0
0

【iOS逆向与安全】frida-trace命令大全

  1. 1、spawn - 冷启动
  2. frida-trace -U -f com.apple.ExampleCode -m "+[NSURL URLWithString:]"
  4. 2、attach - 热启动
  5. frida-trace -UF -m "+[NSURL URLWithString:]"
  7. 3、Hook类方法
  8. frida-trace -UF -m "+[NSURL URLWithString:]"
  10. 4、Hook实例方法
  11. frida-trace -UF -m "-[NSURL host]"
  13. 5、Hook类的所有方法
  14. frida-trace -UF -m "*[NSURL *]"
  16. 6、模糊Hook类的所有方法
  17. frida-trace -UF -m "*[*service* *]"
  19. 7、模糊Hook所有类的特定方法
  20. frida-trace -UF -m "*[* *sign*]"
  22. 8、模糊Hook所有类的特定方法并忽略大小写
  23. 假设我们要hook所有类中包含getSign或getsign关键词的方法
  24. frida-trace -UF -m "*[* get?ign]"
  26. 9、模糊Hook所有类的特定方法并排除viewDidLoad方法
  27. frida-trace -UF -m "*[DetailViewController *]" -M "-[DetailViewController viewDidLoad]"
  29. 10、Hook某个动态库
  30. frida-trace -UF -I "libcommonCrypto*"
  32. 11、Hook get或post的接口地址
  33. frida-trace -UF -m "+[NSURL URLWithString:]"
  34. js代码如下：
  36. {
  37.   onEnter(log, args, state) {
  38.     var args2 = new ObjC.Object(args[2]);
  39.     log(`-[NSURL URLWithString:${args2}]`);
  40.   },
  41.   onLeave(log, retval, state) {
  42.   }
  43. }
  45. 12、Hook post的body
  46. js代码如下：
  48. frida-trace -UF -m "-[NSMutableURLRequest setHTTPBody:]"
  49. {
  50.   onEnter(log, args, state) {
  51.     var args2 = new ObjC.Object(args[2]);
  52.     log(`-[NSMutableURLRequest setHTTPBody:${args2.bytes().readUtf8String(args2.length())}]`);
  53.   },
  54.   onLeave(log, retval, state) {
  55.   }
  56. }

13、Hook即将显示页面

  1. frida-trace -UF -m "-[UINavigationController pushViewController:animated:]" -m "-[UIViewController presentViewController:animated:completion:]"
  3. pushViewController:animated:方法的js代码如下：
  5. {
  6.   onEnter(log, args, state) {
  7.     var args2 = new ObjC.Object(args[2]);
  8.     log(`-[UINavigationController pushViewController:${args2.$className} animated:${args[3]}]`);
  9.   },
  10.   onLeave(log, retval, state) {
  11.   }
  12. }
  14. presentViewController:animated:completion:方法对应的js代码如下：
  16. {
  17.   onEnter(log, args, state) {
  18.     var args2 = new ObjC.Object(args[2]);
  19.     log(`-[UIViewController presentViewController:${args2.$className} animated:${args[3]} completion:${args[4]}]`);
  20.   },
  21.   onLeave(log, retval, state) {
  22.   }
  23. }

14、Hook MD5函数

  1. frida-trace -UF -i "CC_MD5"
  3. js代码如下：
  5. {
  6.   onEnter(log, args, state) {
  7.     this.args0 = args[0];    // 入参
  8.     this.args2 = args[2];    // 返回值指针
  9.   },
  10.   onLeave(log, retval, state) {
  11.     var ByteArray = Memory.readByteArray(this.args2, 16);
  12.     var uint8Array = new Uint8Array(ByteArray);
  14.     var str = "";
  15.     for(var i = 0; i < uint8Array.length; i++) {
  16.         var hextemp = (uint8Array[i].toString(16))
  17.         if(hextemp.length == 1){
  18.             hextemp = "0" + hextemp
  19.         }
  20.         str += hextemp;
  21.     }
  22.     log(`CC_MD5(${this.args0.readUtf8String()})`);       // 入参
  23.     log(`CC_MD5()=${str}=`);                                                    // 返回值
  24.   }
  25. }

15、Hook Base64编码方法

  1. frida-trace -UF -m "-[NSData base64EncodedStringWithOptions:]"
  2. js代码如下：
  4. {
  5.   onEnter(log, args, state) {
  6.     this.self = args[0];
  7.   },
  8.   onLeave(log, retval, state) {
  9.     var before = ObjC.classes.NSString.alloc().initWithData_encoding_(this.self, 4);
  10.     var after = new ObjC.Object(retval);
  11.     log(`-[NSData base64EncodedStringWithOptions:]before=${before}=`);
  12.     log(`-[NSData base64EncodedStringWithOptions:]after=${after}=`);
  13.   }
  14. }

16、Hook Base64解码方法

  1. frida-trace -UF -m "-[NSData initWithBase64EncodedData:options:]" -m "-[NSData initWithBase64EncodedString:options:]"
  3. initWithBase64EncodedData:options:方法对应的js代码如下：
  5. {
  6.   onEnter(log, args, state) {
  7.     this.arg2 = args[2];
  8.   },
  9.   onLeave(log, retval, state) {
  10.     var before = ObjC.classes.NSString.alloc().initWithData_encoding_(this.arg2, 4);
  11.     var after = ObjC.classes.NSString.alloc().initWithData_encoding_(retval, 4);
  12.     log(`-[NSData initWithBase64EncodedData:]before=${before}=`);
  13.     log(`-[NSData initWithBase64EncodedData:]after=${after}=`);
  14.   }
  15. }
  17. initWithBase64EncodedString:options:方法对应的js代码如下：
  19. {
  20.   onEnter(log, args, state) {
  21.     this.arg2 = args[2];
  22.   },
  23.   onLeave(log, retval, state) {
  24.     var before = new ObjC.Object(this.arg2);
  25.     var after = ObjC.classes.NSString.alloc().initWithData_encoding_(retval, 4);
  26.     log(`-[NSData initWithBase64EncodedString:]before=${before}=`);
  27.     log(`-[NSData initWithBase64EncodedString:]after=${after}=`);
  28.   }
  29. }

17、Hook加密函数AES、DES、3DES

  1. frida-trace -UF -i CCCrypt
  3. js代码如下：
  5. {
  6.     onEnter: function(log, args, state) {
  7.         this.op = args[0]
  8.         this.alg = args[1]
  9.         this.options = args[2]
  10.         this.key = args[3]
  11.         this.keyLength = args[4]
  12.         this.iv = args[5]
  13.         this.dataIn = args[6]
  14.         this.dataInLength = args[7]
  15.         this.dataOut = args[8]
  16.         this.dataOutAvailable = args[9]
  17.         this.dataOutMoved = args[10]
  19.         log('CCCrypt(' +
  20.             'op: ' + this.op + '[0:加密,1:解密]' + ', ' +
  21.             'alg: ' + this.alg + '[0:AES128,1:DES,2:3DES]' + ', ' +
  22.             'options: ' + this.options + '[1:ECB,2:CBC,3:CFB]' + ', ' +
  23.             'key: ' + this.key + ', ' +
  24.             'keyLength: ' + this.keyLength + ', ' +
  25.             'iv: ' + this.iv + ', ' +
  26.             'dataIn: ' + this.dataIn + ', ' +
  27.             'inLength: ' + this.inLength + ', ' +
  28.             'dataOut: ' + this.dataOut + ', ' +
  29.             'dataOutAvailable: ' + this.dataOutAvailable + ', ' +
  30.             'dataOutMoved: ' + this.dataOutMoved + ')')
  32.         if (this.op == 0) {
  33.             log("dataIn:")
  34.             log(hexdump(ptr(this.dataIn), {
  35.                 length: this.dataInLength.toInt32(),
  36.                 header: true,
  37.                 ansi: true
  38.             }))
  39.             log("key: ")
  40.             log(hexdump(ptr(this.key), {
  41.                 length: this.keyLength.toInt32(),
  42.                 header: true,
  43.                 ansi: true
  44.             }))
  45.             log("iv: ")
  46.             log(hexdump(ptr(this.iv), {
  47.                 length: this.keyLength.toInt32(),
  48.                 header: true,
  49.                 ansi: true
  50.             }))
  51.         }
  52.     },
  53.     onLeave: function(log, retval, state) {
  54.         if (this.op == 1) {
  55.             log("dataOut:")
  56.             log(hexdump(ptr(this.dataOut), {
  57.                 length: Memory.readUInt(this.dataOutMoved),
  58.                 header: true,
  59.                 ansi: true
  60.             }))
  61.             log("key: ")
  62.             log(hexdump(ptr(this.key), {
  63.                 length: this.keyLength.toInt32(),
  64.                 header: true,
  65.                 ansi: true
  66.             }))
  67.             log("iv: ")
  68.             log(hexdump(ptr(this.iv), {
  69.                 length: this.keyLength.toInt32(),
  70.                 header: true,
  71.                 ansi: true
  72.             }))
  73.         } else {
  74.             log("dataOut:")
  75.             log(hexdump(ptr(this.dataOut), {
  76.                 length: Memory.readUInt(this.dataOutMoved),
  77.                 header: true,
  78.                 ansi: true
  79.             }))
  80.         }
  81.         log("CCCrypt did finish")
  82.     }
  83. }

18、Hook加密函数RSA

  2. rsa加密有公钥加密和私钥加密两种方式
  3. frida-trace -UF -i "SecKeyEncrypt" -i "SecKeyRawSign"
  5. SecKeyEncrypt公钥加密函数对应的js代码如下：
  7. {
  8.   onEnter(log, args, state) {
  9.     // 由于同一条加密信息可能会多次调用该函数，故在这输出该函数的调用栈。可根据栈信息去分析上层函数
  10.     log(`SecKeyEncrypt()=${args[2].readCString()}=`);
  11.     log('SecKeyEncrypt called from:\n' +
  12.         Thread.backtrace(this.context, Backtracer.ACCURATE)
  13.         .map(DebugSymbol.fromAddress).join('\n') + '\n');
  14.   },
  15.   onLeave(log, retval, state) {
  16.   }
  17. }
  19. SecKeyRawSign私钥加密函数对应的js代码如下：
  21. {
  22.   onEnter(log, args, state) {
  23.     log(`SecKeyRawSign()=${args[2].readCString()}=`);
  24.     log('SecKeyRawSign called from:\n' +
  25.         Thread.backtrace(this.context, Backtracer.ACCURATE)
  26.         .map(DebugSymbol.fromAddress).join('\n') + '\n');
  27.   },
  28.   onLeave(log, retval, state) {
  29.   }
  30. }

19、修改方法的入参

  1. frida-trace -UF -m "-[DetailViewController setObj:]"
  3. js代码如下：
  4. {
  5.   onEnter(log, args, state) {
  6.     var self = new ObjC.Object(args[0]);  // 当前对象
  7.     var method = args[1].readUtf8String();  // 当前方法名
  8.     log(`[${self.$className} ${method}]`);
  10.     // 字符串
  11.     // var str = ObjC.classes.NSString.stringWithString_("hi wit!")  // 对应的oc语法：NSString *str = [NSString stringWithString:@"hi with!"];
  12.     // args[2] = str  // 修改入参为字符串
  14.     // 数组
  15.     // var array = ObjC.classes.NSMutableArray.array();  // 对应的oc语法：NSMutableArray array = [NSMutablearray array];
  16.     // array.addObject_("item1");  // 对应的oc语法：[array addObject:@"item1"];
  17.     // array.addObject_("item2");  // 对应的oc语法：[array addObject:@"item2"];
  18.     // args[2] = array; // 修改入参为数组
  20.     // 字典
  21.     // var dictionary = ObjC.classes.NSMutableDictionary.dictionary(); // 对应的oc语法:NSMutableDictionary *dictionary = [NSMutableDictionary dictionary];
  22.     // dictionary.setObject_forKey_("value1", "key1"); // 对应的oc语法：[dictionary setObject:@"value1" forKey:@"key1"]
  23.     // dictionary.setObject_forKey_("value2", "key2"); // 对应的oc语法：[dictionary setObject:@"value2" forKey:@"key2"]
  24.     // args[2] = dictionary; // 修改入参为字典
  26.     // 字节
  27.     var data = ObjC.classes.NSMutableData.data(); // 对应的oc语法：NSMutableData *data = [NSMutableData data];
  28.     var str = ObjC.classes.NSString.stringWithString_("hi wit!")  // 获取一个字符串。 对应的oc语法：NSString *str = [NSString stringWithString:@"hi with!"];
  29.     var subData = str.dataUsingEncoding_(4);  // 将str转换为data,编码为utf-8。对应的oc语法：NSData *subData = [str dataUsingEncoding:NSUTF8StringEncoding];
  30.     data.appendData_(subData);  // 将subData添加到data。对应的oc语法：[data appendData:subData];
  31.     args[2] = data; // 修改入参字段
  33.     // 更多数据类型：https://developer.apple.com/documentation/foundation
  34.   },
  36.   onLeave(log, retval, state) {
  38.   }
  39. }

20、修改方法的返回值

  1. frida-trace -UF -m "-[DetailViewController Obj]"
  3. js代码如下：
  4. {
  5.   onEnter(log, args, state) {
  7.   },
  8.   onLeave(log, retval, state) {
  9.     // 字符串
  10.     var str = ObjC.classes.NSString.stringWithString_("hi wit!")  // 对应的oc语法：NSString *str = [NSString stringWithString:@"hi with!"];
  11.     retval.replace(str)  // 修改返回值
  12.     var after = new ObjC.Object(retval); // 打印出来是个指针时，请用该方式转换后再打印
  13.     log(`before:=${retval}=`);
  14.     log(`after:=${after}=`);
  15.   }
  16. }

21、打印字符串、数组、字典

  1. frida-trace -UF -m "-[DetailViewController setObj:]"
  3. js代码如下：
  4. {
  5.   onEnter(log, args, state) {
  6.     var self = new ObjC.Object(args[0]);  // 当前对象
  7.     var method = args[1].readUtf8String();  // 当前方法名
  8.     log(`[${self.$className} ${method}]`);
  10.     var before = args[2];
  11.     // 注意，日志输出请直接使用log函数。不要使用console.log()
  12.     var after = new ObjC.Object(args[2]); // 打印出来是个指针时，请用该方式转换后再打印
  13.     log(`before:=${before}=`);
  14.     log(`after:=${after}=`);
  15.   },
  16.   onLeave(log, retval, state) {
  18.   }
  19. }

22、打印NSData

  1. frida-trace -UF -m "-[DetailViewController setObj:]"

js代码如下：

  1. {
  2.   onEnter(log, args, state) {
  3.     var self = new ObjC.Object(args[0]);  // 当前对象
  4.     var method = args[1].readUtf8String();  // 当前方法名
  5.     log(`[${self.$className} ${method}]`);
  7.     var before = args[2];
  9.     // 注意，日志输出请直接使用log函数。不要使用console.log()
  10.    
  11.     var after = new ObjC.Object(args[2]); // 打印NSData
  12.     var outValue = after.bytes().readUtf8String(after.length()) // 将data转换为string
  13.     log(`before:=${before}=`);
  14.     log(`after:=${outValue}=`);
  15.   },
  16.   onLeave(log, retval, state) {
  18.   }
  19. }

23、打印对象的所有属性和方法

  1. frida-trace -UF -m "-[DetailViewController setObj:]"
  3. js代码如下：
  4. {
  5.   onEnter(log, args, state) {
  6.     var self = new ObjC.Object(args[0]);  // 当前对象
  7.     var method = args[1].readUtf8String();  // 当前方法名
  8.     log(`[${self.$className} ${method}]`);
  10.     var customObj = new ObjC.Object(args[2]); // 自定义对象
  11.     // 打印该对象所有属性
  12.     var ivarList = customObj.$ivars;
  13.     for (key in ivarList) {
  14.        log(`key${key}=${ivarList[key]}=`);
  15.     }
  17.     // 打印该对象所有方法
  18.     var methodList = customObj.$methods;
  19.     for (var i=0; i<methodList.length; i++) {
  20.        log(`method=${methodList[i]}=`);
  21.     }
  22.   },
  23.   onLeave(log, retval, state) {
  25.   }
  26. }

24、打印调用栈

  1. frida-trace -UF -m "+[NSURL URLWithString:]"
  3. js代码如下：
  4. {
  5.   onEnter(log, args, state) {
  6.     var url = new ObjC.Object(args[2]);
  7.     log(`+[NSURL URLWithString:${url}]`);
  8.     log('NSURL URLWithString: called from:\n' +
  9.         Thread.backtrace(this.context, Backtracer.ACCURATE)
  10.         .map(DebugSymbol.fromAddress).join('\n') + '\n');
  11.   },
  12.   onLeave(log, retval, state) {
  13.   }
  14. }

25、日志输出到文件

  1. frida-trace -UF -m "+[NSURL URLWithString:]" -o run.log

26、更多数据类型

  1. /**
  2.  * Converts to a signed 32-bit integer.
  3.  */
  4.   toInt32(): number;
  6.   /**
  7.   * Converts to an unsigned 32-bit integer.
  8.   */
  9.   toUInt32(): number;
  11.   /**
  12.   * Converts to a “0x”-prefixed hexadecimal string, unless a `radix`
  13.   * is specified.
  14.   */
  15.   toString(radix?: number): string;
  17.   /**
  18.   * Converts to a JSON-serializable value. Same as `toString()`.
  19.   */
  20.   toJSON(): string;
  22.   /**
  23.   * Returns a string containing a `Memory#scan()`-compatible match pattern for this pointer’s raw value.
  24.   */
  25.   toMatchPattern(): string;
  27.   readPointer(): NativePointer;
  28.   readS8(): number;
  29.   readU8(): number;
  30.   readS16(): number;
  31.   readU16(): number;
  32.   readS32(): number;
  33.   readU32(): number;
  34.   readS64(): Int64;
  35.   readU64(): UInt64;
  36.   readShort(): number;
  37.   readUShort(): number;
  38.   readInt(): number;
  39.   readUInt(): number;
  40.   readLong(): number | Int64;
  41.   readULong(): number | UInt64;
  42.   readFloat(): number;
  43.   readDouble(): number;
  44.   readByteArray(length: number): ArrayBuffer | null;
  45.   readCString(size?: number): string | null;
  46.   readUtf8String(size?: number): string | null;
  47.   readUtf16String(length?: number): string | null;
标签： ios javascript 开发语言
本文转载自: https://blog.csdn.net/qq_21051503/article/details/142218083
版权归原作者 ios and Android 所有， 如有侵权，请联系我们删除。
登录后发布评论

“【iOS逆向与安全】frida-trace命令大全”的评论:

还没有评论
关于作者
...
overfit同步小助手
文章同步
相关阅读

网络安全法-网络运行安全

使用selenium/drissionpage时如何阻止chrome自动跳转http到https

docker desktop 里部署的Open WebUI 管理员密码忘记了的处理方法

在ubuntu20.04中搭建onsite比赛运行环境

利用开源的低代码表单设计器FcDesigner高效管理和渲染复杂表单结构

Kafka学习笔记

【前端】浏览器输入url到页面呈现发生了什么？

文章导航
没有找到文章内容分段。。。