360免费壳（一）

	
function my_hook_dlopen(soName = '') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    if (path.indexOf(soName) >= 0) {
                        this.is_can_hook = true;
                    }
                }
            },
            onLeave: function (retval) {
                if (this.is_can_hook) {
                    hook_open();
                }
            }
        }
    );
}
function hook_open(){
    var pth = Module.findExportByName(null,"open");
  Interceptor.attach(ptr(pth),{
      onEnter:function(args){
          this.filename = args[0];
          console.log("",this.filename.readCString())
      },onLeave:function(retval){
      }
  })
}
setImmediate(my_hook_dlopen,"libjiagu");

console.log('RegisterNatives called from:\\n' + Thread.backtrace(this.context, Backtracer.FUZZY).map(DebugSymbol.fromAddress).join('\\n') + '\\n');

function addr_in_so(addr){
    var process_Obj_Module_Arr = Process.enumerateModules();
    for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
        if(addr>process_Obj_Module_Arr[i].base && addr<process_Obj_Module_Arr[i].base.add(process_Obj_Module_Arr[i].size)){
            console.log(addr.toString(16),"is in",process_Obj_Module_Arr[i].name,"offset: 0x"+(addr-process_Obj_Module_Arr[i].base).toString(16));
        }
    }
}
function hook_proc_self_maps() {
    const openPtr = Module.getExportByName(null, 'open');
    const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
    var fakePath = "/data/data/com.oacia.apk_protect/maps_nonexistent";
    Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
        var pathname = Memory.readUtf8String(pathnameptr);
        console.log("open",pathname);//,Process.getCurrentThreadId()
        if (pathname.indexOf("maps") >= 0) {
            console.log("find",pathname+", redirect to",fakePath);
            var filename = Memory.allocUtf8String(fakePath);
            return open(filename, flag);
        }
        if (pathname.indexOf("dex") >= 0) {
            Thread.backtrace(this.context, Backtracer.FUZZY).map(addr_in_so);
        }
        var fd = open(pathnameptr, flag);
        return fd;
    }, 'int', ['pointer', 'int']));
}

function my_hook_dlopen(soName='') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    //console.log(path);
                    if (path.indexOf(soName) >= 0) {
                        this.is_can_hook = true;
                    }
                }
            },
            onLeave: function (retval) {
                if (this.is_can_hook) {
                    hook_proc_self_maps();
                }
            }
        }
    );
}
setImmediate(my_hook_dlopen,'libjiagu');

function LogPrint(log) {
    var theDate = new Date();
    var hour = theDate.getHours();
    var minute = theDate.getMinutes();
    var second = theDate.getSeconds();
    var mSecond = theDate.getMilliseconds();

    hour < 10 ? hour = "0" + hour : hour;
    minute < 10 ? minute = "0" + minute : minute;
    second < 10 ? second = "0" + second : second;
    mSecond < 10 ? mSecond = "00" + mSecond : mSecond < 100 ? mSecond = "0" + mSecond : mSecond;
    var time = hour + ":" + minute + ":" + second + ":" + mSecond;
    var threadid = Process.getCurrentThreadId();
    //console.log("[" + time + "]" + "->threadid:" + threadid + "--" + log);

}

//用于绕过frida检测
function hooklibc() {
    Interceptor.attach(Module.findExportByName(null, "readlink"), {
            onEnter: function (args) {
                this.aaa = args[0];
                this.bbb = args[1];
                this.ccc = args[2];
            }, onLeave: function (retval) {
                var s2str = this.bbb.readCString();
                if (s2str.indexOf("/data/local/tmp/re.frida.server/linjector") != -1) {
                    this.bbb.writeUtf8String("/system/framework/boot.art");
                    retval.replace(0x1A);
                }
            }
        }
    );
    var libcmodule = Process.getModuleByName("libc.so");
    var openaddr = libcmodule.getExportByName("open");
    Interceptor.attach(openaddr, {
        onEnter: function (args) {
            var filepath = ptr(args[0]).readCString();
            LogPrint("open:" + filepath);
            if (filepath.indexOf("/maps") != -1) {
                try {
                    ptr(args[0]).writeUtf8String("/sdcard/maps")
                } catch (e) {
                    console.log(e)
                }

            }
            if (filepath.indexOf("/su") != -1) {
                try {
                    ptr(args[0]).writeUtf8String("/xxx/su")
                } catch (e) {
                    // console.log(e)
                }

            }
            if (filepath.indexOf("/status") != -1) {
                ptr(args[0]).writeUtf8String("/sdcard/status");
            }
            LogPrint("open replace:" + ptr(args[0]).readCString());

        }, onLeave: function (retval) {
            //LogPrint("open return:" + retval);
        }
    });
}

function main() {
    //bypass frida detection
    hooklibc();
}

setImmediate(main);

function my_hook_dlopen(soName = '') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    if (path.indexOf(soName) >= 0) {
                        this.is_can_hook = true;
                    }
                }
            },
            onLeave: function (retval) {
                if (this.is_can_hook) {
                    hook_5E6C();
                }
            }
        }
    );
  }
  function hook_5E6C(){
    var module = Process.findModuleByName("libjiagu_64.so");
    Interceptor.attach(module.base.add(0x5E6C), {
        // fd, buff, len
        onEnter: function (args) {
            console.log(hexdump(args[0], {
              offset: 0,// 相对偏移
              length: 0x38*0x6+0x20,//dump 的大小
              header: true,
              ansi: true
            }));
            console.log(args[1])
            console.log(args[2])
            console.log(`base = ${module.base}`)
        },
        onLeave: function (ret) {
        }
    });
}
setImmediate(my_hook_dlopen,"libjiagu");

var rc4_enc_text_addr,rc4_enc_size;
function hook_rc4_enc(){
    var module = Process.findModuleByName("libjiagu_64.so");
    Interceptor.attach(module.base.add(0x6044), {
        // fd, buff, len
        onEnter: function (args) {
            rc4_enc_text_addr = args[0];
            rc4_enc_size = args[1];
            console.log(hexdump(args[0], {
              offset: 0,// 相对偏移
              length: 0x30,//dump 的大小
              header: true,
              ansi: true
            }));
            console.log(args[1])

        },
        onLeave: function (ret) {
            console.log(hexdump(rc4_enc_text_addr, {
              offset: 0,// 相对偏移
              length: 0x30,//dump 的大小
              header: true,
              ansi: true
            }));
        }
    });
}

  function hook_5B08(){
    var module = Process.findModuleByName("libjiagu_64.so");
    Interceptor.attach(module.base.add(0x5B08), {
        // fd, buff, len
        onEnter: function (args) {
             // 获取 v4 值的地址, 假设 v4 存储在 a2 + 16
        var v4Ptr = ptr(args[1]).add(16);
        
        // 读取 v4 值，这里假设 v4 是一个指针，且其类型为 unsigned char *
        var v4Value = v4Ptr.readPointer();
            console.log(hexdump(v4Value, {
                offset: 0,            // 从 v4 指针位置开始
                length: 0x64,           // 打印 64 字节的内容（可以根据需要调整）
                header: true,         // 显示十六进制地址和偏移
                ansi: true            // 显示可打印字符
            }));
            console.log(args[2])
            console.log(`base = ${module.base}`)
        },
        onLeave: function (ret) {
        }
    });
}

function (iterator) : void {
    var instruction = iterator.next();
    do{
    if (func_addr.indexof(instruction.address - module.base) != -1){
        if(func_addr.indexof(instruction.address - module.base) <func_addr_KEke.length){
            console.log("(KEkeELF)call" + times+ ":" + func_name[func_addr.indexof(instru
                                                                                   }
        elsef{
            console.log("(mainELF)call" + times+ ":" + func_name[func_addr.indexof(instru
                        }
                        times=times+1
                        }
        iterator.keep() ;
    } while ((instruction = iterator.next()) !== null);
},

function dump_memory(start,size,filename) {
    var file_path = "/data/data/com.oacia.apk_protect/" + filename;
    var file_handle = new File(file_path, "wb");
    if (file_handle && file_handle != null) {
        var libso_buffer = start.readByteArray(size.toUInt32());
        file_handle.write(libso_buffer);
        file_handle.flush();
        file_handle.close();
        console.log("[dump]:", file_path);
    }
}
function hook_zlib_result(){
    var module = Process.findModuleByName("libjiagu_64.so");
    Interceptor.attach(module.base.add(0x1B63F0), {
        // fd, buff, len
        onEnter: function (args) {
            console.log("inflate result")
            console.log(hexdump(next_in, {
              offset: 0,// 相对偏移
              length: 0x50,//dump 的大小
              header: true,
              ansi: true
            }));
            console.log(hexdump(next_out, {
              offset: 0,// 相对偏移
              length: 0x50,//dump 的大小
              header: true,
              ansi: true
            }));
            dump_memory(next_out,avail_out,"dex001")
        },
        onLeave: function (ret) {
        }
    });
}
var zlib_count=0;
var next_in,avail_in,next_out,avail_out;
function hook_zlib(){
    Interceptor.attach(Module.findExportByName(null, "inflate"), {
        // fd, buff, len
        onEnter: function (args) {
            zlib_count+=1
            if(zlib_count>1){
                hook_zlib_result();
            }
            next_in=ptr(args[0].add(0x0).readS64());
            avail_in=ptr(args[0].add(0x8).readS64());
            next_out=ptr(args[0].add(0x18).readS64());
            avail_out=ptr(args[0].add(0x20).readS64());
            console.log(hexdump(next_in, {
              offset: 0,// 相对偏移
              length: 0x50,//dump 的大小
              header: true,
              ansi: true
            }));
            console.log(args[1]);
        },
        onLeave: function (ret) {
        }
    });
}