移动应用安全与风控——应用分析常用工具

adb reboot bootloader

fastboot flashing unlock  或 fastboot oem unlock

adb pull /sdcard/Download/magisk_patched-23000_T5HA4.img .
adb reboot bootloader
fastboot boot magisk_patched-23000_T5HA4.img

# 标记该应用为xposed模块，用于xposed框识别
<meta-data android:name="xposedmodule" android:value="true" />  
# 对该xposed模块的描述
<meta-data
  android:name="xposeddescription" 
  android:value="Edxposed demo!" /> 
# 模块支持的最低API版本
<meta-data android:name="xposedminversion" android:value="54" />

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.hook.xposed">
    <application
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name">
        <meta-data
            android:name="xposedmodule"
            android:value="true" />
        <meta-data
            android:name="xposeddescription"
            android:value="Edxposed Xposed Test" />
        <meta-data
            android:name="xposedminversion"
            android:value="54" />
    </application>
</manifest>

dependencies {
    compileOnly 'de.robv.android.xposed:api:82'
    compileOnly 'de.robv.android.xposed:api:82:sources'
}

repositories {
    jcenter()
}

dependencies {
    compileOnly files('libs/XposedBridgeApi-82.jar')
}

com.hook.xposed.InitHook

// Multi-dex support
findAndHookMethod("android.app.Application",
    loadPackageParam.classLoader,
    "attach",
    Context.class,
    new XC_MethodHook() {
        @Override
        protected void afterHookedMethod(MethodHookParam param) {
            Context context = (Context) param.args[0];
            ClassLoader classLoader = context.getClassLoader();
            // 此处开始正常进行hook操作
            .....
        }
    }
);

......
public String getTextViewShowData(String input, int count) {
     return "Hello, welcome to here!!!";
}
......

XposedHelpers.findAndHookMethod("com.demo.app.MainActivity", lpparam.classLoader, "getTextViewShowData", String.class, int.class, new XC_MethodHook() {
    @Override
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
        // 在getTextViewShowData方法执行前拦截并修改
        param.setResult("this function is be hooked!!!");
    }
});

Class<?> customClass = XposedHelpers.findClass("自定义变量的的完整路径", classLoader);
findAndHookMethod(
        "目标类名", 
        classLoader,                                    
        "目标方法名",
        String.class,
        customClass,
        new XC_MethodHook() {
            @Override
            protected void afterHookedMethod(MethodHookParam param) {
            }
        }
);

$ pip3 install frida-tools

adb push  frida-server /data/local/tmp
adb shell  // 进入到Android的命令行模式
$ su       // 切换到root模式
# chemod a+x /data/local/tmp/frida-server
# ./data/local/tmp/frida-server

adb forward tcp:27042 tcp:27042
adb forward tcp:27043 tcp:27043

# 查询usb连接的设备上的进程信息
$ frida-ps -U
  PID  Name
-----  -------------------------------------------------------
 5805      com.google.android.gms
 5366      com.google.android.gms.persistent
11067      com.google.android.gms.ui
 7371      com.google.android.gms.unstable
 5649      com.google.android.googlequicksearchbox
 5592      com.google.android.googlequicksearchbox:interactor
 5628      android.process.media

$ frida-ls-devices
Id                Type    Name
----------------  ------  ------------
local             local   Local System
CVH7N15A20001095  usb     Nexus 6P
socket            remote  Local Socket

# 跟踪进程中的recv* 和 send* API调用
$ frida-trace -i "recv*" -i "send*" <进程名>
# 在应用程序中跟踪ObjC方法调用
$ frida-trace -m "ObjC" <进程名>     
# 在设备中打开应用程序并跟踪函数call的调用
$ frida-trace -U -f <进程名> -I "call" 
# 在Android设备上的指定应用程序中跟踪所有JNI函数的调用
$ frida-trace -U -i "Java_*" <进程名>

# 显示通过usb连接的设备上的进程信息
$ frida-ps -U
# 显示通过usb连接的设备上活跃的进程信息
$ frida-ps -Ua
# 显示通过usb连接的设备上安装的应用信息
$ frida-ps -Uai

# Frida连接到usb连接的设备上的Chrome，并在调试模式下加载 test.js
$ frida -U Chrome -l test.js --debug

# 发现应用程序中的内部函数
$ frida-discover -n <进程名>
$ frida-discover -p <进程id>

$ frida-kill -D <DEVICE-ID> <PID>
# 查询当前连接的设备
$ frida-ls-devices
Id                Type    Name
----------------  ------  ------------
local             local   Local System
CVH7N15A20001095  usb     Nexus 6P
socket            remote  Local Socket
# 列出指定设备上活跃的进程信息
$ frida-ps -D CVH7N15A20001095  -a
  PID  Name
-----  -------------------------------------------------------
 5805      com.google.android.gms
 5366      com.google.android.gms.persistent
11067      com.google.android.gms.ui
 7371      com.google.android.gms.unstable
 5649      com.google.android.googlequicksearchbox
 5592      com.google.android.googlequicksearchbox:interactor
 5628      android.process.media
# 杀死制定设备上的进程
$ frida-kill -D CVH7N15A20001095  5805

# Attach 到目标进程
process = frida.attach(target_process)
# 加载jscode 到目标进程
script = process.create_script(script_code)
script.load()

# 启动指定的进程
pid = device.spawn([packename])
# attach到新创建的进程
process = device.attach(pid)
# 加载jscode 到目标进程
script = process.create_script(jscode)
script.on('message', on_message)
script.load()
# 新创建的进程为挂起状态，调用resume将进程恢复
device.resume(pid)

# 获取指定设备id的设备
device = frida.get_device_manager().get_device("device id")
# 获取远程的设备
manager = frida.get_device_manager()
device = manager.add_remote_device("30.128.25.128:8080")
# 获取通过usb连接的设备
device = frida.get_usb_device()

import sys
import frida
# 获取通过usb连接的设备 
device = frida.get_usb_device()
# 启动指定的进程
pid = device.spawn(["com.frida.test"])
# attach到新创建的进程
session = device.attach(pid)
# 新创建的进程为挂起状态，调用resume将进程恢复
device.resume(pid)
jscode = """
Java.perform(function(){
    var main=Java.use("com.frida.test.MainActivity");
    main.test.implementation = function()
    {
        console.log("You have been Hooked");
    }
});
"""
def on_message(message,data):
    # message的类型为map，取出key payload 的value
    print(message["payload"])  
script = session.create_script(jscode)
# 设置message回调函数为on_message。js代码调用send就会发到on_message 
script.on("message",on_message)
script.load()
sys.stdin.read()

import frida
import sys
# 获取通过usb连接的设备 
device = frida.get_usb_device()
# 启动指定的进程
pid = device.spawn(["com.frida.test"])
# attach到新创建的进程
session = device.attach(pid)
# 新创建的进程为挂起状态，调用resume将进程恢复
device.resume(pid)
jscode = """
var openPtr = Module.findExportByName("libc.so", "open");
Interceptor.attach(openPtr, {
     onEnter : function(args){
         var pathPtr = args[0];
         send("open called ! path=" + pathPtr.readUtf8String());
     },
     onLeave : function(retval){
         send("open leave.....");
     }
});
"""
def on_message(message, data):
 # message的类型为map，取出key payload 的value
    print(message["payload"])   
script = session.create_script(jscode)
# 设置message回调函数为on_message。js代码调用send就会发到on_message
script.on("message", on_message)
script.load()
sys.stdin.read()

pip3 install objection

objection -g [packageName/bundleID] explore

objection -g packageName explore --startup-command 'android hooking watch class_method xxxx' 

# 查看应用的activity组件信息
android hooking list activities
# 查看应用的service组件信息
android hooking list services
# 查看应用的broadcast receiver组件信息
android hooking list receivers

# 启动指定的activity组件
android intent launch_activity [class_activity]
# 启动指定的service组件
android intent launch_service [class_service]

# 查看内存中所有的类
android/ios hooking list classes
# 查看指定类中所有的方法
android/ios hooking list class_methods <class_name>
# 查找指定特征的类
android/ios hooking search classes <class_name>
# 查找指定特征的方法
android/ios hooking search methods <method_name>

# hook指定类下所有的方法
android/ios hooking watch class [class_name]
# hook指定类中的指定方法
# --dump-args : 打印参数
# --dump-backtrace : 打印调用栈
# --dump-return : 打印返回值
android/ios hooking watch class_method [class_name] --dump-args --dump-backtrace --dump-return
# 设置返回值，目前仅支持bool类型
android/ios hooking set return_value [class_name] false
# 生成frida的hook代码
android/ios hooking generate simple [class_name]

# 搜索指定类的实例, 获取该类的实例id
search instances search instances [class_name]
# 通过实例id直接调用该类中的方法
android heap execute [instance_id] [method_name]

android/ios sslpinning disable

# 枚举当前进程模块
memory list modules
# 查看指定模块的导出函数
memory list exports [lib_name] 
# 将导出函数的结果保存到指定的文件
memory list exports [lib_name] --json result.json 
# 搜索内存
memory search --string --offsets-only

# 尝试对抗root检测
android root disable
# 尝试模拟root环境
android root simulate
# 截图
android/ios ui screenshot [image.png]
# 对抗越狱检测
ios jailbreak disable
# dump keychain中的内容
ios keychain dump
# 尝试关闭ios生物特征认证
ios ui biometrics_bypass
# 执行shell命令
android shell_exec [command]

# 将theos 下载安装到指定目录中
git clone --recursive https://github.com/theos/theos.git /opt/theos
# 将theos添加到环境变量中
export THEOS=/opt/theos
export PATH="$THEOS/bin:$PATH"
# 安装签名工具,用于对编译完成后的文件签名
brew install ldid

{ Filter = { Bundles = ( "com.test.demo","com.test.demo1" ); }; }

%hook ClassName
// Hooking a class method
+ (id)sharedInstance {
    return %orig;
}
// Hooking an instance method with an argument.
- (void)messageName:(int)argument {
    %orig;
}
// Hooking an instance method with no arguments.
- (id)noArguments {
       %orig;
}
%end

%hook ClassName
// Hooking a class method
+ (id)sharedInstance {
    return %orig;
}
%end

%group testGroup
%hook ClassName
// Hooking a class method
+ (id)sharedInstance {
    return %orig;
}
%end
%end
%ctor {
    %init(testGroup);
}

%hook ClassName
%new
- (void)addNewMethod {
}
%end

%hook ClassName
- (int)add:(int)a to:(int)b {
    if (a != 0) {
        // Return original result if `a` is not 0
        return %orig;
    }
    // Otherwise, use 1 as `a`
    return %orig(1, b);
}
%end

%hook ClassName
- (void)targetMethod:(id)arg1 {
    %log
}
%end

#import <SpringBoard/SpringBoard.h>
%hook SpringBoard
-(void)applicationDidFinishLaunching:(id)application {
    %orig;
    UIAlertView *alert = [[UIAlertView alloc] initWithTitle:@"Test"
        message:@"Tweak test！！！"
        delegate:nil
        cancelButtonTitle:@"确定"
        otherButtonTitles:nil];
    [alert show];
}
%end

# 设置Tweak插件安装到目标手机的IP，否则安装将失败
export THEOS_DEVICE_IP=[目标手机IP]
# 编译并安装Tweak插件
make do

# Drozer依赖python 2.x，此处的pip 必须为python 2.x的版本
pip install drozer-2.4.4-py2-none-any.whl --ignore-installed pyOpenSSL

pip install protobuf==3.17.3 pyOpenSSL Twisted service_identity
# 安装 Mac Command Line
xcode-select --install

# 端口转发
adb forward tcp:31415 tcp:31415
# 连接drozer
drozer console connect

dz> run app.package.info -a package_name

dz> run app.package.attacksurface package_name

# 其它组件信息查询命令类似，只需更改命令中的组件类型即可
dz> run app.activity.info -a package_name

# 启动时使用空action
dz> run app.activity.start --component package_name activity_name
# 启动时指定action
dz> run app.activity.start --component package_name activity_name
--action android.intent.action.XXX

# 获取目标应用中对外暴露的URI
dz> run scanner.provider.finduris -a package_name
# 通过暴露的URI进行信息检索
dz> run app.provider.query content://uri/passwords/ --vertical

dz> run scanner.provider.injection -a package_name

# 全局可写文件检测
dz> run scanner.misc.writablefiles --privileged /data/data/pacakge_name
# 全局可读文件检测
dz> run scanner.misc.readablefiles --privileged /data/data/pacakge_name