frida hook InMemoryDexClassLoader内存加载实现dump dex文件

最新推荐文章于 2026-07-05 09:24:33 发布

原创最新推荐文章于 2026-07-05 09:24:33 发布 · 1.2k 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

收录于

逆向

本文介绍了如何利用frida工具，针对Android应用中InMemoryDexClassLoader的内存加载机制，进行动态hook，实现在运行时dump Dex文件到本地，详细阐述了相关步骤和关键代码。

import frida, sys

myflag = False
def on_message(message, data):
    global myflag
    if message['type'] == 'send':
        print("data--------=",data)
        #print("[*] {0}".format(message['payload']))
        print("type=",type(message['payload']))
        mydata =  message['payload']
        print("mydata len--------=",len(mydata))
        if myflag == False :
            myflag = True
            file_object=open("d:\\test.dex",'wb+')
            for i in iter(mydata):
                dat1 = i.to_bytes(1,"little",signed=True)
                print("dat1----",dat1)
                file_object.write(dat1)
    else:
        print(message)

jscode = """
    Java.perform(function () {
        const InMemoryDexClassLoader = Java.use('dalvik.system.InMemoryDexClassLoader');
            InMemoryDexClassLoader.$init.overload('java.nio.ByteBuffer', 'java.lang.ClassLoader')
            .implementation = function (buff, loader) {
            this.$init(buff, loader);
            console.log("----------++" + this)
            console.log("buff len----------++" + buff.capacity())
            var hexA = new Array()
            for (var i = 0; i < buff.capacity(); i++) {
                hexA.push(buff.get(i))
            }
            send(hexA)
            //console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
            Java.classFactory.loader = this;
        }
    });
    """
process = frida.get_usb_device().attach('IQ Option')
script = process.create_script(jscode)
script.on('message', on_message)
script.load()
sys.stdin.read()

标签

#python