Android安全-frida16.2.1 编译patch全过程
推荐 原创0x1 frida 编译流程
github: https://github.com/taisuii/rusda
建立一个项目目录并拉下frida源码，并进入项目目录
1 2 | git clone --recurse-submodules -b 16.2.1 https://github.com/frida/fridacd frida |
此时执行ls ，看到的文件应当是如此
(base) r@ubuntu20:~/Documents/FRIDA/frida$ ls BSDmakefile COPYING frida-gum frida.sln Makefile.freebsd.mk Makefile.toolchain.mk build frida-clr frida-node frida-swift Makefile.linux.mk README.md config.mk frida-core frida-python frida-tools Makefile.macos.mk releng CONTRIBUTING.md frida-go frida-qml Makefile Makefile.sdk.mk
一键 安装nodejs22
1 2 3 4 5 6 7 8 9 10 11 | # 构造下载 URLNODE_TAR_URL="https://nodejs.org/dist/v22.12.0/node-v22.12.0-linux-x64.tar.xz"wget $NODE_TAR_URL # 解压 Node.js 安装包到用户目录tar -xf node-v22.12.0-linux-x64.tar.xz -C $HOME/binrm -r node-v22.12.0-linux-x64.tar.xz# 设置 NODE_HOME 和 PATHexport NODE_HOME=$HOME/bin/node-v22.12.0-linux-x64export PATH=${NODE_HOME}/bin:$PATH# 打印 Node.js 版本以确认安装成功node -v |
(base) r@ubuntu20:~/Documents/FRIDA/frida$ # 构造下载 URL
(base) r@ubuntu20:~/Documents/FRIDA/frida$ NODE_TAR_URL="https://nodejs.org/dist/v22.12.0/node-v22.12.0-linux-x64.tar.xz"
(base) r@ubuntu20:~/Documents/FRIDA/frida$ wget $NODE_TAR_URL
--2024-12-09 23:31:18-- https://nodejs.org/dist/v22.12.0/node-v22.12.0-linux-x64.tar.xz
正在解析主机 nodejs.org (nodejs.org)... 198.18.1.205
正在连接 nodejs.org (nodejs.org)|198.18.1.205|:443... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度： 29734248 (28M) [application/x-xz]
正在保存至: “node-v22.12.0-linux-x64.tar.xz”
node-v22.12.0-linux-x64.tar.xz 100%[============================================================================>] 28.36M 8.89MB/s 用时 3.2s
2024-12-09 23:31:21 (8.89 MB/s) - 已保存 “node-v22.12.0-linux-x64.tar.xz” [29734248/29734248])
(base) r@ubuntu20:~/Documents/FRIDA/frida$ # 解压 Node.js 安装包到用户目录
(base) r@ubuntu20:~/Documents/FRIDA/frida$ tar -xf node-v22.12.0-linux-x64.tar.xz -C $HOME/bin
(base) r@ubuntu20:~/Documents/FRIDA/frida$ # 设置 NODE_HOME 和 PATH
(base) r@ubuntu20:~/Documents/FRIDA/frida$ export NODE_HOME=$HOME/bin/node-v22.12.0-linux-x64
(base) r@ubuntu20:~/Documents/FRIDA/frida$ export PATH=${NODE_HOME}/bin:$PATH
(base) r@ubuntu20:~/Documents/FRIDA/frida$ # 打印 Node.js 版本以确认安装成功
(base) r@ubuntu20:~/Documents/FRIDA/frida$ node -v
v22.12.0
(base) r@ubuntu20:~/Documents/FRIDA/frida$ ls
BSDmakefile COPYING frida-go frida-python frida-swift Makefile.freebsd.mk Makefile.sdk.mk README.md
config.mk frida-clr frida-gum frida-qml frida-tools Makefile.linux.mk Makefile.toolchain.mk releng
CONTRIBUTING.md frida-core frida-node frida.sln Makefile Makefile.macos.mk node-v22.12.0-linux-x64.tar.xz
(base) r@ubuntu20:~/Documents/FRIDA/frida$ rm -r node-v22.12.0-linux-x64.tar.xz
(base) r@ubuntu20:~/Documents/FRIDA/frida$
再make一下
1 | make |
安装ndk
执行以下命令，查看所需要的ndk版本，得到以下输出
1 | cat releng/setup-env.sh |grep "ndk_required=" |
(base) r@ubuntu20:~/Documents/FRIDA/frida$ cat releng/setup-env.sh |grep "ndk_required=" ndk_required=25
一键安装ndk25
1 2 3 4 5 6 | wget https://dl.google.com/android/repository/android-ndk-r25c-linux.zipunzip android-ndk-r25c-linux.zip $HOME/bin/rm -r android-ndk-r25c-linux.zipexport ANDROID_NDK_ROOT=$HOME/bin/android-ndk-r25cexport PATH=$ANDROID_NDK_ROOT:$PATHndk-build -v |
安装依赖
1 2 | sudo apt updatesudo apt-get install build-essential git lib32stdc++-9-dev libc6-dev-i386 |
1 | pip3 install lief |
编译
查看编译选项
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 | (frida-compile) r@ubuntu20:~/Documents/FRIDA/frida$ makemake[1]: 进入目录“/home/r/Documents/FRIDA/frida”Usage: make TARGET [VARIABLE=value]Where TARGET specifies one or more of: /* gum */ gum-linux-x86 Build for Linux/x86 gum-linux-x86_64 Build for Linux/x86-64 gum-linux-x86-thin Build for Linux/x86 without cross-arch support gum-linux-x86_64-thin Build for Linux/x86-64 without cross-arch support gum-linux-x86_64-gir Build for Linux/x86-64 with shared GLib and GIR gum-linux-arm Build for Linux/arm gum-linux-armbe8 Build for Linux/armbe8 gum-linux-armhf Build for Linux/armhf......等等 |
编译安卓arm64的frida
1 | make core-android-arm64 |
编译完成
Installing lib/base/libfrida-base-1.0.a to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/lib Installing lib/base/frida-base.h to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/include/frida-1.0 Installing lib/base/frida-base-1.0.vapi to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/share/vala/vapi Installing lib/payload/libfrida-payload-1.0.a to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/lib Installing lib/payload/frida-payload.h to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/include/frida-1.0 Installing lib/payload/frida-payload-1.0.vapi to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/share/vala/vapi Installing lib/gadget/frida-gadget.so to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/lib/frida/64 Installing src/api/frida-core.h to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/include/frida-1.0 Installing src/api/frida-core-1.0.vapi to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/share/vala/vapi Installing src/api/frida-core-1.0.deps to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/share/vala/vapi Installing src/api/libfrida-core-1.0.a to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/lib Installing server/frida-server to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/bin Installing portal/frida-portal to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/bin Installing inject/frida-inject to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/bin Installing /home/r/Documents/FRIDA/frida/frida-core/lib/selinux/frida-selinux.h to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/include/frida-1.0 Installing /home/r/Documents/FRIDA/frida/build/tmp-android-arm64/frida-core/meson-private/frida-base-1.0.pc to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/lib/pkgconfig Installing /home/r/Documents/FRIDA/frida/build/tmp-android-arm64/frida-core/meson-private/frida-payload-1.0.pc to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/lib/pkgconfig Installing /home/r/Documents/FRIDA/frida/build/tmp-android-arm64/frida-core/meson-private/frida-core-1.0.pc to /home/r/Documents/FRIDA/frida/build/frida-android-arm64/lib/pkgconfig make[1]: 离开目录“/home/r/Documents/FRIDA/frida”
查看编译后的文件
1 | cd build/frida-android-arm64/bin && ls |
(frida-compile) r@ubuntu20:~/Documents/FRIDA/frida$ cd build/frida-android-arm64/bin && ls frida-inject frida-portal frida-server gum-graft (frida-compile) r@ubuntu20:~/Documents/FRIDA/frida/build/frida-android-arm64/bin$
0x2 修改frida
先把所有的 "frida_agent_main" 换成"main"
然后直接git am打上patch, 如果不会打的话其实一个个改也不费事，因为核心其实在python脚本，和前面的字符串处理
我这里把frida改成了rusda，你也可以改成其他的
github: GitHub - taisuii/rusda: 对frida 16.2.1的patch
python脚本新建在frida-core/src目录下
如果你提示No module named 'lief' 说明Python模块没有装好 pip3 install lief
然后编译，这里可以过滤日志编译，如果编译成功还是有很多特征大部分原因是python脚本没有打上patch
1 | make core-android-arm64 | grep Patch |
(base) r@ubuntu20:~/Documents/FRIDA/frida$ make core-android-arm64 | grep Patch [*] Patch frida-agent: /home/r/Documents/FRIDA/frida/build/tmp-android-arm64/frida-core/src/frida-agent@emb/frida-agent-64.so [*] Patch `frida` to `rusda` [*] Patching section name=.rodata offset=0x1c4a26 orig:FridaScriptEngine new:enignEtpircSadirF [*] Patching section name=.rodata offset=0x1d24db orig:FridaScriptEngine new:enignEtpircSadirF [*] Patching section name=.rodata offset=0x1d9472 orig:GLib-GIO new:OIG-biLG [*] Patching section name=.rodata offset=0x1959df orig:GDBusProxy new:yxorPsuBDG [*] Patching section name=.rodata offset=0x1c4b31 orig:GDBusProxy new:yxorPsuBDG [*] Patching section name=.rodata offset=0x1b1746 orig:GumScript new:tpircSmuG [*] Patching section name=.rodata offset=0x210bed orig:GumScript new:tpircSmuG [*] Patching section name=.rodata offset=0x238393 orig:GumScript new:tpircSmuG [*] Patching section name=.rodata offset=0x246184 orig:GumScript new:tpircSmuG [*] Patch `gum-js-loop` to `russellloop` [*] Patch `gmain` to `rmain` [*] Patch `gdbus` to `rubus` [*] Patch Finish [*] Patch frida-agent: /home/r/Documents/FRIDA/frida/build/tmp-android-arm64/frida-core/src/frida-agent@emb/frida-agent-32.so [*] Patch `frida` to `rusda` [*] Patching section name=.rodata offset=0xcc3a3 orig:FridaScriptEngine new:enignEtpircSadirF [*] Patching section name=.rodata offset=0xd984c orig:FridaScriptEngine new:enignEtpircSadirF [*] Patching section name=.rodata offset=0xe066f orig:GLib-GIO new:OIG-biLG [*] Patching section name=.rodata offset=0x9e15e orig:GDBusProxy new:yxorPsuBDG [*] Patching section name=.rodata offset=0xcc4ae orig:GDBusProxy new:yxorPsuBDG [*] Patching section name=.rodata offset=0xb96c5 orig:GumScript new:tpircSmuG [*] Patching section name=.rodata offset=0x115e26 orig:GumScript new:tpircSmuG [*] Patching section name=.rodata offset=0x13d0a3 orig:GumScript new:tpircSmuG [*] Patching section name=.rodata offset=0x14aa2d orig:GumScript new:tpircSmuG [*] Patch `gum-js-loop` to `russellloop` [*] Patch `gmain` to `rmain` [*] Patch `gdbus` to `rubus` [*] Patch Finish [*] Patch frida-agent: /home/r/Documents/FRIDA/frida/build/tmp-android-arm64/frida-core/src/frida-agent@emb/frida-agent-arm64.so [*] Patch `frida` to `rusda` [*] Patch frida-agent: /home/r/Documents/FRIDA/frida/build/tmp-android-arm64/frida-core/src/frida-agent@emb/frida-agent-arm.so [*] Patch `frida` to `rusda` (base) r@ubuntu20:~/Documents/FRIDA/frida$ ls
0x3 运行测试
这里换个端口，就是全绿
1 2 3 4 5 | cd build/frida-android-arm64/binadb push frida-server /data/local/tmpadb shellchmod +x frida-server./frida-server -l 127.0.0.1:12345 |
1 | frida -H 127.0.0.1:12345 -f com.yimian.envcheck |
0x4 参考
GitHub - Ylarod/Florida: 基础反检测 frida-server / Basic anti-detection frida-server
更多【Android安全-frida16.2.1 编译patch全过程】相关视频教程：www.yxfzedu.com
相关文章推荐
- 企业安全-学习Kubernetes笔记——安装NFS驱动 - Android安全CTF对抗IOS安全
- 企业安全-学习Kubernetes笔记——kubeadm安装Kubernetes - Android安全CTF对抗IOS安全
- 软件逆向-wibu软授权(四) - Android安全CTF对抗IOS安全
- 软件逆向-使用IDAPython开发复制RVA的插件 - Android安全CTF对抗IOS安全
- 2-wibu软授权(三) - Android安全CTF对抗IOS安全
- 软件逆向-wibu软授权(二) - Android安全CTF对抗IOS安全
- 软件逆向-wibu软授权(一) - Android安全CTF对抗IOS安全
- 软件逆向- PE格式：分析IatHook并实现 - Android安全CTF对抗IOS安全
- Android安全-安卓API自动化安全扫描 - Android安全CTF对抗IOS安全
- 二进制漏洞- Chrome v8 Issue 1307610漏洞及其利用分析 - Android安全CTF对抗IOS安全
- iOS安全-IOS 脱壳入坑经验分享 - Android安全CTF对抗IOS安全
- 二进制漏洞-Windows UAF 漏洞分析CVE-2014-4113 - Android安全CTF对抗IOS安全
- CTF对抗-lua 逆向学习 & RCTF picstore 还原代码块 - Android安全CTF对抗IOS安全
- Android安全-如何修改unity HybridCLR 热更dll - Android安全CTF对抗IOS安全
- 软件逆向-浅谈编译器对代码的优化 - Android安全CTF对抗IOS安全
- 二进制漏洞-年终CLFS漏洞汇总分析 - Android安全CTF对抗IOS安全
- 软件逆向-自动化提取恶意文档中的shellcode - Android安全CTF对抗IOS安全
- 二进制漏洞-铁威马TerraMaster CVE-2022-24990&CVE-2022-24989漏洞分析报告 - Android安全CTF对抗IOS安全
- 4-seccomp-bpf+ptrace实现修改系统调用原理（附demo） - Android安全CTF对抗IOS安全
- 二进制漏洞-Windows内核提权漏洞CVE-2018-8120分析 - Android安全CTF对抗IOS安全
记录自己的技术轨迹
文章规则：
1)：文章标题请尽量与文章内容相符
2)：严禁色情、血腥、暴力
3)：严禁发布任何形式的广告贴
4)：严禁发表关于中国的政治类话题
5)：严格遵守中国互联网法律法规
6)：有侵权,疑问可发邮件至service@yxfzedu.com
近期原创 更多