{"id":76,"date":"2025-09-18T11:11:00","date_gmt":"2025-09-18T03:11:00","guid":{"rendered":"http:\/\/hmuseab.tstatic.top\/?p=76"},"modified":"2025-09-19T11:16:52","modified_gmt":"2025-09-19T03:16:52","slug":"%e4%bb%8e0%e5%bc%80%e5%a7%8b%e9%80%86%e5%90%91%e5%88%86%e6%9e%90%e4%b8%80%e4%b8%aaapp-%e6%9f%90%e7%82%b9%e5%b0%8f%e8%af%b4","status":"publish","type":"post","link":"https:\/\/muse.lzink.icu\/?p=76","title":{"rendered":"\u4ece0\u5f00\u59cb\u9006\u5411\u5206\u6790\u4e00\u4e2aapp \u67d0\u70b9\u5c0f\u8bf4"},"content":{"rendered":"\n
\n

\u539f\u521b \u5df2\u4e8e 2023-12-11 19:44:38 \u4fee\u6539 \u00b7 2.1k \u9605\u8bfb \u00b7 9 \u00b7 13 \u00b7 CC 4.0 BY-SA\u7248\u6743 \u7248\u6743\u58f0\u660e\uff1a\u672c\u6587\u4e3a\u535a\u4e3b\u539f\u521b\u6587\u7ae0\uff0c\u9075\u5faa CC 4.0 BY-SA \u7248\u6743\u534f\u8bae\uff0c\u8f6c\u8f7d\u8bf7\u9644\u4e0a\u539f\u6587\u51fa\u5904\u94fe\u63a5\u548c\u672c\u58f0\u660e\u3002 \u6587\u7ae0\u94fe\u63a5\uff1ahttps:\/\/blog.csdn.net\/blackblackblack223\/article\/details\/134725402<\/a><\/p>\n<\/blockquote>\n\n\n\n

\u524d\u7f6e\u6761\u4ef6<\/h2>\n\n\n\n

1.\u9996\u5148\u6211\u4eec\u5047\u8bbe\u5df2\u7ecf\u642d\u5efa\u597d\u4e86\u6293\u5305\u5de5\u5177 charles 2.\u5e76\u4e14\u6709\u4e00\u4e2a\u53ef\u8fd0\u884c\u7684\u865a\u62df\u6216\u8005\u771f\u5b9e\u8bbe\u5907 \u83b7\u53d6root\u6743\u9650\uff0c\u540c\u65f6\u5b89\u88c5\u4e86adb 3.\u9009\u62e9\u4e00\u6b3ehook\u5de5\u5177 \u6b64\u5904\u9009\u62e9frida \u4ee5\u4e0a\u6ca1\u6709\u8fbe\u6210\u7684\u53ef\u4ee5\u627e\u6211\u5386\u53f2\u6587\u7ae0<\/p>\n\n\n\n

\u9009\u62e9\u4e00\u6b3e\u5e94\u7528 \u67d0\u70b9\u5c0f\u8bf4<\/h2>\n\n\n\n

\u67d0\u5c0f\u8bf4\u5e94\u7528\u4e3a\u6848\u4f8b \u6bd4\u5982\u6211\u4eec\u60f3\u770b\u5c0f\u8bf4\u7684\u57fa\u672c\u4fe1\u606f \u53bb\u5e94\u7528\u5546\u5e97\u4e0b\u8f7d\u5e76\u4e14\u5b89\u88c5app\u5230\u6a21\u62df\u5668\uff08\u4f18\u5148\u4f4e\u4f4e\u7248\u672c \u5bb9\u6613\u5206\u6790\uff09 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n

\u5206\u6790\u63a5\u53e3\u4ee5\u540e\u53d1\u73b0\u53ef\u4ee5\u6293\u5305\u4f46\u662f\u6ca1\u6709\u6570\u636e<\/p>\n\n\n\n

\u901a\u8fc7\u914d\u7f6epostern+charles\u53ef\u4ee5\u89e3\u51b3\u8fd9\u4e2a\u95ee\u9898 charles\u8fd9\u4e48\u914d\uff0c\u8d70socks5 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n

\u7136\u540e\u6a21\u62df\u5668\u88c5postern \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n

\u53ef\u4ee5\u6293\u5230\u6211\u9700\u8981\u7684\u8bf7\u6c42\u6570\u636e\u5305\u4e86<\/p>\n\n\n\n

\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"\/<\/div><\/figure>\n\n\n\n

\u5f00\u59cbhook app<\/h2>\n\n\n\n

\u4f46\u662f\u542f\u52a8\u5ba2\u6237\u7aeffrida\u9700\u8981\u77e5\u9053\u5e94\u7528\u7684\u5305\u540d<\/p>\n\n\n\n

\u6b64\u5904\u6709\u4e00\u4e2a\u547d\u4ee4adbshell \u8fdb\u5165\u624b\u673a\u547d\u4ee4\u884c dumpsys windowwindows|grep com \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n

\u547d\u4ee4\u53ef\u4ee5\u4fee\u6539<\/p>\n\n\n\n

\u6b64\u65f6\u53cd\u659c\u6760\u540e\u9762\u5c31\u662f\u5305\u540d<\/p>\n\n\n\n

\u6709\u4e86\u5305\u540d\u5c31\u53ef\u4ee5\u8fdb\u884chook\u4e86\uff0c\u7b2c\u4e00\u4e2a\u601d\u8defhook \u4e00\u4e2aapp\u7684string\u6784\u9020\u51fd\u6570<\/p>\n\n\n\n

Java.perform(\/*hook string\u7684js\u65b9\u6cd5*\/
function hook_string_factory() {
    var StringFactory = Java.use('java.lang.StringFactory');
    StringFactory.newStringFromString.implementation = function (content) {
        console.log(\"java.lang.StringFactory.newStringFromString->\" + content);
        var result = this.newStringFromString(content);
        return result;
    };
})
\u200b
hook_string_factory()<\/pre>\n\n\n\n
\u8fdb\u884chook \u7136\u540e\u6253\u5370\u6240\u6709string\u6784\u9020
 frida -U -f com.qidian.QDReader -l .\\hook-string.js -o output.log<\/pre>\n\n\n\n
\u6253\u5370\u7ed3\u679c\u5c31\u51fa\u73b0\u4e86 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n
\u6211\u4eec\u6355\u83b7\u5230\u81ea\u5df1\u9700\u8981\u7684\u5b57\u7b26\u4e32\u4ee5\u540e \u53ef\u4ee5\u901a\u8fc7if\u5224\u65ad\u5728\u91cc\u9762\u6253\u5370\u4e00\u4e2a\u5806\u6808 \u7136\u540e\u901a\u8fc7\u5b9a\u4f4d\u9605\u8bfb\u53cd\u7f16\u8bd1\u540e\u7684\u4ee3\u7801 \uff0c\u4e00\u70b9\u4e00\u70b9\u5206\u6790\u8bf7\u6c42\u53c2\u6570 \uff0c\u52a0\u5bc6\u53c2\u6570\u7b49\u7b49<\/p>\n\n\n\n
\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"\/<\/div><\/figure>\n\n\n\n
\u6b64\u5904\u7684\u53cd\u7f16\u8bd1\u5de5\u5177\u63a8\u8350jadx \uff0cjeb\uff0cgda\u7b49\u7b49<\/p>\n\n\n\n
\u5230\u4e86\u8fd9\u91cc\u95ee\u9898\u6765\u4e86 string\u6ca1\u6709hook\u5230\u6211\u60f3\u8981\u7684\u53c2\u6570<\/p>\n\n\n\n
frida\u5bf9map\u7684put\u51fd\u6570\u8fdb\u884chook<\/h2>\n\n\n\n
\u4e8e\u662f\u6211\u9009\u62e9map\u8fdb\u884chook\uff0chook\u6253\u5370map\u4e2d\u6bcf\u4e2a\u8fdb\u884c\u8c03\u7528put\u7684\u51fd\u6570 \u5f53\u8bf7\u6c42\u5934\u5305\u542bborgus\uff0c\u6216\u8005qdsign\u7684\u4e00\u4e9b\u5b57\u7b26\u4e32\u65f6\u5019 \u6253\u5370\u4e00\u4e2a\u8c03\u7528\u6808 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n
\u6253\u5370\u7ed3\u679c\u5982\u56fe<\/p>\n\n\n\n
\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u8fd9\u4e2a\u53c2\u6570\u662f\u4e00\u4e2anative\u53d8\u91cf \u9700\u8981\u53d6so\u4e2d\u8fdb\u884c\u5206\u6790 \u4ecb\u4e8e\u4e3a\u4e86\u5199\u6587\u7ae0 so\u96be\u5ea6\u8f83\u5927 \u5c31\u4e0d\u5c55\u5f00\u8bf4\u4e86 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n
\u7b2c\u4e00\u4e2a\u53c2\u6570\u7ecf\u8fc7hook\u53d1\u73b0\u662furl \u7b2c\u4e8c\u4e2a\u53c2\u6570\u662fget\/post \u8bf7\u6c42\u5f62\u5f0f \u7b2c\u4e09\u4e2a\u662fresponsebody \uff0c\u5c31\u662f\u8bf7\u6c42\u5934request\u7684body<\/p>\n\n\n\n
\u7ecf\u8fc7\u591a\u6b21\u70b9\u51fb\u89e6\u53d1 \u53d1\u73b0\u7b2c\u4e00\u4e2a\u53c2\u6570url \u6253\u5370\u7ed3\u679c\u6ca1\u6709\u6211\u60f3\u8981\u7684v3\/bookdetail\/get\u8fd9\u4e2a\u8bf7\u6c42<\/p>\n\n\n\n
\u8c03\u7528so\u52a0\u5bc6\u63a5\u53e3\u7684\u5730\u65b9\u4e0d\u6b62\u4e00\u4e2a<\/h2>\n\n\n\n
\u6240\u4ee5so\u8c03\u7528\u540c\u4e00\u5957\u52a0\u5bc6\u7b97\u6cd5\u7684\u5165\u53e3\u5e94\u8be5\u4e0d\u6b62\u4e00\u4e2a\u4f4d\u7f6e<\/p>\n\n\n\n
\u6211\u653e\u5f03map\u8c03\u7528\u6808\u7684\u65b9\u5f0f<\/p>\n\n\n\n
\u540e\u6765\u6211\u5f00\u59cb\u5206\u6790\u8fd9\u4e2a\u8bf7\u6c42 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n
\u8fd9\u4e2aurl\u7684\u8bf7\u6c42\u90e8\u5206\u9664\u4e86url\u4ee5\u5916\u53ef\u4ee5\u5269\u4f59\u7684header\u9009\u9879\u90fd\u53ef\u4ee5\u901a\u8fc7so\u5c42\u8fd4\u56de\uff0c\u8fd9\u4e2a\u7ed3\u8bba\u662f\u6211hook\u4e0a\u9762\u7684native\u51fd\u6570\u5f97\u5230\u7684\u7ed3\u8bba<\/p>\n\n\n\n
\u63a5\u4e0b\u6765\u6211\u628a\u76ee\u6807\u653e\u5230\u4e86\u62e6\u622a\u5668\u4e0a\uff0c\u5c31\u662f\u53d1\u9001\u4e00\u4e2a\u8bf7\u6c42\u5230\u4e1a\u52a1\u903b\u8f91\u4e4b\u524d\uff0c\u5df2\u7ecf\u5f97\u5230\u8fd4\u56de\u7ed3\u679c\u6e32\u67d3\u5230\u9875\u9762\u4e4b\u524d\u90fd\u662f\u7ecf\u8fc7N\u4e2a\u8fc7\u6ee4\u5668interceptor<\/p>\n\n\n\n
\u6211\u8fd8\u662fhook map\uff0c\u4e0d\u8fc7\u662f\u5427\u8bf7\u6c42\u53c2\u6570\u6362\u4e86\u4e00\u4e2a\u5173\u952e\u5b57 get\u53c2\u6570<\/p>\n\n\n\n
\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"\/<\/div><\/figure>\n\n\n\n
hook map \uff0c\u5305\u542bisoutbook\u5173\u952e\u5b57\u5c31\u6253\u5370\u8c03\u7528\u6808 \u7ec8\u4e8e\u6211\u5f97\u5230\u4e86\u5b8c\u6574\u7684\u62e6\u622a\u5668\u7684\u8c03\u7528\u6808 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n
\u901a\u8fc7hook\u6211\u53d1\u73b0\u8bf7\u6c42\u5934\u7ecf\u8fc7\u8fd9\u4e24\u4e2a\u62e6\u622a\u5668\u7684\u65f6\u5019\u53d1\u751f\u4e86\u53d8\u5316\uff0c\u5e94\u8be5\u5c31\u662f\u586b\u5145\u4e86borgus\u7b49\u4e00\u7cfb\u5217\u52a0\u5bc6\u53c2\u6570<\/p>\n\n\n\n
\u4f46\u662f\u6211\u4e0d\u77e5\u9053borgus\u7b49\u53c2\u6570\u7684\u5177\u4f53\u6dfb\u52a0\u4f4d\u7f6e<\/p>\n\n\n\n
\u6211\u5c06\u76ee\u5149\u653e\u5230\u4e86\u8bf7\u6c42Request\u7684addheader\u65b9\u6cd5\u4e0a \u5f00\u59cbhook \u6ca1\u53d1\u73b0\u4ec0\u4e48\u6709\u4ef7\u503c\u7684\u4e1c\u897f \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n
\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"\/<\/div><\/figure>\n\n\n\n
\u4f46\u662f\u901a\u8fc7\u5c1d\u8bd5\u6211\u901a\u8fc7\u8c03\u7528\u6808\u53d1\u73b0\u4e86\u4e00\u4e2a\u65b0\u7684\u62e6\u622a\u5668 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n
\u901a\u8fc7\u6253\u5370\u53d1\u73b0\u6240\u6709\u6211\u9700\u8981\u7684\u8bf7\u6c42\u4f53headers\u53c2\u6570\u90fd\u6765\u81eajava\u7684native\u65b9\u6cd5addRetrofitH<\/p>\n\n\n\n
\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"\/<\/div><\/figure>\n\n\n\n
\u6784\u9020request\u8bf7\u6c42\u4f20\u9012\u5230so\u5c42<\/h2>\n\n\n\n
\u770b\u58f0\u660e\u53d1\u73b0\u4f20\u9012\u5230native\u65b9\u6cd5\u662f\u4e00\u4e2a\u5bf9\u8c61\uff08\u5982\u4f55\u6784\u9020request\u5bf9\u8c61\uff1f\uff09 \u8fd4\u56de\u4e00\u4e2arequest \uff08\u4f20\u5165\u4f20\u51faheaders\u53d1\u751f\u4e86\u4ec0\u4e48\uff09 \u7b54\u6848\u5c31\u662f \u4f20\u5165\u7684header\u4e3a\u7a7a \u4f20\u51fa\u7684header\u52a0\u5bc6\u53c2\u6570\u5168\u90e8\u586b\u5145\u5b8c\u6bd5<\/p>\n\n\n\n
\u5230\u4e86\u8fd9\u91cc \u6211\u624b\u52a8\u62fc\u51d1\u4e86\u4e00\u4e2a\u8bf7\u6c42\u5c45\u7136\u62ff\u5230\u6570\u636e\u4e86<\/p>\n\n\n\n
\u56e0\u6b64\u6211\u6700\u540e\u6784\u9020\u4e86\u4e00\u4e2a\u4ee3\u7801 \u5982\u4e0b\uff08\u53ef\u4fee\u6539\u7528\u4f5crpc\uff09 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\n\n\n
\u6784\u9020\u8bf7\u6c42\u53d1\u9001\u7136\u540e\u6253\u5370\u51fa\u6570\u636e<\/p>\n\n\n\n
\u8fd9\u91cc\u7684book_id\u627e\u89c4\u5f8b\u53ef\u4ee5\u53d1\u73b0\u4ed6\u4eec\u7edf\u4e00\u6709\u4e00\u4e2a103\u524d\u7f00\uff0c\u5176\u4ed6\u7684\u4f4d\u901a\u8fc71\u5f00\u59cb\u9012\u589e\u8f6e\u8be2 \u5e94\u8be5\u5c31\u53ef\u4ee5\u627e\u5230\u6240\u6709\u5c0f\u8bf4\u4e86<\/p>\n\n\n\n
\u5230\u8fd9\u91cc\u5c0f\u8bf4\u7684\u8be6\u60c5\u9875\u5c31\u53ef\u4ee5\u62ff\u5230\u4e86\uff08\u901a\u8fc7\u904d\u5386id+rpc\u6784\u9020\u8bf7\u6c42\uff09<\/p>\n\n\n\n
\u6848\u4f8b\u4ec5\u9002\u7528\u4e8e\u5b66\u4e60\u5206\u6790<\/p>\n\n\n\n
\u5177\u4f53\u4ee3\u7801\u53ef\u4ee5\u53c2\u8003github https:\/\/github.com\/victor-zhao-177\/appspiderHook<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
\u539f\u521b \u5df2\u4e8e 2023-12-11 19:44:38 \u4fee\u6539 \u00b7 2.1k \u9605\u8bfb \u00b7 9 \u00b7  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-76","post","type-post","status-publish","format-standard","hentry","category-7"],"_links":{"self":[{"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=\/wp\/v2\/posts\/76","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=76"}],"version-history":[{"count":1,"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=\/wp\/v2\/posts\/76\/revisions"}],"predecessor-version":[{"id":77,"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=\/wp\/v2\/posts\/76\/revisions\/77"}],"wp:attachment":[{"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=76"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=76"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/muse.lzink.icu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=76"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}