Frida Hook so示例模板

# -*- coding: utf-8 -*-
# @Author  : Codeooo
# @Time    : 2021/12/24


import frida
import sys



"""
NDK开发
https://blog.csdn.net/weixin_38927522/article/details/120078401
动静态注册
https://blog.csdn.net/weixin_38927522/article/details/119672156
"""



# hook so层方法
jscode = """
Java.perform(function(){
    Interceptor.attach(Module.findExportByName("libfridaso.so","Java_com_example_fridasostring_fridaSoString_FridaSo"),{
        onEnter: function(args) {
            send("Hook start");
            send("args[2]=" + args[2]); //这里打印第一个参数为下标2,因为静态注册: 0,1 为JNIEnv* env,jobject obj|jclass clazz 动态注册: JavaVM* vm
        },
        onLeave: function(retval){
            send("return:"+retval);
            var env = Java.vm.getEnv(); //获取env对象，也就是native函数的第一个参数
            var jstrings = env.newStringUtf("tamper"); //因为返回的是字符串指针，使用我们需要构造一个newStringUtf对象，用来代替这个指针
            retval.replace(jstrings); //替换返回值
        }
    });
});
"""

jscode_fun = """
Java.perform(function(){
    var str_name_so = "libnative-lib.so";    //要hook的so名
    var str_name_func = "func_exp";          //要hook的函数名
    //var str_name_func = "_Z12func_exp_cppv";    //这里注意名称
    
    var n_addr_func = Module.findExportByName(str_name_so , str_name_func);
    console.log("func addr is ---" + n_addr_func);
    
    Interceptor.attach(n_addr_func, {
        //在hook函数之前执行的语句
        onEnter: function(args)
        {
            console.log("hook on enter")
        },
        //在hook函数之后执行的语句
        onLeave:function(retval)
        {
            console.log("hook on leave")
        }
    });
});
"""

# hook so地址
jscode_addr = """
Java.perform(function(){
    var str_name_so = "libnative-lib.so";    //要hook的so名
    var n_addr_func_offset = 0x7078;         //要hook的函数在函数里面的偏移
    
    //加载到内存后 函数地址 = so地址 + 函数偏移
    var n_addr_so = Module.findBaseAddress(str_name_so);
    var n_addr_func = parseInt(n_addr_so, 16) + n_addr_func_offset;
    
    var ptr_func = new NativePointer(n_addr_func);
    Interceptor.attach(ptr_func, 
    {
        onEnter: function(args) 
        {
            console.log("hook on enter no exp");
        },
        onLeave:function(retval)
        {
            console.log("hook on Leave no exp");
        }
    });
});
"""




def printMessage(message,data):
    if message['type'] == 'send':
        print(' {0}'.format(message['payload']))
    else:
        print(message)

process = frida.get_remote_device().attach('com.sun.codeooo')
script = process.create_script(jscode)
script.on('message',printMessage)
script.load()
sys.stdin.read()