更新 hookssl.js

main.py

@@ -5,8 +5,12 @@ import sys
 import time
 
 
+FIRST_WRITE = True  # 全局变量，用于跟踪是否是首次写入
+
 def on_message(message, data):
     print(message)
+    # modules.files_utils.write_log(message)
+    # print(message)
     # if message['type'] == 'send':
     #     print(message['payload'])
 
@@ -21,11 +25,12 @@ def attach_method(is_spawn):
 
 
 def main(package_name,script_path,is_spawn):
+    # 从Python发送数据到Frida的JavaScript脚本
     print(f"script_path: {script_path}")
     js_code = modules.files_utils.read_javascript(script_path)
     # print(js_code)
     modules.command.start_frida()
-    modules.command.clearCache(package_name)
+    # modules.command.clearCache(package_name)
     # 连接到USB设备
     device = frida.get_usb_device()
     print(device)
@@ -34,8 +39,10 @@ def main(package_name,script_path,is_spawn):
         print(f"进程pid: {pid}")
         process = device.attach(pid)
         script = process.create_script(js_code)
-        script.on("message", on_message)
+        # script.on("message", on_message)
         script.load()
+        # data_to_send = {'data': 'Hello from Python!'}
+        # script.post({'type': 'input_data', 'payload': data_to_send})
         device.resume(pid)  # 加载完脚本后, 恢复进程运行
         sys.stdin.read()
     else:
@@ -60,10 +67,10 @@ if __name__ == '__main__':
     # 是否以spawn模式运行
     is_spawn = True
     # 目标进程名
-    attach_process_name = "Navi"
+    attach_process_name = "百度网盘"
     # 目标包名
-    package_name = "com.msf.angelmobile"
+    package_name = "com.baidu.netdisk"
     # 注入的脚本路径
-    script_path = "./hook_conversions.js"
+    # script_path = "scripts/hook_conversions.js"
-    # script_path = "./r0capture/script.js"
+    script_path = "scripts/baidunetdisk.js"
     main(package_name,script_path, is_spawn)

modules/files_utils.py

@@ -13,3 +13,11 @@ def read_javascript(script_path):
     with open(script_path, "r") as file:
         script_code = file.read()
         return script_code
+def write_log(messages):
+    global FIRST_WRITE
+    print(f"FIRST_WRITE: {FIRST_WRITE}")
+    with open("frida_log.log", "a") as log_file:
+        if FIRST_WRITE:  # 如果是首次写入
+            log_file.write("\n\n\n")  # 空出三行
+            FIRST_WRITE = False  # 更新状态，表明已经写过了
+        log_file.write(str(messages) + "\n")

scripts/baidunetdisk.js

@@ -0,0 +1,21 @@
+console.log("Script loaded successfully");
+
+Java.perform(function () {
+    var Request = Java.use("okhttp3.Request");
+
+    // Hook Request的toString方法
+    Request.toString.implementation = function () {
+        // 调用原始的toString方法并保存结果
+        var result = this.toString();
+
+        // 打印结果
+        console.log("Request.toString result: " + result);
+
+        // 返回原始方法调用的结果
+        return result;
+    };
+});
+
+
+
+

scripts/hook_conversions.js

@@ -1,19 +1,11 @@
-console.log("Script loaded successfully");
+log_info("Script loaded successfully");
 // hook_okhttp_client()
 if (Java.available) {
     hook_json()
-    Java.perform(function () {
+    let class_name = "okhttp3.OkHttpClient"
-        try {
+    if (check_class(class_name)){
-            var OkHttpClient = Java.use("okhttp3.OkHttpClient");
+        hook_okhttp_client()
-            console.log(OkHttpClient.toString())
+    }
-            if (OkHttpClient != null){
-                hook_okhttp_client();
-                log_info("OkHttp detected in the app");
-            }
-        } catch (e) {
-            log_info("OkHttp not detected in the app");
-        }
-    });
     Java.perform(function () {
         log_info("start hook java.net.URL");
         var URL = Java.use('java.net.URL');
@@ -49,10 +41,6 @@ function hook_okhttp_client() {
             log_info("start hook_okhttp_client.")
             try {
                 var OkHttpClient = Java.use("okhttp3.OkHttpClient");
-                // log_info("OkHttpClient: " + OkHttpClient.toString());
-                var class_name = OkHttpClient.$className;
-                console.log(class_name+ "-------")
-                printMethods(OkHttpClient.toString());
                 OkHttpClient.newCall.overload('okhttp3.Request').implementation = function (request) {
                     var requestUrl = request.url();
                     if (requestUrl) {
@@ -60,12 +48,11 @@ function hook_okhttp_client() {
                     } else {
                         console.log("OkHttp Request URL is not available");
                     }
-                    // console.log("OkHttp Request Headers: " + request.headers().toString());
+                    console.log("OkHttp Request Headers: " + request.headers().toString());
-
-                    // if (request.method() == "POST") {
-                    //     console.log("OkHttp Request Body: " + request.body().contentType().toString());
-                    // }
 
+                    if (request.method() == "POST") {
+                        console.log("OkHttp Request Body: " + request.body().contentType().toString());
+                    }
                     var call = this.newCall(request);
                     var response = call.execute();
                     console.log("OkHttp Response: " + response.body().string());
@@ -158,8 +145,8 @@ function hook_json() {
         var JSONObject = Java.use('org.json.JSONObject');
         JSONObject.toString.overload().implementation = function () {
             var result = this.toString.call(this);
-            // console.log("Serialized JSONObject: " + result);
+            // get_conversions(result)
-            log_info("Serialized JSONObject: " + result)
+            // log_info("Serialized JSONObject: " + result)
             return result;
         };
     });
@@ -179,4 +166,32 @@ function log_info(messages) {
     const timestamp = `${year}-${month}-${day} ${hours}:${minutes}:${seconds}:${milliseconds}`;
 
     console.log(`${timestamp} - ${messages}`);
-}
+    send(`${timestamp} - ${messages}`);
+}
+
+function check_class(class_name) {
+    var classFound = false; // 默认为未找到
+    Java.enumerateLoadedClasses({
+        onMatch: function(currentClassName) {
+            if (currentClassName === class_name) {
+                classFound = true; // 如果找到了类，则设置为true
+            }
+        },
+        onComplete: function() {
+            if (classFound) {
+                log_info(class_name + " has been loaded!");
+            } else {
+                log_info(class_name + " has not been loaded yet.");
+            }
+        }
+    });
+    return classFound;
+}
+
+recv('input_data', function(payload) {
+    console.log(typeof(payload))
+
+    console.log(JSON.stringify(payload))
+    console.log('Received data from Python: ' + payload.payload.data);
+});
+

scripts/hook_qqmusic.js

@@ -0,0 +1,40 @@
+log_info("Script loaded successfully");
+if (Java.available) {
+    hook_json()
+    Java.perform(function () {
+        log_info("start hook java.net.URL");
+        var URL = Java.use('java.net.URL');
+        URL.$init.overload('java.lang.String').implementation = function (spec) {
+            log_info("URL request: " + spec)
+            return this.$init(spec);
+        };
+    });
+}
+
+function log_info(messages) {
+    const now = new Date();
+    const year = now.getFullYear();
+    const month = String(now.getMonth() + 1).padStart(2, '0'); // Months are 0-based
+    const day = String(now.getDate()).padStart(2, '0');
+    const hours = String(now.getHours()).padStart(2, '0');
+    const minutes = String(now.getMinutes()).padStart(2, '0');
+    const seconds = String(now.getSeconds()).padStart(2, '0');
+    const milliseconds = String(now.getMilliseconds()).padStart(3, '0');
+
+    const timestamp = `${year}-${month}-${day} ${hours}:${minutes}:${seconds}:${milliseconds}`;
+
+    console.log(`${timestamp} - ${messages}`);
+    send(`${timestamp} - ${messages}`);
+}
+
+function hook_json() {
+    Java.perform(function () {
+        var JSONObject = Java.use('org.json.JSONObject');
+        JSONObject.toString.overload().implementation = function () {
+            var result = this.toString.call(this);
+            // get_conversions(result)
+            log_info("Serialized JSONObject: " + result)
+            return result;
+        };
+    });
+}

scripts/hookssl.js

@@ -1,3 +1,4 @@
+console.log("Script loaded successfully");
 Java.perform(function() {
 
 /*
@@ -67,11 +68,6 @@ hook list:
 	} catch (e) {
 		quiet_send("registerClass from X509TrustManager >>>>>>>> " + e.message);
 	}
-
-
-
-
-
 	// Prepare the TrustManagers array to pass to SSLContext.init()
 	var TrustManagers = [TrustManager.$new()];
 

scripts/monitor_request.js

@@ -0,0 +1,32 @@
+log_info("Script loaded successfully");
+Java.perform(function () {
+  var OkHttpClient = Java.use('okhttp3.OkHttpClient');
+  var Request = Java.use('okhttp3.Request');
+
+  OkHttpClient.newCall.implementation = function (request) {
+    var url = request.url().toString();
+    var method = request.method();
+    var body = request.body();
+    var size = body != null ? body.contentLength() / 1024 : 0;
+    console.log("Method: " + method + "\nURL: " + url + "\nSize: " + size + " kb");
+
+    return this.newCall(request);
+  };
+});
+
+
+function log_info(messages) {
+    const now = new Date();
+    const year = now.getFullYear();
+    const month = String(now.getMonth() + 1).padStart(2, '0'); // Months are 0-based
+    const day = String(now.getDate()).padStart(2, '0');
+    const hours = String(now.getHours()).padStart(2, '0');
+    const minutes = String(now.getMinutes()).padStart(2, '0');
+    const seconds = String(now.getSeconds()).padStart(2, '0');
+    const milliseconds = String(now.getMilliseconds()).padStart(3, '0');
+
+    const timestamp = `${year}-${month}-${day} ${hours}:${minutes}:${seconds}:${milliseconds}`;
+
+    console.log(`${timestamp} - ${messages}`);
+    send(`${timestamp} - ${messages}`);
+}

scripts/test.js

@@ -0,0 +1,20 @@
+Java.perform(function() {
+    var ByteArrayOutputStream = Java.use('java.io.ByteArrayOutputStream');
+    var HttpsURLConnection = Java.use('javax.net.ssl.HttpsURLConnection');
+
+    HttpsURLConnection.getOutputStream.implementation = function() {
+        var outputStream = this.getOutputStream();
+
+        // 创建一个新的 ByteArrayOutputStream 实例，以便于我们读取数据。
+        var byteArrayOutputStream = ByteArrayOutputStream.$new();
+
+        outputStream.write.overload('[B').implementation = function(buffer) {
+            byteArrayOutputStream.write(buffer);
+            console.log("[*] Data written to URL:", this.getURL().toString());
+            console.log("[*] Data:", byteArrayOutputStream.toString('UTF-8'));
+            return outputStream.write(buffer);
+        };
+
+        return outputStream;
+    };
+});

scripts/url_request.js

@@ -0,0 +1,82 @@
+Java.perform(function() {
+    var URL = Java.use("java.net.URL");
+    var HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection");
+    var HttpURLConnection = Java.use("java.net.HttpURLConnection");
+    var OutputStreamWriter = Java.use("java.io.OutputStreamWriter");
+    var BufferedReader = Java.use("java.io.BufferedReader");
+    var InputStreamReader = Java.use("java.io.InputStreamReader");
+    var OutputStream = Java.use('java.io.OutputStream');
+    var OkHttpClient = Java.use('okhttp3.OkHttpClient');
+
+    URL.$init.overload('java.lang.String').implementation = function(url) {
+        console.log("[*] URL init:", url.toString());
+        return this.$init(url);
+    };
+
+    HttpsURLConnection.setDoOutput.implementation = function(value) {
+        console.log("[*]HttpsURLConnection setDoOutput:", value);
+        return this.setDoOutput(value);
+    };
+
+    HttpsURLConnection.setRequestProperty.implementation = function(key, value) {
+        console.log("[*] setRequestProperty:", key, value);
+        return this.setRequestProperty(key, value);
+    };
+
+
+    HttpsURLConnection.getOutputStream.implementation = function() {
+        console.log("[*] getOutputStream");
+        return this.getOutputStream();
+    };
+
+
+
+    HttpURLConnection.setRequestProperty.implementation = function(key, value) {
+        console.log("[*] setRequestProperty:", key, value);
+        return this.setRequestProperty(key, value);
+    };
+
+    HttpURLConnection.setDoOutput.implementation = function(value) {
+        console.log("[*]HttpURLConnection setDoOutput:", value);
+        return this.setDoOutput(value);
+    };
+
+    // HttpURLConnection.getOutputStream.implementation = function() {
+    //     console.log("[*] getOutputStream");
+    //     var outputStream = this.getOutputStream();
+    //
+    //     outputStream.write.overload('[B').implementation = function(buffer) {
+    //         console.log("[*] Data written:", Java.array('byte', buffer).toString());
+    //         return this.write(buffer);
+    //     };
+    //     return outputStream;
+    // };
+
+    // OutputStream.write.overload('[B').implementation = function(buffer) {
+    //     console.log("[*] Data written:", Java.array('byte', buffer).toString());
+    //     return this.write(buffer);
+    // };
+
+    BufferedReader.readLine.overload().implementation = function() {
+        var line = this.readLine();
+        // console.log("[*] BufferedReader.readLine:", line);
+        return line;
+    };
+
+    InputStreamReader.$init.overload('java.io.InputStream').implementation = function(stream) {
+        console.log("[*] InputStreamReader.init:", stream);
+        return this.$init(stream);
+    };
+
+    OkHttpClient.newCall.overload('okhttp3.Request').implementation = function(request) {
+        console.log("[*] Request URL:", request.url().toString());
+        console.log("[*] Request Headers:", request.headers().toString());
+
+        if (request.method() == "POST") {
+            console.log("[*] Request Body:", request.body().toString());
+        }
+
+        return this.newCall(request);
+    };
+});
+

test.py

@@ -1,7 +1,7 @@
 import frida,sys
 import modules.files_utils
 
-js_code = modules.files_utils.read_javascript("./hook_conversions.js")
+js_code = modules.files_utils.read_javascript("scripts/hook_conversions.js")
 device = frida.get_usb_device()
 pid = device.spawn(["com.naviapp"])    # 以挂起方式创建进程
 process = device.attach(pid)