smartdone / Frida-Scripts

一些frida脚本
665 stars 179 forks source link

大佬,我修改了你的脱壳脚本,改用frida api的dexclassloader,然后就抓不到dex了,大佬有空看看? #15

Open sepyeight opened 5 years ago

sepyeight commented 5 years ago

function load_dex(){ const dex_base64 = "ZGV4CjAzNQDVM9Gem2f8js0P2fE5NgyLrzl3LEyM5KLQFgAAcAAAAHhWNBIAAAAAAAAAAAAWAACBAAAAcAAAACYAAAB0AgAAHgAAAAwDAAAIAAAAdAQAACsAAAC0BAAAAgAAAAwGAACEEAAATAYAAEwGAABPBgAAUgYAAGIGAABqBgAAbgYAAH0GAACJBgAAmQYAAK4GAACxBgAAtQYAALoGAAC9BgAAzgYAANEGAADVBgAA2QYAAN4GAADjBgAA9wYAACQHAABPBwAAdAcAAJQHAACzBwAAzAcAAN8HAAD4BwAADwgAADMIAABVCAAAaQgAAH8IAACTCAAArggAAMkIAADkCAAAAAkAABcJAAAuCQAAWQkAAHIJAACLCQAAuAkAAMoJAAD1CQAAGwoAAD0KAABuCgAAlAoAAMsKAAD2CgAAFwsAACYLAAAvCwAANAsAADcLAAA7CwAARQsAAEkLAABNCwAAUAsAAFQLAABoCwAAfQsAAJoLAACnCwAArAsAAMQLAADMCwAA2AsAAOULAADwCwAA/wsAAAYMAAAJDAAAHwwAACwMAAA/DAAASAwAAEsMAABPDAAAUwwAAFwMAABvDAAAkAwAALoMAADcDAAABA0AABINAAAaDQAAIw0AADENAAA4DQAAQw0AAEgNAABSDQAAZA0AAIYNAACmDQAAxA0AANYNAADqDQAA9Q0AAAEOAAAKDgAAGg4AADYOAABZDgAAbA4AAHsOAACMDgAAjw4AAJcOAACiDgAAqg4AALMOAAC5DgAAxg4AAM4OAADUDgAA3g4AAOMOAADyDgAA+A4AAP4OAAAIDwAAEw8AAAkAAAAMAAAAEwAAABQAAAAVAAAAFgAAABcAAAAYAAAAGQAAABoAAAAbAAAAHAAAAB0AAAAeAAAAHwAAACAAAAAhAAAAIgAAACMAAAAkAAAAJQAAACYAAAApAAAAKgAAACwAAAAtAAAALgAAAC8AAAAwAAAAMQAAADIAAAAzAAAANAAAADgAAAA9AAAAPwAAAEAAAABBAAAACQAAAAAAAAAAAAAACgAAAAAAAAAcDwAACwAAAAAAAACADwAADgAAAAkAAAAAAAAAEAAAAAkAAABYDwAADgAAAA4AAAAAAAAADwAAAA4AAAAsDwAAEAAAAA4AAAAcDwAAEQAAAA4AAAAkDwAAEgAAAA4AAABIDwAAEgAAAA4AAABQDwAADgAAABAAAAAAAAAADwAAABEAAAAsDwAAEAAAABEAAABYDwAAEAAAABMAAABYDwAAEAAAABUAAABgDwAADgAAABcAAAAAAAAADgAAAB0AAAAAAAAAOAAAACEAAAAAAAAAOQAAACEAAAAsDwAAOgAAACEAAAA0DwAAOwAAACEAAAB4DwAAOwAAACEAAABgDwAAOwAAACEAAACIDwAAOwAAACEAAABoDwAAPAAAACEAAABwDwAAPQAAACIAAAAAAAAAPgAAACIAAAAcDwAADgAAACMAAAAAAAAADgAAACUAAAAAAAAAAwAJAH8AAAAEAAAABgAAAAQAAAAHAAAABAABAA0AAAAEAAAANQAAAAQAEAA3AAAABAAfAFwAAAAgACAANgAAAAIAAgBLAAAAAwAVAAMAAAADABIAegAAAAQAEgADAAAABAAWAFQAAAAEAA8AYQAAAAQACQBqAAAACAAQAFMAAAAJAA4AZQAAAAkAHQBmAAAACQALAGkAAAAJAAMAbgAAAAoABAByAAAACwALAGgAAAAMAAsAaAAAAA4AEgADAAAADgADAGAAAAAQABsAWgAAABEAEgADAAAAEQAMAEUAAAARAA0ARQAAABEACwB+AAAAEgAIAF8AAAASAAEAZwAAABMABwBfAAAAEwAZAHsAAAAUAAsAaQAAABQAHABtAAAAFAAKAHEAAAAUABkAewAAABUAEgADAAAAFQAbAEMAAAAVAAYAXwAAABUAAAB8AAAAFgAYAH0AAAAXABoAbwAAABcABQB2AAAAGQATAAMAAAAbABEATAAAAB4AEgADAAAAHwAUAAMAAAAfABkARAAAAB8AFwBbAAAAAwAAABAAAAAOAAAAiA8AAAgAAADYDwAAyhUAAAAAAAAEAAAAAQAAAA4AAAAAAAAACAAAAOgPAADbFQAAjg8AAAEoAAEpAA4sIGZpZWxkIG5hbWU6IAAGPGluaXQ+AAI+OwANQVVUT0xPQURDTEFTUwAKQkxPQ0tfU0laRQAOQ09SRV9QT09MX1NJWkUAE0VudW1lcmF0ZUNsYXNzLmphdmEAAUkAAklMAANJTEwAAUoAD0tFRVBfQUxJVkVfVElNRQABTAACTEkAAkxMAANMTEkAA0xMTAASTGFuZHJvaWQvdXRpbC9Mb2c7ACtMY29tL2FsZXgvYXV0b2xvYWRjbGFzc2VzL0VudW1lcmF0ZUNsYXNzJDE7AClMY29tL2FsZXgvYXV0b2xvYWRjbGFzc2VzL0VudW1lcmF0ZUNsYXNzOwAjTGRhbHZpay9hbm5vdGF0aW9uL0VuY2xvc2luZ01ldGhvZDsAHkxkYWx2aWsvYW5ub3RhdGlvbi9Jbm5lckNsYXNzOwAdTGRhbHZpay9hbm5vdGF0aW9uL1NpZ25hdHVyZTsAF0xkYWx2aWsvc3lzdGVtL0RleEZpbGU7ABFMamF2YS9sYW5nL0NsYXNzOwAXTGphdmEvbGFuZy9DbGFzc0xvYWRlcjsAFUxqYXZhL2xhbmcvRXhjZXB0aW9uOwAiTGphdmEvbGFuZy9JbGxlZ2FsQWNjZXNzRXhjZXB0aW9uOwAgTGphdmEvbGFuZy9Ob1N1Y2hGaWVsZEV4Y2VwdGlvbjsAEkxqYXZhL2xhbmcvT2JqZWN0OwAUTGphdmEvbGFuZy9SdW5uYWJsZTsAEkxqYXZhL2xhbmcvU3RyaW5nOwAZTGphdmEvbGFuZy9TdHJpbmdCdWlsZGVyOwAZTGphdmEvbGFuZy9yZWZsZWN0L0FycmF5OwAZTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwAaTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsAFUxqYXZhL3V0aWwvQXJyYXlMaXN0OwAVTGphdmEvdXRpbC9BcnJheUxpc3Q8AClMamF2YS91dGlsL0FycmF5TGlzdDxMamF2YS9sYW5nL1N0cmluZzs+OwAXTGphdmEvdXRpbC9Db2xsZWN0aW9uczsAF0xqYXZhL3V0aWwvRW51bWVyYXRpb247ACtMamF2YS91dGlsL0VudW1lcmF0aW9uPExqYXZhL2xhbmcvU3RyaW5nOz47ABBMamF2YS91dGlsL0xpc3Q7AClMamF2YS91dGlsL2NvbmN1cnJlbnQvQXJyYXlCbG9ja2luZ1F1ZXVlOwAkTGphdmEvdXRpbC9jb25jdXJyZW50L0Jsb2NraW5nUXVldWU7ACBMamF2YS91dGlsL2NvbmN1cnJlbnQvRXhlY3V0b3JzOwAvTGphdmEvdXRpbC9jb25jdXJyZW50L1JlamVjdGVkRXhlY3V0aW9uSGFuZGxlcjsAJExqYXZhL3V0aWwvY29uY3VycmVudC9UaHJlYWRGYWN0b3J5OwA1TGphdmEvdXRpbC9jb25jdXJyZW50L1RocmVhZFBvb2xFeGVjdXRvciRBYm9ydFBvbGljeTsAKUxqYXZhL3V0aWwvY29uY3VycmVudC9UaHJlYWRQb29sRXhlY3V0b3I7AB9MamF2YS91dGlsL2NvbmN1cnJlbnQvVGltZVVuaXQ7AA1NQVhfUE9PTF9TSVpFAAdTRUNPTkRTAANUQUcAAVYAAlZJAAhWSUlKTExMTAACVkwAAlZaAAFaAAJaTAASW0xqYXZhL2xhbmcvQ2xhc3M7ABNbTGphdmEvbGFuZy9PYmplY3Q7ABtbTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsAC2FjY2Vzc0ZsYWdzAANhZGQAFmFsbG93Q29yZVRocmVhZFRpbWVPdXQABmFwcGVuZAAKYXJnc0xlbmd0aAALY2xhc3NMb2FkZXIACWNsYXNzTmFtZQANY2xhc3NOYW1lTGlzdAAFY2xhenoAAWQAFGRlZmF1bHRUaHJlYWRGYWN0b3J5AAtkZXhFbGVtZW50cwARZGV4RWxlbWVudHNMZW5ndGgAB2RleEZpbGUAAWUAAmUxAAJlMgAHZW50cmllcwARZW51bWVyYXRlQWxsQ2xhc3MAH2VudW1lcmF0ZUFsbENsYXNzIGNsYXNzIG5hbWUgOiAAKGVudW1lcmF0ZUFsbENsYXNzIGNsYXNzIG5hbWUgbGlzdCBzaXplOiAAIGVudW1lcmF0ZUFsbENsYXNzIG1ldGhvZCBzaXplIDogACZlbnVtZXJhdGVBbGxDbGFzcyB0cnkgdG8gbG9hZCBtZXRob2Q6IAAMZW51bWVyYXRpb25zAAZlcXVhbHMAB2V4ZWN1dGUADGV4ZWN1dG9yUG9vbAAFZmllbGQACWZpZWxkTmFtZQADZ2V0AAhnZXRDbGFzcwAQZ2V0Q2xhc3NOYW1lTGlzdAAgZ2V0Q2xhc3NOYW1lTGlzdCBjbGFzcyBuYW1lIGlzOiAAHmdldENsYXNzTmFtZUxpc3QgY2xhc3NMb2FkZXI6IAAcZ2V0Q2xhc3NOYW1lTGlzdCBlcnJvciBtc2c6IAAQZ2V0RGVjbGFyZWRGaWVsZAASZ2V0RGVjbGFyZWRNZXRob2RzAAlnZXRMZW5ndGgACmdldE1lc3NhZ2UAB2dldE5hbWUADmdldE9iamVjdEZpZWxkABpnZXRPYmplY3RGaWVsZCBlcnJvciBtc2c6IAAhZ2V0T2JqZWN0RmllbGQgdHJ5IHRvIGdldCBjbGFzczogABFnZXRQYXJhbWV0ZXJUeXBlcwANZ2V0U3VwZXJjbGFzcwAPaGFzTW9yZUVsZW1lbnRzAAFpAAZpbnZva2UACWxvYWRDbGFzcwAGbWV0aG9kAAdtZXRob2RzAARuYW1lAAtuZXh0RWxlbWVudAAGb2JqZWN0AARvYmpzAAhwYXRoTGlzdAADcnVuAA1zZXRBY2Nlc3NpYmxlAARzaXplAARzb3J0AAh0b1N0cmluZwAJdmFsJGNsYXp6AAV2YWx1ZQAAAAEAAAAOAAAAAgAAAA4AAAABAAAAAAAAAAcAAAAAAAAAAQAgABoAHQAcAAAAAgAAAA4AEAACAAAADgAkAAEAAAAQAAAAAQAAAAoAAAABAAAAGAAAAAEAAAAiAAAAAQAAAAkAAAACAAAAEAAQAAEAAAAPAAUEAgQKBgIEHhcFAgYCQgQIdR4CBwGAARwGFwAXGxcBFycXIRcEAgUBgAEaBAAAAAAAAAAAAAEAAAChDwAAAgAAALQPAACZDwAAzA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFAAAAxA8AAFMBAA4AVwAOaQMAdSYBFw9pAwN0FUtaAwRHAS0DBXklARoPAntKBQMFBAUFQwUAHB8AEgAOAEoBSA4BHw9qSwQAShYpARoPAQEDAXEBaWkDAkkRARYPSwMDSwqgBQIFAwIXOwUABQEcHwAcAUgOAR4PWwQAShYpwwMBTg9LAwJPAQEBAwNxAS3/BARaGCxpaQMFSREBFg88BQUCeh0FBEUFAQUCBQMbHgMBUQwBGhAFATwAMQJ4Xw5LAwBLCgEiDwEQEFoDAl4UPAILWQUCHgMBUw0BGg8FAQJ0HR8DAlEOWgEiD0sDA14UPFoFAx4DAVIMARoFAQUCIwAAAAIAAgABAAAAABAAAAYAAABbAQAAcBAPAAAADgAKAAEAAwABAAUQAABSAAAAVJAAAG4QCQAAAAwAGgEFACICEQBwEBIAAgAaA1cAbiAUADIAIQNuIBMAMgBuEBUAAgAMAnEgAAAhACEBEgI1EjAARgMAAhIUbiAdAEMAbhAbAAMADAQhRCNFJAAaBgUAIgcRAHAQEgAHABoIWABuIBQAhwBuEBoAAwAMCG4gFACHAG4QFQAHAAwHcSAAAHYAEgZuMBwAYwXYAgIBKNEoAg0ADgAAAAAATAABAAEBC1ABAAEAAQAAADIQAAAEAAAAcBAPAAAADgALAAEACQABADYQAAB6AAAAIgkfAGIFBwAiBhkAEiBwICUABgBxACYAAAAMByIIHgBwECcACAATAQoAEwIeABYDAgAHkHYJKAAAAGkJBgBiAAYAEhFuICkAEABxEAUACgAMABoBBQAiAhEAcBASAAIAGgNWAG4gFAAyAG4QIQAAAAoDbiATADIAbhAVAAIADAJxIAAAIQASAW4QIQAAAAoCNSEvAG4gIAAQAAwCHwIQABoDBQAiBBEAcBASAAQAGgVVAG4gFABUAG4gFAAkAG4QFQAEAAwEcSAAAEMAbiAMACoADANiBAYAIgUDAHAgAQA1AG4gKgBUANgBAQEozigCDQAOACUAAABPAAEAAQELeAoAAQACAAEAahAAAI8AAAAaAAUAIgERAHAQEgABABoCYwBuIBQAIQBuEBAACQAMAm4QCgACAAwCbiAUACEAbhAVAAEADAFxIAAAEAAiABUAcBAeAAAAGgF5AHEgBgAZAAwBGgJNAHEgBgAhAAwBcRAXAAEACgISAzUjOwBxIBYAMQAMBBoFTwBxIAYAVAAMBB8ECABuEAcABAAMBHIQIwAEAAoFOAUiAHIQJAAEAAwFHwUQABoGBQAiBxEAcBASAAcAGghiAG4gFACHAG4gFABXAG4QFQAHAAwHcSAAAHYAbiAfAFAAKNvYAwMBKMYoHA0BGgIFACIDEQBwEBIAAwAaBGQAbiAUAEMAbhANAAEADARuIBQAQwBuEBUAAwAMA3EgAAAyAHEQIgAAABEAAAAjAAAASAABAAEBC3AIAAIAAgACALMQAACxAAAAbhAQAAYADAAaAQUAIgIRAHAQEgACABoDbABuIBQAMgBuEAoAAAAMA24gFAAyABoDAgBuIBQAMgBuIBQAcgBuEBUAAgAMAnEgAAAhAG4QCgAAAAwBHAIOAG4QCgACAAwCbiARACEACgE5AXsAEhFuIAgAcAAMAm4gGQASAG4gGABiAAwDEQMNARoCBQAiAxEAcBASAAMAGgRrAG4gFABDAG4QDgABAAwEbiAUAEMAbhAVAAMADANxIAAAMgAoyA0CbhALAAAADAMHMBoDBQAiBBEAcBASAAQAGgVsAG4gFABUAG4QCgAAAAwFbiAUAFQAGgUCAG4gFABUAG4gFAB0AG4QFQAEAAwEcSAAAEMAbiAIAHAADANuIBkAEwBuIBgAYwAMAREBDQEaAwUAIgQRAHAQEgAEABoFawBuIBQAVABuEA0AAQAMBW4gFABUAG4QFQAEAAwEcSAAAEMAKLASAREBAAA3AAAACwABAGAAAAAyAAYAAgINXwxDAQuTAQABAQEAkCABgIAE/CECAZgiBgAEAAEaARoBGgEaARkBCQOBgATYIwEJ8CMBCYAmAQm8KAAAABEAAAAAAAAAAQAAAAAAAAABAAAAgQAAAHAAAAACAAAAJgAAAHQCAAADAAAAHgAAAAwDAAAEAAAACAAAAHQEAAAFAAAAKwAAALQEAAAGAAAAAgAAAAwGAAACIAAAgQAAAEwGAAABEAAADQAAABwPAAAFIAAAAQAAAI4PAAAEIAAAAwAAAJkPAAADEAAABAAAALwPAAAGIAAAAgAAANgPAAADIAAABgAAAAAQAAABIAAABgAAAPwQAAAAIAAAAgAAAMoVAAAAEAAAAQAAAAAWAAA="; const Base64 = Java.use("android.util.Base64"); const FileOutputStream = Java.use("java.io.FileOutputStream"); var dex_bytes = Base64.decode(dex_base64, 0); var dex_path =Java.classFactory.cacheDir+".dex"; console.log("[V]write dex to " + dex_path);

var fout = FileOutputStream.$new(dex_path);
fout.write(dex_bytes, 0, dex_bytes.length);
fout.close();
var dx = Java.openClassFile(dex_path);
dx.load();

// var EnumerateClass = Java.use("com.alex.autoloadclasses.EnumerateClass");
// EnumerateClass.enumerateAllClass(Java.classFactory.loader);

var help_class = Java.classFactory.loader.loadClass("com.alex.autoloadclasses.EnumerateClass");
var Clazz = Java.use("java.lang.Class");
var help_class_obj = Java.cast(help_class, Clazz);
var ClassLoader = Java.use("java.lang.ClassLoader");

var loaderList = Java.array("Ljava.lang.Object;", [Java.classFactory.loader]);
var ClassArgs = Java.array("Ljava.lang.Class;", [ClassLoader.class]);
var method = help_class_obj.getDeclaredMethod("enumerateAllClass", ClassArgs);
method.invoke(null, loaderList);

}

得到的类名之后我加载进去的dex的类名?别的dex都找不到,请问这个是什么问题?