frida -hook 笔记--byte[]转String进行参数打印与替换参数

博主最近在学习使用frida,在hook某个native函数的的时候,发现参数和返回值都是byte[]数据类型,因为想查看传参和返回值, 下面就记录一下如何在js代码中如果打印byte[]

public static native byte[] aseEncrypt(byte[] bArr,byte[] bArr);

一下代码成功打印参数和返回结果的16进制字符串

Java.perform(function () {
          
   
   var ByteString = Java.use("com.android.okhttp.okio.ByteString");
   var TestClass = Java.use("com.test.test.a");
   TestClass.aseEncrypt.implementation = function(args1,args2){
          
   
      console.log("++++++++++++++Hook Strat++++++++++++++++++++");
      console.log("before aseEncrypt args1:" + ByteString.of(args1).hex());
      console.log("before aseEncrypt args2:" + ByteString.of(args2).hex());
      
      var result = this.aseEncrypt(args1,args2);

      console.log("after aseEncrypt args1:" + ByteString.of(args1).hex());
      console.log("after aseEncrypt args2:" + ByteString.of(args2).hex());
      console.log("aseEncrypt result:" + result);
      console.log("++++++++++++++Hook End!++++++++++++++++++++");
      return result;
   }
});

那么如果想替换要hook函数参数,该如何构建使用byte[]来构建呢?

如果打印参数类型的话,会发现byte[]会被转为js中的object类型,因此只需构建数据结构就行了!

参考代码如下:

//十六进制字符串转Object
function Str2BytesObj(str){
          
   
    var pos = 0;
    var len = str.length;
    if(len %2 != 0){
          
   
       return null;
    }
    len /= 2;
    var ObjA = new Object();
    for(var i=0; i<len; i++){
          
   
       var s = str.substr(pos, 2);
       var v = parseInt(s, 16);
       if(v >127) v = v-255-1
       ObjA[i] = v;
       pos += 2;
    }
    //这里不要忘了添加字符串长度
    ObjA[length] = len
    return ObjA;
}

使用上面的函数构建object,可以修改上面的hook代码来替换byte[]参数了! 参考代码如下:

Java.perform(function () {
          
   

   var ByteString = Java.use("com.android.okhttp.okio.ByteString");
   var TestClass = Java.use("com.test.test.a");

   TestClass.aseEncrypt.implementation = function(args1,args2){
          
   

      console.log("++++++++++++++Hook Strat++++++++++++++++++++");
      console.log(typeof(args1))  //js中的Object类型
      console.log("before aseEncrypt args1:" + ByteString.of(args1).hex());
      console.log("before aseEncrypt args2:" + ByteString.of(args2).hex())
//      var result = this.aseEncrypt(args1,args2);

      //替换参数
      var rep1 = "0a104e43376a4f3870"
      var rep2 = "0a104e43376a4f3870"
      args3 = Str2BytesObj(rep1)
      args4 = Str2BytesObj(rep2)
      
      var result = this.aseEncrypt(args1,args2);
      console.log("aseEncrypt result:" + result);
      console.log("++++++++++++++Hook End!++++++++++++++++++++");
      return result;
   }

});

免责声明:以上代码未经过严格测试,仅供萌新参考!大神放过! 更新时间:2021-03-18