frida 初体验

adb -d install UnCrackable-Level1.apk

public void onCreate(Bundle bundle) {
    if (C0002c.m2a() || C0002c.m3b() || C0002c.m4c()) {
    	m5a("Root detected!");
    }
    if (C0001b.m1a(getApplicationContext())) {
    	m5a("App is debuggable!");
    }
    super.onCreate(bundle);
    setContentView(R.layout.activity_main);
}

public class C0002c {
    /* renamed from: a */
    public static boolean m2a() {
        for (String file : System.getenv("PATH").split(":")) {
            if (new File(file, "su").exists()) {
                return true;
            }
        }
        return false;
    }

    /* renamed from: b */
    public static boolean m3b() {
        String str = Build.TAGS;
        return str != null && str.contains("test-keys");
    }

    /* renamed from: c */
    public static boolean m4c() {
        for (String file : new String[]{"/system/app/Superuser.apk", "/system/xbin/daemonsu", "/system/etc/init.d/99SuperSUDaemon", "/system/bin/.ext/.su", "/system/etc/.has_su_daemon", "/system/etc/.installed_su_daemon", "/dev/com.koushikdutta.superuser.daemon/"}) {
            if (new File(file).exists()) {
                return true;
            }
        }
        return false;
    }
}

private void m5a(String str) {
    AlertDialog create = new AlertDialog.Builder(this).create();
    create.setTitle(str);
    create.setMessage("This is unacceptable. The app is now going to exit.");
    create.setButton(-3, "OK", new DialogInterface.OnClickListener() {
        public void onClick(DialogInterface dialogInterface, int i) {
            System.exit(0);
        }
    });
    create.setCancelable(false);
    create.show();
}

setImmediate(function () {
    console.log("[*] hook start")
    Java.perform(function () {
        var System = Java.use("java.lang.System");
        System.exit.implementation = function (v) {
            console.log("[*] exit called");
        }
        console.log("[*] exit handler modified");
    })
})

public void verify(View view) {
    String str;
    String obj = ((EditText) findViewById(R.id.edit_text)).getText().toString();
    AlertDialog create = new AlertDialog.Builder(this).create();
    if (C0005a.m6a(obj)) {
        create.setTitle("Success!");
        str = "This is the correct secret.";
    } else {
        create.setTitle("Nope...");
        str = "That's not it. Try again.";
    }
    create.setMessage(str);
    create.setButton(-3, "OK", new DialogInterface.OnClickListener() {
        public void onClick(DialogInterface dialogInterface, int i) {
            dialogInterface.dismiss();
        }
    });
    create.show();
}

setImmediate(function () {
    console.log("[*] hook start")
    Java.perform(function () {
        var System = Java.use("java.lang.System");
        System.exit.implementation = function (v) {
            console.log("[*] exit called");
        }
        console.log("[*] exit handler modified");

        /* 这种一直没有成功，以后再深究下原因。 */
        // var String = Java.use("java.lang.String");
        // String.equals.overload("java.lang.Object").implementation = function (v) {
        //     console.log("[*] return true");
        //     // return true;
        // }
        // console.log("[*] equals handler modified");

        var String = Java.use("sg.vantagepoint.uncrackable1.a");
        String.a.implementation = function (v) {
            console.log("[*] return true");
            return true;
        }
        console.log("[*] a handler modified");
    })
})

a.a(b("8d127684cbc37c17616d806cf50473cc"), Base64.decode("5UJiFctbmgbDoLXmpL12mkno8HT4Lv8dlat8FxR2GOc=", 0));

Java.use("sg.vantagepoint.a.a").a.implementation = function (arg1, arg2) {
    const retVal = this.a(arg1, arg2);  // 获取到返回值
    var decrypt = "";
    for (var i = 0; i < retVal.length; i++) {  // frida 里不支持 let 写法……
        decrypt += String.fromCharCode(retVal[i]);
    }
    console.log(decrypt);
    return retVal;
}