adb: error: failed to copy 'G:\buuctf\frida-server-14.2.14-android-x86_64\fs_Rui' to
'data\local\tmp\fs_Rui': couldn't create file: Read-only file system
第二個問題：sdk中的adb和夜神中的abd版本不合。。adb server version (31) doesn’t match this client (36)，以至于每次一使用腳本連接，然后frida-server就會掛掉，然后就出現了上方的報錯，只需要把sdk的adb復制一份放在夜神里面就行嘍
沒有SDK環境的報錯
解碼
D:\桌面\apktool.jar d D:\桌面\02.apk -o targetappFolder
將apk重新打包
D:\桌面\apktool.jar b -o repackaged.apk targetappFolder/
--version show program's version number and exit
-h,--help show this help message and exit
-D ID,--device=ID connect to device with the given ID
-U,--usb connect to USB device
-R,--remote connect to remote frida-server
-H HOST,--host=HOST connect to remote frida-server on HOST
-a,--applications list only applications
-i,--installed include all installed applications
2. frida-trace 動態跟蹤
--version show program's version number and exit -h,--help show this help message and exit -D ID,--device=ID connect to device with the given ID -U,--usb connect to USB device -R,--remote connect to remote frida-server -H HOST,--host=HOST connect to remote frida-server on HOST -f FILE,--file=FILE spawn FILE -n NAME,--attach-name=NAME attach to NAME -p PID,--attach-pid=PID attach to PID --debug enable the Node.js compatible script debugger --disable-jit disable JIT -I MODULE,--include-module=MODULE include MODULE -X MODULE,--exclude-module=MODULE exclude MODULE -i FUNCTION,--include=FUNCTION include FUNCTION -x FUNCTION,--exclude=FUNCTION exclude FUNCTION -a MODULE!OFFSET,--add=MODULE!OFFSET add MODULE!OFFSET -T,--include-imports include program's imports -t MODULE,--include-module-imports=MODULE include MODULE imports -m OBJC_METHOD,--include-objc-method=OBJC_METHOD include OBJC_METHOD
可以看到終端中出現:open：Loaded handler at :”/用戶名/__handlers__/libc.so/open.js” frida-trace會生成一個javascript文件，然后Frida會將其注入到進程中，并跟蹤特定的調用。生成的open.js腳本將鉤住libc.so中的open函數并輸出參數. 默認的open.js:
/** Auto-generated by Frida. Please modify to match the signature of open.* This stub is currently auto-generated from manpages when available.** For full API reference, see: https://frida.re/docs/javascript-api/*/{/*** Called synchronously when about to call open.** @this {object} - Object allowing you to store state for use in onLeave.* @param {function} log - Call this function with a string to be presented to the user.* @param {array} args - Function arguments represented as an array of NativePointer objects.* For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.* It is also possible to modify arguments by assigning a NativePointer object to an element of this array.* @param {object} state - Object allowing you to keep state across function calls.* Only one JavaScript function will execute at a time, so do not worry about race-conditions.* However, do not use this to store function arguments across onEnter/onLeave, but instead* use "this" which is an object for keeping state local to an invocation.*/onEnter(log, args, state){log('open()');},/*** Called synchronously when about to return from open.** See onEnter for details.** @this {object} - Object allowing you to access state stored in onEnter.* @param {function} log - Call this function with a string to be presented to the user.* @param {NativePointer} retval - Return value represented as a NativePointer object.* @param {object} state - Object allowing you to keep state across function calls.*/onLeave(log, retval, state){}}
可以修改open.js進行操作，然后進行終端輸出：
/* * Auto-generated by Frida. Please modify to match the signature of open. * This stub is currently auto-generated from manpages when available. * * For full API reference, see: http://www.frida.re/docs/javascript-api/ */{/** * Called synchronously when about to call open. * * @this {object} - Object allowing you to store state for use in onLeave. * @param {function} log - Call this function with a string to be presented to the user. * @param {array} args - Function arguments represented as an array of NativePointer objects. * For example use Memory.readUtf8String(args[0]) if the first argument is a pointer to a C string encoded as UTF-8. * It is also possible to modify arguments by assigning a NativePointer object to an element of this array. * @param {object} state - Object allowing you to keep state across function calls. * Only one JavaScript function will execute at a time, so do not worry about race-conditions. * However, do not use this to store function arguments across onEnter/ onLeave, but instead * use "this" which is an object for keeping state local to an invocation. */ onEnter: function (log, args, state){log("open("+"path=\""+ Memory.readUtf8String(args[0])+"\""+", oflag="+ args[1]+")");},/** * Called synchronously when about to return from open. * * See onEnter for details. * * @this {object} - Object allowing you to access state stored in onEnter. * @param {function} log - Call this function with a string to be presented to the user. * @param {NativePointer} retval - Return value represented as a NativePointer object. * @param {object} state - Object allowing you to keep state across function calls. */ onLeave: function (log, retval, state){}}
#!/usr/bin/python
import frida
# js
jscode="""
console.log("[*] Starting script");
Java.perform(function(){ var Activity = Java.use("android.app.Activity"); Activity.onResume.implementation = function (){ console.log("[*] onResume() got called!"); this.onResume();};});"""
# startup frida and attach to com.android.chrome process on a usb device
process = frida.get_remote_device().attach("com.android.chrome")# create a script for frida of jsccode
script = process.create_script(jscode)# and load the script
script.load()
#!/usr/bin/python
import frida
# put your javascript-code here
jscode="""
console.log("[*] Starting script");
Java.perform(function(){var Activity = Java.use("android.app.Activity");Activity.onResume.implementation = function (){console.log("[*] onResume() got called!");this.onResume();};});"""
# startup frida and attach to com.android.chrome process on a usb device
process = frida.get_usb_device().attach("com.android.chrome")# create a script for frida of jsccode
script = process.create_script(jscode)# and load the script
script.load()
#!/usr/bin/python
import frida
import sys
# put your javascript-code here
jscode="""
console.log("[*] Starting script");
Java.perform(function(){var Activity = Java.use("android.app.Activity");Activity.onResume.implementation = function (){console.log("[*] onResume() got called!");this.onResume();};});"""
# startup frida and attach to com.android.chrome process on a usb device
process = frida.get_usb_device().attach("com.android.chrome")# create a script for frida of jsccode
script = process.create_script(jscode)# and load the script
script.load()
sys.stdin.read()
