首页
论坛
课程
招聘
[求助] Android frida hook android.os.Parcel部分失效的原因?
2018-11-9 09:53 2004

[求助] Android frida hook android.os.Parcel部分失效的原因?

2018-11-9 09:53
2004
环境:
Nexus 5 rooted android6
frida12.2.22
app:deskclock(系统闹钟)
测试函数:
//IAlarmManager.java
 public void set(int type, long triggerAtTime, long windowLength,
                long interval, int flags, android.app.PendingIntent operation,
                android.os.WorkSource workSource,
                android.app.AlarmManager.AlarmClockInfo alarmClock)
                throws android.os.RemoteException {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();

                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    _data.writeInt(type);
                    _data.writeLong(triggerAtTime);
                    _data.writeLong(windowLength);
                    _data.writeLong(interval);
                    _data.writeInt(flags);
该set函数在下图点击设置一个闹钟按钮时会触发,会调用Alarm服务的方法,进行Parcel打包,如上图代码所示:

测试脚本,可以用以下js代码去hook set()和以及writeInt和NativewriteInt函数:
Java.perform(function(){
    var ibinder = Java.use("android.app.IAlarmManager$Stub$Proxy");
    ibinder.set.overload('int', 'long','long','long','int', 'android.app.PendingIntent','android.os.WorkSource','android.app.AlarmManager$AlarmClockInfo').implementation = function(a,b,c,d,e,f,g,h){
        send("IAramManager--set--");
        var res = this.set(a,b,c,d,e,f,g,h);
        send("--end--IAramManager--set--");
        return res;
    }
});
Java.perform(function(){
    var Parcel = Java.use("android.os.Parcel");
    Parcel.writeInt.implementation = function(i){
        send("writeInt.");
        return this.writeInt(i);
    }
});
Java.perform(function(){
    var Parcel = Java.use("android.os.Parcel");
    Parcel.nativeWriteInt.implementation = function(a,b){
        send("nativeWriteInt.");
        return this.nativeWriteInt(a,b);
    }
});

在Parcel.java中可以看到,writeInt和nativeWriteInt的调用关系:(暂时不考虑记录set函数中的writeLong)
// Parcel.java
public final void writeInt(int val) {
    nativeWriteInt(mNativePtr, val);
}
public final void writeLong(long val) {
    nativeWriteLong(mNativePtr, val);
}

按理说,输出的结果序列应该是:set()->writeInt()->nativeWriteInt()....这样。但我的实际测试结果如下:
{u'type': u'send', u'payload': u'IAramManager--set--'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'nativeWriteInt.'}
{u'type': u'send', u'payload': u'--end--IAramManager--set--'}

writeInt这一层完全没有hook住,所以想求助于各位,造成这种状况的原因?以及怎样才能抓住Parcel.java内的函数?
另外,我用Xposed做相同实验,是可以抓取到set内部调用的writeInt()函数的,如下(Exception是我打印的):
D/fuzz-writeInt( 1110): writeInt
D/fuzz-writeInt( 1110): java.lang.Exception
D/fuzz-writeInt( 1110): 	at buptnsrc.com.xposed_example.Main$3.afterHookedMethod(Main.java:61)
D/fuzz-writeInt( 1110): 	at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:374)
D/fuzz-writeInt( 1110): 	at android.os.Parcel.writeInt(<Xposed>)
D/fuzz-writeInt( 1110): 	at android.app.IAlarmManager$Stub$Proxy.set(IAlarmManager.java:165)
D/fuzz-writeInt( 1110): 	at android.app.AlarmManager.setImpl(AlarmManager.java:409)
D/fuzz-writeInt( 1110): 	at android.app.AlarmManager.set(AlarmManager.java:208)
D/fuzz-writeInt( 1110): 	at com.example.android.apis.app.AlarmController$1.onClick(AlarmController.java:102)
D/fuzz-writeInt( 1110): 	at android.view.View.performClick(View.java:4780)
D/fuzz-writeInt( 1110): 	at android.view.View$PerformClick.run(View.java:19866)
D/fuzz-writeInt( 1110): 	at android.os.Handler.handleCallback(Handler.java:739)
D/fuzz-writeInt( 1110): 	at android.os.Handler.dispatchMessage(Handler.java:95)
D/fuzz-writeInt( 1110): 	at android.os.Looper.loop(Looper.java:135)
D/fuzz-writeInt( 1110): 	at android.app.ActivityThread.main(ActivityThread.java:5254)
D/fuzz-writeInt( 1110): 	at java.lang.reflect.Method.invoke(Native Method)
D/fuzz-writeInt( 1110): 	at java.lang.reflect.Method.invoke(Method.java:372)
D/fuzz-writeInt( 1110): 	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
D/fuzz-writeInt( 1110): 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)
D/fuzz-writeInt( 1110): 	at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:107)

求助各位讨论下,是frida本身的问题,还是我写的不对...orz..心力憔悴几天了orz
另外,在hook过程中,在set函数调用之外,偶尔也能抓到writeInt函数,但是为了明确问题以及与源码对照,就只针对set函数内测试。
欢迎围观~讨论~orz,不胜感激~

安卓应用层抓包通杀脚本发布!《高研班》2021年3月班开始招生!

收藏
点赞0
打赏
分享
最新回复 (2)
雪    币: 2
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
wx_机器猫_678323 活跃值 2018-11-9 11:05
2
0
pulic final 定义为不可继承不可改写,frida貌似hook不了吧
雪    币: 3134
活跃值: 活跃值 (20)
能力值: ( LV9,RANK:165 )
在线值:
发帖
回帖
粉丝
demoLin 活跃值 2018-11-9 12:16
3
0
wx_机器猫_678323 pulic final 定义为不可继承不可改写,frida貌似hook不了吧
但是在set()之外,比如直接在程序启动时hook,是可以抓取到一些writeInt,readInt的,而且用XPosed可以抓到,而且我自己写个public final做测试也可以抓到。
游客
登录 | 注册 方可回帖
返回