猿人学安卓题#1

下载地址

https://appmatch.yuanrenxue.com/

视频教程

https://www.bilibili.com/video/BV1wg411Z7JT/

python代码

import frida  # 导入frida模块
import sys  # 导入sys模块

def on_message(message, data):  # js中执行send函数后要回调的函数
    print(message)

'''
spawn模式，Frida会自行启动并注入进目标App，Hook的时机非常早
'''
# device=frida.get_remote_device()
# pid=device.spawn(['com.jx885.reward'])  #包名
# device.resume(pid)
# time.sleep(1)
# session = device.attach(pid)

'''
attach模式，Frida会附加到当前的目标进程中，即需要App处于启动状态，这也意味着只能从当前时机往后Hook，
'''
session = frida.get_remote_device().attach('猿人学2022')  #APPNAME

with open("./frida.js") as f:
    script = session.create_script(f.read())

script.on('message', on_message)  # 加载回调函数，也就是js中执行send函数规定要执行的python函数
script.load()  # 加载脚本

arg='page=11658249853'
sign=script.exports.getsign(arg)
print(sign)
#sys.stdin.read()

frida.js

function bin2String(array) {
  return String.fromCharCode.apply(String, array);
}
function stringToBytes(str) {
    var ch,
    st,
    re = [];
    for (var i = 0; i < str.length; i++) {
        ch = str.charCodeAt(i);
        st = [];
        do {
            st.push(ch & 0xFF);
            ch = ch >> 8;
        } while (ch);
        re = re.concat(st.reverse());
    }
    return re;
}

// Java.perform(function (){
//     Java.use('com.yuanrenxue.match2022.security.Sign').sign.implementation=function (arg){
//         console.log(arg);
//         console.log('arg:',bin2String(arg));
//         var msign=this.sign(arg);
//         console.log('sign:',msign)
//         return msign;
//     }
// });

function sign(s){
    var result='';
    Java.perform(function (){
        result=Java.use('com.yuanrenxue.match2022.security.Sign').$new().sign(stringToBytes(s));
    })
    return result
}
rpc.exports={
    getsign:sign
}