[网络协议]RPC及其自动化

修改DEMO

package com.roysue.demo02;

import androidx.appcompat.app.AppCompatActivity;

import android.os.Bundle;
import android.util.Log;



public class MainActivity extends AppCompatActivity {

    private String total = "hello";
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        while(true){
            try{
                Thread.sleep(1000);
            } catch(InterruptedException e) {
                e.printStackTrace();
            }
            fun(50, 30);
            Log.d("rOysue.String", fun("LoWeRcAsE Me!!!!!!!"));
        }
    }
    void fun(int x, int y){
        Log.d("rOysue.sum", String.valueOf(x+y));
    }
    String fun(String x){
        return x.toLowerCase();
    }

    void secret(){
        total += " ##secretFunc";
        Log.d("rOysue.secret", "this is secret func");
    }
    static void staticSecret(){
        Log.d("rOysue.secret", "this is static secret func");
    }

}

代码清单 4.js

function CallSecretFunc() {
    Java.perform(function(){

        Java.choose('com.roysue.demo02.MainActivity',{
            onMatch:function(instance){
                instance.secret()
            },
            onComplete:function(){

            }

        })

    })
}
function getTotalValue(){
    Java.perform(function(){
        var MainActivity = Java.use('com.roysue.demo02.MainActivity')
        Java.choose('com.roysue.demo02.MainActivity',{
            onMatch:function(instance){
                console.log('total value = ', instance.total.value)
            },
            onComplete:function(){
                console.log('search Complete')
            }
        })
    })
}
setImmediate(getTotalValue)

rpc.exports = {
    callsecretfunc :  CallSecretFunc,
    gettotalvalue : getTotalValue
};

在确认函数没有写错且功能达到预期后，接下来开始RPC远程调用。将CallSecretFunc()函数和getTotalValue()函数导出，使得外部可以进行调用。在尾部加上RPC相关代码：

rpc.exports = {
? ? callsecretfunc : ?CallSecretFunc,
? ? gettotalvalue : getTotalValue
};

这部分代码实现的功能是将?CallSecretFunc()函数和getTotalValue()函数分别导出为callsecretfunc和gettotalvalue。需要注意的是，导出名不可以有大写字母或者下划线。接下来在外部就可以调用这两个函数了。

代码清单 loader.py

import frida, sys

def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

device = frida.get_usb_device()  #获取usb设备句柄
process = device.attach('demo02') #获取给定包名的app进程

#获取js脚本内容
with open('4.js') as f:
    jscode = f.read()
script = process.create_script(jscode) #把JS脚本塞进process

script.on('message', on_message)  #注册自己消息对应的函数，当JS想输出时会通过指定on_message进行
script.load()

command = ""
while 1 == 1:
    command = input("\nEnter Command:\n1: Exit\n2: Call secret function\n3: Get Total Value\nchoice:")
    if command == "1":
        break
    #RPC远程调用
    elif command == "2":
        script.exports.callsecretfunc()
    elif command == "3":
        script.exports.gettotalvalue()