编写测试APP

1，APP下载链接

https://github.com/heiyu-sec/r0lian/tree/master/demo13

2，编写TestThread中的内容，APP编译安装，就会持续执行打印

3，编译执行成功，日志持续打印出来了

4，APP点击能正常唤起

Frida

1，安装frida，并确认客户端的frida版本

2，选择同版本的firda服务端下载

https://github.com/frida/frida/releases?page=4

3，启动frida server

adb push frida-server /data/local/tmp/
adb shell
su
cd /data/local/tmp/
chmod 777 frida-server
./frida-server

4，转发android TCP端口到本地

adb forward tcp:27042 tcp:27042
adb forward tcp:27043 tcp:27043

5，确认是否成功,能打印出如下进程，就说明frida的服务启动成功了

frida-ps -R

Frida脚本编写

简单方法直接hook

1，APP代码如下，相对简单，一个类下面只有一个单独的方法add（）

2，编写脚本，获取入参并打印

function main(){
    Java.perform(function(){
        var TestThreadClass = Java.use("com.dta.demo13.TestThread")
        TestThreadClass.add.implementation = function(arg1,arg2){
            console.log("the first arg is ==>"+arg1)
            console.log("the second arg is ==>"+arg2)
            var result = this.add(arg1,arg2)
            console.log("the result is ==>"+result)
            return result;
        }
    })
}

打印调用栈

function main(){
    Java.perform(function(){
        var TestThreadClass = Java.use("com.dta.demo13.TestThread")
        TestThreadClass.add.implementation = function(arg1,arg2){
            printStack()
            arg1=2;
            arg2=5;
            console.log("the first arg is ==>"+arg1)
            console.log("the second arg is ==>"+arg2)
            var result = this.add(arg1,arg2)
            console.log("the result is ==>"+result)
            return result;
        }
    })
    function printStack(){
        var ExceptionClass = Java.use("java.lang.Exception")
        var LogClass = Java.use("android.util.Log")
        console.log("----------------STACK--------------------")
        console.log(LogClass.getStackTraceString(ExceptionClass.$new()))
        console.log("----------------------------------------")
    }
}
setImmediate(main)

hook重载方法

1，修改下APP，写个有重载的add()

2，直接执行会报错，会让你选择overload哪一个方法

3，修改脚本，用hook string的add（）为例

function main(){
    Java.perform(function(){
        var TestThreadClass = Java.use("com.dta.demo13.TestThread")
        TestThreadClass.add.overload('java.lang.String', 'java.lang.String').implementation = function(arg1,arg2){
            printStack()
            console.log("the first arg is ==>"+arg1)
            console.log("the second arg is ==>"+arg2)
            var result = this.add(arg1,arg2)
            console.log("the result is ==>"+result)
            return result;
        }
    })
    function printStack(){
        var ExceptionClass = Java.use("java.lang.Exception")
        var LogClass = Java.use("android.util.Log")
        console.log("----------------STACK--------------------")
        console.log(LogClass.getStackTraceString(ExceptionClass.$new()))
        console.log("----------------------------------------")
    }
}
setImmediate(main)

参数构造主动调用

function main(){
    Java.perform(function(){
       /* 
       //overload
        var TestThreadClass = Java.use("com.dta.demo13.TestThread")
        TestThreadClass.add.overload('java.lang.String', 'java.lang.String').implementation = function(arg1,arg2){
            printStack()
            console.log("the first arg is ==>"+arg1)
            console.log("the second arg is ==>"+arg2)
            var result = this.add(arg1,arg2)
            console.log("the result is ==>"+result)
            return result;
        }
        */
        //param edit
        Java.choose("com.dta.demo13.TestThread",{
            onMatch:function(instanse){
                // var result= instanse.add("10","11");
                var result= instanse.add(1,3);
                console.log("the result is ==>"+result)
            },
            onComplete:function(){
            }
        })
    })
    function printStack(){
        var ExceptionClass = Java.use("java.lang.Exception")
        var LogClass = Java.use("android.util.Log")
        console.log("----------------STACK--------------------")
        console.log(LogClass.getStackTraceString(ExceptionClass.$new()))
        console.log("----------------------------------------")
    }
}
setImmediate(main)

动静态处理

function main(){
    Java.perform(function(){
       /* 
       //overload
        var TestThreadClass = Java.use("com.dta.demo13.TestThread")
        TestThreadClass.add.overload('java.lang.String', 'java.lang.String').implementation = function(arg1,arg2){
            printStack()
            console.log("the first arg is ==>"+arg1)
            console.log("the second arg is ==>"+arg2)
            var result = this.add(arg1,arg2)
            console.log("the result is ==>"+result)
            return result;
        }
        */
        /*
        //param edit
        Java.choose("com.dta.demo13.TestThread",{
            onMatch:function(instanse){
                // var result= instanse.add("10","11");
                var result= instanse.add(1,3);
                console.log("the result is ==>"+result)
            },
            onComplete:function(){
            }
        })
        */
        //static dynamic
        var result = Java.use("com.dta.demo13.TestThread").static_add("123","456")
        console.log("the result is ==>"+ result)
    })
    function printStack(){
        var ExceptionClass = Java.use("java.lang.Exception")
        var LogClass = Java.use("android.util.Log")
        console.log("----------------STACK--------------------")
        console.log(LogClass.getStackTraceString(ExceptionClass.$new()))
        console.log("----------------------------------------")
    }
}
setImmediate(main)

原文始发于微信公众号（车联网攻防日记）：【安卓逆向】Frida对堆栈，重载，静态方法hook