these-android-re/android_of_theseus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

zmnbqzjgùzpoegjqreùgjrezn

Browse source
This commit is contained in:
Jean-Marie Mineau 2025-04-04 18:17:04 +02:00
parent a6a0740c61
commit 6ee51c13d6
Signed by: histausse
GPG key ID: B66AEEDA9B645AD2
5 changed files with 527 additions and 366 deletions
Download patch file Download diff file Expand all files Collapse all files

841
frida/poetry.lock generated
View file

File diff suppressed because it is too large Load diff

2
frida/pyproject.toml
View file

@ -8,7 +8,7 @@ authors = [
readme = "README.md" readme = "README.md"
requires-python = ">=3.13,<4.0.0" requires-python = ">=3.13,<4.0.0"
dependencies = [ dependencies = [
"frida (==16.7.0)", "frida (==16.7.4)",
"frida-tools (>=13.6.1,<14.0.0)", "frida-tools (>=13.6.1,<14.0.0)",
"androguard (>=4.1.2,<5.0.0)" "androguard (>=4.1.2,<5.0.0)"
] ]

10
frida/theseus_frida/__init__.py
View file

@ -21,7 +21,9 @@ from loguru import logger # type: ignore
logger.remove() # remove androguard logs logger.remove() # remove androguard logs
FRIDA_SCRIPT = Path(__file__).parent / "hook.js" FRIDA_SCRIPT = Path(__file__).parent / "hook.js"
STACK_CONSUMER_B64 = Path(__file__).parent / "StackConsumer.dex.b64" FRIDA_SERVER_BIN = Path(__file__).parent / "frida-server-16.7.4-android-x86_64.xz"
FRIDA_SERVER_ANDROID_PATH = "/data/local/tmp/frida-server"
# The number of bytes used to encode a java hash (from Object.hashCode or System.identiyHashCode) # The number of bytes used to encode a java hash (from Object.hashCode or System.identiyHashCode)
# The type is 'int', so it sould be a 32bit signed value? # The type is 'int', so it sould be a 32bit signed value?
@ -230,10 +232,6 @@ def handle_load_dex(data, data_storage: dict, file_storage: Path):
) )
FRIDA_SERVER_BIN = Path(__file__).parent / "frida-server-16.7.0-android-x86_64.xz"
FRIDA_SERVER_ANDROID_PATH = "/data/local/tmp/frida-server"
def setup_frida(device_name: str, env: dict[str, str], adb: str) -> frida.core.Device: def setup_frida(device_name: str, env: dict[str, str], adb: str) -> frida.core.Device:
if device_name != "": if device_name != "":
device = frida.get_device(device_name) device = frida.get_device(device_name)
@ -386,7 +384,7 @@ def collect_runtime(
# Don't wait for confirmation that all cl were sended # Don't wait for confirmation that all cl were sended
# global CLASSLOADER_DONE # global CLASSLOADER_DONE
# CLASSLOADER_DONE = False # CLASSLOADER_DONE = False
script.post({"type": "dump-class-loaders"}) # script.post({"type": "dump-class-loaders"})
# t = spinner() # t = spinner()
# while not CLASSLOADER_DONE: # while not CLASSLOADER_DONE:
# print( # print(

BIN
frida/theseus_frida/frida-server-16.7.0-android-x86_64.xz → frida/theseus_frida/frida-server-16.7.4-android-x86_64.xz
View file

Binary file not shown.

40
frida/theseus_frida/hook.js
View file

@ -39,12 +39,12 @@ function registerStackConsumer() {
var meth = Java.cast(m, Method); var meth = Java.cast(m, Method);
let methodname = meth.getName(); let methodname = meth.getName();
if (methodname.startsWith("$r8$lambda$")) { if (methodname.startsWith("$r8$lambda$")) {
lambdamethod = methodname; lambdamethod = '_' + methodname;
}; };
}); });
return Java.registerClass({ let spec = {
name: "theseus.android.StackConsumer", name: "TheseusAndroidStackConsumer",
implements: [Consumer], implements: [Consumer],
fields: { fields: {
stack: 'java.util.ArrayList', stack: 'java.util.ArrayList',
@ -57,24 +57,39 @@ function registerStackConsumer() {
this.stack.value = ArrayList.$new(); this.stack.value = ArrayList.$new();
} }
}], }],
accept(frame) { 'accept': function (frame) {
var castedFrame = Java.cast(frame, StackFrame); var castedFrame = Java.cast(frame, StackFrame);
this.stack.value.add(castedFrame); this.stack.value.add(castedFrame);
}, },
getStack: [{ 'getStack': [{
returnType: '[Ljava.lang.StackWalker$StackFrame;', returnType: '[Ljava.lang.StackWalker$StackFrame;',
argumentTypes: [], argumentTypes: [],
implementation: function () { implementation: function () {
return this.stack.value.toArray(Java.array('java.lang.StackWalker$StackFrame', [])); return this.stack.value.toArray(Java.array('java.lang.StackWalker$StackFrame', []));
}, },
}], }],
andThen(cons) { "andThen": [{
return this.$super.andThen(cons); returnType: 'java.util.function.Consumer',
}, argumentTypes: ['java.util.function.Consumer'],
lambda$andThen$0(consumer, obj) {}, implementation: function (cons) {
['_' + lambdamethod]: function (cons1, cons2, obj) {} return this.$super.andThen(cons);
},
}],
"lambda$andThen$0": [{
returnType: 'void',
argumentTypes: ['java.util.function.Consumer', 'java.lang.Object'],
implementation: function (consumer, obj) {},
}],
[lambdamethod]: [{
returnType: 'void',
argumentTypes: ['java.util.function.Consumer', 'java.util.function.Consumer', 'java.lang.Object'],
implementation: function (cons1, cons2, obj) {}
}]
}, },
}); };
console.log(Object.keys(spec.methods));
return Java.registerClass(spec);
} }
// recv('dump-class-loaders', function onMessage(msg) {dump_classloaders()}); // recv('dump-class-loaders', function onMessage(msg) {dump_classloaders()});
@ -375,6 +390,7 @@ Java.perform(() => {
elements, elements,
); );
}; };
dump_classloaders();
}); });
recv('dump-class-loaders', function onMessage(msg) {dump_classloaders()}); //recv('dump-class-loaders', function onMessage(msg) {dump_classloaders()});