Skip to content

Commit

Permalink
Release v1.2.1
Browse files Browse the repository at this point in the history
  • Loading branch information
hyugogirubato committed Sep 28, 2023
1 parent de49abd commit db18678
Show file tree
Hide file tree
Showing 5 changed files with 795 additions and 33 deletions.
22 changes: 22 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,27 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres
to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.2.1] - 2023-09-28

## Added

- **Native**: Added a demo example.
- **Java**: Added a demo example.
- **Java**: Color activation choice option (support non-colored shell).

## Changed

- **Java**: Code rewriting and optimization.
- **Java**: Full regex support for some options.
- **Java**: Improved debug information.
- **Java**: Readme update.

## Fixed

- **Java**: Fix support for all types of variables.
- **Java**: Fix support for multi-constructor of a function.
- **Java**: Fix method search.

## [1.2.0] - 2023-09-22

## Added
Expand Down Expand Up @@ -105,6 +126,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

- Initial Release.

[1.2.1]: https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.2.1
[1.2.0]: https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.2.0
[1.1.5]: https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.1.5
[1.1.4]: https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.1.4
Expand Down
88 changes: 63 additions & 25 deletions scripts/android-java/README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# Android Java Interceptor

[![Version](https://img.shields.io/badge/Version-v1.1-blue)](https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.2.1)

Android Java Interceptor is a Frida script that allows you to intercept and modify function calls in Android Java
applications. With this script, you can monitor and manipulate the behavior of specific functions within the target
application.
Expand All @@ -14,40 +16,76 @@ To use the script, follow these steps:

3. Run the following command to start the script:

````shell
frida -D "DEVICE" -l "java.js" -f "PACKAGE"
````
```shell
frida -D "DEVICE" -l "java.js" -f "PACKAGE"
```

Replace "DEVICE" with the device or emulator ID and "PACKAGE" with the package name of the target application.
Replace "DEVICE" with the device or emulator ID and "PACKAGE" with the package name of the target application. You can
also specify the binary path of the application if needed.

## Customization
## Configuration

Modify the `FUNCTIONS` array in the `java.js` script to specify the functions you want to intercept. You can define the
package, class, and function names as needed. Leave the `function` array empty to intercept all methods within a class.
### Libraries and Methods

## Output
- Customize the `LIBRARIES` array to specify the libraries and methods you want to intercept. Use an empty list to
capture everything or specify function names to filter.

Example:
```javascript
const LIBRARIES = [
{
"name": "com.android.example.ui.service",
"methods": ["loadNative"]
},
{
"name": "android.webkit.WebView",
"methods": []
}
];
```

### Target Selection

- Use the `PACKAGE` variable to specify the target package name. Set it to "undefined" to intercept all processes,
including system processes.

When the script intercepts a function call, it will print the following information to the console:
Example:
```javascript
const PACKAGE = undefined;
```

### Output Configuration

- Customize the script's output by modifying the following variables:
- `COLOR`: Colorize the output for better visibility.
- `TIMEOUT`: Set a waiting time before attaching processes.
- `DEBUG`: Display additional information on the current process.
Example:
```javascript
const COLOR = true;
const TIMEOUT = 0;
const DEBUG = false;
```
## Output
- **onEnter**: Indicates that the intercepted function is being entered.
- **[i] argType**: The type and value of the function argument at index `i`.
- **onLeave**: Indicates that the intercepted function is being exited.
- **[0] returnType**: The type and value of the function's return value.
When the script intercepts a Java function call, it will print information to the console, including the method name,
arguments, and return values.
For example:
Example:
````shell
[+] onEnter: com.example.ui.fragment.LoginFragment.login
--> [0] String: john.doe@example.com
--> [1] String: password123
[-] onLeave: com.example.ui.fragment.LoginFragment.login
--> [0] Boolean: true
````
```shell
[+] onEnter: com.android.example.ui.service.loadNative
--> [0] String: exampleArgument
[-] onLeave: com.android.example.ui.service.loadNative
--> [0] Integer: 42
```
This output shows that the `login` function in the `LoginFragment` class of the `com.example.ui.fragment` package was
intercepted. The function was called with two arguments: a string representing the email and a string representing the
password. The function returned a boolean value of `true`.
This output indicates that the `loadNative` method in the `com.android.example.ui.service` class was intercepted,
capturing a string argument "exampleArgument," and the method returned an integer value of `42`.
## License
This project is licensed under the [GPL v3 License](https://github.com/hyugogirubato/Frida-CodeShare/blob/main/LICENSE).
This project is licensed under the GPL v3 License. See
the [LICENSE](https://github.com/hyugogirubato/Frida-CodeShare/blob/main/LICENSE) file for details.
30 changes: 22 additions & 8 deletions scripts/android-java/java.js
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
**
** Android Java Interceptor frida script v1.1 hyugogirubato
**
** frida -D "89a90a4" -l "java.js" -f "com.crunchyroll.crunchyroid"
** frida -D "DEVICE" -l "java.js" -f "PACKAGE"
**
** Update: https://github.com/hyugogirubato/Frida-CodeShare/releases/tag/v1.2.1
**
Expand All @@ -17,8 +17,8 @@
*/
const LIBRARIES = [
{
"name": "com.ellation.crunchyroll.api.etp.content.EtpContentServiceDecorator",
"methods": []
"name": "com.android.example.ui.service",
"methods": ["loadNative"]
},
{
"name": "android.webkit.WebView",
Expand All @@ -30,7 +30,6 @@ const LIBRARIES = [
* Use to filter loaders.
* Use "undefined" to intercept all loader processes (system included).
*/
// const PACKAGE = "com.crunchyroll.crunchyroid";
const PACKAGE = undefined;

/**
Expand Down Expand Up @@ -241,7 +240,7 @@ const parseMemory = (type, value) => {
case "java.security.AlgorithmParameters":
default:
if (type.match(/^\[L.*;$/)) {
result[type] = []
result[type] = [];
value.forEach((e) => {
const match = type.match(/^\[L(.+?);$/);
result[type].push(parseMemory(match ? match[1] : parseType(type), e));
Expand All @@ -262,11 +261,9 @@ const parseMemory = (type, value) => {
}

const printMemory = (type, value, index, color) => {
print(type);

// Type
const items = Object.entries(parseMemory(type, value));
for (let [key, value] of items) {
// Value
try {
value = value instanceof Object ? JSON.stringify(value) : value;
} catch (e) {
Expand Down Expand Up @@ -296,6 +293,15 @@ const attachFunction = (module) => {
const params = methodParams(method);
for (const p of params) {
const returnType = method.overload(...p).returnType.type;
if (DEBUG) {
print(JSON.stringify({
instance: module["name"],
method: m,
params: p,
returnType: returnType
}, null, 2));
}

method.overload(...p).implementation = function (...args) {
print(`[+] onEnter: ${module["name"]}.${m}`, color);
for (let i = 0; i < p.length; i++) {
Expand All @@ -311,6 +317,7 @@ const attachFunction = (module) => {
}
}
}

}


Expand All @@ -330,7 +337,14 @@ setTimeout(function () {
} catch (e) {
loader = library["loader"];
}

print(`[>] Attach: ${loader} (${modules.length})`);
if (DEBUG) {
print(JSON.stringify({
...library,
modules: modules
}, null, 2));
}
for (const module of modules) {
attachFunction(module);
}
Expand Down
Loading

0 comments on commit db18678

Please sign in to comment.