获取安卓敏感调用检测

//hook常规的获取设备信息接口
//通过打印堆栈信息来看是什么sdk调用


function showjavastack(){
    var javastack = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new());
    //console.log(javastack);
}   

function hook(){
    Java.perform(function() {
        var TelephonyManager = Java.use("android.telephony.TelephonyManager");
        //IMEI hook
        TelephonyManager.getDeviceId.overload().implementation = function () {
            console.log("[*]Called - getDeviceId()");
            var temp = this.getDeviceId();
            console.log("real IMEI: "+temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
        };
        // muti IMEI
        TelephonyManager.getDeviceId.overload('int').implementation = function (p) {
            console.log("[*]Called - getDeviceId(int) param is"+p);
            var temp = this.getDeviceId(p);
            console.log("real IMEI "+p+": "+temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
        };
        //IMSI hook
        TelephonyManager.getSimSerialNumber.overload().implementation = function () {
            console.log("[*]Called - getSimSerialNumber(String)");
            var temp = this.getSimSerialNumber();
            console.log("real IMSI: "+temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
        };
        //取出 IMEI 需要 api26以上
        TelephonyManager.getImei.overload().implementation = function(){
            console.log("[*]Called - getImei");
            var temp = this.getImei();
            console.log("real IMEI:" + temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
        }
        TelephonyManager.getImei.overload('int').implementation = function(a){
            console.log("[*]Called - getImei(int)");
            var temp = this.getImei(a);
            console.log("real IMEI(int):" + temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
        }
        TelephonyManager.getSimOperatorName.overload().implementation = function(){
            console.log("[*]Called - getSimOperatorName");
            var temp = this.getSimOperatorName();
            console.log("real 运营商:" + temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
        }
        TelephonyManager.getSimOperatorName.overload('int').implementation = function(a){
            console.log("[*]Called - getSimOperatorName(int)");
            var temp = this.getSimOperatorName(a);
            console.log("real 运营商:" + temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
        }
        TelephonyManager.getLine1Number.overload().implementation = function(){
            console.log("[*]Called - getLine1Number");
            var temp = this.getLine1Number();
            console.log("real MSISDN:" + temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
        }
        TelephonyManager.getLine1Number.overload('int').implementation = function(a){
            console.log("[*]Called - getLine1Number");
            var temp = this.getLine1Number(a);
            console.log("real MSISDN:" + temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
        }
        
        
        //////////////////////////////////////

        
    
        // hook MAC
        var wifi = Java.use("android.net.wifi.WifiInfo");
        wifi.getMacAddress.implementation = function () {
            console.log("[*]Called - getMacAddress");
            var tmp = this.getMacAddress();
            console.log("[*]real MAC: "+tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }

        var NetworkInterface = Java.use("java.net.NetworkInterface");
        NetworkInterface.getHardwareAddress.implementation = function () {
            console.log("[*]Called - getHardwareAddress");
            var tmp = this.getHardwareAddress();
            console.log("[*]real HardwareAddress: "+tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
    
        //ANDOID_ID hook
        var Secure = Java.use("android.provider.Settings$Secure");
        Secure.getString.implementation = function (p1,p2) {
            if(p2.indexOf("android_id")<0) return this.getString(p1,p2);
            console.log("[*]Called - get android_ID, param is:"+p2);
            var temp = this.getString(p1,p2);
            console.log("real Android_ID: "+temp);
            showjavastack();
            console.log("------------------------------------------------------");
            return temp;
    
        }
    
        //android获取GPS
        var LocationManager = Java.use("android.location.LocationManager");
        LocationManager.getLastKnownLocation.implementation = function(a){
            console.log("[*]Called - getLastKnownLocation");
            var tmp = this.getLastKnownLocation(a);
            console.log("调用getLastKnownLocation获取了GPS地址" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        LocationManager.requestLocationUpdates.overload('android.location.LocationRequest', 'android.app.PendingIntent').implementation = function(a,b){
            console.log("[*]Called - requestLocationUpdates.overload('android.location.LocationRequest', 'android.app.PendingIntent')");
            var tmp = this.requestLocationUpdates(a,b);
            console.log("调用requestLocationUpdates获取了GPS地址" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        LocationManager.requestLocationUpdates.overload('android.location.LocationRequest', 'android.location.LocationListener', 'android.os.Looper').implementation = function(a,b,c){
            console.log("[*]Called - requestLocationUpdates.overload('android.location.LocationRequest', 'android.location.LocationListener', 'android.os.Looper')");
            var tmp = this.requestLocationUpdates(a,b,c);
            console.log("调用requestLocationUpdates获取了GPS地址" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        LocationManager.requestLocationUpdates.overload('android.location.LocationRequest', 'android.location.LocationListener', 'android.os.Looper', 'android.app.PendingIntent').implementation = function(a,b,c,d){
            console.log("[*]Called - requestLocationUpdates.overload('android.location.LocationRequest', 'android.location.LocationListener', 'android.os.Looper', 'android.app.PendingIntent')");
            var tmp = this.requestLocationUpdates(a,b,c,d);
            console.log("调用requestLocationUpdates获取了GPS地址" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        LocationManager.requestLocationUpdates.overload('long', 'float', 'android.location.Criteria', 'android.app.PendingIntent').implementation = function(a,b,c,d){
            console.log("[*]Called - requestLocationUpdates.overload('long', 'float', 'android.location.Criteria', 'android.app.PendingIntent')");
            var tmp = this.requestLocationUpdates(a,b,c,d);
            console.log("调用requestLocationUpdates获取了GPS地址" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        LocationManager.requestLocationUpdates.overload('java.lang.String', 'long', 'float', 'android.app.PendingIntent').implementation = function(a,b,c,d){
            console.log("[*]Called - requestLocationUpdates.overload('java.lang.String', 'long', 'float', 'android.app.PendingIntent')");
            var tmp = this.requestLocationUpdates(a,b,c,d);
            console.log("调用requestLocationUpdates获取了GPS地址" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        LocationManager.requestLocationUpdates.overload('java.lang.String', 'long', 'float', 'android.location.LocationListener').implementation = function(a,b,c,d){
            console.log("[*]Called - requestLocationUpdates.overload('java.lang.String', 'long', 'float', 'android.location.LocationListener')");
            var tmp = this.requestLocationUpdates(a,b,c,d);
            console.log("调用requestLocationUpdates获取了GPS地址" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        LocationManager.requestLocationUpdates.overload('long', 'float', 'android.location.Criteria', 'android.location.LocationListener', 'android.os.Looper').implementation = function(a,b,c,d,e){
            console.log("[*]Called - requestLocationUpdates.overload('long', 'float', 'android.location.Criteria', 'android.location.LocationListener', 'android.os.Looper')");
            var tmp = this.requestLocationUpdates(a,b,c,d,e);
            console.log("调用requestLocationUpdates获取了GPS地址" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        LocationManager.requestLocationUpdates.overload('java.lang.String', 'long', 'float', 'android.location.LocationListener', 'android.os.Looper').implementation = function(a,b,c,d,e){
            console.log("[*]Called - requestLocationUpdates.overload('java.lang.String', 'long', 'float', 'android.location.LocationListener', 'android.os.Looper')");
            var tmp = this.requestLocationUpdates(a,b,c,d,e);
            console.log("调用requestLocationUpdates获取了GPS地址" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }

        //获取应用列表
        var Runtime = Java.use("java.lang.Runtime");
        Runtime.exec.overload('java.lang.String').implementation = function(a){
            console.log("[*]Called - exec(command)");
            var tmp = this.exec(a);
            console.log("执行exec的命令:" + a);
            if(a.indexOf("packages") != -1){
                console.log("应用使用"+ a + "收集应用列表");
                showjavastack();
            }
            console.log("------------------------------------------------------");
            return tmp;
        }
        var PackageManager = Java.use("android.content.pm.PackageManager");
        PackageManager.getInstalledPackages.implementation = function(a){
            console.log("[*]Called - getInstalledPackages");
            var tmp = this.getInstalledPackages(a);
            console.log("调用getInstalledPackages获取了应用列表" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        PackageManager.getInstalledApplications.implementation = function(a){
            console.log("[*]Called - getInstalledApplications");
            var tmp = this.getInstalledApplications(a);
            console.log("调用getInstalledApplications获取了应用列表" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        PackageManager.queryIntentActivities.implementation = function(a,b){
            console.log("[*]Called - queryIntentActivities");
            var tmp = this.queryIntentActivities(a,b);
            console.log("调用queryIntentActivities获取了应用列表" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        var ContextWrapper = Java.use("android.content.ContextWrapper");
        ContextWrapper.getPackageManager.implementation = function(){
            console.log("[*]Called - getPackageManager");
            var tmp = this.getPackageManager();
            console.log("调用getPackageManager获取了应用列表" + tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }

    
        //android的hidden API，需要通过反射调用
        var SP = Java.use("android.os.SystemProperties");
        SP.get.overload('java.lang.String').implementation = function (p1) {
            var tmp = this.get(p1);
            console.log("[*]"+p1+" : "+tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        }
        SP.get.overload('java.lang.String', 'java.lang.String').implementation = function (p1,p2) {
            var tmp = this.get(p1,p2)
            console.log("[*]"+p1+","+p2+" : "+tmp);
            showjavastack();
            console.log("------------------------------------------------------");
            return tmp;
        } 
        
    })
}

function main(){
    hook();
}

setImmediate(main); ```
//新建一个命令行

adb shell

cd 保存frida_server的路径

./frida_server

//新建另一个命令行

//转发frida_server默认端口
adb forward tcp:27042 tcp:27042

frida -Uf packagename -l hook_privacy.js的绝对路径