c_str());\n",
    "}\n",
    "...\n",
    "public class MainActivity extends AppCompatActivity {\n",
    "\n",
    "    private static final String TAG = \"sakura\";\n",
    "\n",
    "    // Used to load the 'native-lib' library on application startup.\n",
    "    static {\n",
    "        System.loadLibrary(\"native-lib\");\n",
    "    }\n",
    "\n",
    "    @Override\n",
    "    protected void onCreate(Bundle savedInstanceState) {\n",
    "        super.onCreate(savedInstanceState);\n",
    "        setContentView(R.layout.activity_main);\n",
    "\n",
    "        // Example of a call to a native method\n",
    "        TextView tv = (TextView) findViewById(R.id.sample_text);\n",
    "        tv.setText(stringFromJNI());\n",
    "        Log.d(TAG, stringFromJNI());\n",
    "    }\n",
    "\n",
    "    /**\n",
    "     * A native method that is implemented by the 'native-lib' native library,\n",
    "     * which is packaged with this application.\n",
    "     */\n",
    "    public native String stringFromJNI();\n",
    "}\n",
    "```\n",
    "\n",
    "## 九、Frida native hook : JNIEnv和反射\n",
    "### 9.1、以jni字符串来掌握基本的JNIEnv用法\n",
    "```java\n",
    "public native String stringWithJNI(String context);\n",
    "...\n",
    "\n",
    "extern \"C\"\n",
    "JNIEXPORT jstring JNICALL\n",
    "Java_myapplication_example_com_ndk_1demo_MainActivity_stringWithJNI(JNIEnv *env, jobject instance,\n",
    "                                                                    jstring context_) {\n",
    "    const char *context = env->GetStringUTFChars(context_, 0);\n",
    "\n",
    "    int context_size = env->GetStringUTFLength(context_);\n",
    "\n",
    "    if (context_size > 0) {\n",
    "        LOGD(\"%s\\n\", context);\n",
    "    }\n",
    "\n",
    "    env->ReleaseStringUTFChars(context_, context);\n",
    "\n",
    "    return env->NewStringUTF(\"sakura1328\");\n",
    "}\n",
    "\n",
    "12-26 22:30:00.548 15764-15764/myapplication.example.com.ndk_demo D/sakura1328: sakura\n",
    "```\n",
    "\n",
    "### 9.2、Java反射\n",
    "　　多去读一下java的反射API。  \n",
    "  \n",
    "　　Java高级特性——反射  \n",
    "　　1、查找调用各种API接口、JNI、frida/xposed原理的一部分\n",
    "　　2、反射基本API\n",
    "　　3、反射修改访问控制、修改属性值\n",
    "　　4、JNI so调用反射进入java世界\n",
    "　　5、xposed/Frida hook原理\n",
    "　　这里其实有一个伏笔，就是为什么我们要trace artmethod，hook artmethod是因为有些so混淆得非常厉害，然后也就很难静态分析看出so里面调用了哪些java函数，也不是通过类似JNI的GetMethodID这样来调用的。而是通过类似findclass这种方法先得到类，然后再反射调用app里面的某个java函数。  \n",
    "\n",
    "　　所以去hook它执行的位置，每一个java函数对于Android源码而言都是一个artmethod结构体，然后hook拿到artmethod实例以后调用类函数，打印这个函数的名称。  \n",
    "```java\n",
    "public class MainActivity extends AppCompatActivity {\n",
    "\n",
    "    private static final String TAG = \"sakura\";\n",
    "\n",
    "    // Used to load the 'native-lib' library on application startup.\n",
    "    static {\n",
    "        System.loadLibrary(\"native-lib\");\n",
    "    }\n",
    "\n",
    "    @Override\n",
    "    protected void onCreate(Bundle savedInstanceState) {\n",
    "        super.onCreate(savedInstanceState);\n",
    "        setContentView(R.layout.activity_main);\n",
    "\n",
    "        // Example of a call to a native method\n",
    "        TextView tv = (TextView) findViewById(R.id.sample_text);\n",
    "        tv.setText(stringWithJNI(\"sakura\"));\n",
    "//        Log.d(TAG, stringFromJNI());\n",
    "//        Log.d(TAG, stringWithJNI(\"sakura\"));\n",
    "        try {\n",
    "            testClass();\n",
    "        } catch (ClassNotFoundException e) {\n",
    "            e.printStackTrace();\n",
    "        } catch (NoSuchFieldException e) {\n",
    "            e.printStackTrace();\n",
    "        } catch (IllegalAccessException e) {\n",
    "            e.printStackTrace();\n",
    "        } catch (NoSuchMethodException e) {\n",
    "            e.printStackTrace();\n",
    "        } catch (InvocationTargetException e) {\n",
    "            e.printStackTrace();\n",
    "        }\n",
    "    }\n",
    "\n",
    "    public void testClass() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException, NoSuchMethodException, InvocationTargetException {\n",
    "        Test sakuraTest = new Test();\n",
    "        // 获得Class的方法（三种）\n",
    "        Class testClazz = MainActivity.class.getClassLoader().loadClass(\"myapplication.example.com.ndk_demo.Test\");\n",
    "        Class testClazz2 = Class.forName(\"myapplication.example.com.ndk_demo.Test\");\n",
    "        Class testClazz3 = Test.class;\n",
    "        Log.i(TAG, \"Classloader.loadClass->\" + testClazz);\n",
    "        Log.i(TAG, \"Classloader.loadClass->\" + testClazz2);\n",
    "        Log.i(TAG, \"Classloader.loadClass->\" + testClazz3.getName());\n",
    "\n",
    "        // 获得类中属性相关的方法\n",
    "        Field publicStaticField = testClazz3.getDeclaredField(\"publicStaticField\");\n",
    "        Log.i(TAG, \"testClazz3.getDeclaredField->\" + publicStaticField);\n",
    "\n",
    "        Field publicField = testClazz3.getDeclaredField(\"publicField\");\n",
    "        Log.i(TAG, \"testClazz3.getDeclaredField->\" + publicField);\n",
    "\n",
    "        //对于Field的get方法，如果是static，则传入null即可;如果不是，则需要传入一个类的实例\n",
    "        String valueStaticPublic = (String) publicStaticField.get(null);\n",
    "        Log.i(TAG, \"publicStaticField.get->\" + valueStaticPublic);\n",
    "\n",
    "        String valuePublic = (String) publicField.get(sakuraTest);\n",
    "        Log.i(TAG, \"publicField.get->\" + valuePublic);\n",
    "\n",
    "        //对于private属性，需要设置Accessible\n",
    "        Field privateStaticField = testClazz3.getDeclaredField(\"privateStaticField\");\n",
    "        privateStaticField.setAccessible(true);\n",
    "\n",
    "        String valuePrivte = (String) privateStaticField.get(null);\n",
    "        Log.i(TAG, \"modified before privateStaticField.get->\" + valuePrivte);\n",
    "\n",
    "        privateStaticField.set(null, \"modified\");\n",
    "\n",
    "        valuePrivte = (String) privateStaticField.get(null);\n",
    "        Log.i(TAG, \"modified after privateStaticField.get->\" + valuePrivte);\n",
    "\n",
    "        Field[] fields = testClazz3.getDeclaredFields();\n",
    "        for (Field i : fields) {\n",
    "            Log.i(TAG, \"testClazz3.getDeclaredFields->\" + i);\n",
    "        }\n",
    "\n",
    "        // 获得类中method相关的方法\n",
    "        Method publicStaticMethod = testClazz3.getDeclaredMethod(\"publicStaticFunc\");\n",
    "        Log.i(TAG, \"testClazz3.getDeclaredMethod->\" + publicStaticMethod);\n",
    "\n",
    "        publicStaticMethod.invoke(null);\n",
    "\n",
    "        Method publicMethod = testClazz3.getDeclaredMethod(\"publicFunc\", java.lang.String.class);\n",
    "        Log.i(TAG, \"testClazz3.getDeclaredMethod->\" + publicMethod);\n",
    "\n",
    "        publicMethod.invoke(sakuraTest, \" sakura\");\n",
    "    }\n",
    "\n",
    "    /**\n",
    "     * A native method that is implemented by the 'native-lib' native library,\n",
    "     * which is packaged with this application.\n",
    "     */\n",
    "    public native String stringFromJNI();\n",
    "\n",
    "    public native String stringWithJNI(String context);\n",
    "}\n",
    "...\n",
    "public class Test {\n",
    "    private static final String TAG = \"sakura_test\";\n",
    "\n",
    "    public static String publicStaticField = \"i am a publicStaticField\";\n",
    "    public String publicField = \"i am a publicField\";\n",
    "\n",
    "    private static String privateStaticField = \"i am a privateStaticField\";\n",
    "    private String privateField = \"i am a privateField\";\n",
    "\n",
    "    public static void publicStaticFunc() {\n",
    "        Log.d(TAG, \"I`m from publicStaticFunc\");\n",
    "    }\n",
    "\n",
    "    public void publicFunc(String str) {\n",
    "        Log.d(TAG, \"I`m from publicFunc\" + str);\n",
    "    }\n",
    "\n",
    "    private static void privateStaticFunc() {\n",
    "        Log.i(TAG, \"I`m from privateFunc\");\n",
    "    }\n",
    "\n",
    "    private void privateFunc() {\n",
    "        Log.i(TAG, \"I`m from privateFunc\");\n",
    "    }\n",
    "}\n",
    "...\n",
    "...\n",
    "12-26 23:57:11.784 17682-17682/myapplication.example.com.ndk_demo I/sakura: Classloader.loadClass->class myapplication.example.com.ndk_demo.Test\n",
    "12-26 23:57:11.784 17682-17682/myapplication.example.com.ndk_demo I/sakura: Classloader.loadClass->class myapplication.example.com.ndk_demo.Test\n",
    "12-26 23:57:11.784 17682-17682/myapplication.example.com.ndk_demo I/sakura: Classloader.loadClass->myapplication.example.com.ndk_demo.Test\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: testClazz3.getDeclaredField->public static java.lang.String myapplication.example.com.ndk_demo.Test.publicStaticField\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: testClazz3.getDeclaredField->public java.lang.String myapplication.example.com.ndk_demo.Test.publicField\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: publicStaticField.get->i am a publicStaticField\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: publicField.get->i am a publicField\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: modified before privateStaticField.get->i am a privateStaticField\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: modified after privateStaticField.get->modified\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: testClazz3.getDeclaredFields->private java.lang.String myapplication.example.com.ndk_demo.Test.privateField\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: testClazz3.getDeclaredFields->public java.lang.String myapplication.example.com.ndk_demo.Test.publicField\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: testClazz3.getDeclaredFields->private static final java.lang.String myapplication.example.com.ndk_demo.Test.TAG\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: testClazz3.getDeclaredFields->private static java.lang.String myapplication.example.com.ndk_demo.Test.privateStaticField\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: testClazz3.getDeclaredFields->public static java.lang.String myapplication.example.com.ndk_demo.Test.publicStaticField\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo I/sakura: testClazz3.getDeclaredMethod->public static void myapplication.example.com.ndk_demo.Test.publicStaticFunc()\n",
    "12-26 23:57:11.785 17682-17682/myapplication.example.com.ndk_demo D/sakura_test: I`m from publicStaticFunc\n",
    "12-26 23:57:11.786 17682-17682/myapplication.example.com.ndk_demo I/sakura: testClazz3.getDeclaredMethod->public void myapplication.example.com.ndk_demo.Test.publicFunc(java.lang.String)\n",
    "12-26 23:57:11.786 17682-17682/myapplication.example.com.ndk_demo D/sakura_test: I`m from publicFunc sakura\n",
    "```\n",
    "　　memory list modules\n",
    "\n",
    "\n",
    "## 十、Frida反调试\n",
    "　　这一节的主要内容就是关于反调试的原理和如何破解反调试，重要内容还是看文章理解即可。\n",
    "　　因为我并不需要做反调试相关的工作，所以部分内容略过。\n",
    "　　Frida反调试与反反调试基本思路：（Java层API、Native层API、Syscall)\n",
    "　　　　1、AntiFrida\n",
    "　　　　2、frida-detection-demo\n",
    "　　　　3、多种特征检测Frida\n",
    "　　　　4、来自高维的对抗 - 逆向TinyTool自制\n",
    "　　　　5、Unicorn 在 Android 的应用\n",
    "\n",
    "## 十一、Frida native hook : 符号hook JNI、art&libc\n",
    "### 11.1、Native函数的Java Hook及主动调用\n",
    "　　对native函数的java层hook和主动调用和普通java函数完全一致，略过。\n",
    "\n",
    "### 11.2、jni.h头文件导入\n",
    "　　导入jni.h，先search一下这个文件在哪。\n",
    "```shell\n",
    "sakura@sakuradeMacBook-Pro:~/Library/Android/sdk￥ find ./ -name \"jni.h\"\n",
    ".//ndk-bundle/sysroot/usr/include/jni.h\n",
    "Error /Users/sakura/Library/Android/sdk/ndk-bundle/sysroot/usr/include/jni.h,27: Can't open include file 'stdarg.h'\n",
    "Total 1 errors\n",
    "Caching 'Exports'... ok\n",
    "```\n",
    "　　报错，所以拷贝一份jni.h出来  \n",
    "\n",
    "　　将这两个头文件导入删掉  \n",
    "　　　　#include <stdarg.h>  \n",
    "　　　　#include <stdint.h>  \n",
    "　　导入成功, 现在就能识别_JNIEnv了。\n",
    "\n",
    "\n",
    "### 11.3、JNI函数符号hook\n",
    "先查看一下导出了哪些函数。\n",
    "\n",
    "```c\n",
    "extern \"C\" JNIEXPORT jstring JNICALL\n",
    "Java_myapplication_example_com_ndk_1demo_MainActivity_stringFromJNI(\n",
    "        JNIEnv *env,\n",
    "        jobject /* this */) {\n",
    "    std::string hello = \"Hello from C++\";\n",
    "    LOGD(\"sakura1328\");\n",
    "    return env->NewStringUTF(hello.c_str());\n",
    "}\n",
    "extern \"C\"\n",
    "JNIEXPORT jstring JNICALL\n",
    "Java_myapplication_example_com_ndk_1demo_MainActivity_stringWithJNI(JNIEnv *env, jobject instance,\n",
    "                                                                    jstring context_) {\n",
    "    const char *context = env->GetStringUTFChars(context_, 0);\n",
    "\n",
    "    int context_size = env->GetStringUTFLength(context_);\n",
    "\n",
    "    if (context_size > 0) {\n",
    "        LOGD(\"%s\\n\", context);\n",
    "    }\n",
    "\n",
    "    env->ReleaseStringUTFChars(context_, context);\n",
    "\n",
    "    return env->NewStringUTF(\"sakura1328\");\n",
    "}\n",
    "```\n",
    "　　这里有几个需要的API:  \n",
    "　　1、首先是找到是否so被加载，通过Process.enumerateModules(),这个API可以枚举被加载到内存的modules。  \n",
    "　　2、然后通过Module.findBaseAddress(module name)来查找要hook的函数所在的so的基地址，如果找不到就返回null。  \n",
    "　　3、然后可以通过findExportByName(moduleName: string, exportName: string): NativePointer来查找导出函数的绝对地址。如果不知道moduleName是什么，可以传入一个null进入，但是会花费一些时间遍历所有的module。如果找不到就返回null。  \n",
    "　　4、找到地址之后，就可以拦截function/instruction的执行。通过Interceptor.attach。使用方法见下代码。  \n",
    "　　5、另外为了将jstring的值打印出来，可以使用jenv的函数getStringUtfChars，就像正常的写native程序一样。  \n",
    "　　6、Java.vm.getEnv().getStringUtfChars(args[2], null).readCString()  \n",
    "\n",
    "　　这里我是循环调用的string_with_jni，如果不循环调用，那就要主动调用一下这个函数，或者hook dlopen。  \n",
    "　　hook dlopen的方法在这个代码可以参考。  \n",
    "```js\n",
    "function hook_native() {\n",
    "    // console.log(JSON.stringify(Process.enumerateModules()));\n",
    "    var libnative_addr = Module.findBaseAddress(\"libnative-lib.so\")\n",
    "    console.log(\"libnative_addr is: \" + libnative_addr)\n",
    "\n",
    "    if (libnative_addr) {\n",
    "        var string_with_jni_addr = Module.findExportByName(\"libnative-lib.so\", \n",
    "        \"Java_myapplication_example_com_ndk_1demo_MainActivity_stringWithJNI\")\n",
    "        console.log(\"string_with_jni_addr is: \" + string_with_jni_addr)\n",
    "    }\n",
    "\n",
    "    Interceptor.attach(string_with_jni_addr, {\n",
    "        onEnter: function (args) {\n",
    "            console.log(\"string_with_jni args: \" + args[0], args[1], args[2])\n",
    "            console.log(Java.vm.getEnv().getStringUtfChars(args[2], null).readCString())\n",
    "        },\n",
    "        onLeave: function (retval) {\n",
    "            console.log(\"retval:\", retval)\n",
    "            console.log(Java.vm.getEnv().getStringUtfChars(retval, null).readCString())\n",
    "            var newRetval = Java.vm.getEnv().newStringUtf(\"new retval from hook_native\");\n",
    "            retval.replace(ptr(newRetval));\n",
    "        }\n",
    "    })\n",
    "}\n",
    "```\n",
    "```shell\n",
    "libnative_addr is: 0x7a0842f000\n",
    "string_with_jni_addr is: 0x7a08436194\n",
    "[Google Pixel::myapplication.example.com.ndk_demo]-> string_with_jni args: 0x7a106cc1c0 0x7ff0b71da4 0x7ff0b71da8\n",
    "sakura\n",
    "retval: 0x75\n",
    "sakura1328\n",
    "```\n",
    "　　这里还写了一个hook env里的GetStringUTFChars的代码，和上面一样，不赘述了。\n",
    "```js\n",
    "function hook_art(){\n",
    "    var addr_GetStringUTFChars = null;\n",
    "    //console.log( JSON.stringify(Process.enumerateModules()));\n",
    "    var symbols = Process.findModuleByName(\"libart.so\").enumerateSymbols();\n",
    "    for(var i = 0;i<symbols.length;i++){\n",
    "        var symbol = symbols[i].name;\n",
    "        if((symbol.indexOf(\"CheckJNI\")==-1)&&(symbol.indexOf(\"JNI\")>=0)){\n",
    "            if(symbol.indexOf(\"GetStringUTFChars\")>=0){\n",
    "                console.log(symbols[i].name);\n",
    "                console.log(symbols[i].address);\n",
    "                addr_GetStringUTFChars = symbols[i].address;\n",
    "            }\n",
    "        }\n",
    "    }\n",
    "    console.log(\"addr_GetStringUTFChars:\", addr_GetStringUTFChars);\n",
    "    Java.perform(function (){\n",
    "        Interceptor.attach(addr_GetStringUTFChars, {\n",
    "            onEnter: function (args) {\n",
    "                console.log(\"addr_GetStringUTFChars OnEnter args[0],args[1]\",args[0],args[1]);\n",
    "                //console.log(hexdump(args[0].readPointer()));\n",
    "                //console.log(Java.vm.tryGetEnv().getStringUtfChars(args[0]).readCString()); \n",
    "            }, onLeave: function (retval) {\n",
    "                console.log(\"addr_GetStringUTFChars OnLeave\",ptr(retval).readCString());\n",
    "            }\n",
    "        })\n",
    "    })\n",
    "}\n",
    "```\n",
    "### 11.4、JNI函数参数、返回值打印和替换\n",
    "　　1、libc函数符号hook  \n",
    "　　2、libc函数参数、返回值打印和替换  \n",
    "　　3、hook libc的也和上面的完全一样，也不赘述了。  \n",
    "　　4、所以看到这里，究其本质就是找到导出符号和它所在的so基地址了。  \n",
    "```js\n",
    "function hook_libc(){\n",
    "    var pthread_create_addr = null;\n",
    "    var symbols = Process.findModuleByName(\"libc.so\").enumerateSymbols();\n",
    "    for(var i = 0;i<symbols.length;i++){\n",
    "        var symbol = symbols[i].name;\n",
    "    \n",
    "        if(symbol.indexOf(\"pthread_create\")>=0){\n",
    "            //console.log(symbols[i].name);\n",
    "            //console.log(symbols[i].address);\n",
    "            pthread_create_addr = symbols[i].address;\n",
    "        }\n",
    "    \n",
    "    }\n",
    "    console.log(\"pthread_create_addr,\",pthread_create_addr);\n",
    "    Interceptor.attach(pthread_create_addr,{\n",
    "        onEnter:function(args){\n",
    "            console.log(\"pthread_create_addr args[0],args[1],args[2],args[3]:\",args[0],args[1],args[2],args[3]);\n",
    "\n",
    "        },onLeave:function(retval){\n",
    "            console.log(\"retval is:\",retval)\n",
    "        }\n",
    "    })\n",
    "}\n",
    "```\n",
    "\n",
    "## 十二、Frida native hook : JNI_Onload/动态注册/inline_hook/native层调用栈打印\n",
    "　　https://github.com/android/ndk-samples\n",
    "\n",
    "### 12.1、JNI_Onload/动态注册原理\n",
    "　　JNI_Onload/动态注册/Frida hook RegisterNative  \n",
    "　　　　1、JNI与动态注册  \n",
    "　　　　2、native 方法的动态注册  \n",
    "　　　　3、Frida hook art  \n",
    "　　详细的内容参见我写的文章，这里只给出栗子。\n",
    "```java\n",
    "Log.d(TAG,stringFromJNI2());\n",
    "public native String stringFromJNI2();\n",
    "```\n",
    "```c\n",
    "JNIEXPORT jstring JNICALL stringFromJNI2(\n",
    "        JNIEnv *env,\n",
    "        jclass clazz) {\n",
    "    jclass testClass = env->FindClass(\"myapplication/example/com/ndk_demo/Test\");\n",
    "    jfieldID publicStaticField = env->GetStaticFieldID(testClass, \"publicStaticField\",\n",
    "                                                       \"Ljava/lang/String;\");\n",
    "    jstring publicStaticFieldValue = (jstring) env->GetStaticObjectField(testClass,\n",
    "                                                                         publicStaticField);\n",
    "    const char *value_ptr = env->GetStringUTFChars(publicStaticFieldValue, NULL);\n",
    "    LOGD(\"now content is %s\", value_ptr);\n",
    "    std::string hello = \"Hello from C++ stringFromJNI2\";\n",
    "    return env->NewStringUTF(hello.c_str());\n",
    "}\n",
    "...\n",
    "JNIEXPORT jint JNI_OnLoad(JavaVM *vm, void *reserved) {\n",
    "    JNIEnv *env;\n",
    "    vm->GetEnv((void **) &env, JNI_VERSION_1_6);\n",
    "    JNINativeMethod methods[] = {\n",
    "            {\"stringFromJNI2\", \"()Ljava/lang/String;\", (void *) stringFromJNI2},\n",
    "    };\n",
    "    env->RegisterNatives(env->FindClass(\"myapplication/example/com/ndk_demo/MainActivity\"), methods,\n",
    "                         1);\n",
    "    return JNI_VERSION_1_6;\n",
    "}\n",
    "```\n",
    "### 12.2、Frida hook RegisterNative\n",
    "　　使用下面这个脚本来打印出RegisterNatives的参数，这里需要注意的是使用了enumerateSymbolsSync,它是enumerateSymbols的同步版本。   \n",
    "　　另外和我们之前通过Java.vm.tryGetEnv().getStringUtfChars来调用env里的方法不同。  \n",
    "　　这里则是通过将之前找到的getStringUtfChars函数地址和参数信息封装起来，直接调用，具体的原理我没有深入分析，先记住用法。  \n",
    "　　原理其实是一样的，都是根据符号找到地址，然后hook符号地址，然后打印参数。  \n",
    "```java\n",
    "declare const NativeFunction: NativeFunctionConstructor;\n",
    "\n",
    "interface NativeFunctionConstructor {\n",
    "    new(address: NativePointerValue, retType: NativeType, argTypes: NativeType[], abiOrOptions?: NativeABI | NativeFunctionOptions): NativeFunction;\n",
    "    readonly prototype: NativeFunction;\n",
    "}\n",
    "...\n",
    "var funcGetStringUTFChars = new NativeFunction(addrGetStringUTFChars, \"pointer\", [\"pointer\", \"pointer\", \"pointer\"]);\n",
    "```\n",
    "```js\n",
    "var ishook_libart = false;\n",
    "\n",
    "function hook_libart() {\n",
    "    if (ishook_libart === true) {\n",
    "        return;\n",
    "    }\n",
    "    var symbols = Module.enumerateSymbolsSync(\"libart.so\");\n",
    "    var addrGetStringUTFChars = null;\n",
    "    var addrNewStringUTF = null;\n",
    "    var addrFindClass = null;\n",
    "    var addrGetMethodID = null;\n",
    "    var addrGetStaticMethodID = null;\n",
    "    var addrGetFieldID = null;\n",
    "    var addrGetStaticFieldID = null;\n",
    "    var addrRegisterNatives = null;\n",
    "    var addrAllocObject = null;\n",
    "    var addrCallObjectMethod = null;\n",
    "    var addrGetObjectClass = null;\n",
    "    var addrReleaseStringUTFChars = null;\n",
    "    for (var i = 0; i < symbols.length; i++) {\n",
    "        var symbol = symbols[i];\n",
    "        if (symbol.name == \"_ZN3art3JNI17GetStringUTFCharsEP7_JNIEnvP8_jstringPh\") {\n",
    "            addrGetStringUTFChars = symbol.address;\n",
    "            console.log(\"GetStringUTFChars is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name == \"_ZN3art3JNI12NewStringUTFEP7_JNIEnvPKc\") {\n",
    "            addrNewStringUTF = symbol.address;\n",
    "            console.log(\"NewStringUTF is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name == \"_ZN3art3JNI9FindClassEP7_JNIEnvPKc\") {\n",
    "            addrFindClass = symbol.address;\n",
    "            console.log(\"FindClass is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name == \"_ZN3art3JNI11GetMethodIDEP7_JNIEnvP7_jclassPKcS6_\") {\n",
    "            addrGetMethodID = symbol.address;\n",
    "            console.log(\"GetMethodID is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name == \"_ZN3art3JNI17GetStaticMethodIDEP7_JNIEnvP7_jclassPKcS6_\") {\n",
    "            addrGetStaticMethodID = symbol.address;\n",
    "            console.log(\"GetStaticMethodID is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name == \"_ZN3art3JNI10GetFieldIDEP7_JNIEnvP7_jclassPKcS6_\") {\n",
    "            addrGetFieldID = symbol.address;\n",
    "            console.log(\"GetFieldID is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name == \"_ZN3art3JNI16GetStaticFieldIDEP7_JNIEnvP7_jclassPKcS6_\") {\n",
    "            addrGetStaticFieldID = symbol.address;\n",
    "            console.log(\"GetStaticFieldID is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name == \"_ZN3art3JNI15RegisterNativesEP7_JNIEnvP7_jclassPK15JNINativeMethodi\") {\n",
    "            addrRegisterNatives = symbol.address;\n",
    "            console.log(\"RegisterNatives is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name.indexOf(\"_ZN3art3JNI11AllocObjectEP7_JNIEnvP7_jclass\") >= 0) {\n",
    "            addrAllocObject = symbol.address;\n",
    "            console.log(\"AllocObject is at \", symbol.address, symbol.name);\n",
    "        }  else if (symbol.name.indexOf(\"_ZN3art3JNI16CallObjectMethodEP7_JNIEnvP8_jobjectP10_jmethodIDz\") >= 0) {\n",
    "            addrCallObjectMethod = symbol.address;\n",
    "            console.log(\"CallObjectMethod is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name.indexOf(\"_ZN3art3JNI14GetObjectClassEP7_JNIEnvP8_jobject\") >= 0) {\n",
    "            addrGetObjectClass = symbol.address;\n",
    "            console.log(\"GetObjectClass is at \", symbol.address, symbol.name);\n",
    "        } else if (symbol.name.indexOf(\"_ZN3art3JNI21ReleaseStringUTFCharsEP7_JNIEnvP8_jstringPKc\") >= 0) {\n",
    "            addrReleaseStringUTFChars = symbol.address;\n",
    "            console.log(\"ReleaseStringUTFChars is at \", symbol.address, symbol.name);\n",
    "        }\n",
    "    }\n",
    "\n",
    "    if (addrRegisterNatives != null) {\n",
    "        Interceptor.attach(addrRegisterNatives, {\n",
    "            onEnter: function (args) {\n",
    "                console.log(\"[RegisterNatives] method_count:\", args[3]);\n",
    "                var env = args[0];\n",
    "                var java_class = args[1];\n",
    "                \n",
    "                var funcAllocObject = new NativeFunction(addrAllocObject, \"pointer\", [\"pointer\", \"pointer\"]);\n",
    "                var funcGetMethodID = new NativeFunction(addrGetMethodID, \"pointer\", [\"pointer\", \"pointer\", \"pointer\", \"pointer\"]);\n",
    "                var funcCallObjectMethod = new NativeFunction(addrCallObjectMethod, \"pointer\", [\"pointer\", \"pointer\", \"pointer\"]);\n",
    "                var funcGetObjectClass = new NativeFunction(addrGetObjectClass, \"pointer\", [\"pointer\", \"pointer\"]);\n",
    "                var funcGetStringUTFChars = new NativeFunction(addrGetStringUTFChars, \"pointer\", [\"pointer\", \"pointer\", \"pointer\"]);\n",
    "                var funcReleaseStringUTFChars = new NativeFunction(addrReleaseStringUTFChars, \"void\", [\"pointer\", \"pointer\", \"pointer\"]);\n",
    "\n",
    "                var clz_obj = funcAllocObject(env, java_class);\n",
    "                var mid_getClass = funcGetMethodID(env, java_class, Memory.allocUtf8String(\"getClass\"), Memory.allocUtf8String(\"()Ljava/lang/Class;\"));\n",
    "                var clz_obj2 = funcCallObjectMethod(env, clz_obj, mid_getClass);\n",
    "                var cls = funcGetObjectClass(env, clz_obj2);\n",
    "                var mid_getName = funcGetMethodID(env, cls, Memory.allocUtf8String(\"getName\"), Memory.allocUtf8String(\"()Ljava/lang/String;\"));\n",
    "                var name_jstring = funcCallObjectMethod(env, clz_obj2, mid_getName);\n",
    "                var name_pchar = funcGetStringUTFChars(env, name_jstring, ptr(0));\n",
    "                var class_name = ptr(name_pchar).readCString();\n",
    "                funcReleaseStringUTFChars(env, name_jstring, name_pchar);\n",
    "\n",
    "                //console.log(class_name);\n",
    "\n",
    "                var methods_ptr = ptr(args[2]);\n",
    "\n",
    "                var method_count = parseInt(args[3]);\n",
    "                for (var i = 0; i < method_count; i++) {\n",
    "                    var name_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3));\n",
    "                    var sig_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize));\n",
    "                    var fnPtr_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize * 2));\n",
    "\n",
    "                    var name = Memory.readCString(name_ptr);\n",
    "                    var sig = Memory.readCString(sig_ptr);\n",
    "                    var find_module = Process.findModuleByAddress(fnPtr_ptr);\n",
    "                    console.log(\"[RegisterNatives] java_class:\", class_name, \"name:\", name, \"sig:\", sig, \"fnPtr:\", fnPtr_ptr, \"module_name:\", find_module.name, \"module_base:\", find_module.base, \"offset:\", ptr(fnPtr_ptr).sub(find_module.base));\n",
    "\n",
    "                }\n",
    "            },\n",
    "            onLeave: function (retval) { }\n",
    "        });\n",
    "    }\n",
    "\n",
    "    ishook_libart = true;\n",
    "}\n",
    "\n",
    "hook_libart();\n",
    "```\n",
    "\n",
    "　　结果很明显的打印了出来，包括动态注册的函数的名字，函数签名，加载地址和在so里的偏移量，\n",
    "```shell\n",
    "[RegisterNatives] java_class: myapplication.example.com.ndk_demo.MainActivity name: stringFromJNI2 sig: ()Ljava/lang/String; fnPtr: 0x79f8698484 module_name: libnative-lib.so module_base: 0x79f8691000 offset: 0x7484\n",
    "```\n",
    "　　最后测试一下yang开源的一个hook art的脚本，很有意思，trace出了非常多的需要的信息。\n",
    "```shell\n",
    "frida -U --no-pause -f package_name -l hook_art.js\n",
    "...\n",
    "[FindClass] name:myapplication/example/com/ndk_demo/Test\n",
    "[GetStaticFieldID] name:publicStaticField, sig:Ljava/lang/String;\n",
    "[GetStringUTFChars] result:i am a publicStaticField\n",
    "[NewStringUTF] bytes:Hello from C++ stringFromJNI2\n",
    "[GetStringUTFChars] result:sakura\n",
    "```\n",
    "### 12.3、native层调用栈打印\n",
    "　　直接使用frida提供的接口打印栈回溯。\n",
    "```js\n",
    "Interceptor.attach(f, {\n",
    "  onEnter: function (args) {\n",
    "    console.log('RegisterNatives called from:\\n' +\n",
    "        Thread.backtrace(this.context, Backtracer.ACCURATE)\n",
    "        .map(DebugSymbol.fromAddress).join('\\n') + '\\n');\n",
    "  }\n",
    "});\n",
    "```\n",
    "　　效果如下,我加到了hook registerNative的地方。\n",
    "```shell\n",
    "[Google Pixel::myapplication.example.com.ndk_demo]-> RegisterNatives called from:\n",
    "0x7a100be03c libart.so!0xe103c\n",
    "0x7a100be038 libart.so!0xe1038\n",
    "0x79f85699a0 libnative-lib.so!_ZN7_JNIEnv15RegisterNativesEP7_jclassPK15JNINativeMethodi+0x44\n",
    "0x79f85698e0 libnative-lib.so!JNI_OnLoad+0x90\n",
    "0x7a102b9fd4 libart.so!_ZN3art9JavaVMExt17LoadNativeLibraryEP7_JNIEnvRKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEP8_jobjectP8_jstringPS9_+0x638\n",
    "0x7a08e3820c libopenjdkjvm.so!JVM_NativeLoad+0x110\n",
    "0x70b921c4 boot.oat!oatexec+0xa81c4\n",
    "```\n",
    "\n",
    "### 12.4、主动调用去进行方法参数替换\n",
    "　　使用Interceptor.replace，不赘述。主要目的还是为了改掉函数原本的执行行为，而不是仅仅打印一些信息。\n",
    "\n",
    "### 12.5、inline hook\n",
    "　　inline hook简单理解就是不是hook函数开始执行的地方，而是hook函数中间执行的指令，整体来说没什么区别，就是把找函数符号地址改成从so里找到偏移，然后加到so基地址上就行,注意一下它的attach的callback。\n",
    "```c\n",
    "/**\n",
    " * Callback to invoke when an instruction is about to be executed.\n",
    " */\n",
    "type InstructionProbeCallback = (this: InvocationContext, args: InvocationArguments) => void;\n",
    "type InvocationContext = PortableInvocationContext | WindowsInvocationContext | UnixInvocationContext;\n",
    "\n",
    "interface PortableInvocationContext {\n",
    "    /**\n",
    "     * Return address.\n",
    "     */\n",
    "    returnAddress: NativePointer;\n",
    "\n",
    "    /**\n",
    "     * CPU registers. You may also update register values by assigning to these keys.\n",
    "     */\n",
    "    context: CpuContext;\n",
    "\n",
    "    /**\n",
    "     * OS thread ID.\n",
    "     */\n",
    "    threadId: ThreadId;\n",
    "\n",
    "    /**\n",
    "     * Call depth of relative to other invocations.\n",
    "     */\n",
    "    depth: number;\n",
    "\n",
    "    /**\n",
    "     * User-defined invocation data. Useful if you want to read an argument in `onEnter` and act on it in `onLeave`.\n",
    "     */\n",
    "    [x: string]: any;\n",
    "}\n",
    "...\n",
    "...\n",
    "interface Arm64CpuContext extends PortableCpuContext {\n",
    "    x0: NativePointer;\n",
    "    x1: NativePointer;\n",
    "    x2: NativePointer;\n",
    "    x3: NativePointer;\n",
    "    x4: NativePointer;\n",
    "    x5: NativePointer;\n",
    "    x6: NativePointer;\n",
    "    x7: NativePointer;\n",
    "    x8: NativePointer;\n",
    "    x9: NativePointer;\n",
    "    x10: NativePointer;\n",
    "    x11: NativePointer;\n",
    "    x12: NativePointer;\n",
    "    x13: NativePointer;\n",
    "    x14: NativePointer;\n",
    "    x15: NativePointer;\n",
    "    x16: NativePointer;\n",
    "    x17: NativePointer;\n",
    "    x18: NativePointer;\n",
    "    x19: NativePointer;\n",
    "    x20: NativePointer;\n",
    "    x21: NativePointer;\n",
    "    x22: NativePointer;\n",
    "    x23: NativePointer;\n",
    "    x24: NativePointer;\n",
    "    x25: NativePointer;\n",
    "    x26: NativePointer;\n",
    "    x27: NativePointer;\n",
    "    x28: NativePointer;\n",
    "\n",
    "    fp: NativePointer;\n",
    "    lr: NativePointer;\n",
    "}\n",
    "```\n",
    "　　我的so是自己编译的，具体的汇编代码如下,总之这里很明显在775C时，x0里保存的是一个指向”sakura”这个字符串的指针。(其实我也不是很看得懂arm64了已经，就随便hook了一下)，所以hook这个指令，然后Memory.readCString(this.context.x0);打印出来，结果如下\n",
    "```smali\n",
    ".text:000000000000772C ; __unwind {\n",
    ".text:000000000000772C                 SUB             SP, SP, #0x40\n",
    ".text:0000000000007730                 STP             X29, X30, [SP,#0x30+var_s0]\n",
    ".text:0000000000007734                 ADD             X29, SP, #0x30\n",
    ".text:0000000000007738 ; 6:   v6 = a1;\n",
    ".text:0000000000007738                 MOV             X8, XZR\n",
    ".text:000000000000773C                 STUR            X0, [X29,#var_8]\n",
    ".text:0000000000007740 ; 7:   v5 = a3;\n",
    ".text:0000000000007740                 STUR            X1, [X29,#var_10]\n",
    ".text:0000000000007744                 STR             X2, [SP,#0x30+var_18]\n",
    ".text:0000000000007748 ; 8:   v4 = (const char *)_JNIEnv::GetStringUTFChars(a1, a3, 0LL);\n",
    ".text:0000000000007748                 LDUR            X0, [X29,#var_8]\n",
    ".text:000000000000774C                 LDR             X1, [SP,#0x30+var_18]\n",
    ".text:0000000000007750                 MOV             X2, X8\n",
    ".text:0000000000007754                 BL              ._ZN7_JNIEnv17GetStringUTFCharsEP8_jstringPh ; _JNIEnv::GetStringUTFChars(_jstring *,uchar *)\n",
    ".text:0000000000007758                 STR             X0, [SP,#0x30+var_20]\n",
    ".text:000000000000775C ; 9:   if ( (signed int)_JNIEnv::GetStringUTFLength(v6, v5) > 0 )\n",
    ".text:000000000000775C                 LDUR            X0, [X29,#var_8]\n",
    ".text:0000000000007760                 LDR             X1, [SP,#0x30+var_18]\n",
    "```\n",
    "```js\n",
    "function inline_hook() {\n",
    "    var libnative_lib_addr = Module.findBaseAddress(\"libnative-lib.so\");\n",
    "    if (libnative_lib_addr) {\n",
    "        console.log(\"libnative_lib_addr:\", libnative_lib_addr);\n",
    "        var addr_775C = libnative_lib_addr.add(0x775C);\n",
    "        console.log(\"addr_775C:\", addr_775C);\n",
    "\n",
    "        Java.perform(function () {\n",
    "            Interceptor.attach(addr_775C, {\n",
    "                onEnter: function (args) {\n",
    "                    var name = this.context.x0.readCString()\n",
    "                    console.log(\"addr_775C OnEnter :\", this.returnAddress, name);\n",
    "                },\n",
    "                onLeave: function (retval) {\n",
    "                     console.log(\"retval is :\", retval) \n",
    "                }\n",
    "            })\n",
    "        })\n",
    "    }\n",
    "}\n",
    "setImmediate(inline_hook())\n",
    "```\n",
    "```shell\n",
    "Attaching...                                                            \n",
    "libnative_lib_addr: 0x79fabe0000\n",
    "addr_775C: 0x79fabe775c\n",
    "TypeError: cannot read property 'apply' of undefined\n",
    "    at [anon] (../../../frida-gum/bindings/gumjs/duktape.c:56618)\n",
    "    at frida/runtime/core.js:55\n",
    "[Google Pixel::myapplication.example.com.ndk_demo]-> addr_775C OnEnter : 0x79fabe7758 sakura\n",
    "addr_775C OnEnter : 0x79fabe7758 sakura\n",
    "```\n",
    "　　到这里已经可以总结一下我目前的学习了，需要补充一些frida api的学习，比如NativePointr里居然有个readCString，这些API是需要再看看的。\n",
    "\n",
    "## 十三、Frida native hook : Frida hook native app实战\n",
    "　　1、破解Frida全端口检测的native层反调试  \n",
    "　　　　hook libc的pthread_create函数  \n",
    "　　2、破解TracePid的native反调试  \n",
    "　　　　target: https://gtoad.github.io/2017/06/25/Android-Anti-Debug/  \n",
    "　　　　solve : hook libc的fgets函数  \n",
    "　　3、native层修改参数、返回值  \n",
    "　　4、静态分析JNI_Onload  \n",
    "　　5、动态trace主动注册 & IDA溯源  \n",
    "　　6、动态trace JNI、libc函数 & IDA溯源  \n",
    "　　7、native层主动调用、打调用栈  \n",
    "　　8、主动调用libc读写文件  \n",
    "　　看下logcat  \n",
    "```shell\n",
    "n/u0a128 for activity com.gdufs.xman/.MainActivity\n",
    "12-28 05:53:26.898 26615 26615 V com.gdufs.xman: JNI_OnLoad()\n",
    "12-28 05:53:26.898 26615 26615 V com.gdufs.xman: RegisterNatives() --> nativeMethod() ok\n",
    "12-28 05:53:26.898 26615 26615 D com.gdufs.xman m=: 0\n",
    "12-28 05:53:26.980 26615 26615 D com.gdufs.xman m=: Xman\n",
    "```\n",
    "```shell\n",
    "sakura@sakuradeMacBook-Pro:~/gitsource/frida-agent-example/agent# frida -U --no-pause -f com.gdufs.xman -l hook_reg.js\n",
    "...\n",
    "[Google Pixel::com.gdufs.xman]-> [RegisterNatives] method_count: 0x3\n",
    "[RegisterNatives] java_class: com.gdufs.xman.MyApp name: initSN sig: ()V fnPtr: 0xd4ddf3b1 module_name: libmyjni.so module_base: 0xd4dde000 offset: 0x13b1\n",
    "[RegisterNatives] java_class: com.gdufs.xman.MyApp name: saveSN sig: (Ljava/lang/String;)V fnPtr: 0xd4ddf1f9 module_name: libmyjni.so module_base: 0xd4dde000 offset: 0x11f9\n",
    "[RegisterNatives] java_class: com.gdufs.xman.MyApp name: work sig: ()V fnPtr: 0xd4ddf4cd module_name: libmyjni.so module_base: 0xd4dde000 offset: 0x14cd\n",
    "```\n",
    "　　initSN  \n",
    "　　　　感觉意思应该是从/sdcard/reg.dat里读一个值，然后和EoPAoY62@ElRD进行比较。  \n",
    "　　　　最后setValue，从导出函数看一下，最后推测第一个参数应该是JNIEnv \\*env，然后就看到了给字段m赋值。     \n",
    "  \n",
    "　　saveSN  \n",
    "　　　　这个看上去就是根据str的值，去变换”W3_arE_whO_we_ARE”字符串，然后写入到/sdcard/reg.dat里   \n",
    "\n",
    "　　结合一下看，只要initSN检查到/sdcard/reg.dat里是EoPAoY62@ElRD，应该就会给m设置成1。只要m的值是1，就能走到work()函数的逻辑。  \n",
    "　　参考frida的file api  \n",
    "```js\n",
    "function main() {\n",
    "    var file = new File(\"/sdcard/reg.dat\",'w')\n",
    "    file.write(\"EoPAoY62@ElRD\")\n",
    "    file.flush()\n",
    "    file.close()\n",
    "}\n",
    "setImmediate(main())\n",
    "```\n",
    "　　这样我们继续看work的逻辑;v2是从getValue得到的，看上去就是m字段的值，此时应该是1，一会hook一下看看。\n",
    "```shell\n",
    "[NewStringUTF] bytes:输入即是flag,格式为xman{……}！\n",
    "```\n",
    "　　callWork里又调用了work函数，死循环了。  \n",
    "\n",
    "　　那看来看去最后还是回到了initSN，那其实我们看的顺序似乎错了。  \n",
    "　　理一下逻辑，n2执行完保存到文件，然后n1 check一下，所以最后还是要逆n2的算法，pass。   \n",
    "\n",
    "\n",
    "## 十四、Frida trace四件套\n",
    "### 14.1、jni trace : trace jni\n",
    "https://github.com/chame1eon/jnitrace\n",
    "\n",
    "pip install jnitrace\n",
    "\n",
    "Requirement already satisfied: frida>=12.5.0 in /Users/sakura/.pyenv/versions/3.7.7/lib/python3.7/site-packages (from jnitrace) (12.8.0)\n",
    "Requirement already satisfied: colorama in /Users/sakura/.pyenv/versions/3.7.7/lib/python3.7/site-packages (from jnitrace) (0.4.3)\n",
    "Collecting hexdump (from jnitrace)\n",
    "  Downloading https://files.pythonhosted.org/packages/55/b3/279b1d57fa3681725d0db8820405cdcb4e62a9239c205e4ceac4391c78e4/hexdump-3.3.zip\n",
    "Installing collected packages: hexdump, jnitrace\n",
    "  Running setup.py install for hexdump ... done\n",
    "  Running setup.py install for jnitrace ... done\n",
    "Successfully installed hexdump-3.3 jnitrace-3.0.8\n",
    "usage: jnitrace [options] -l libname target\n",
    "默认应该是spawn运行的，\n",
    "\n",
    "-m来指定是spawn还是attach\n",
    "-b指定是fuzzy还是accurate\n",
    "-i \\<regex\\>指定一个正则表达式来过滤出方法名，例如-i Get -i RegisterNatives就会只打印出名字里包含Get或者RegisterNatives的JNI methods。\n",
    "-e \\<regex\\>和-i相反，同样通过正则表达式来过滤，但这次会将指定的内容忽略掉。\n",
    "-I \\<string\\>trace导出的方法，jnitrace认为导出的函数应该是从Java端能够直接调用的函数，所以可以包括使用RegisterNatives来注册的函数，例如-I stringFromJNI -I nativeMethod([B)V，就包括导出名里有stringFromJNI，以及使用RegisterNames来注册，并带有nativeMethod([B)V签名的函数。\n",
    "-o path/output.json，导出输出到文件里。\n",
    "-p path/to/script.js，用于在加载jnitrace脚本之前将指定路径的Frida脚本加载到目标进程中，这可以用于在jnitrace启动之前对抗反调试。\n",
    "-a path/to/script.js，用于在加载jnitrace脚本之后将指定路径的Frida脚本加载到目标进程中\n",
    "--ignore-env，不打印所有的JNIEnv函数\n",
    "--ignore-vm，不打印所有的JavaVM函数\n",
    "sakura@sakuradeMacBook-Pro:~/Desktop/lab/alpha/tools/android/frida_learn/0620/0620/xman/resources/lib/armeabi-v7a# jnitrace -l libmyjni.so com.gdufs.xman\n",
    "Tracing. Press any key to quit...\n",
    "Traced library \"libmyjni.so\" loaded from path \"/data/app/com.gdufs.xman-X0HkzLhbptSc0tjGZ3yQ2g==/lib/arm\".\n",
    "\n",
    "           /* TID 28890 */\n",
    "    355 ms [+] JavaVM->GetEnv\n",
    "    355 ms |- JavaVM*          : 0xefe99140\n",
    "    355 ms |- void**           : 0xda13e028\n",
    "    355 ms |:     0xeff312a0\n",
    "    355 ms |- jint             : 65542\n",
    "    355 ms |= jint             : 0\n",
    "\n",
    "    355 ms ------------------------Backtrace------------------------\n",
    "    355 ms |-> 0xda13a51b: JNI_OnLoad+0x12 (libmyjni.so:0xda139000)\n",
    "\n",
    "\n",
    "           /* TID 28890 */\n",
    "    529 ms [+] JNIEnv->FindClass\n",
    "    529 ms |- JNIEnv*          : 0xeff312a0\n",
    "    529 ms |- char*            : 0xda13bdef\n",
    "    529 ms |:     com/gdufs/xman/MyApp\n",
    "    529 ms |= jclass           : 0x81    { com/gdufs/xman/MyApp }\n",
    "\n",
    "    529 ms ------------------------Backtrace------------------------\n",
    "    529 ms |-> 0xda13a539: JNI_OnLoad+0x30 (libmyjni.so:0xda139000)\n",
    "\n",
    "\n",
    "           /* TID 28890 */\n",
    "    584 ms [+] JNIEnv->RegisterNatives\n",
    "    584 ms |- JNIEnv*          : 0xeff312a0\n",
    "    584 ms |- jclass           : 0x81    { com/gdufs/xman/MyApp }\n",
    "    584 ms |- JNINativeMethod* : 0xda13e004\n",
    "    584 ms |:     0xda13a3b1 - initSN()V\n",
    "    584 ms |:     0xda13a1f9 - saveSN(Ljava/lang/String;)V\n",
    "    584 ms |:     0xda13a4cd - work()V\n",
    "    584 ms |- jint             : 3\n",
    "    584 ms |= jint             : 0\n",
    "\n",
    "    584 ms ------------------------Backtrace------------------------\n",
    "    584 ms |-> 0xda13a553: JNI_OnLoad+0x4a (libmyjni.so:0xda139000)\n",
    "\n",
    "\n",
    "           /* TID 28890 */\n",
    "    638 ms [+] JNIEnv->FindClass\n",
    "    638 ms |- JNIEnv*          : 0xeff312a0\n",
    "    638 ms |- char*            : 0xda13bdef\n",
    "    638 ms |:     com/gdufs/xman/MyApp\n",
    "    638 ms |= jclass           : 0x71    { com/gdufs/xman/MyApp }\n",
    "\n",
    "    638 ms -----------------------Backtrace-----------------------\n",
    "    638 ms |-> 0xda13a377: setValue+0x12 (libmyjni.so:0xda139000)\n",
    "\n",
    "\n",
    "           /* TID 28890 */\n",
    "    688 ms [+] JNIEnv->GetStaticFieldID\n",
    "    688 ms |- JNIEnv*          : 0xeff312a0\n",
    "    688 ms |- jclass           : 0x71    { com/gdufs/xman/MyApp }\n",
    "    688 ms |- char*            : 0xda13be04\n",
    "    688 ms |:     m\n",
    "    688 ms |- char*            : 0xda13be06\n",
    "    688 ms |:     I\n",
    "    688 ms |= jfieldID         : 0xf1165004    { m:I }\n",
    "\n",
    "    688 ms -----------------------Backtrace-----------------------\n",
    "    688 ms |-> 0xda13a38d: setValue+0x28 (libmyjni.so:0xda139000)\n",
    "\n",
    "\n",
    "### 14.2、strace : trace syscall\n",
    "https://linuxtools-rst.readthedocs.io/zh_CN/latest/tool/strace.html\n",
    "\n",
    "### 14.3、frida-trace : trace libc(or more)\n",
    "https://frida.re/docs/frida-trace/\n",
    "\n",
    "Usage:frida-trace [options] target\n",
    "\n",
    "frida-trace -U -i \"strcmp\" -f com.gdufs.xman\n",
    "...\n",
    "  5634 ms  strcmp(s1=\"fi\", s2=\"es-US\")\n",
    "  5635 ms  strcmp(s1=\"da\", s2=\"es-US\")\n",
    "  5635 ms  strcmp(s1=\"es\", s2=\"es-US\")\n",
    "  5635 ms  strcmp(s1=\"eu-ES\", s2=\"es-US\")\n",
    "  5635 ms  strcmp(s1=\"et-EE\", s2=\"es-US\")\n",
    "  5635 ms  strcmp(s1=\"et-EE\", s2=\"es-US\")\n",
    "art trace: hook artmethod\n",
    "\n",
    "### 14.4、hook_artmethod : trace java函数调用\n",
    "https://github.com/lasting-yang/frida_hook_libart/blob/master/hook_artmethod.js\n",
    "\n",
    "### 14.5、修改AOSP源码打印\n",
    "改aosp源码trace信息\n",
    "\n",
    "\n",
    "## 十五、Frida native hook : init_array开发和自动化逆向\n",
    "init_array原理\n",
    "常见的保护都会在init_array里面做，关于其原理，主要阅读以下文章即可。\n",
    "\n",
    "IDA调试android so的.init_array数组\n",
    "Android NDK中.init段和.init_array段函数的定义方式\n",
    "Linker学习笔记\n",
    "IDA静态分析init_array\n",
    "// 编译生成后在.init段 [名字不可更改]\n",
    "extern \"C\" void _init(void) {\n",
    "    LOGD(\"Enter init......\");\n",
    "}\n",
    "\n",
    "// 编译生成后在.init_array段 [名字可以更改]\n",
    "__attribute__((__constructor__)) static void sakura_init() {\n",
    "    LOGD(\"Enter sakura_init......\");\n",
    "}\n",
    "...\n",
    "...\n",
    "2016-12-29 16:51:23.017 5160-5160/com.example.ndk_demo D/sakura1328: Enter init......\n",
    "2016-12-29 16:51:23.017 5160-5160/com.example.ndk_demo D/sakura1328: Enter sakura_init......\n",
    "\n",
    "IDA快捷键shift+F7找到segment，然后就可以找到.init_array段，然后就可以找到里面保存的函数地址。\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "IDA动态调试so\n",
    "打开要调试的apk，找到入口\n",
    "\n",
    "sakura@sakuradeMacBook-Pro:~/.gradle/caches$ adb shell dumpsys activity top | grep TASK\n",
    "TASK com.android.systemui id=29 userId=0\n",
    "TASK null id=26 userId=0\n",
    "TASK com.example.ndk_demo id=161 userId=0\n",
    "启动apk,并让设备将处于一个Waiting For Debugger的状态\n",
    "adb shell am start -D -n com.example.ndk_demo/.MainActivity\n",
    "\n",
    "执行android_server64\n",
    "\n",
    "sailfish:/data/local/tmp # ./android_server64\n",
    "IDA Android 64-bit remote debug server(ST) v1.22. Hex-Rays (c) 2004-2017\n",
    "Listening on 0.0.0.0:23946...\n",
    "新开一个窗口使用forward程序进行端口转发：adb forward tcp:23946 tcp:23946\n",
    "\n",
    "adb forward tcp:<本地机器的网络端口号> tcp:<模拟器或是真机的网络端口号>\n",
    "例:adb [-d|-e|-s ] forward tcp:6100 tcp:7100 表示把本机的6100端口号与模拟器的7100端口建立起相关，当模拟器或真机向自己的7100端口发送了数据，那们我们可以在本机的6100端口读取其发送的内容，这是一个很关键的命令，以后我们使用jdb调试apk之前，就要用它先把目标进程和本地端口建立起关联\n",
    "\n",
    "打开IDA，选择菜单Debugger -> Attach -> Remote ARM Linux/Android debugger\n",
    "\n",
    "打开IDA，选择菜单Debugger -> Process options, 填好，然后选择进程去attach。\n",
    "\n",
    "\n",
    "查看待调试的进程adb jdwp\n",
    "\n",
    "sakura@sakuradeMacBook-Pro:~$ adb jdwp\n",
    "10436\n",
    "转发端口adb forward tcp:8700 jdwp:10436，将该进程的调试端口和本机的8700绑定。\n",
    "\n",
    "jdb连接调试端口，从而让程序继续运行 jdb -connect com.sun.jdi.SocketAttach:hostname=127.0.0.1,port=8700\n",
    "\n",
    "找到断点并断下。\n",
    "\n",
    "打开module\n",
    "\n",
    "找到linker64\n",
    "\n",
    "找到call array函数\n",
    "\n",
    "下断并按F9断下\n",
    "\n",
    "\n",
    "最终我确实可以调试到.init_array的初始化，具体的代码分析见Linker学习笔记这里。\n",
    "\n",
    "init_array && JNI_Onload “自吐”\n",
    "JNI_Onload\n",
    "目标是找到动态注册的函数的地址，因为这种函数没有导出。\n",
    "\n",
    "JNINativeMethod methods[] = {\n",
    "            {\"stringFromJNI2\", \"()Ljava/lang/String;\", (void *) stringFromJNI2},\n",
    "    };\n",
    "    env->RegisterNatives(env->FindClass(\"com/example/ndk_demo/MainActivity\"), methods,\n",
    "                         1);\n",
    "首先jnitrace -m spawn -i \"RegisterNatives\" -l libnative-lib.so com.example.ndk_demo\n",
    "\n",
    "525 ms [+] JNIEnv->RegisterNatives\n",
    "525 ms |- JNIEnv*          : 0x7a106cc1c0\n",
    "525 ms |- jclass           : 0x89    { com/example/ndk_demo/MainActivity }\n",
    "525 ms |- JNINativeMethod* : 0x7ff0b71120\n",
    "525 ms |:     0x79f00d36b0 - stringFromJNI2()Ljava/lang/String;\n",
    "然后objection -d -g com.example.ndk_demo run memory list modules explore | grep demo\n",
    "\n",
    "sakura@sakuradeMacBook-Pro:~￥ objection -d -g com.example.ndk_demo run memory list modules explore | grep demo\n",
    "[debug] Attempting to attach to process: `com.example.ndk_demo`\n",
    "Warning: Output is not to a terminal (fd=1).\n",
    "base.odex                                        0x79f0249000  106496 (104.0 KiB)    /data/app/com.example.ndk_demo-HGAFhnKyKCSIpzn227pwXw==/oat/arm64/base.odex\n",
    "libnative-lib.so                                 0x79f00c4000  221184 (216.0 KiB)    /data/app/com.example.ndk_demo-HGAFhnKyKCSIpzn227pwXw==/lib/arm64/libnative...\n",
    "offset = 0x79f00d36b0 - 0x79f00c4000 = 0xf6b0\n",
    "\n",
    "这样就找到了\n",
    "\n",
    "\n",
    "init_array\n",
    "没有支持arm64，可以在安装app的时候adb install --abi armeabi-v7a强制让app运行在32位模式\n",
    "\n",
    "这个脚本整体来说就是hook callfunction，然后打印出init_array里面的函数地址和参数等。\n",
    "\n",
    "从源码看，关键就是call_array这里调用的call_function，第一个参数代表这是注册的init_array里面的function，第二个参数则是init_array里存储的函数的地址。\n",
    "\n",
    "template \\<typename F\\>\n",
    "static void call_array(const char* array_name __unused,\n",
    "                       F* functions,\n",
    "                       size_t count,\n",
    "                       bool reverse,\n",
    "                       const char* realpath) {\n",
    "  if (functions == nullptr) {\n",
    "    return;\n",
    "  }\n",
    "\n",
    "  TRACE(\"[ Calling %s (size %zd) @ %p for '%s' ]\", array_name, count, functions, realpath);\n",
    "\n",
    "  int begin = reverse ? (count - 1) : 0;\n",
    "  int end = reverse ? -1 : count;\n",
    "  int step = reverse ? -1 : 1;\n",
    "\n",
    "  for (int i = begin; i != end; i += step) {\n",
    "    TRACE(\"[ %s[%d] == %p ]\", array_name, i, functions[i]);\n",
    "    call_function(\"function\", functions[i], realpath);\n",
    "  }\n",
    "\n",
    "  TRACE(\"[ Done calling %s for '%s' ]\", array_name, realpath);\n",
    "}\n",
    "function LogPrint(log) {\n",
    "    var theDate = new Date();\n",
    "    var hour = theDate.getHours();\n",
    "    var minute = theDate.getMinutes();\n",
    "    var second = theDate.getSeconds();\n",
    "    var mSecond = theDate.getMilliseconds()\n",
    "\n",
    "    hour < 10 ? hour = \"0\" + hour : hour;\n",
    "    minute < 10 ? minute = \"0\" + minute : minute;\n",
    "    second < 10 ? second = \"0\" + second : second;\n",
    "    mSecond < 10 ? mSecond = \"00\" + mSecond : mSecond < 100 ? mSecond = \"0\" + mSecond : mSecond;\n",
    "\n",
    "    var time = hour + \":\" + minute + \":\" + second + \":\" + mSecond;\n",
    "    var threadid = Process.getCurrentThreadId();\n",
    "    console.log(\"[\" + time + \"]\" + \"->threadid:\" + threadid + \"--\" + log);\n",
    "\n",
    "}\n",
    "\n",
    "function hooklinker() {\n",
    "    var linkername = \"linker\";\n",
    "    var call_function_addr = null;\n",
    "    var arch = Process.arch;\n",
    "    LogPrint(\"Process run in:\" + arch);\n",
    "    if (arch.endsWith(\"arm\")) {\n",
    "        linkername = \"linker\";\n",
    "    } else {\n",
    "        linkername = \"linker64\";\n",
    "        LogPrint(\"arm64 is not supported yet!\");\n",
    "    }\n",
    "\n",
    "    var symbols = Module.enumerateSymbolsSync(linkername);\n",
    "    for (var i = 0; i < symbols.length; i++) {\n",
    "        var symbol = symbols[i];\n",
    "        //LogPrint(linkername + \"->\" + symbol.name + \"---\" + symbol.address);\n",
    "        if (symbol.name.indexOf(\"__dl__ZL13call_functionPKcPFviPPcS2_ES0_\") != -1) {\n",
    "            call_function_addr = symbol.address;\n",
    "            LogPrint(\"linker->\" + symbol.name + \"---\" + symbol.address)\n",
    "\n",
    "        }\n",
    "    }\n",
    "\n",
    "    if (call_function_addr != null) {\n",
    "        var func_call_function = new NativeFunction(call_function_addr, 'void', ['pointer', 'pointer', 'pointer']);\n",
    "        Interceptor.replace(new NativeFunction(call_function_addr,\n",
    "            'void', ['pointer', 'pointer', 'pointer']), new NativeCallback(function (arg0, arg1, arg2) {\n",
    "            var functiontype = null;\n",
    "            var functionaddr = null;\n",
    "            var sopath = null;\n",
    "            if (arg0 != null) {\n",
    "                functiontype = Memory.readCString(arg0);\n",
    "            }\n",
    "            if (arg1 != null) {\n",
    "                functionaddr = arg1;\n",
    "\n",
    "            }\n",
    "            if (arg2 != null) {\n",
    "                sopath = Memory.readCString(arg2);\n",
    "            }\n",
    "            var modulebaseaddr = Module.findBaseAddress(sopath);\n",
    "            LogPrint(\"after load:\" + sopath + \"--start call_function,type:\" + functiontype + \"--addr:\" + functionaddr + \"---baseaddr:\" + modulebaseaddr);\n",
    "            if (sopath.indexOf('libnative-lib.so') >= 0 && functiontype == \"DT_INIT\") {\n",
    "                LogPrint(\"after load:\" + sopath + \"--ignore call_function,type:\" + functiontype + \"--addr:\" + functionaddr + \"---baseaddr:\" + modulebaseaddr);\n",
    "\n",
    "            } else {\n",
    "                func_call_function(arg0, arg1, arg2);\n",
    "                LogPrint(\"after load:\" + sopath + \"--end call_function,type:\" + functiontype + \"--addr:\" + functionaddr + \"---baseaddr:\" + modulebaseaddr);\n",
    "\n",
    "            }\n",
    "\n",
    "        }, 'void', ['pointer', 'pointer', 'pointer']));\n",
    "    }\n",
    "}\n",
    "\n",
    "setImmediate(hooklinker)\n",
    "我调试了一下linker64，因为没有导出call_function的地址，所以不能直接hook符号名，而是要根据偏移去hook，以后再说。\n",
    "其实要看init_array，直接shift+F7去segment里面找.init_array段就可以了，这里主要是为了反反调试，因为可能反调试会加在init_array里，hook call_function就可以让它不加载反调试程序。\n",
    "\n",
    "native层未导出函数主动调用（任意符号和地址）\n",
    "现在我想要主动调用sakura_add来打印值,可以ida打开找符号，或者根据偏移，总之最终用这个NativePointer指针来初始化一个NativeFunction来调用。\n",
    "\n",
    "extern \"C\"\n",
    "JNIEXPORT jint JNICALL\n",
    "Java_com_example_ndk_1demo_MainActivity_sakuraWithInt(JNIEnv *env, jobject thiz, jint a, jint b) {\n",
    "    // TODO: implement sakuraWithInt()\n",
    "    return sakura_add(a,b);\n",
    "}\n",
    "...\n",
    "int sakura_add(int a, int b){\n",
    "    int sum = a+b;\n",
    "    LOGD(\"sakura add a+b:\",sum);\n",
    "    return sum;\n",
    "}\n",
    "\n",
    "\n",
    "function main() {\n",
    "    var libnative_lib_addr = Module.findBaseAddress(\"libnative-lib.so\");\n",
    "    console.log(\"libnative_lib_addr is :\", libnative_lib_addr);\n",
    "    if (libnative_lib_addr) {\n",
    "        var sakura_add_addr1 = Module.findExportByName(\"libnative-lib.so\", \"_Z10sakura_addii\");\n",
    "        var sakura_add_addr2 = libnative_lib_addr.add(0x0F56C) ;\n",
    "        console.log(\"sakura_add_addr1 \", sakura_add_addr1);\n",
    "        console.log(\"sakura_add_addr2 \", sakura_add_addr2)\n",
    "    }\n",
    "\n",
    "    var sakura_add1 = new NativeFunction(sakura_add_addr1, \"int\", [\"int\", \"int\"]);\n",
    "    var sakura_add2 = new NativeFunction(sakura_add_addr2, \"int\", [\"int\", \"int\"]);\n",
    "\n",
    "    console.log(\"sakura_add1 result is :\", sakura_add1(200, 33));\n",
    "    console.log(\"sakura_add2 result is :\", sakura_add2(100, 133));\n",
    "}\n",
    "setImmediate(main())\n",
    "...\n",
    "...\n",
    "libnative_lib_addr is : 0x79fa1c5000\n",
    "sakura_add_addr1  0x79fa1d456c\n",
    "sakura_add_addr2  0x79fa1d456c\n",
    "sakura_add1 result is : 233\n",
    "sakura_add2 result is : 233\n",
    "\n",
    "\n",
    "## 十六、C/C++ hook\n",
    "//todo\n",
    "\n",
    "Native/JNI层参数打印和主动调用参数构造\n",
    "jni的基本类型要通过调用jni相关的api转化成c++对象，才能打印和调用。\n",
    "jni主动调用的时候，参数构造有两种方式，一种是Java.vm.getenv，另一种是hook获取env之后来调用jni相关的api构造参数。\n",
    "\n",
    "C/C++编成so并引入Frida调用其中的函数\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "## 二、Frida Hook调试Java\n",
    "### 2.1、查看需hook的app包名与启动页\n",
    "　　在模拟器打开了任意一个app，命令行执行以下命令，就可以看到打开程序的包名及启动页的actvity。<br>\n",
    ">adb shell dumpsys window | findstr mCurrentFocus　　　# windows平台<br>\n",
    "adb shell dumpsys window | grep mFocusedWindow<br>\n",
    "adb shell pm path com.android.bluetooth　　　　　# 根据应用包名查看应用启动路径<br>\n",
    "\n",
    "\n",
    "### 2.2、调试安卓app\n",
    "　　frida hook调试app首先需要该app的源码, 找到自己想要调试的函数的位置。一切准备就绪后，就可以开始调试安卓程序了，参考以下步骤<br>\n",
    "　　在运行有frida-server的设备上安装需要调试的app<br>\n",
    "　　运行app然后在终端里运行指令: adb shell dumpsys activity top即可查看该app的包名, 这里假设我们找到的是com.xxx.xxx，然后使用python编写hook脚本：\n",
    ">\\# -*- coding:utf-8 -*-<br>\n",
    "import frida, sys<br>\n",
    "<br>\n",
    "\\# frida -U --no-pause -f \"com.xxx.xxx\"<br>\n",
    "package_name = \"com.xxx.xxx\" # 该app的包名<br>\n",
    "def on_message(message, data):<br>\n",
    " if message\\['type'\\] == 'send':<br>\n",
    "     print(\"\\[\\*\\] {0}\".format(message\\['payload'\\]))<br>\n",
    " else:<br>\n",
    "     print(message)<br>\n",
    "<br>\n",
    "\\# hook脚本<br>\n",
    "jscode = \"\"\"<br>\n",
    "Java.perform(function () {<br>\n",
    " console.log(\"start hook\")<br>\n",
    " var userLogin = Java.use(\"com.a.b.c\"); //com.a.b.c中c是需要调试函数所在的类名, com.a.b是c类所在的包名<br>\n",
    " send(\"userLogin: \" + userLogin);<br>\n",
    " userLogin.Encrypt.overload(\"java.lang.String\", \"java.lang.String\").implementation = function(a1, a2){<br>\n",
    "     console.log(a1);<br>\n",
    "     var result = this.Encrypt(a1, a2);<br>\n",
    "     console.log(result);<br>\n",
    "     return result;<br>\n",
    " }// Encrypt是我们想要hook的函数，\"java.lang.String\"则为相应位置的参数类型占位, a1,a2即为该函数的两个参数<br>\n",
    "});<br>\n",
    "\"\"\"<br>\n",
    "<br>\n",
    "device = frida.get_usb_device()<br>\n",
    "print(\"\\[\\*\\] 找到设备\")<br>\n",
    "\\# pid = device.spawn(\\[package_name\\])<br>\n",
    "\\# print(pid)<br>\n",
    "process = device.attach(package_name)<br>\n",
    "print(\"\\[\\*\\] 找到进程\")<br>\n",
    "\\# device.resume(pid)<br>\n",
    "script = process.create_script(jscode)<br>\n",
    "script.on('message', on_message)<br>\n",
    "print('\\[\\*\\] Running CTF')<br>\n",
    "script.load()<br>\n",
    "sys.stdin.read()<br>\n",
    "process.detach()<br>\n",
    "\n",
    "　　由于进程过多，可能导致上述代码不能成功执行hook功能，此时可通过在终端中执行frida -U --no-pause -f \"com.xxx.xxx\"来打开app(需将设备中待调试的app退出)， 然后再将hook脚本代码贴到终端中即可实现hook功能<br>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.7"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}