void* entry_point_from_quick_compiled_code_; } ptr_sized_fields_; } class MANAGED Class { HeapReference<ClassLoader> class_loader_;
HeapReference<Class> component_type_;
HeapReference<DexCache> dex_cache_; ... } class MANAGED DexCache { HeapReference<String> location_; // Number of elements in the call_sites_ array. Note that this appears here // because of our packing logic for 32 bit fields. uint32_t num_resolved_call_sites_;
var minvoke = Module.findExportByName("libart.so", "_ZN3art9ArtMethod6InvokeEPNS_6ThreadEPjjPNS_6JValueEPKc"); Interceptor.attach(invoke, { onEnter: function (args) { { // console.log("get artmtd "+args[0]); var classs=ptr(args[0]).readU32() // console.log("get classs "+classs); var dex_cache=(ptr(classs).add(16)).readU32() var dexfile=(ptr(dex_cache).add(16)).readU32() var begin=ptr(dexfile).add(4).readU32() var offset=(ptr(args[0]).add(8)).readU32() // console.log("get begin "+begin); // console.log("get offset"+offset); // var index=ptr(args[0]).add(16).readU32() // console.log("get index "+index); var codeitem=ptr(begin).add(offset) console.log("get codeitem "+codeitem); // Memory.protect(ptr(codeitem), 64, 'rw-'); var codesize=(ptr(codeitem).add(12).readU32())*2 // var codesize=GetCodeItemSize(codeitem) console.log("get size "+codesize)
var code=ptr(codeitem).add(16).readByteArray(codesize) console.log(code) }
}, onLeave: function (retval) {
} });
codeitem结构
struct CodeItem { uint16_t registers_size_; // the number of registers used by this code // (locals + parameters) uint16_t ins_size_; // the number of words of incoming arguments to the method // that this code is for uint16_t outs_size_; // the number of words of outgoing argument space required // by this code for method invocation uint16_t tries_size_; // the number of try_items for this instance. If non-zero, // then these appear as the tries array just after the // insns in this instance. uint32_t debug_info_off_; // file offset to debug info stream uint32_t insns_size_in_code_units_; // size of the insns array, in 2 byte code units uint16_t insns_[1]; // actual array of bytecode.
function frida_Java() { Java.perform(function () { if(Java.available) { var ActivityThread=Java.use("android.app.ActivityThread"); var AppBindData=Java.use("android.app.ActivityThread$AppBindData") var LoadedApk=Java.use("android.app.LoadedApk") var Application=Java.use("android.app.Application") var ClassLoader=Java.use("dalvik.system.BaseDexClassLoader") var DexPathList=Java.use("dalvik.system.DexPathList") var Element=Java.use("dalvik.system.DexPathList$Element") var DexFile=Java.use("dalvik.system.DexFile") var System=Java.use("java.lang.System")
ActivityThread.performLaunchActivity.implementation=function(){ console.log("Found performLaunchActivity" ); var activityThread=ActivityThread.currentActivityThread() activityThread=Java.cast(activityThread,ActivityThread)
var BoundApplication=activityThread.mBoundApplication.value BoundApplication=Java.cast(BoundApplication,AppBindData)
var info=BoundApplication.info.value info=Java.cast(info,LoadedApk)
var mApplication=info.mApplication.value mApplication=Java.cast(mApplication,Application)
var classLoader=mApplication.getClassLoader() console.log("get ClassLoader"+classLoader);
// Java.classFactory.loader = classloader
classLoader=Java.cast(classLoader,ClassLoader) var pathList=classLoader.pathList.value // console.log("get pathList" ); pathList=Java.cast(pathList,DexPathList) var dexElements=pathList.dexElements.value for(var i=0;i<dexElements.length;i++) { var env=Java.vm.getEnv() var dexElement=Java.cast(dexElements[i],Element) var dexFile=dexElement.dexFile.value dexFile=Java.cast(dexFile,DexFile) var mCookie=dexFile.mCookie.value//mCookie就是native层所加载dex文件结构的标识
var classes=dexFile.getClassNameList(mCookie) console.log("get classes" ); for(var i=0;i<classes.length;i++) { // console.log("Found class "+classes[i]);
var classa=Java.classFactory.use(classes[i]) var constructors=classa.class.getDeclaredConstructors() for(var i=0;i<constructors.length;i++) { console.log("Found constructors "+constructors[i]); } var funcs=classa.class.getDeclaredMethods()
还是等大佬源码了
xmhwws
