[Google Pixel::com.roysue.roysueapplication]-> 成功hook clz类
成功hook clz类

setTimeout(function (){  Java.perform(function (){    console.log("n[*] enumerating classes...");    //Java对象的API enumerateLoadedClasses    Java.enumerateLoadedClasses({      //该回调函数中的_className参数就是类的名称，每次回调时都会返回一个类的名称      onMatch: function(_className){        //在这里将其输出        console.log("[*] found instance of '"+_className+"'");
        //如果只需要打印出com.roysue包下所有类把这段注释即可，想打印其他的替换掉indexOf中参数即可定位到~        //if(_className.toString().indexOf("com.roysue")!=-1)        //{        //    console.log("[*] found instance of '"+_className+"'");        //}      },      onComplete: function(){        //会在枚举类结束之后回调一次此函数        console.log("[*] class enuemration complete");      }    });  });});

function enumMethods(targetClass){    var hook = Java.use(targetClass);    var ownMethods = hook.class.getDeclaredMethods();    hook.$dispose;    return ownMethods;}
function hook_overload_5() {    if(Java.available) {        Java.perform(function () {           var a = enumMethods("com.roysue.roysueapplication.User$clz")           a.forEach(function(s) {                console.log(s);           });        });    }}

function hook_overload_8() {
    if(Java.available) {     
        Java.perform(function () {       
             console.log("start hook");            
             var targetMethod = 'add';            
             var targetClass = 'com.roysue.roysueapplication.Ordinary_Class';            
             var targetClassMethod = targetClass + '.' + targetMethod;            
             //目标类            
             var hook = Java.use(targetClass);            
             //重载次数            
             var overloadCount = hook[targetMethod].overloads.length;            
             //打印日志：追踪的方法有多少个重载            
             console.log("Tracing " + targetClassMethod + " [" + overloadCount + " overload(s)]");            
             //每个重载都进入一次            
             for (var i = 0; i < overloadCount; i++) {            
                    //hook每一个重载                    
                    hook[targetMethod].overloads[i].implementation = function() {                    
                        console.warn("n*** entered " + targetClassMethod);                        
                        //可以打印每个重载的调用栈，对调试有巨大的帮助，当然，信息也很多，尽量不要打印，除非分析陷入僵局                        
                        Java.perform(function() {                     
                            var bt = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new());                                
                                console.log("nBacktrace:n" + bt);                        
                         });                           
                         // 打印参数                        
                         if (arguments.length) console.log();                        
                         for (var j = 0; j < arguments.length; j++) {                        
                             console.log("arg[" + j + "]: " + arguments[j]);                        
                         }                        
                         //打印返回值                        
                         var retval = this[targetMethod].apply(this, arguments); // rare crash (Frida bug?)              
                         console.log("nretval: " + retval);                        
                         console.warn("n*** exiting " + targetClassMethod);                        
                         return retval;                    
                     }                
                  }            
           console.log("hook end");       
       });   
    }
 }

import codecsimport fridafrom time import sleep
# 附加进程名称为：com.roysue.roysueapplicationsession = frida.get_remote_device().attach('com.roysue.roysueapplication')
# 这是需要执行的js脚本，rpc需要在js中定义source = """    //定义RPC    rpc.exports = {        //这里定义了一个给外部调用的方法：sms        sms: function () {            var result = "";            //嵌入HOOK代码            Java.perform(function () {                //拿到class类                var Ordinary_Class = Java.use("com.roysue.roysueapplication.Ordinary_Class");                //最终rpc的sms方法会返回add(1,3)的结果！                result = Ordinary_Class.add(1,3);             });            return result;        },    };"""
# 创建js脚本script = session.create_script(source)script.load()
# 这里可以直接调用java中的函数rpc = script.exports# 在这里也就是python下直接通过rpc调用sms()方法print(rpc.sms())sleep(1)
session.detach()

VERSION="1.0.0"setTimeout(function(){    Java.perform(function(){        Java.enumerateLoadedClasses({                onMatch: function(instance){                    if (instance.split(".")[1] == "bluetooth"){                        console.log("[->]t"+lightBlueCursor()+instance+closeCursor());                    }                },                onComplete: function() {}            });
        Java.choose("android.bluetooth.BluetoothGattServer",{                onMatch: function (instance){                    ...                onComplete: function() { console.log("[*] -----");}            });
        Java.choose("android.bluetooth.BluetoothGattService",{                onMatch: function (instance){                    ...                onComplete: function() { console.log("[*] -----");}            });
         Java.choose("android.bluetooth.BluetoothSocket",{                onMatch: function (instance){                    ...                onComplete: function() { console.log("[*] -----");}            });
          Java.choose("android.bluetooth.BluetoothServerSocket",{                onMatch: function (instance){                    ...                onComplete: function() { console.log("[*] -----");}            });
          Java.choose("android.bluetooth.BluetoothDevice",{                onMatch: function (instance){                    ...                onComplete: function() { console.log("[*] -----");}            });    });},0);

$ frida -U -f com.whatsapp -l raptor_frida_android_trace_fixed.js --no-pause