frida_android使用

root@kali:~# dpkg-reconfigure tzdata

Current default time zone: 'Asia/Shanghai'
Local time is now:      Mon Jun  8 15:53:20 CST 2020.
Universal Time is now:  Mon Jun  8 07:53:20 UTC 2020.

sudo apt-get update
sudo apt-get upgrade
apt install xfonts-intl-chinese
apt install ttf-wqy-microhei

apt install tmux

# 划分上下两个窗格
$ tmux split-window

# 划分左右两个窗格
$ tmux split-window -h

# 光标切换到上方窗格
$ tmux select-pane -U

# 光标切换到下方窗格
$ tmux select-pane -D

# 光标切换到左边窗格
$ tmux select-pane -L

# 光标切换到右边窗格
$ tmux select-pane -R

# 当前窗格上移
$ tmux swap-pane -U

# 当前窗格下移
$ tmux swap-pane -D

git clone https://github.com/pyenv/pyenv.git ~/.pyenv
echo 'export PYENV_ROOT="$HOME/.pyenv"' >> ~/.bashrc
echo 'export PATH="$PYENV_ROOT/bin:$PATH"' >> ~/.bashrc
echo -e 'if command -v pyenv 1>/dev/null 2>&1; then\n  eval "$(pyenv init -)"\nfi' >> ~/.bashrc
重新打开个控制台
 exec "$SHELL"
pyenv version 查看版本

pyenv下载python
pyenv install 3.8.0
当前版本
pyenv version
全部版本
pyenv versions
切换版本
pyenv local 3.8.0
查看python版本
python -V
查看pip版本
pip -V

curl -sL https://deb.nodesource.com/setup_10.x | sudo -E bash

sudo apt update

sudo apt install -y nodejs
sudo apt install npm

root@kali:~/Downloads/platform-tools# cat ~/.bashrc |grep export

export PYENV_ROOT="$HOME/.pyenv"

export PATH="$PYENV_ROOT/bin:$PATH"

root@kali:~/Downloads/platform-tools# pwd

/root/Downloads/platform-tools

root@kali:~/Downloads/platform-tools# export PATH="/root/Downloads/platform-tools:$PATH"



nano ~/.bashrc

添加

export PATH="/root/Downloads/platform-tools:$PATH"

推出nano

ctrl x - y

source ~/.bahrc
测试命令

adb

/root/Desktop/android-studio/bin
./studio.sh 

export PATH="/root/Android/Sdk/platform-tools:$PATH"
添加到~/.bashrc
nano ~/.bashrc
ctrl x
y
source ~/.bashrc
which adb
/root/Android/Sdk/platform-tools/adb

openssl dgst -sha256 bullhead-opm7.181205.001-factory-5f189d84.zip

adb shell getprop ro.product.cpu.abi #查看手机cpu

解压frida-server
cd frida-server-12.8.0-android-arm64
root@kali:~/Desktop/frida-server-12.8.0-android-arm64# ls
frida-server-12.8.0-android-arm64
root@kali:~/Desktop/frida-server-12.8.0-android-arm64# mv frida-server-12.8.0-android-arm64 fs1280arm64
adb push  fs1280arm64 /data/local/tmp
adb shell 
su
cd /data/local/tmp
chmod 777 fs1280arm64
./fs1280arm64 -l 0.0.0.0:8888

pip install frida==12.8.0 
pip install frida-tools==5.3.0 
pip install objection==1.8.4

 ./fs1280arm64

objection -N -g com.android.settings explore
plugin load /root/Desktop/Wallbreaker 
plugin wallbreaker classdump --fullname android.bluetooth.BuletoothDevice
plugin wallbreaker classdump --fullname sun.util.logging.PlatformLogger

 ./fs1280arm64

objection -N -g com.android.settings explore
plugin load /root/Desktop/FRIDA-DEXDump 
plugin dexdump search 
android intent launch_activity com.xx.xx.activity.MainActivity
plugin dexdump dump
新打开一个命令行窗口
cd root/com.xx.xx/
搜索MainActivity
grep -ril "MainActivity" *

目前最新正确的Frida环境搭建方法： 
1. git clone https://github.com/oleavr/frida-agent-example.git
2. cd frida-agent-example/ 
3. npm install 
4. 使用VSCode等IDE打开此工程，在agent下编写typescript，会有智能提示。 
5. npm run watch会监控代码修改自动编译生成js文件 
6. frida -U -f com.example.android --no-pause -l _agent.js

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        findViewById(R.id.mBtnTest).setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View view) {
                helloAndroid();
                test1();
                test2(123);
                test3("str");
                test4("str",true);

                ((Button)findViewById(R.id.mBtnTest)).setText(test5());
            }
        });
    }

    private void helloAndroid() {
        System.out.println("helloAndroid");
    }

    private void test1() {
        System.out.println("test1()");
    }

    private void test2(int i) {
        System.out.println("test2(int)"+i);
    }

    private void test3(String s) {
        System.out.println("test3(String)"+s);
    }

    private void test4(String s,boolean b) {
        System.out.println("test4(String,boolean)"+s+","+b);
    }

    private String test5() {
        return "error";
    }
}

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto"
    xmlns:tools="http://schemas.android.com/tools"
    android:layout_width="match_parent"
    android:layout_height="match_parent"
    tools:context=".MainActivity">
    
    <Button
        android:id="@+id/mBtnTest"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content" />

</LinearLayout>

console.log("[*] Starting script");
Java.perform(function () {
    var MainActivity = Java.use("com.demo.android_frida.MainActivity");
    MainActivity.helloAndroid.implementation = function () {
        console.log("helloAndroid()");
        // this.private_func();
    };
    MainActivity.test1.overload().implementation = function () {
        console.log("test1()");
        // this.private_func();
    };
    MainActivity.test2.overload("int").implementation = function (i) {
        console.log("test2(int): " + i);
        // this.private_func(i);
    };
    MainActivity.test3.overload("java.lang.String").implementation = function () {
        console.log("test3(String): " + arguments[0]);
        // this.private_func(arguments[0]);
    };
    //输出
    MainActivity.test4.overload("java.lang.String", "boolean").implementation = function (s, b) {
        console.log("test4(String,boolean): " + s + ", " + b);
        // this.private_func(s, b);
    };
    // 修改返回值
    MainActivity.test5.overload().implementation= function(){
        console.log("test5");
        // return this.test5()+"llll";
        return "ffff";
    }
});

frida -U -l frida.js com.demo.android_frida

     ____
    / _  |   Frida 12.4.8 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/
Attaching... 

[*] Starting script
[LGE Nexus 5::com.demo.android_frida]-> helloAndroid()
test1()
test2(int): 123
test3(String): str
test4(String,boolean): str, true
test5