配置环境

  1. 安卓模拟器上传 Frida-server

    image-20240608133927182

  2. Windows 连接安卓模拟器

    image-20240608134102634

  3. 运行 Frida-server

    image-20240608134230330

hook

  1. 查看 PID

    image-20240608134331148

  2. 连接进程

    image-20240608134406589

  3. hook 函数拿到 flag

    image-20240608134441787

exp

1
2
3
4
5
6
7
8
Java.perform(() => {
  const data = Java.use("net.persianov.crackme0x03.Data");
  const f = data.isPasswordOk;
  f.implementation = function (arg) {
    console.log(arg);
    return true;
  };
});
1
2
3
4
5
Java.perform(() => {
  const fg = Java.use("net.persianov.crackme0x03.FlagGuard");
  console.log(fg);
  console.log(fg.$new().generate());
});