hook框架frida添加至于安卓应用中
转载至于https://koz.io/using-frida-on-android-without-root/
Frida is a great toolkit by @oleavr, used to build tools for dynamic instrumentation of apps in userspace. It is often used, like Substrate, Xposed and similar frameworks, during security reviews of mobile applications.
Typically rooted Android devices are used during such reviews. There are several reasons for this, but the most important is that the frida-server
binary, which executes on the device, requires root privileges to attach to (ptrace
) the target application, in order to inject the Frida gadget library into the memory space of the process.
However, testing on a rooted device is not the only way! I am not sure why this technique is not more widely publicized, but Frida can also be used on non-rooted Android devices and non-jailbroken iPhones, without running frida-server
at all. In this post I will focus on Android, however things are pretty similar on iOS - frida can also be used on jailed Apple devices.
A few advantages of using Frida on a non-rooted device:
- Enables testing on devices you cannot or do not want to root (obviously).
- Avoids some sideeffects due to application checks for ptracing/debugging or checks for tampered environment.
However:
- This technique will trigger checks against repackaging (unless those are separately bypassed).
Adding frida-gadget
to an Android application
The technique is simple, it can be described in short as “adding a shared library & repackaging the Android application”. Here it is, step by step:
Get the the APK binary of te application you want to test, e.g.
myapp.apk
.Use
apktool
to decode the APK into it’s contents. Preferably its latest version.$ apktool d myapp.apk -o extractedFolder
Add the frida native libraries (
frida-gadget
) into the APK’s /lib folder. The gadget libraries for each architecture can be found in Frida’s release page. Make sure to add the libraries for the correct architecture in a suitable folder under/lib
, e.g./lib/armeabi
for 32bit ARM devices.$ apktool --version
2.2.2 $ apktool d -o out_dir original.apk
I: Using Apktool 2.2.2 on original.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: ~/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files... # download frida gadget - for 32bit ARM in this case
$ wget https://github.com/frida/frida/releases/download/9.1.26/frida-gadget-9.1.26-android-arm.so.xz
2017-04-11 10:48:45 (3.29 MB/s) - ‘frida-gadget-9.1.26-android-arm.so.xz’ saved [3680748/3680748] # extract the compressed archive
$ unxz frida-gadget-9.1.26-android-arm.so.xz $ ls
frida-gadget-9.1.26-android-arm.so # copy frida gadget library in armeabi directory under lib
$ cp frida_libs/armeabi/frida-gadget-9.1.26-android-arm.so out_dir/lib/armeabi/libfrida-gadget.so
Inject a
System.loadLibrary("frida-gadget")
call into the bytecode of the app, ideally before any other bytecode executes or any native code is loaded. A suitable place is typically the static initializer of the entry point classes of the app, e.g. the main application Activity, found via the manifest.An easy way to do this is to add the following smali code in a suitable function:
const-string v0, "frida-gadget"
invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V
Alternatively someone could create a script that injects the library into the process via ptrace; but this script would need to be packaged with the application (just like
gdbserver
).Add the Internet permission to the manifest if it’s not there already, so that Frida gadget can open a socket.
<uses-permission android:name="android.permission.INTERNET" />
Repackage the application:
$ apktool b -o repackaged.apk out_dir/
I: Using Apktool 2.2.2
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether resources has changed...
I: Building resources...
I: Copying libs... (/lib)
I: Building apk file...
I: Copying unknown files/dir...
Sign the updated APK using your own keys and zipalign.
# if you dont have a keystore already, here's how to create one
$ keytool -genkey -v -keystore custom.keystore -alias mykeyaliasname -keyalg RSA -keysize 2048 -validity 10000 # sign the APK
$ jarsigner -sigalg SHA1withRSA -digestalg SHA1 -keystore mycustom.keystore -storepass mystorepass repackaged.apk mykeyaliasname # verify the signature you just created
$ jarsigner -verify repackaged.apk # zipalign the APK
$ zipalign 4 repackaged.apk repackaged-final.apk
Install the updated APK to a device.
If this process seems complicated, the good news is that it can be automated. As part of the appmon hooking framework (based on Frida) @dpnishant released apk_builder, a script automating most of the above steps!
Using frida gadget
When you next start the application you are going to see an empty screen: The injected libfrida-gadget.so
library has opened a tcp socket and waits for a connection from frida.
You should see a message similar to the following in logcat:
Frida: Listening on TCP port 27042
Running nestat
on the device confirms the listening socket:
shell@flo:/ $ netstat -ln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:27042 0.0.0.0:*
As you might expect, the next step is connecting to the listening socket: Most frida tools work as expected although there are a few issues that can be handled better, e.g. connecting to the library after initialization, not just during loading.
There is just one thing to keep in mind: The process name you are going to use in Frida tooling should be “Gadget” instead of the normal package name.
$ frida-ps -U
Waiting for USB device to appear...
PID Name
----- ------
16071 Gadget
Examples!
$ frida -U Gadget
____
/ _ | Frida 9.1.26 - A world-class dynamic instrumentation framework
| (_| |
> _ | Commands:
/_/ |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at http://www.frida.re/docs/home/
Waiting for USB device to appear...
[USB::Samsung SM-G925F::Gadget]-> Java.available
true
[USB::Samsung SM-G925F::Gadget]->
$ frida-trace -U -i open Gadget
Instrumenting functions...
open: Auto-generated handler at "/tmp/test/__handlers__/libc.so/open.js"
Started tracing 1 function. Press Ctrl+C to stop.
/* TID 0x2df7 */
4870 ms open(pathname=0xa280b100, flags=0x241)
4873 ms open(pathname=0xb6d69df3, flags=0x2)
/* TID 0x33d2 */
115198 ms open(pathname=0xb6d69df3, flags=0x2)
115227 ms open(pathname=0xb6d69df3, flags=0x2)
Enjoy!
hook框架frida添加至于安卓应用中的更多相关文章
- hook框架frida的安装以及简单实用案例
1.下载地址 https://github.co/frida/frida/releases 2.另外两种安装方法 1.Install from prebuilt binaries This is th ...
- hook框架-frida使用-环境配置
一.python安装模块 pip3 install frida pip3 install frida-tools 二.下载frida-server #下载链接 https://github.com/f ...
- hook框架-frida使用-APP在模拟器无法打开,用钩子去除限制
app拿soul为例子 一.环境配置 #模拟器的frida服务为86 #frida-server-12.9.8-android-x86 adb push frida-server-12.9.8-and ...
- hook框架-frida简单使用模板以及frida相关接口
一目录结构 ├── test.py #py脚本 └── test.js #js脚本 一.py脚本 test.py import frida import sys #连接设备app dev=frida. ...
- Android Hook框架adbi的分析(1)---注入工具hijack
本文博客地址:http://blog.csdn.net/qq1084283172/article/details/74055505 一.Android Hook框架adbi的基本介绍 adbi是And ...
- Android 安全研究 hook 神器frida学习(一)
在进行安卓安全研究时,hook技术是不可或缺的,常用的有Xposed:Java层的HOOK框架,由于要修改Zgote进程,需要Root,体验过Xposed,整个过程还是很繁琐的,并且无法hook,na ...
- 【转】Android Hook框架Xposed详解
1 Introduction 1.1 概述 Xposed 是 GitHUB 上 rovo89 大大设计的一个针对 Android 平台的动态劫持项目,通过替换 /system/bin/app_pro ...
- Android中免root的hook框架Legend原理解析
一.前言 Android中hook框架已经非常多了,最优秀的当属Xposed和Substrate了,这两个框架我在之前的文章都详细介绍过了,不了解的同学,可以转战这里:http://www.wjdia ...
- Android Hook框架Xposed详解
1 Introduction 1.1 概述 Xposed 是 GitHUB 上 rovo89 大大设计的一个针对 Android 平台的动态劫持项目,通过替换 /system/bin/app_pro ...
随机推荐
- word2vec生成后缀名model文件处理
引入from gensim.models import word2vec 读取test02.model里面的词· model = word2vec.Word2Vec.load('test02.mode ...
- CSP2019 滚粗记
目录 CSP 2019 游记 DAY 0 DAY 1 DAY 2 CSP总结 自测之后 CSP 2019 游记 坐标:GD,GZ 人物:hyf 组别:J和S 任务:划水 目标:划水 任务奖励:退役证书 ...
- SpringBoot中普通类无法通过@Autowired自动注入Service、dao等bean解决方法
无法注入原因: 有的时候我们有一些类并不想注入Spring容器中,有Spring容器实例化,但是我们又想使用Spring容器中的一些对象,所以就只能借助工具类来获取了 工具类: package com ...
- nginx 缓存
浏览器缓存与nginx缓存 浏览器缓存 优点:使用有效缓存时,没有网络消耗,速度快:即使有网络消耗,但对失效缓存使用304响应做到网络消耗最小化 缺点:仅提升一个用户的体验 nginx 缓存 优点:提 ...
- JS闭包(2)
利用闭包的特点,我们可以在封装自己的模块的时候只向外暴露我们模块中的数据,而不让其修改. 1.第一中封装的方式,新建一个myModule.js文件,这个模块的作用是对外部提供明天和后天的天气. 在my ...
- jQuery常用操作(待续)
1. input清空内容 <1> $("#选择器id").val(""); <2> $("input[name='input框 ...
- python的沙盒环境--virtualenv
VirtualEnv用于在一台机器上创建多个独立的python运行环境,VirtualEnvWrapper为前者提供了一些便利的命令行上的封装. 使用 VirtualEnv 的理由: 隔离项目之间 ...
- 获取进程对应的UID登陆用户
getlogin获取登陆用户,守护进程调用出错 一个用户UID可以对应多个登陆名吗?貌似可以
- TCP/IP,三次握手四次挥手,TCP/UDP , HTTP/HTTPS
internet:通用名词,由多个计算机网络组成的网络,网络间的通信协议是任意的 Internet:专用名词,当前全球最大的开放计算机网络,采用TCP/IP协议族作为通信的规则.www万维网是广泛应用 ...
- 一个小白对auth的理解
---恢复内容开始--- PS:最近需要做一个验证用户权限的功能,在官方和百度看了下,发现大家都是用auth来做验证,官方有很多auth的使用教程,但是都不全面,我也提问了几个关于auth的问题 也没 ...