吾爱破解 - LCG - LSG |安卓破解|病毒分析|破解软件|www.40881110.com

 ?#19968;?#23494;码
 注册[Register]
搜索
查看: 1812|回复: 8
上一主题 下一主题

[Android 原创] Frida HOOK入门之剪刀石头布破解

  [复制链接]
跳转到指定楼层
楼主
Richor 发表于 2019-6-26 10:16 回帖奖励
本帖最后由 Richor 于 2019-6-26 10:18 编辑

个人觉得FrIDA是比Xpose更牛逼一丢丢的框架,今天用一个剪刀石头布的apk来?#24471;?#19968;下frida HOOK
目标:让程序直接输出获胜1000次
第一步:搭建环境
(1)Python及其IDE
    1.1安装python2.7或者python3.6        进入官网:https://www.python.org/   选择Downloads>Windows  下载相应版本   安装
    1.2 Python IDE:我是使用pycharm,其他的IDE?#27604;?#20063;可以
    1.3模拟器选用雷电模拟器

(2)Frida环境搭建
    2.1模拟器端环境
       下载https://github.com/frida/frida/releases/download/12.0.8/frida-server-12.0.8-android-x86.xz  即可  并改名为Frida-server
        打开CMD输入下面的指令
       adb push  Frida-server  /data/local/tmp/      adb shell "chmod 755 /data/local/tmp/Frida-server"
      adb shell  "/data/local/tmp/Frida-server &"
     不要关闭此窗口,否则frida-server会掉
   2.2Python端环境
       打开pycharm,新建工程,打开新的CMD,输入以下指令
       pip install frida
      安装完成后查看进程
    firda-ps -U
   
(3)程序分析
我们先用ak反编译看?#21019;?#30721;
[Asm] 纯文本查看 复制代码
.class public Lcom/example/seccon2015/rock_paper_scissors/MainActivity;
.super Landroid/app/Activity;
.source "MainActivity.java"

# interfaces
.implements Landroid/view/View$OnClickListener;


# instance fields
.field P:Landroid/widget/Button;

.field S:Landroid/widget/Button;

.field cnt:I

.field flag:I

.field private final handler:Landroid/os/Handler;

.field m:I

.field n:I

.field r:Landroid/widget/Button;

.field private final showMessageTask:Ljava/lang/Runnable;


# direct methods
.method static constructor <clinit>()V
    .locals 1

    .prologue
    .line 22
    const-string v0, "calc"

    invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V

    .line 23
    return-void
.end method

.method public constructor <init>()V
    .locals 1

    .prologue
    .line 13
    invoke-direct {p0}, Landroid/app/Activity;-><init>()V

    .line 15
    const/4 v0, 0x0

    iput v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->cnt:I

    .line 25
    new-instance v0, Landroid/os/Handler;

    invoke-direct {v0}, Landroid/os/Handler;-><init>()V

    iput-object v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->handler:Landroid/os/Handler;

    .line 26
    new-instance v0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity$1;

    invoke-direct {v0, p0}, Lcom/example/seccon2015/rock_paper_scissors/MainActivity$1;-><init>(Lcom/example/seccon2015/rock_paper_scissors/MainActivity;)V

    iput-object v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->showMessageTask:Ljava/lang/Runnable;

    return-void
.end method


# virtual methods
.method public native calc()I
.end method

.method public onClick(Landroid/view/View;)V
    .locals 10
    .param p1, "v"    # Landroid/view/View;

    .prologue
    const/4 v9, 0x3

    const/4 v8, 0x2

    const/4 v7, 0x0

    const/4 v6, 0x1

    .line 78
    iget v5, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->flag:I

    if-ne v5, v6, :cond_0

    .line 109
    :goto_0
    return-void

    .line 80
    :cond_0
    iput v6, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->flag:I

    .line 82
    const v5, 0x7f0c0052

    invoke-virtual {p0, v5}, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->findViewById(I)Landroid/view/View;

    move-result-object v4

    check-cast v4, Landroid/widget/TextView;

    .line 83
    .local v4, "tv3":Landroid/widget/TextView;
    const-string v5, ""

    invoke-virtual {v4, v5}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    .line 85
    const v5, 0x7f0c0050

    invoke-virtual {p0, v5}, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->findViewById(I)Landroid/view/View;

    move-result-object v2

    check-cast v2, Landroid/widget/TextView;

    .line 86
    .local v2, "tv":Landroid/widget/TextView;
    const v5, 0x7f0c0051

    invoke-virtual {p0, v5}, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->findViewById(I)Landroid/view/View;

    move-result-object v3

    check-cast v3, Landroid/widget/TextView;

    .line 88
    .local v3, "tv2":Landroid/widget/TextView;
    iput v7, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->m:I

    .line 89
    new-instance v0, Ljava/util/Random;

    invoke-direct {v0}, Ljava/util/Random;-><init>()V

    .line 90
    .local v0, "rm":Ljava/util/Random;
    invoke-virtual {v0, v9}, Ljava/util/Random;->nextInt(I)I

    move-result v5

    iput v5, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->n:I

    .line 92
    new-array v1, v9, [Ljava/lang/String;

    const-string v5, "CPU: Paper"

    aput-object v5, v1, v7

    const-string v5, "CPU: Rock"

    aput-object v5, v1, v6

    const-string v5, "CPU: Scissors"

    aput-object v5, v1, v8

    .line 93
    .local v1, "ss":[Ljava/lang/String;
    iget v5, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->n:I

    aget-object v5, v1, v5

    invoke-virtual {v3, v5}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    .line 95
    iget-object v5, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->P:Landroid/widget/Button;

    if-ne p1, v5, :cond_1

    .line 96
    const-string v5, "YOU: Paper"

    invoke-virtual {v2, v5}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    .line 97
    iput v7, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->m:I

    .line 99
    :cond_1
    iget-object v5, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->r:Landroid/widget/Button;

    if-ne p1, v5, :cond_2

    .line 100
    const-string v5, "YOU: Rock"

    invoke-virtual {v2, v5}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    .line 101
    iput v6, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->m:I

    .line 103
    :cond_2
    iget-object v5, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->S:Landroid/widget/Button;

    if-ne p1, v5, :cond_3

    .line 104
    const-string v5, "YOU: Scissors"

    invoke-virtual {v2, v5}, Landroid/widget/TextView;->setText(Ljava/lang/CharSequence;)V

    .line 105
    iput v8, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->m:I

    .line 108
    :cond_3
    iget-object v5, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->handler:Landroid/os/Handler;

    iget-object v6, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->showMessageTask:Ljava/lang/Runnable;

    const-wide/16 v8, 0x3e8

    invoke-virtual {v5, v6, v8, v9}, Landroid/os/Handler;->postDelayed(Ljava/lang/Runnable;J)Z

    goto :goto_0
.end method

.method protected onCreate(Landroid/os/Bundle;)V
    .locals 1
    .param p1, "savedInstanceState"    # Landroid/os/Bundle;

    .prologue
    .line 60
    invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V

    .line 61
    const v0, 0x7f040018

    invoke-virtual {p0, v0}, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->setContentView(I)V

    .line 63
    const v0, 0x7f0c004d

    invoke-virtual {p0, v0}, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->findViewById(I)Landroid/view/View;

    move-result-object v0

    check-cast v0, Landroid/widget/Button;

    iput-object v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->P:Landroid/widget/Button;

    .line 64
    const v0, 0x7f0c004f

    invoke-virtual {p0, v0}, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->findViewById(I)Landroid/view/View;

    move-result-object v0

    check-cast v0, Landroid/widget/Button;

    iput-object v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->S:Landroid/widget/Button;

    .line 65
    const v0, 0x7f0c004e

    invoke-virtual {p0, v0}, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->findViewById(I)Landroid/view/View;

    move-result-object v0

    check-cast v0, Landroid/widget/Button;

    iput-object v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->r:Landroid/widget/Button;

    .line 67
    iget-object v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->P:Landroid/widget/Button;

    invoke-virtual {v0, p0}, Landroid/widget/Button;->setOnClickListener(Landroid/view/View$OnClickListener;)V

    .line 68
    iget-object v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->r:Landroid/widget/Button;

    invoke-virtual {v0, p0}, Landroid/widget/Button;->setOnClickListener(Landroid/view/View$OnClickListener;)V

    .line 69
    iget-object v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->S:Landroid/widget/Button;

    invoke-virtual {v0, p0}, Landroid/widget/Button;->setOnClickListener(Landroid/view/View$OnClickListener;)V

    .line 71
    const/4 v0, 0x0

    iput v0, p0, Lcom/example/seccon2015/rock_paper_scissors/MainActivity;->flag:I

    .line 72
    return-void
.end method

反编译成java看看
[Java] 纯文本查看 复制代码
package com.example.seccon2015.rock_paper_scissors;

import android.app.Activity;
import android.os.Bundle;
import android.os.Handler;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.Button;
import android.widget.TextView;
import java.util.Random;

public class MainActivity extends Activity implements OnClickListener {
    Button P;
    Button S;
    int cnt = 0;
    int flag;
    private final Handler handler = new Handler();
    int m;
    int n;
    Button r;
    private final Runnable showMessageTask = new Runnable() {
        public void run() {
            TextView tv3 = (TextView) MainActivity.this.findViewById(R.id.textView3);
            MainActivity mainActivity;
            if (MainActivity.this.n - MainActivity.this.m == 1) {
                mainActivity = MainActivity.this;
                mainActivity.cnt++;
                tv3.setText("WIN! +" + String.valueOf(MainActivity.this.cnt));
            } else if (MainActivity.this.m - MainActivity.this.n == 1) {
                MainActivity.this.cnt = 0;
                tv3.setText("LOSE +0");
            } else if (MainActivity.this.m == MainActivity.this.n) {
                tv3.setText("DRAW +" + String.valueOf(MainActivity.this.cnt));
            } else if (MainActivity.this.m < MainActivity.this.n) {
                MainActivity.this.cnt = 0;
                tv3.setText("LOSE +0");
            } else {
                mainActivity = MainActivity.this;
                mainActivity.cnt++;
                tv3.setText("WIN! +" + String.valueOf(MainActivity.this.cnt));
            }
            if (1000 == MainActivity.this.cnt) {
                tv3.setText("SECCON{" + String.valueOf((MainActivity.this.cnt + MainActivity.this.calc()) * 107) + "}");
            }
            MainActivity.this.flag = 0;
        }
    };

    public native int calc();

    static {
        System.loadLibrary("calc");
    }

    /* Access modifiers changed, original: protected */
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        this.P = (Button) findViewById(R.id.button);
        this.S = (Button) findViewById(R.id.button3);
        this.r = (Button) findViewById(R.id.buttonR);
        this.P.setOnClickListener(this);
        this.r.setOnClickListener(this);
        this.S.setOnClickListener(this);
        this.flag = 0;
    }

    public void onClick(View v) {
        if (this.flag != 1) {
            this.flag = 1;
            ((TextView) findViewById(R.id.textView3)).setText("");
            TextView tv = (TextView) findViewById(R.id.textView);
            TextView tv2 = (TextView) findViewById(R.id.textView2);
            this.m = 0;
            this.n = new Random().nextInt(3);
            tv2.setText(new String[]{"CPU: Paper", "CPU: Rock", "CPU: Scissors"}[this.n]);
            if (v == this.P) {
                tv.setText("YOU: Paper");
                this.m = 0;
            }
            if (v == this.r) {
                tv.setText("YOU: Rock");
                this.m = 1;
            }
            if (v == this.S) {
                tv.setText("YOU: Scissors");
                this.m = 2;
            }
            this.handler.postDelayed(this.showMessageTask, 1000);
        }
    }
}

我们就可以得到CPU生成状态的位置在onclick
(4)Frida HOOK
我们得到目标的条件是
m=0 n=1  cnt=999
我们开?#24613;?#20889;python的代码
[Python] 纯文本查看 复制代码
import frida, sys


def on_message(message, data):
    if message['type'] == 'send':
        print("[/i][i] {0}".format(message['payload']))
    else:
        print(message)


jscode = """
Java.perform(function () {
    var MainActivity = Java.use('com.example.seccon2015.rock_paper_scissors.MainActivity');
//开始hook onClick方法  需要注意这个function是传?#38382;?#30340;  所以我们hook时别忘了  
//public void onClick(View paramView){}
MainActivity.onClick.implementation = function (v) {
        this.onClick(v);
//修改m,n的值
        this.m.value = 0;
        this.n.value = 1;
        this.cnt.value = 999;
        send("Success!")
    }
});
"""

process = frida.get_usb_device().attach('com.example.seccon2015.rock_paper_scissors')
script = process.create_script(jscode)
script.on('message', on_message)
script.load()
sys.stdin.read()

最终结果


   
       pip install frida-tools
      pip install frida-tools
      

rps.rar

867.79 KB, 下载次数: 68, 下载积分: 吾爱币 -1 CB

免费评分

参与人数 4吾爱币 +12 热心值 +4 收起 理由
qtfreet00 + 9 + 1 ?#34892;?#21457;布原创作?#32602;?#21566;爱破解论坛因你更精彩!
独行风云 + 1 + 1 ?#34892;?#21457;布原创作?#32602;?#21566;爱破解论坛因你更精彩!
cxp521 + 1 + 1 谢谢@Thanks!
h0314 + 1 + 1 热心回复!

查看全部评分

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

沙发
jiang196771 发表于 2019-6-26 10:40
前排为大神鼓掌,可惜我看不懂啊,&#128557;&#128557;
3#
ccraker 发表于 2019-6-26 11:12
如果能讲的更详细一点就好了,第三?#25945;?#20102;一段smali代码,结果还是靠反编译java来的
4#
 楼主| Richor 发表于 2019-6-26 13:42 <
ccraker 发表于 2019-6-26 11:12
如果能讲的更详细一点就好了,第三?#25945;?#20102;一段smali代码,结果还是靠反编译java来的

Smali代码和java代码一样的,Java更加直观一点
5#
血色天空 发表于 2019-6-26 13:59
虽然没有看懂个,但是还是为楼主鼓掌
6#
不苦小和尚 发表于 2019-6-26 20:19
为什么一运行,app就退出了
7#
可还行丶 发表于 2019-6-26 20:21
懂这些是不是得先会英语?
8#
xianyucoder 发表于 2019-7-18 15:00
第三?#25945;?#30340;有点快,有点&#128563;懵逼
9#
pwpdc75 发表于 2019-7-21 14:41
学习一下,非常好,谢谢
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告:禁止回复与主题无关内容,违者重罚!

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2019-7-21 18:38

Powered by Discuz!

© 2001-2017 Comsenz Inc.

快速回复 返回顶部 返回列表
球探网篮球指数
内蒙古快3开奖结果59期 河北燕赵风采排列七 贵州快三技巧稳赚法 山东体彩官方网站 通比牛牛外挂下载 华东15选5开奖结果查询 曾道人攻略 北京十一选五前三直和值 欢乐斗地主积分欢乐豆 福建十一选五历史开奖 微信猜拳平局怎么办 通天绝算 福彩30选5今晚开奖结果 九龙一码中特书 北京pk10雪球最稳计划