Android Flutter APP逆向分析

1
2
3
4

frida --version    #我使用的版本16.5.9 
adb shell
su
getprop ro.product.cpu.abi   #查看手机架构，真机一般是arm64-v8a，模拟器一般是x86_64，

1
2
3
4
5
6
7
8
9

### 将frida-server-16.5.9-android-arm64放入手机磁盘
adb push ./frida-server-16.5.9-android-arm64 /data/local/tmp
### 启动frida-server-16.5.9-android-arm64服务
adb shell
su
cd /data/local/tmp
mv frida-server-16.5.9-android-arm64 frida-server
chmod 777 frida-server
./frida-server &   

1
2
3
4
5
6
7
8

frida-ps -U    ##查看应用进程ID，
frida-ps -Uai   ##查看应用的包名和进程ID, 
### 方法一
frida -U -f 包名 -l blutter_frida.js   ##如果APP已启动,-f会导致APP重启，libapp.app 没有加载成功导致hook失败
### 方法二
frida -U -n 应用名 -l blutter_frida.js ## 先启动APP
### 方法三：
frida -U -p 进程ID -l blutter_frida.js  ## 采用的此方法成功

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

function dumpArgs(step, address, bufSize) {

    var buf = Memory.readByteArray(address, bufSize)

    console.log('Argument ' + step + ' address ' + address.toString() + ' ' + 'buffer: ' + bufSize.toString() + '\n\n Value:\n' +hexdump(buf, {
        offset: 0,
        length: bufSize,
        header: false,
        ansi: false
    }));

    console.log("Trying interpret that arg is pointer")
    console.log("=====================================")
    try{

    console.log(Memory.readCString(ptr(address)));
    console.log(ptr(address).readCString());
    console.log(hexdump(ptr(address)));
    }catch(e){
        console.log(e);
    }


    console.log('')
    console.log('----------------------------------------------------')
    console.log('')
}

function onLibappLoaded() {
    const fn_addr = 0x966e24;   ## 此处修改为你想hook的函数地址
    Interceptor.attach(libapp.add(fn_addr), {
        onEnter: function () {
            init(this.context);
            ## 打印第一个入参
            let objPtr = getArg(this.context, 0);
            const [tptr, cls, values] = getTaggedObjectValue(objPtr);
            console.log(`${cls.name}@${tptr.toString().slice(2)} =`, JSON.stringify(values, null, 2));
            ## 打印第二个入参
            let objPtr1 = getArg(this.context, 1);
            const [tptr1, cls1, values1] = getTaggedObjectValue(objPtr1);
            console.log(`${cls1.name}@${tptr1.toString().slice(2)} =`, JSON.stringify(values1, null, 2));
        },
        onLeave: function(retval){
            ## 打印函数返回信息
            dumpArgs(0,retval,500);
        }
    });
}