一、前言

二、HTTPUrlConnection 信息自吐

// URLConnectionhttpUrlConnection.setDoOutput(true);httpUrlConnection.setDoInput(true);HttpUrlConnection.setUseCaches(false);httpUrlConnection.setRequestProperty("Content-type", "application/x-java-serialized-object");httpUrlConnection.connect();// HttpURLConnectionhttpUrlConnection.setRequestMethod("POST");

function hook_java(){    Java.perform(function(){        // httpUrlConnection.setDoOutput(true);        // httpUrlConnection.setDoInput(true);        // HttpUrlConnection.setUseCaches(false);        var URLConnection = Java.use("java.net.URLConnection")        URLConnection.setDoOutput.implementation = function(isOutput){            console.log("URLConnection.setDoOutput : ",isOutput);            return this.setDoOutput(isOutput);        }        URLConnection.setDoInput.implementation = function(isInput){            console.log("URLConnection.setDoInput : ",isInput);            return this.setDoInput(isInput);        }        URLConnection.setUseCaches.implementation = function(isUseCaches){            console.log("URLConnection.setUseCaches : ",isUseCaches);            return this.setUseCaches(isUseCaches);        }        // com.android.okhttp.internal.huc.HttpURLConnectionImpl        var HttpURLConnectionImpl = Java.use("com.android.okhttp.internal.huc.HttpURLConnectionImpl");        HttpURLConnectionImpl.setRequestProperty.implementation = function(name,value){            console.log("HttpURLConnectionImpl.setRequestProperty => ",name,": ",value);            return this.setRequestProperty(name,value);        }        HttpURLConnectionImpl.setRequestMethod.implementation = function(type){            console.log("HttpURLConnectionImpl.setRequestMethod : ",type);            return this.setRequestMethod(type);        }        HttpURLConnectionImpl.connect.implementation = function(){            console.log("HttpURLConnectionImpl.connect");            return this.connect();        }     });} function main(){    hook_java();}setImmediate(main);

三、so构造函数自吐

soinfo::call_constructors()    call_function("DT_INIT", init_func_, get_realpath());    call_array("DT_INIT_ARRAY", init_array_, init_array_count_, false, get_realpath());            ------>循环调用了 call_function("function", functions[i], realpath);

function hook_init_array() {    //console.log("hook_constructor",Process.pointerSize);    if (Process.pointerSize == 4) {        var linker = Process.findModuleByName("linker");    }else if (Process.pointerSize == 8) {        var linker = Process.findModuleByName("linker64");     }      var addr_call_array = null;    if (linker) {        var symbols = linker.enumerateSymbols();        for (var i = 0; i < symbols.length; i++) {            var name = symbols[i].name;            if (name.indexOf("call_array") >= 0) {                addr_call_array = symbols[i].address;            }        }    }    if (addr_call_array) {        Interceptor.attach(addr_call_array, {            onEnter: function (args) {                 this.type = ptr(args[0]).readCString();                //console.log(this.type,args[1],args[2],args[3])                if (this.type == "DT_INIT_ARRAY") {                    this.count = args[2];                    //this.addrArray = new Array(this.count);                    this.path = ptr(args[3]).readCString();                    var strs = new Array(); //定义一数组                    strs = this.path.split("/"); //字符分割                    this.filename = strs.pop();                    if(this.count > 0){                        console.log("path : ", this.path);                        console.log("filename : ", this.filename);                    }                    for (var i = 0; i < this.count; i++) {                        console.log("offset : init_array["+i+"] = ", ptr(args[1]).add(Process.pointerSize*i).readPointer().sub(Module.findBaseAddress(this.filename)));                        //插入hook init_array代码                    }                }            },            onLeave: function (retval) {             }        });    }}

function hook_constructor() {    if (Process.pointerSize == 4) {        var linker = Process.findModuleByName("linker");    } else {        var linker = Process.findModuleByName("linker64");    }     var addr_call_function =null;    var addr_g_ld_debug_verbosity = null;    var addr_async_safe_format_log = null;    if (linker) {        //console.log("found linker");        var symbols = linker.enumerateSymbols();        for (var i = 0; i < symbols.length; i++) {            var name = symbols[i].name;            if (name.indexOf("call_function") >= 0){                addr_call_function = symbols[i].address;               // console.log("call_function",JSON.stringify(symbols[i]));            }            else if(name.indexOf("g_ld_debug_verbosity") >=0){                addr_g_ld_debug_verbosity = symbols[i].address;                 ptr(addr_g_ld_debug_verbosity).writeInt(2);             } else if(name.indexOf("async_safe_format_log") >=0 && name.indexOf('va_list') < 0){               // console.log("async_safe_format_log",JSON.stringify(symbols[i]));                addr_async_safe_format_log = symbols[i].address;             }         }    }    if(addr_async_safe_format_log){        Interceptor.attach(addr_async_safe_format_log,{            onEnter: function(args){                this.log_level  = args[0];                this.tag = ptr(args[1]).readCString()                this.fmt = ptr(args[2]).readCString()                if(this.fmt.indexOf("c-tor") >= 0 && this.fmt.indexOf('Done') < 0){                    this.function_type = ptr(args[3]).readCString(), // func_type                    this.so_path = ptr(args[5]).readCString();                    var strs = new Array(); //定义一数组                    strs = this.so_path.split("/"); //字符分割                    this.so_name = strs.pop();                    this.func_offset  = ptr(args[4]).sub(Module.findBaseAddress(this.so_name))                     console.log("func_type:", this.function_type,                        '\nso_name:',this.so_name,                        '\nso_path:',this.so_path,                        '\nfunc_offset:',this.func_offset                     );                   // hook代码在这加                }            },            onLeave: function(retval){            }        })    }  }

四、后记

• 一个通用的纯 Java 安卓隐藏 API 限制绕过方案
  

• 2021南极动物厂游戏高赛竞赛决赛分析02
  

• 2021南极动物厂游戏高赛竞赛决赛分析01
  

• 理解frame faking 栈迁移+例题详解(含图示)
  

• 关于谷歌P0的AppContainer逃逸的一种简单的复现