Swahili - Ht
HackTricks Training Twitter Linkedin Sponsor

Frida Tutorial

Mafunzo ya Frida

Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Njia nyingine za kusaidia HackTricks:

Mshauri wa tuzo za mdudu: Jisajili kwa Intigriti, jukwaa la tuzo za mdudu la malipo la juu lililoanzishwa na wadukuzi, kwa wadukuzi! Jiunge nasi kwenye https://go.intigriti.com/hacktricks leo, na anza kupata tuzo hadi $100,000!

LogoRegister - IntigritiRegister - Intigriti

Usanidi

Sanidi zana za frida:

pip install frida-tools
pip install frida

Pakua na usakinishe kwenye kifaa cha android seva ya frida (Pakua toleo jipya). Mstari mmoja wa kuwasha upya adb kwa mode ya root, kuunganisha kwenye kifaa, kupakia frida-server, kutoa ruhusa za utekelezaji na kuendesha kwa nyuma:

adb root; adb connect localhost:6000; sleep 1; adb push frida-server /data/local/tmp/; adb shell "chmod 755 /data/local/tmp/frida-server"; adb shell "/data/local/tmp/frida-server &"

Angalia kama inavyofanya kazi:

frida-ps -U #List packages and processes
frida-ps -U | grep -i <part_of_the_package_name> #Get all the package name

Mafunzo

Mafunzo ya 1

Kutoka: https://medium.com/infosec-adventures/introduction-to-frida-5a3f51595ca1 APK: https://github.com/t0thkr1s/frida-demo/releases Msimbo wa Chanzo: https://github.com/t0thkr1s/frida-demo

Fuata kiungo hiki kusoma.

Mafunzo ya 2

Kutoka: https://11x256.github.io/Frida-hooking-android-part-2/ (Sehemu 2, 3 & 4) APKs na Msimbo wa Chanzo: https://github.com/11x256/frida-android-examples

Fuata kiungo hiki kusoma.

Mafunzo ya 3

Kutoka: https://joshspicer.com/android-frida-1 APK: https://github.com/OWASP/owasp-mstg/blob/master/Crackmes/Android/Level_01/UnCrackable-Level1.apk

Fuata kiungo hiki kusoma.

Unaweza kupata skripti zaidi za Frida hapa: https://codeshare.frida.re/

Mifano ya Haraka

Kuita Frida kutoka kwenye mstari wa amri

frida-ps -U

#Basic frida hooking
frida -l disableRoot.js -f owasp.mstg.uncrackable1

#Hooking before starting the app
frida -U --no-pause -l disableRoot.js -f owasp.mstg.uncrackable1
#The --no-pause and -f options allow the app to be spawned automatically,
#frozen so that the instrumentation can occur, and the automatically
#continue execution with our modified code.

Skripti ya Msingi ya Python

import frida

# Create a session to connect to the target Android device
device = frida.get_usb_device()
pid = device.spawn(["com.example.app"])
session = device.attach(pid)

# Load the JavaScript code into the session
with open("script.js", "r") as file:
    script_code = file.read()
script = session.create_script(script_code)

# Load the script into the target app's process
script.load()

# Run the script
script.exports.run()

# Detach from the target app's process and clean up
session.detach()
device.kill(pid)

Skripti Rahisi ya Python

import frida

# Unda kikao cha kuunganisha kifaa cha Android kilicholengwa
device = frida.get_usb_device()
pid = device.spawn(["com.example.app"])
session = device.attach(pid)

# Pakia kificho cha JavaScript kwenye kikao
with open("script.js", "r") as file:
    script_code = file.read()
script = session.create_script(script_code)

# Pakia kificho kwenye mchakato wa programu ya lengo
script.load()

# Chalisha kificho
script.exports.run()

# Tenganisha kutoka kwenye mchakato wa programu ya lengo na safisha
session.detach()
device.kill(pid)
import frida, sys

jscode = open(sys.argv[0]).read()
process = frida.get_usb_device().attach('infosecadventures.fridademo')
script = process.create_script(jscode)
print('[ * ] Running Frida Demo application')
script.load()
sys.stdin.read()

Kufunga kazi bila vigezo

Funga kazi a() ya darasa sg.vantagepoint.a.c

Java.perform(function () {
;  rootcheck1.a.overload().implementation = function() {
rootcheck1.a.overload().implementation = function() {
send("sg.vantagepoint.a.c.a()Z   Root check 1 HIT!  su.exists()");
return false;
};
});

Kufunga java exit()

Katika programu za Android, exit() ni njia ya kumaliza programu. Kwa kufunga njia hii, tunaweza kuzuia programu isifunge kwa njia ya kawaida.

Frida inaruhusu kufunga njia hii kwa kuingilia kati kwenye kificho cha Java na kubadilisha matokeo ya wito wa exit().

Hatua za kufunga exit()

  1. Anza kwa kuanzisha mazingira ya Frida kwenye kifaa chako cha Android.

  2. Tumia kifaa chako cha Android kuanzisha mawasiliano na programu unayotaka kufunga exit().

  3. Tumia Frida kuchunguza kificho cha Java kinachohusiana na exit().

  4. Tumia Frida kubadilisha matokeo ya wito wa exit() ili kuzuia programu isifunge.

Mifano ya Kubadilisha exit()

Kubadilisha Matokeo ya exit() kuwa 0

Java.perform(function() {
  var System = Java.use('java.lang.System');
  System.exit.implementation = function() {
    console.log('exit() hooked');
    return 0;
  };
});

Kubadilisha Matokeo ya exit() kuwa 1

Java.perform(function() {
  var System = Java.use('java.lang.System');
  System.exit.implementation = function() {
    console.log('exit() hooked');
    return 1;
  };
});

Kwa kufuata hatua hizi, unaweza kufunga exit() kwenye programu yako ya Android na kubadilisha matokeo ya wito wa exit() kulingana na mahitaji yako.

var sysexit = Java.use("java.lang.System");
sysexit.exit.overload("int").implementation = function(var_0) {
send("java.lang.System.exit(I)V  // We avoid exiting the application  :)");
};

Frida Tutorial: Kufunga .onStart() & .onCreate() ya MainActivity

Katika mafunzo haya, tutajifunza jinsi ya kufunga .onStart() na .onCreate() ya MainActivity katika programu ya Android kwa kutumia Frida.

Hatua ya 1: Kuandaa Mazingira

Kabla ya kuanza, hakikisha kuwa umeweka mazingira yako ya maendeleo ya Android na Frida. Unaweza kufuata hatua zilizoelezwa katika mafunzo haya ili kuweka mazingira yako.

Hatua ya 2: Kuandika Script ya Frida

Tutahitaji kuandika script ya Frida ili kufunga .onStart() na .onCreate() ya MainActivity. Hapa kuna script ya mfano:

Java.perform(function() {
    var MainActivity = Java.use('com.example.app.MainActivity');

    MainActivity.onStart.implementation = function() {
        console.log('onStart() imefungwa!');
        this.onStart();
    };

    MainActivity.onCreate.implementation = function() {
        console.log('onCreate() imefungwa!');
        this.onCreate();
    };
});

Hatua ya 3: Kutekeleza Script ya Frida

Sasa tunahitaji kutekeleza script ya Frida kwenye programu ya Android. Hapa kuna hatua za kufuata:

  1. Anza programu yako ya Android kwenye kifaa chako cha majaribio.

  2. Fungua terminal na nenda kwenye saraka ambapo script ya Frida imehifadhiwa.

  3. Chapa amri ifuatayo kutekeleza script ya Frida:

frida -U -f com.example.app -l script.js --no-pause

Kumbuka kubadilisha com.example.app na jina la pakiti la programu yako ya Android.

Hatua ya 4: Kupima Matokeo

Baada ya kutekeleza script ya Frida, unapaswa kuona ujumbe "onStart() imefungwa!" na "onCreate() imefungwa!" kwenye terminal. Hii inathibitisha kuwa .onStart() na .onCreate() ya MainActivity zimefungwa.

Hitimisho

Kwa kufuata hatua hizi, unaweza kufunga .onStart() na .onCreate() ya MainActivity katika programu yako ya Android kwa kutumia Frida. Hii inaweza kuwa na manufaa katika uchunguzi wa usalama na upimaji wa programu.

var mainactivity = Java.use("sg.vantagepoint.uncrackable1.MainActivity");
mainactivity.onStart.overload().implementation = function() {
send("MainActivity.onStart() HIT!!!");
var ret = this.onStart.overload().call(this);
};
mainactivity.onCreate.overload("android.os.Bundle").implementation = function(var_0) {
send("MainActivity.onCreate() HIT!!!");
var ret = this.onCreate.overload("android.os.Bundle").call(this,var_0);
};

Kufunga .onCreate() ya Android

Katika maendeleo ya programu za Android, .onCreate() ni njia muhimu sana ambayo huitwa wakati shughuli (activity) ya Android inaundwa. Kwa kufunga .onCreate(), tunaweza kuingilia kati mchakato wa kuanzisha shughuli na kufanya mabadiliko fulani.

Frida ni kifaa cha kuvamia ambacho kinaweza kutumika kufunga .onCreate() ya Android. Hapa kuna hatua za kufuata:

  1. Tumia Frida kuanzisha mchakato wa programu ya Android unayotaka kufunga .onCreate() yake.

  2. Tumia Frida kusoma na kuchambua kificho cha programu ili kupata jina la darasa na jina la njia ya .onCreate().

  3. Tumia Frida kuunda skripti ya JavaScript ambayo itaingilia kati .onCreate() na kufanya mabadiliko unayotaka.

  4. Tumia Frida kutekeleza skripti ya JavaScript kwenye mchakato wa programu ya Android.

Hapa kuna mfano wa skripti ya JavaScript ambayo inafunga .onCreate() ya shughuli ya Android:

Java.perform(function() {
  var Activity = Java.use('com.example.Activity'); // Badilisha 'com.example.Activity' na jina la darasa la shughuli yako ya Android

  Activity.onCreate.implementation = function(savedInstanceState) {
    // Mabadiliko unayotaka kufanya
    // ...

    // Kuita .onCreate() ya awali
    this.onCreate(savedInstanceState);
  };
});

Kwa kutekeleza skripti hii ya JavaScript na Frida, utaweza kufunga .onCreate() ya shughuli ya Android na kufanya mabadiliko unayotaka.

var activity = Java.use("android.app.Activity");
activity.onCreate.overload("android.os.Bundle").implementation = function(var_0) {
send("Activity HIT!!!");
var ret = this.onCreate.overload("android.os.Bundle").call(this,var_0);
};

Kufunga kazi na vigezo na kupata thamani

Kufunga kazi ya kufichua. Chapisha kuingia, ita kazi halisi ya kufichua kuingia na hatimaye, chapisha data wazi:

function getString(data){
var ret = "";
for (var i=0; i < data.length; i++){
ret += data[i].toString();
}
return ret
}
var aes_decrypt = Java.use("sg.vantagepoint.a.a");
aes_decrypt.a.overload("[B","[B").implementation = function(var_0,var_1) {
send("sg.vantagepoint.a.a.a([B[B)[B   doFinal(enc)  // AES/ECB/PKCS7Padding");
send("Key       : " + getString(var_0));
send("Encrypted : " + getString(var_1));
var ret = this.a.overload("[B","[B").call(this,var_0,var_1);
send("Decrypted : " + ret);

var flag = "";
for (var i=0; i < ret.length; i++){
flag += String.fromCharCode(ret[i]);
}
send("Decrypted flag: " + flag);
return ret; //[B
};

Kufunga kazi na kuzipiga kwa kutumia kuingiza kwetu

Funga kazi ambayo inapokea herufi na ipige kazi hiyo kwa kutumia herufi nyingine (kutoka hapa)

var string_class = Java.use("java.lang.String"); // get a JS wrapper for java's String class

my_class.fun.overload("java.lang.String").implementation = function(x){ //hooking the new function
var my_string = string_class.$new("My TeSt String#####"); //creating a new String by using `new` operator
console.log("Original arg: " +x );
var ret =  this.fun(my_string); // calling the original function with the new String, and putting its return value in ret variable
console.log("Return value: "+ret);
return ret;
};

Kupata kitu kilichoundwa tayari cha darasa

Ikiwa unataka kuchukua sifa fulani ya kitu kilichoundwa, unaweza kutumia hii.

Katika mfano huu utaona jinsi ya kupata kitu cha darasa my_activity na jinsi ya kuita kazi .secret() ambayo itachapisha sifa ya faragha ya kitu:

Java.choose("com.example.a11x256.frida_test.my_activity" , {
onMatch : function(instance){ //This function will be called for every instance found by frida
console.log("Found instance: "+instance);
console.log("Result of secret func: " + instance.secret());
},
onComplete:function(){}
});

Mafunzo mengine ya Frida

Mshauri wa tuzo ya mdudu: Jisajili kwa Intigriti, jukwaa la tuzo za mdudu la malipo lililoanzishwa na wadukuzi, kwa wadukuzi! Jiunge nasi kwenye https://go.intigriti.com/hacktricks leo, na anza kupata tuzo hadi $100,000!

LogoRegister - IntigritiRegister - Intigriti
Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Njia nyingine za kusaidia HackTricks:

PreviousExploiting a debuggeable applicationNextFrida Tutorial 1

Last updated