安卓

安卓抓包

tcpdump
http://www.androidtcpdump.com/
./tcpdump -i any -p -s 0 -w /sdcard/capture.pcap

adb 强制安装

adb install -r wx.apk

frida

1
2
3
4
5
6
7
adb push frida-server /data/local/tmp/
adb shell
su
cd /data/local/tmp/
chmod 777 frida-server
./frida-server &
adb forward tcp:27042 tcp:27042

frida 脚本

https://codeshare.frida.re/browse
https://github.com/Nightbringer21/fridump

js api

函数重载和构造函数

1
2
var sclass = Java.use("xxx.class");
sclass.$new.overload('java.lang.String', 'int').implementation = function() {

Hashmap构造和类型转换

1
2
3
4
5
6
7
var HashMap = Java.use("java.util.HashMap");
var Map = Java.use("java.util.Map");
hashmap = HashMap.$new()
var map = Java.cast(hashmap, Map);
map.put("a", "1");
map.put("b", "2");

docs

https://pypkg.com/pypi/frida/api/
https://github.com/frida/frida-java/blob/master/index.js
https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.3.2

安卓命令

查看窗口栈

1
2
adb shell
dumpsys window

查看窗口的activity

dumpsys activity top

调起activity

am start -n 包名/activity名 参数

有的activity可能需要flags
http://gityuan.com/2016/02/27/am-command/

xposed

https://github.com/ac-pm/Inspeckage
开启debug https://github.com/pylerSM/XInstaller
修改硬件信息 https://github.com/1998lixin/Hardwarecode

脱壳

patch 安卓模拟器源码进行脱壳 https://github.com/CheckPointSW/android_unpacker
dex逆向辅助(Dalvik) https://github.com/CalebFenton/dex-oracle
安卓反混淆辅助 https://github.com/CalebFenton/simplify

抓包解密

https://github.com/federicodotta/Brida/
http://bobao.360.cn/learning/detail/4209.html

so 逆向辅助

https://github.com/feicong/jni_helper

jadx

因为Jadx打开apk文件会解析资源文件,如果一个app有很多资源文件,那么Jadx打开就会卡死,所以很多同学问我为什么Jadx打开apk文件就出现卡死状态,主要是因为解析资源文件导致的。所以为了防止卡死,直接解压出dex文件,然后打开就不会卡死了。

工具

安卓shell https://termux.com/
adb下载 https://developer.android.com/studio/releases/platform-tools.html
源码静态分析(可能可以改造) https://github.com/blackarbiter/Android_Code_Arbiter (https://tech.meituan.com/Android-Code-Arbiter.html)
Android SDK https://developer.android.com/studio/index.html?hl=zh-cn
busybox https://busybox.net/downloads/binaries/

Genymotion

Google Apps

http://opengapps.org/
https://github.com/opengapps/opengapps

ARM_Translation

https://forum.xda-developers.com/showthread.php?t=2528952

adb

在设置里指定adb的path,或者用自带的adb

分享到 评论