-
-
[求助] Android frida hook android.os.Parcel部分失效的原因？
-
2018-11-9 09:53
-
环境：
在Parcel.java中可以看到，writeInt和nativeWriteInt的调用关系：（暂时不考虑记录set函数中的writeLong）
按理说，输出的结果序列应该是：set()->writeInt()->nativeWriteInt()....这样。但我的实际测试结果如下：
writeInt这一层完全没有hook住，所以想求助于各位，造成这种状况的原因？以及怎样才能抓住Parcel.java内的函数？
求助各位讨论下，是frida本身的问题，还是我写的不对...orz..心力憔悴几天了orz
Nexus 5 rooted android6
frida12.2.22
app:deskclock(系统闹钟)
测试函数：
//IAlarmManager.java
public void set(int type, long triggerAtTime, long windowLength,
long interval, int flags, android.app.PendingIntent operation,
android.os.WorkSource workSource,
android.app.AlarmManager.AlarmClockInfo alarmClock)
throws android.os.RemoteException {
android.os.Parcel _data = android.os.Parcel.obtain();
android.os.Parcel _reply = android.os.Parcel.obtain();
try {
_data.writeInterfaceToken(DESCRIPTOR);
_data.writeInt(type);
_data.writeLong(triggerAtTime);
_data.writeLong(windowLength);
_data.writeLong(interval);
_data.writeInt(flags);该set函数在下图点击设置一个闹钟按钮时会触发,会调用Alarm服务的方法，进行Parcel打包，如上图代码所示：
测试脚本，可以用以下js代码去hook set()和以及writeInt和NativewriteInt函数：
Java.perform(function(){
var ibinder = Java.use("android.app.IAlarmManager$Stub$Proxy");
ibinder.set.overload('int', 'long','long','long','int', 'android.app.PendingIntent','android.os.WorkSource','android.app.AlarmManager$AlarmClockInfo').implementation = function(a,b,c,d,e,f,g,h){
send("IAramManager--set--");
var res = this.set(a,b,c,d,e,f,g,h);
send("--end--IAramManager--set--");
return res;
}
});
Java.perform(function(){
var Parcel = Java.use("android.os.Parcel");
Parcel.writeInt.implementation = function(i){
send("writeInt.");
return this.writeInt(i);
}
});
Java.perform(function(){
var Parcel = Java.use("android.os.Parcel");
Parcel.nativeWriteInt.implementation = function(a,b){
send("nativeWriteInt.");
return this.nativeWriteInt(a,b);
}
});
// Parcel.java
public final void writeInt(int val) {
nativeWriteInt(mNativePtr, val);
}
public final void writeLong(long val) {
nativeWriteLong(mNativePtr, val);
}
{u'type': u'send', u'payload': u'IAramManager--set--'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'--end--IAramManager--set--'}
另外，我用Xposed做相同实验，是可以抓取到set内部调用的writeInt()函数的，如下（Exception是我打印的）：
D/fuzz-writeInt( 1110): writeInt D/fuzz-writeInt( 1110): java.lang.Exception D/fuzz-writeInt( 1110): at buptnsrc.com.xposed_example.Main$3.afterHookedMethod(Main.java:61) D/fuzz-writeInt( 1110): at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:374) D/fuzz-writeInt( 1110): at android.os.Parcel.writeInt(<Xposed>) D/fuzz-writeInt( 1110): at android.app.IAlarmManager$Stub$Proxy.set(IAlarmManager.java:165) D/fuzz-writeInt( 1110): at android.app.AlarmManager.setImpl(AlarmManager.java:409) D/fuzz-writeInt( 1110): at android.app.AlarmManager.set(AlarmManager.java:208) D/fuzz-writeInt( 1110): at com.example.android.apis.app.AlarmController$1.onClick(AlarmController.java:102) D/fuzz-writeInt( 1110): at android.view.View.performClick(View.java:4780) D/fuzz-writeInt( 1110): at android.view.View$PerformClick.run(View.java:19866) D/fuzz-writeInt( 1110): at android.os.Handler.handleCallback(Handler.java:739) D/fuzz-writeInt( 1110): at android.os.Handler.dispatchMessage(Handler.java:95) D/fuzz-writeInt( 1110): at android.os.Looper.loop(Looper.java:135) D/fuzz-writeInt( 1110): at android.app.ActivityThread.main(ActivityThread.java:5254) D/fuzz-writeInt( 1110): at java.lang.reflect.Method.invoke(Native Method) D/fuzz-writeInt( 1110): at java.lang.reflect.Method.invoke(Method.java:372) D/fuzz-writeInt( 1110): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903) D/fuzz-writeInt( 1110): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698) D/fuzz-writeInt( 1110): at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:107)
另外，在hook过程中，在set函数调用之外，偶尔也能抓到writeInt函数，但是为了明确问题以及与源码对照，就只针对set函数内测试。
欢迎围观~讨论~orz,不胜感激~
|
|
|---|---|
|
|
|
|
|
但是在set()之外，比如直接在程序启动时hook,是可以抓取到一些writeInt，readInt的，而且用XPosed可以抓到，而且我自己写个public final做测试也可以抓到。 |
