forinxy/-skills/frida

Java.perform(function () {
  var Target = Java.use('com.example.VipManager');
  // 无重载
  Target.isVip.implementation = function () {
    console.log('[+] isVip called -> forced true');
    return true;
  };
  // 有重载时用 overload 指定参数类型
  Target.check.overload('java.lang.String').implementation = function (s) {
    console.log('[+] check(' + s + ') -> true');
    return true;
  };
});

Java.perform(function () {
  var C = Java.use('com.example.Crypto');
  C.encrypt.implementation = function (data) {
    console.log('[encrypt] input=' + data);
    var ret = this.encrypt(data);
    console.log('[encrypt] output=' + ret);
    // 调用栈
    console.log(Java.use('android.util.Log').getStackTraceString(
      Java.use('java.lang.Exception').$new()));
    return ret;
  };
});

// 通杀思路：hook 常见校验点。实战优先用社区维护的通杀脚本（如 frida 官方 codeshare 的
// "universal android ssl pinning bypass"），这里给核心思路：
Java.perform(function () {
  // 1) 干掉 TrustManager 校验
  var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
  var SSLContext = Java.use('javax.net.ssl.SSLContext');
  var TrustManager = Java.registerClass({
    name: 'com.bypass.TrustAll',
    implements: [X509TrustManager],
    methods: {
      checkClientTrusted: function () {},
      checkServerTrusted: function () {},
      getAcceptedIssuers: function () { return []; }
    }
  });
  var init = SSLContext.init.overload(
    '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;',
    'java.security.SecureRandom');
  init.implementation = function (km, tm, sr) {
    init.call(this, km, [TrustManager.$new()], sr);
  };
  // 2) OkHttp CertificatePinner.check 直接放行
  try {
    var CP = Java.use('okhttp3.CertificatePinner');
    CP.check.overload('java.lang.String', 'java.util.List').implementation = function () {};
  } catch (e) {}
});

Java.perform(function () {
  // 常见：hook 检测方法返回 false
  var names = ['isRooted', 'checkRoot', 'isEmulator', 'isDebuggerConnected'];
  // 具体类名要先逆向定位，这里示意
  var Detector = Java.use('com.example.security.Detector');
  names.forEach(function (m) {
    if (Detector[m]) {
      Detector[m].implementation = function () { return false; };
    }
  });
  // 干掉 Debug.isDebuggerConnected
  var Debug = Java.use('android.os.Debug');
  Debug.isDebuggerConnected.implementation = function () { return false; };
});

// hook 导出函数
var addr = Module.findExportByName('libnative.so', 'check_license');
Interceptor.attach(addr, {
  onEnter: function (args) { this.a0 = args[0]; },
  onLeave: function (retval) {
    console.log('[check_license] ret=' + retval);
    retval.replace(ptr(1)); // 强制返回 1
  }
});
// 未导出函数用 模块基址 + 偏移
var base = Module.findBaseAddress('libnative.so');
Interceptor.attach(base.add(0x1234), { /* ... */ });