概述

XPOSED

findAndHookMethod("com.tencent.mm.sdk.platformtools.be", lpparam.classLoader, "tx", int.class, new XC_MethodHook() {
    @Override
    protected void afterHookedMethod(MethodHookParam param) {
        int gameType = ((Integer) param.args[0]).intValue();
        switch (gameType) {
            case 5:
//投骰子游戲，強制返回最大點數，基數為0，所以返回5
                param.setResult(5);
            default:
        }
    }
});
 

frida

package com.wepie.snake.module.game;

private void initEntity()
{
    GameConfig.factor = 1.0F;
    SnakeSurfaceView.access$102(SnakeSurfaceView.this, SnakeFactory.creatSnakeSelf(LoginHelper.getLoginUser().nickname, 5, null));
    SnakeSurfaceView.access$1102(SnakeSurfaceView.this, new AiManager(SnakeSurfaceView.this.snakeInfo));
    SnakeSurfaceView.this.allSnakes.clear();
    SnakeSurfaceView.this.allSnakes.add(SnakeSurfaceView.this.snakeInfo);
    SnakeSurfaceView.this.allSnakes.addAll(SnakeSurfaceView.this.aiManager.snakeAis);
    initUtils();
}

public static SnakeInfo creatSnakeSelf(String paramString, int paramInt, MultiNode paramMultiNode)
{
    int i = SkinConfig.getInUserSkinId();
    SkinInfo localSkinInfo = SkinManager.getInstance().getSkin(i);
    paramString = new SnakeInfo(paramString, localSkinInfo, paramMultiNode);
    Log.i("999", "----->creatSnakeSelf skin_id=" + localSkinInfo.skin_id);
    paramString.bodyInfo.initBodyPoints(getBodyPoints(paramString, 0.0F, 0.0F, paramInt));
    return paramString;
}

private void doSnakeDie(final SnakeInfo snakeInfo, final SnakeInfo snakeInfo2) {
    if (snakeInfo.snakeStatus.superFrameCount <= 0 && (snakeInfo2 == null || snakeInfo2.snakeStatus.superFrameCount <= 0)) {
        this.extraFactory.addWrecks(snakeInfo);
        if (!snakeInfo.isSnakeAi) {
            ((SnakeSurfaceView.GameStatusCallback)this.gameStatusCallback).onGameOver();
        }
        else if (snakeInfo2 != null) {
            snakeInfo2.addKillNum();
            if (!snakeInfo2.isSnakeAi) {
                ((SnakeSurfaceView.GameStatusCallback)this.gameStatusCallback).onKillAi();
            }
        }
        snakeInfo.doDie();
        return;
    }
}

#coding:utf-8

import frida, sys

def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

jscode = """
Java.perform(function () {
    var curSnake = null;

    // Function to hook is defined here
    var SnakeFactory = Java.use('com.wepie.snake.module.game.snake.SnakeFactory');

    // Whenever creatSnakeSelf is called
    SnakeFactory.creatSnakeSelf.implementation = function (name, len, multiNode) {
        // Show a message to know that the function got called
        send('creatSnakeSelf');
        len = 50;

        // Call the original creatSnakeSelf
        curSnake = this.creatSnakeSelf(name, len, multiNode);

        // Log to the console that it's done
        console.log('Done: init snake len: ' + JSON.stringify(len) + " name: " + name
            + " my snake: " + curSnake.toString() + ' isSnakeAi: ' + curSnake.isSnakeAi.value);
        return curSnake;

    };

    var CollisionUtil = Java.use('com.wepie.snake.module.game.snake.CollisionUtil');
    CollisionUtil.doSnakeDie.implementation = function (snake1, snake2) {
        // Show a message to know that the function got called
        if (snake1.equals(curSnake) || snake1.isSnakeAi.value == false){
            console.log('snake1 isSnakeAi: ' + snake1.isSnakeAi.value + " snake1: " + snake1.toString());

            // Log to the console that it's done
            console.log('Done: my snake will not die!');
            return;
        }else{
            // Call the original doSnakeDie
            return this.doSnakeDie(snake1, snake2);
        }

    };

});
"""

process = frida.get_usb_device().attach('com.wepie.snake')
script = process.create_script(jscode)
script.on('message', on_message)
print('[*] Running CTF')
script.load()
sys.stdin.read()

substrate

static void OnCallback_ClassOnCreate(JNIEnv *jni, jobject activity, jobject bundle)
{
    string strName;
    strName = getObjectClassName(jni, activity);
    LOGD("[%s] begin: %s::OnCreate", __FUNCTION__, strName.c_str());

    (*old_onCreate)(jni, activity, bundle);

    LOGD("[%s] dynamic load plug apk: %s", __FUNCTION__, g_cfg.strPlugApkPath.c_str());
    ……
    //呼叫外掛的靜態函式init，原型：public static void init(Activity activity, String soPath)
    jmethodID plugUIinit = jni->GetStaticMethodID(plugClass, "init", "(Landroid/app/Activity;Ljava/lang/String;)V");
    if ( plugUIinit==NULL ) {
        LOGE("[%s] not found \"init\" in plug activity: public static void init(Activity activity, String soPath)", __FUNCTION__);
    }else{
        LOGD("[%s] invoke %s::init", __FUNCTION__, g_cfg.strPlugActivity.c_str());
        jstring soPath = jni->NewStringUTF(g_cfg.strPlugSoPath.c_str());
        jni->CallStaticVoidMethod(plugClass, plugUIinit, activity, soPath);
    }

    LOGD("[%s] end", __FUNCTION__);
}

String dexOutputDir = "/data/data/" + targetPackageName + "/cache";
DexClassLoader dexClassLoader = new DexClassLoader(plugApkPath, dexOutputDir, null, ClassLoader.getSystemClassLoader());
java.lang.Class<?> plugClass = dexClassLoader.loadClass(plugInitClass);
Method mInit = plugClass.getDeclaredMethod(Constant.METHOD_NAME_plug_init, Activity.class, String.class);
mInit.invoke(null, param.thisObject, plugSoPath);

總結