1、直接将某沙app拖入jadx，看起来是加壳的，全是字母。

2、通过frida-dump脱壳出dex，代码太多，一头雾水，决定frida查看一下app load流程。

3、先查看一下so的加载，看起来是基于webview的app，这种安全性更强？

android_dlopen_ext probe /data/user/0/com.hptfludyjx.syjqeafkll/files/HJfOTtKmmn/libflutter.so
android_dlopen_ext probe /vendor/lib/hw/gralloc.sdm845.so
android_dlopen_ext probe /data/user/0/com.hptfludyjx.syjqeafkll/files/HJfOTtKmmn/libkiwi.so
android_dlopen_ext probe /vendor/lib/hw/android.hardware.graphics.mapper@2.0-impl-qti-display.so
android_dlopen_ext probe /data/dalvik-cache/arm/system@product@app@webview@webview.apk@classes.dex
android_dlopen_ext probe libwebviewchromium.so
android_dlopen_ext probe /system/product/app/webview/webview.apk!/lib/armeabi-v7a/libwebviewchromium.so
android_dlopen_ext probe /system/lib/libwebviewchromium_plat_support.so

4、objection查看相关的控件，只有几个，决定从这几个包里面代码入手

com.FsmPTCXp.srkUzUwv.BuMNTWpHywCyOjEG
com.FsmPTCXp.srkUzUwv.SYwlcwEiRFSIXShR
com.FsmPTCXp.srkUzUwv.XgHiUUvJoGlJkOrD
com.FsmPTCXp.srkUzUwv.etdKYlBCbRsMOoYO
com.FsmPTCXp.srkUzUwv.kTqkUkCAFauhrgmp
com.FsmPTCXp.srkUzUwv.pipohLdKqLHPWLVM
com.FsmPTCXp.srkUzUwv.spWureHoPIGDecqQ
com.google.android.gms.common.api.GoogleApiActivity

com.FsmPTCXp.srkUzUwv.SYwlcwEiRFSIXShR

这个里面有webview的创建，在com.pichillilorenzo.flutter_inappwebview.in_app_browser.InAppBrowserManager发现会启动这个控件，后面就是继续分析怎么注入了。

5、继续分析并hook相关的类，终于找到了一些post get时会触发的方法。

(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.dispose()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.makeInitialLoad(java.util.HashMap)
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.dispose()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.makeInitialLoad(java.util.HashMap)
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.dispose()

6、hook关键函数com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.onPageFinished，找到关键的加载js的请求

(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.loadCustomJavaScriptOnPageStarted(android.webkit.WebView)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, java.lang.String)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, android.webkit.WebResourceRequest)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, android.webkit.WebResourceRequest)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, android.webkit.WebResourceRequest)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, java.lang.String)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.onPageFinished(android.webkit.WebView, java.lang.String)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.loadCustomJavaScriptOnPageFinished(android.webkit.WebView)

后面会继续更新。

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！