能力值:
( LV2,RANK:10 )
|
-
-
2 楼
膜
|
能力值:
( LV9,RANK:145 )
|
-
-
3 楼
java.lang.ClassNotFoundException: Didn\'t find class "okhttp3.MyInterceptor"
|
能力值:
( LV6,RANK:96 )
|
-
-
4 楼
beimingyouyu
java.lang.ClassNotFoundException: Didn\'t find class "okhttp3.MyInterceptor"
你用的frida是哪个版本,okhttp3.MyInterceptor是通过Java.registerClass注册的类,不是apk里面的
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
测试没有效果 frida 最新的 12.6.9 版本
|
能力值:
( LV9,RANK:145 )
|
-
-
6 楼
发现是Android版本低的手机里frida会不能使用registerClass,不过换版本高点的手机试了之后同没效果
|
能力值:
( LV6,RANK:96 )
|
-
-
7 楼
beimingyouyu
发现是Android版本低的手机里frida会不能使用registerClass,不过换版本高点的手机试了之后同没效果
我的手机系统是Android 8.1.0, 自己编译的AOSP。 用spawn方式启动app frida -U --no-pause -f xxx -l hook.js
|
能力值:
( LV1,RANK:0 )
|
-
-
8 楼
大佬我想问一下为什么我用Java.cast进行数据类型转换都会报错,我本来是想把java.lang.Object转为[B但是失败了,然后我尝试string转为stirng也会报错,大佬这是什么情况啊
|
能力值:
( LV6,RANK:96 )
|
-
-
9 楼
mb_gygeohyt
大佬我想问一下为什么我用Java.cast进行数据类型转换都会报错,我本来是想把java.lang.Object转为[B但是失败了,然后我尝试string转为stirng也会报错,大佬这是什么情况啊
...
``` var ByteString = Java.use("com.android.okhttp.okio.ByteString"); ByteString.of(BufferObj.readByteArray()).hex() ``` 如果你想打印byte[],可以使用ByteString转成hex的字符串
|
能力值:
( LV2,RANK:10 )
|
-
-
10 楼
大佬,为什么我执行注入hookjs成功了,但是没有回调消息的
|
能力值:
( LV2,RANK:10 )
|
-
-
11 楼
感谢大佬,在原来基础上略作修改,适配了多dex的情况
function hook_okhttp3(classLoader) {
Java.perform(function () {
var ByteString = classLoader.use("com.android.okhttp.okio.ByteString");
var Buffer = classLoader.use("com.android.okhttp.okio.Buffer");
var Interceptor = classLoader.use("okhttp3.Interceptor");
var MyInterceptor = Java.registerClass({
name: "okhttp3.MyInterceptor",
implements: [Interceptor],
methods: {
intercept: function (chain) {
var request = chain.request();
try {
console.log("MyInterceptor.intercept onEnter:", request, "\nrequest headers:\n", request.headers());
var requestBody = request.body();
var contentLength = requestBody ? requestBody.contentLength() : 0;
if (contentLength > 0) {
var BufferObj = Buffer.$new();
requestBody.writeTo(BufferObj);
try {
console.log("\nrequest body String:\n", BufferObj.readString(), "\n");
} catch (error) {
try {
console.log("\nrequest body ByteString:\n", ByteString.of(BufferObj.readByteArray()).hex(), "\n");
} catch (error) {
console.log("error 1:", error);
}
}
}
} catch (error) {
console.log("error 2:", error);
}
var response = chain.proceed(request);
try {
console.log("MyInterceptor.intercept onLeave:", response, "\nresponse headers:\n", response.headers());
var responseBody = response.body();
var contentLength = responseBody ? responseBody.contentLength() : 0;
if (contentLength > 0) {
console.log("\nresponsecontentLength:", contentLength, "responseBody:", responseBody, "\n");
var ContentType = response.headers().get("Content-Type");
console.log("ContentType:", ContentType);
if (ContentType.indexOf("video") == -1) {
if (ContentType.indexOf("application") == 0) {
var source = responseBody.source();
if (ContentType.indexOf("application/zip") != 0) {
try {
console.log("\nresponse.body StringClass\n", source.readUtf8(), "\n");
} catch (error) {
try {
console.log("\nresponse.body ByteString\n", source.readByteString().hex(), "\n");
} catch (error) {
console.log("error 4:", error);
}
}
}
}
}
}
} catch (error) {
console.log("error 3:", error);
}
return response;
}
}
});
var ArrayList = classLoader.use("java.util.ArrayList");
var OkHttpClient = classLoader.use("okhttp3.OkHttpClient");
console.log(OkHttpClient);
OkHttpClient.$init.overload('okhttp3.OkHttpClient$Builder').implementation = function (Builder) {
console.log("OkHttpClient.$init:", this, Java.cast(Builder.interceptors(), ArrayList));
this.$init(Builder);
};
var MyInterceptorObj = MyInterceptor.$new();
var Builder = classLoader.use("okhttp3.OkHttpClient$Builder");
console.log(Builder);
Builder.build.implementation = function () {
this.interceptors().clear();
//var MyInterceptorObj = MyInterceptor.$new();
this.interceptors().add(MyInterceptorObj);
var result = this.build();
return result;
};
Builder.addInterceptor.implementation = function (interceptor) {
this.interceptors().clear();
//var MyInterceptorObj = MyInterceptor.$new();
this.interceptors().add(MyInterceptorObj);
return this;
//return this.addInterceptor(interceptor);
};
console.log("hook_okhttp3...");
});
}
Java.perform(function() {
var application = Java.use("android.app.Application");
application.attach.overload('android.content.Context').implementation = function(context) {
var result = this.attach(context); // 先执行原来的attach方法
var classloader = context.getClassLoader(); // 获取classloader
Java.classFactory.loader = classloader;
hook_okhttp3(Java.classFactory);
}
});
|
能力值:
( LV1,RANK:0 )
|
-
-
12 楼
hook okhttp的目的是把数据包 转移到其他地方进行管理嘛。这样 平常进行的协议分析就被简化了??
|
能力值:
( LV2,RANK:10 )
|
-
-
13 楼
Error: java.lang.ClassNotFoundException: Didn't find class "okhttp3.Interceptor" on path: 为啥会找不到interceptor呢
|
能力值:
( LV1,RANK:0 )
|
-
-
14 楼
fishso
感谢大佬,在原来基础上略作修改,适配了多dex的情况
```
function hook_okhttp3(classLoader) {
Java.perform(function () ...
使用你的这个版本确实可以多dex跑,但是writeTo(BufferObj)的 时候,Buffer和BufferSkin分到了不同的dex,获取request的body异常,怎么解决?我试着dexclassloder,但是一直失败,望帮一下
|
能力值:
( LV10,RANK:175 )
|
-
-
15 楼
支持大佬 先mark一下
|
能力值:
( LV2,RANK:10 )
|
-
-
16 楼
IMZCF
使用你的这个版本确实可以多dex跑,但是writeTo(BufferObj)的 时候,Buffer和BufferSkin分到了不同的dex,获取request的body异常,怎么解决?我试着dexcl ...
console.log("\nrequest-a body String:\n", responseBody.string(), "\n"); request的body异常 这样解析
|
能力值:
( LV3,RANK:20 )
|
-
-
17 楼
支持大佬 先mark一下
|
能力值:
( LV2,RANK:10 )
|
-
-
18 楼
hook_okhttp3... 然后就没了
|
能力值:
( LV2,RANK:10 )
|
-
-
19 楼
error 2: Error: writeTo(): argument types do not match any of: .overload('okio.BufferedSink')
|
能力值:
( LV3,RANK:30 )
|
-
-
20 楼
万里星河
hook_okhttp3...
然后就没了
me too
|
能力值:
( LV1,RANK:0 )
|
-
-
21 楼
支持大佬 先mark一下
|
能力值:
( LV2,RANK:10 )
|
-
-
22 楼
mark
|
能力值:
( LV2,RANK:10 )
|
-
-
23 楼
mark
|
能力值:
( LV2,RANK:10 )
|
-
-
24 楼
感谢分享
|
|
|