前言
在进行 Android 测试时会发现现在大多数 APP 都进行了加固，其中就包括 frida 防护。不能使用 frida，对 APP 渗透测试而言可以说是缺了灵魂。所以绕过 Frida 防护是我们必不可少的一步。
Frida 绕过的各种姿势
1. 使用去特征的 server
https://github.com/hluwa/strongR-frida-android/
2. 修改默认端口
./data/local/tmp/frida-* -l 0.0.0.0:800
adb forward tcp:27042 tcp:800
frida -R package_name -l hook.js
3. VA + Gadget
利用 VirtualApp 自带的延时注入功能，注入 frida-gadget，具体实现可看我 github。
github: https://github.com/jussi-sky/VirtualApp
3.1 引入 gadget.so（更改so名称，可绕过部分检测）
3.2 加载 gadget
package io.virtualapp;
import com.lody.virtual.helper.utils.VLog;
public class FridaGadget {
private static final String TAG = FridaGadget.class.getSimpleName();
static {
try {
System.loadLibrary("ijkplayer");
} catch (Throwable e) {
VLog.e(TAG, VLog.getStackTraceString(e));
}
}
public static void init() {
VLog.d(TAG, "Init Frida Gadget", new Object[0]);
}
}
3.3 重写 AppComponentDelegate，控制 gadget 加载时机
package io.virtualapp;
import android.app.Application;
import android.content.Context;
import com.lody.virtual.client.VClient;
import com.lody.virtual.client.core.AppCallback;
import com.lody.virtual.helper.utils.VLog;
import com.scorpion.IHook.XposedBridge;
import com.scorpion.IHook.callbacks.XC_LoadPackage;
import com.scorpion.reverse.dingding.DingTalk;
import com.swift.sandhook.xposedcompat.utils.ProcessUtils;
public class AppComponentDelegate implements AppCallback {
private static final String TAG = "AppComponentDelegate";
boolean isMainProcess = false;
public Application mApplication;
Context mContext;
public AppComponentDelegate(Context context) {
this.mContext = context;
}
public boolean isMainProcess() {
return this.isMainProcess;
}
public void setMainProcess(boolean mainProcess) {
this.isMainProcess = mainProcess;
boolean z = this.isMainProcess;
}
@Override // com.lody.virtual.client.core.AppCallback
public void beforeStartApplication(String packageName, String processName, Context context) {
}
@Override // com.lody.virtual.client.core.AppCallback
public void beforeApplicationCreate(String packageName, String processName, Application application) {
}
@Override // com.lody.virtual.client.core.AppCallback
public void afterApplicationCreate(String packageName, String processName, Application application) {
FridaGadget.init();
// 多进程应用使用 processName 控制只注入主进程，否则可能会出错
if (processName.equals("com.ford.cnevapp.debug")) {
FridaGadget.init();
}
if (packageName.equals("com.alibaba.android.rimet")) {
VLog.d("VA-", "开始 hook 丁丁打卡", new Object[0]);
DingTalk.hook(VClient.get().getClassLoader());
}
}
private XC_LoadPackage.LoadPackageParam getLoadPackageParam(Application application) {
XC_LoadPackage.LoadPackageParam packageParam = new XC_LoadPackage.LoadPackageParam(XposedBridge.sLoadedPackageCallbacks);
if (application != null) {
if (packageParam.packageName == null) {
packageParam.packageName = application.getPackageName();
}
if (packageParam.processName == null) {
packageParam.processName = ProcessUtils.getProcessName(application);
}
if (packageParam.classLoader == null) {
packageParam.classLoader = application.getClassLoader();
}
if (packageParam.appInfo == null) {
packageParam.appInfo = application.getApplicationInfo();
}
}
return packageParam;
}
}
3.4 最后确认主 Activity 的 AppComponentDelegate 的是否指向的是我们重写的，如果不是删除原对应的 import
3.5 配置自定义 gadget 属性
{
"interaction": {
"type": "listen",
"address": "127.0.0.1",
"port": 26000,
"on_port_conflict": "fail",
"on_load": "resume"
}
}
4. riru + gadget
利用 Magisk 的 riru 模块，在 APP Fork 时注入 frida-gadget，具体实现可看我 github。
github: https://github.com/jussi-sky/Riru-FridaGadget
