frida Hook调式

案例、修改即用

import frida, sys

def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

jscode2 = """

//打印调用堆栈
function printstack(){
    send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
}

//array 转成 string
function array2string(array){
    var buffer = Java.array('byte',array);
    //console.log(buffer.length);
    var result = "";
    for(var i = 0; i< buffer.length; ++i){
        result += (String.fromCharCode(buffer[i]));
    }
    return result;
}

//打印HashMap类型参数
function printHashMap(param_hm){    
    var HashMap = Java.use('java.util.HashMap');
    var args_map = Java.cast(param_hm, HashMap);
    send('args_map:'+args_map.toString());
}

Java.perform(function(){
    var 类名 = Java.use('找到需要hook的类名/路径')  
    类名.需要hook的方法名.implementation = function(参数1,参数2){       
        send(参数1)
        send(参数2)
        var a = this.需要hook的方法名(参数1,参数2)
        send('I am here');
        send(a);                                             
        return a;
    };
})

"""

process = frida.get_usb_device(timeout=1000).attach('添加要hook的包名')
script = process.create_script(jscode2)  # 需要hook的函数
script.on('message', on_message)  # 固定格式，打印
print('[*] Running CTF')
script.load()  # 加载
sys.stdin.read()  # 使程序一直运行，不结束