android_frida

手机：Nexus5 android4.4.4 root 
Dalvik 运行环境(设置-开发者选项-选择运行环境-使用Dalvik)  

pip install frida-tools

adb shell getprop ro.product.cpu.abi 

adb root
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server"
adb shell "data/local/tmp/frida-server &"

adb devices -l

frida-ps -U #会显示进程列表

frida-trace -U -i open com.android.chrome #监控app

frida -U -l example.js com.example.dlive #向app注入js

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        findViewById(R.id.mBtnTest).setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View view) {
                helloAndroid();
                test1();
                test2(123);
                test3("str");
                test4("str",true);

                ((Button)findViewById(R.id.mBtnTest)).setText(test5());
            }
        });
    }

    private void helloAndroid() {
        System.out.println("helloAndroid");
    }

    private void test1() {
        System.out.println("test1()");
    }

    private void test2(int i) {
        System.out.println("test2(int)"+i);
    }

    private void test3(String s) {
        System.out.println("test3(String)"+s);
    }

    private void test4(String s,boolean b) {
        System.out.println("test4(String,boolean)"+s+","+b);
    }

    private String test5() {
        return "error";
    }
}

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto"
    xmlns:tools="http://schemas.android.com/tools"
    android:layout_width="match_parent"
    android:layout_height="match_parent"
    tools:context=".MainActivity">
    
    <Button
        android:id="@+id/mBtnTest"
        android:layout_width="wrap_content"
        android:layout_height="wrap_content" />

</LinearLayout>

console.log("[*] Starting script");
Java.perform(function () {
    var MainActivity = Java.use("com.demo.android_frida.MainActivity");
    MainActivity.helloAndroid.implementation = function () {
        console.log("helloAndroid()");
        // this.private_func();
    };
    MainActivity.test1.overload().implementation = function () {
        console.log("test1()");
        // this.private_func();
    };
    MainActivity.test2.overload("int").implementation = function (i) {
        console.log("test2(int): " + i);
        // this.private_func(i);
    };
    MainActivity.test3.overload("java.lang.String").implementation = function () {
        console.log("test3(String): " + arguments[0]);
        // this.private_func(arguments[0]);
    };
    //输出
    MainActivity.test4.overload("java.lang.String", "boolean").implementation = function (s, b) {
        console.log("test4(String,boolean): " + s + ", " + b);
        // this.private_func(s, b);
    };
    // 修改返回值
    MainActivity.test5.overload().implementation= function(){
        console.log("test5");
        // return this.test5()+"llll";
        return "ffff";
    }
});

frida -U -l frida.js com.demo.android_frida

     ____
    / _  |   Frida 12.4.8 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/
Attaching... 

[*] Starting script
[LGE Nexus 5::com.demo.android_frida]-> helloAndroid()
test1()
test2(int): 123
test3(String): str
test4(String,boolean): str, true
test5