-
Notifications
You must be signed in to change notification settings - Fork 0
/
script_bak.js
639 lines (565 loc) · 25.9 KB
/
script_bak.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
// 绕过TracerPid检测
var ByPassTracerPid = function () {
var fgetsPtr = Module.findExportByName('libc.so', 'fgets');
var fgets = new NativeFunction(fgetsPtr, 'pointer', ['pointer', 'int', 'pointer']);
Interceptor.replace(fgetsPtr, new NativeCallback(function (buffer, size, fp) {
var retval = fgets(buffer, size, fp);
var bufstr = Memory.readUtf8String(buffer);
if (bufstr.indexOf('TracerPid:') > -1) {
Memory.writeUtf8String(buffer, 'TracerPid:\t0');
console.log('tracerpid replaced: ' + Memory.readUtf8String(buffer));
}
return retval;
}, 'pointer', ['pointer', 'int', 'pointer']));
};
// 获取调用链
function getStackTrace() {
var Exception = Java.use('java.lang.Exception');
var ins = Exception.$new('Exception');
var straces = ins.getStackTrace();
if (undefined == straces || null == straces) {
return;
}
var result = '';
for (var i = 0; i < straces.length; i++) {
var str = ' ' + straces[i].toString();
result += str + '\r\n';
}
Exception.$dispose();
return result;
}
function get_format_time() {
var myDate = new Date();
return myDate.getFullYear() + '-' + myDate.getMonth() + '-' + myDate.getDate() + ' ' + myDate.getHours() + ':' + myDate.getMinutes() + ':' + myDate.getSeconds();
}
//告警发送
function alertSend(action, messages, arg, returnValue) {
var _time = get_format_time();
send({
'type': 'notice',
'time': _time,
'action': action,
'messages': messages,
'arg': arg,
'returnValue': returnValue,
'stacks': getStackTrace()
});
}
// 增强健壮性,避免有的设备无法使用 Array.isArray 方法
if (!Array.isArray) {
Array.isArray = function (arg) {
return Object.prototype.toString.call(arg) === '[object Array]';
};
}
// hook方法
function hookMethod(targetClass, targetMethod, targetArgs, action, messages) {
try {
var _Class = Java.use(targetClass);
} catch (e) {
return false;
}
if (targetMethod == '$init') {
var overloadCount = _Class.$init.overloads.length;
for (var i = 0; i < overloadCount; i++) {
_Class.$init.overloads[i].implementation = function () {
var temp = this.$init.apply(this, arguments);
// 是否含有需要过滤的参数
var argumentValues = Object.values(arguments);
if (Array.isArray(targetArgs) && targetArgs.length > 0 && !targetArgs.every(item => argumentValues.includes(item))) {
return null;
}
var arg = '';
for (var j = 0; j < arguments.length; j++) {
arg += '参数' + j + ':' + JSON.stringify(arguments[j]) + '\r\n';
}
if (arg.length == 0) arg = '无参数';
else arg = arg.slice(0, arg.length - 1);
rv = JSON.stringify(temp);
alertSend(action, messages, arg, rv);
return temp;
}
}
} else {
try {
var overloadCount = _Class[targetMethod].overloads.length;
} catch (e) {
console.log(e)
console.log('[*] hook(' + targetMethod + ')方法失败,请检查该方法是否存在!!!');
return false;
}
for (var i = 0; i < overloadCount; i++) {
_Class[targetMethod].overloads[i].implementation = function () {
var temp = this[targetMethod].apply(this, arguments);
// 是否含有需要过滤的参数
var argumentValues = Object.values(arguments);
if (Array.isArray(targetArgs) && targetArgs.length > 0 && !targetArgs.every(item => argumentValues.includes(item))) {
return null;
}
var arg = '';
for (var j = 0; j < arguments.length; j++) {
arg += '参数' + j + ':' + JSON.stringify(arguments[j]) + '\r\n';
}
if (arg.length == 0) arg = '无参数';
else arg = arg.slice(0, arg.length - 1);
rv = JSON.stringify(temp);
alertSend(action, messages, arg, rv);
return temp;
}
}
}
return true;
}
// hook方法(去掉不存在方法)
function hook(targetClass, methodData) {
try {
var _Class = Java.use(targetClass);
} catch (e) {
return false;
}
var methods = _Class.class.getDeclaredMethods();
_Class.$dispose;
// 排查掉不存在的方法,用于各个android版本不存在方法报错问题。
methodData.forEach(function (methodData) {
for (var i in methods) {
if (methods[i].toString().indexOf('.' + methodData['methodName'] + '(') != -1 || methodData['methodName'] == '$init') {
hookMethod(targetClass, methodData['methodName'], methodData['args'], methodData['action'], methodData['messages']);
break;
}
}
});
}
// hook获取其他app信息api,排除app自身
function hookApplicationPackageManagerExceptSelf(targetMethod, action) {
var _ApplicationPackageManager = Java.use('android.app.ApplicationPackageManager');
try {
try {
var overloadCount = _ApplicationPackageManager[targetMethod].overloads.length;
} catch (e) {
return false;
}
for (var i = 0; i < overloadCount; i++) {
_ApplicationPackageManager[targetMethod].overloads[i].implementation = function () {
var temp = this[targetMethod].apply(this, arguments);
var arg = '';
for (var j = 0; j < arguments.length; j++) {
if (j === 0) {
var string_to_recv;
send({'type': 'app_name', 'data': arguments[j]});
recv(function (received_json_object) {
string_to_recv = received_json_object.my_data;
}).wait();
}
arg += '参数' + j + ':' + JSON.stringify(arguments[j]) + '\r\n';
}
if (arg.length == 0) arg = '无参数';
else arg = arg.slice(0, arg.length - 1);
if (string_to_recv) {
rv = JSON.stringify(temp);
alertSend(action, targetMethod + '获取的数据为:' + temp, arg, rv);
}
return temp;
}
}
} catch (e) {
console.log(e);
return
}
}
// 申请权限
function checkRequestPermission() {
var action = '申请权限';
//老项目
hook('android.support.v4.app.ActivityCompat', [
{'methodName': 'requestPermissions', 'action': action, 'messages': '申请具体权限看"参数1"'}
]);
hook('androidx.core.app.ActivityCompat', [
{'methodName': 'requestPermissions', 'action': action, 'messages': '申请具体权限看"参数1"'}
]);
}
// 获取电话相关信息
function getPhoneState() {
var action = '获取电话相关信息';
hook('android.telephony.TelephonyManager', [
// Android 8.0
{'methodName': 'getDeviceId', 'action': action, 'messages': '获取IMEI'},
// Android 8.1、9 android 10获取不到
{'methodName': 'getImei', 'action': action, 'messages': '获取IMEI'},
{'methodName': 'getMeid', 'action': action, 'messages': '获取MEID'},
{'methodName': 'getLine1Number', 'action': action, 'messages': '获取电话号码标识符'},
{'methodName': 'getSimSerialNumber', 'action': action, 'messages': '获取IMSI/iccid'},
{'methodName': 'getSubscriberId', 'action': action, 'messages': '获取IMSI'},
{'methodName': 'getSimOperator', 'action': action, 'messages': '获取MCC/MNC'},
{'methodName': 'getNetworkOperator', 'action': action, 'messages': '获取MCC/MNC'},
{'methodName': 'getSimCountryIso', 'action': action, 'messages': '获取SIM卡国家代码'},
{'methodName': 'getCellLocation', 'action': action, 'messages': '获取电话当前位置信息'},
{'methodName': 'getAllCellInfo', 'action': action, 'messages': '获取电话当前位置信息'},
{'methodName': 'requestCellInfoUpdate', 'action': action, 'messages': '获取基站信息'},
// {'methodName': 'getServiceState', 'action': action, 'messages': '获取sim卡是否可用'},
]);
// 电信卡cid lac
hook('android.telephony.cdma.CdmaCellLocation', [
{'methodName': 'getBaseStationId', 'action': action, 'messages': '获取基站cid信息'},
{'methodName': 'getNetworkId', 'action': action, 'messages': '获取基站lac信息'}
]);
// 移动联通卡 cid/lac
hook('android.telephony.gsm.GsmCellLocation', [
{'methodName': 'getCid', 'action': action, 'messages': '获取基站cid信息'},
{'methodName': 'getLac', 'action': action, 'messages': '获取基站lac信息'}
]);
// 短信
hook('android.telephony.SmsManager', [
{'methodName': 'sendTextMessageInternal', 'action': action, 'messages': '获取短信信息-发送短信'},
{'methodName': 'getDefault', 'action': action, 'messages': '获取短信信息-发送短信'},
{'methodName': 'sendTextMessageWithSelfPermissions', 'action': action, 'messages': '获取短信信息-发送短信'},
{'methodName': 'sendMultipartTextMessageInternal', 'action': action, 'messages': '获取短信信息-发送短信'},
{'methodName': 'sendDataMessage', 'action': action, 'messages': '获取短信信息-发送短信'},
{'methodName': 'sendDataMessageWithSelfPermissions', 'action': action, 'messages': '获取短信信息-发送短信'},
]);
}
// 系统信息(AndroidId/标识/content敏感信息)
function getSystemData() {
var action = '获取系统信息';
hook('android.provider.Settings$Secure', [
{'methodName': 'getString', 'args': ['android_id'], 'action': action, 'messages': '获取安卓ID'}
]);
hook('android.provider.Settings$System', [
{'methodName': 'getString', 'args': ['android_id'], 'action': action, 'messages': '获取安卓ID'}
]);
hook('android.os.Build', [
{'methodName': 'getSerial', 'action': action, 'messages': '获取设备序列号'},
]);
hook('android.app.admin.DevicePolicyManager', [
{'methodName': 'getWifiMacAddress', 'action': action, 'messages': '获取mac地址'},
]);
hook('android.content.ClipboardManager', [
{'methodName': 'getPrimaryClip', 'action': action, 'messages': '读取剪切板信息'},
{'methodName': 'setPrimaryClip', 'action': action, 'messages': '写入剪切板信息'},
]);
hook('android.telephony.UiccCardInfo', [
{'methodName': 'getIccId', 'action': action, 'messages': '读取手机IccId信息'},
]);
//小米
hook('com.android.id.impl.IdProviderImpl', [
{'methodName': 'getUDID', 'action': action, 'messages': '读取小米手机UDID'},
{'methodName': 'getOAID', 'action': action, 'messages': '读取小米手机OAID'},
{'methodName': 'getVAID', 'action': action, 'messages': '读取小米手机VAID'},
{'methodName': 'getAAID', 'action': action, 'messages': '读取小米手机AAID'},
]);
//三星
hook('com.samsung.android.deviceidservice.IDeviceIdService$Stub$Proxy', [
{'methodName': 'getOAID', 'action': action, 'messages': '读取三星手机OAID'},
{'methodName': 'getVAID', 'action': action, 'messages': '读取三星手机VAID'},
{'methodName': 'getAAID', 'action': action, 'messages': '读取三星手机AAID'},
]);
hook('repeackage.com.samsung.android.deviceidservice.IDeviceIdService$Stub$Proxy', [
{'methodName': 'getOAID', 'action': action, 'messages': '读取三星手机OAID'},
{'methodName': 'getVAID', 'action': action, 'messages': '读取三星手机VAID'},
{'methodName': 'getAAID', 'action': action, 'messages': '读取三星手机AAID'},
]);
// 获取content敏感信息
try {
// 通讯录内容
var ContactsContract = Java.use('android.provider.ContactsContract');
var contact_authority = ContactsContract.class.getDeclaredField('AUTHORITY').get('java.lang.Object');
} catch (e) {
console.log(e)
}
try {
// 日历内容
var CalendarContract = Java.use('android.provider.CalendarContract');
var calendar_authority = CalendarContract.class.getDeclaredField('AUTHORITY').get('java.lang.Object');
} catch (e) {
console.log(e)
}
try {
// 浏览器内容
var BrowserContract = Java.use('android.provider.BrowserContract');
var browser_authority = BrowserContract.class.getDeclaredField('AUTHORITY').get('java.lang.Object');
} catch (e) {
console.log(e)
}
try {
// 相册内容
var MediaStore = Java.use('android.provider.MediaStore');
var media_authority = MediaStore.class.getDeclaredField('AUTHORITY').get('java.lang.Object');
} catch (e) {
console.log(e)
}
try {
var ContentResolver = Java.use('android.content.ContentResolver');
var queryLength = ContentResolver.query.overloads.length;
for (var i = 0; i < queryLength; i++) {
ContentResolver.query.overloads[i].implementation = function () {
var temp = this.query.apply(this, arguments);
if (arguments[0].toString().indexOf(contact_authority) != -1) {
rv = JSON.stringify(temp);
alertSend(action, '获取手机通信录内容', '', rv);
} else if (arguments[0].toString().indexOf(calendar_authority) != -1) {
rv = JSON.stringify(temp);
alertSend(action, '获取日历内容', '', rv);
} else if (arguments[0].toString().indexOf(browser_authority) != -1) {
rv = JSON.stringify(temp);
alertSend(action, '获取浏览器内容', '', rv);
} else if (arguments[0].toString().indexOf(media_authority) != -1) {
rv = JSON.stringify(temp);
alertSend(action, '获取相册内容', '', rv);
}
return temp;
}
}
} catch (e) {
console.log(e);
return
}
}
//获取其他app信息
function getPackageManager() {
var action = '获取其他app信息';
hook('android.content.pm.PackageManager', [
{'methodName': 'getInstalledPackages', 'action': action, 'messages': 'APP获取了其他app信息'},
{'methodName': 'getInstalledApplications', 'action': action, 'messages': 'APP获取了其他app信息'}
]);
hook('android.app.ApplicationPackageManager', [
{'methodName': 'getInstalledPackages', 'action': action, 'messages': 'APP获取了其他app信息'},
{'methodName': 'getInstalledApplications', 'action': action, 'messages': 'APP获取了其他app信息'},
{'methodName': 'queryIntentActivities', 'action': action, 'messages': 'APP获取了其他app信息'},
]);
hook('android.app.ActivityManager', [
{'methodName': 'getRunningAppProcesses', 'action': action, 'messages': '获取了正在运行的App'},
{'methodName': 'getRunningServiceControlPanel', 'action': action, 'messages': '获取了正在运行的服务面板'},
]);
//需排除应用本身
hookApplicationPackageManagerExceptSelf('getApplicationInfo', action);
hookApplicationPackageManagerExceptSelf('getPackageInfoAsUser', action);
hookApplicationPackageManagerExceptSelf('getInstallerPackageName', action);
}
// 获取位置信息
function getGSP() {
var action = '获取位置信息';
hook('android.location.LocationManager', [
{'methodName': 'requestLocationUpdates', 'action': action, 'messages': action},
{'methodName': 'getLastKnownLocation', 'action': action, 'messages': action},
{'methodName': 'getBestProvider', 'action': action, 'messages': action},
{'methodName': 'getGnssHardwareModelName', 'action': action, 'messages': action},
{'methodName': 'getGnssYearOfHardware', 'action': action, 'messages': action},
{'methodName': 'getProvider', 'action': action, 'messages': action},
{'methodName': 'requestSingleUpdate', 'action': action, 'messages': action},
{'methodName': 'getCurrentLocation', 'action': action, 'messages': action},
]);
hook('android.location.Location', [
{'methodName': 'getAccuracy', 'action': action, 'messages': action},
{'methodName': 'getAltitude', 'action': action, 'messages': action},
{'methodName': 'getBearing', 'action': action, 'messages': action},
{'methodName': 'getBearingAccuracyDegrees', 'action': action, 'messages': action},
{'methodName': 'getElapsedRealtimeNanos', 'action': action, 'messages': action},
{'methodName': 'getExtras', 'action': action, 'messages': action},
{'methodName': 'getLatitude', 'action': action, 'messages': action},
{'methodName': 'getLongitude', 'action': action, 'messages': action},
{'methodName': 'getProvider', 'action': action, 'messages': action},
{'methodName': 'getSpeed', 'action': action, 'messages': action},
{'methodName': 'getSpeedAccuracyMetersPerSecond', 'action': action, 'messages': action},
{'methodName': 'getTime', 'action': action, 'messages': action},
{'methodName': 'getVerticalAccuracyMeters', 'action': action, 'messages': action},
]);
hook('android.location.Geocoder', [
{'methodName': 'getFromLocation', 'action': action, 'messages': action},
{'methodName': 'getFromLocationName', 'action': action, 'messages': action},
]);
}
// 调用摄像头(hook,防止静默拍照)
function getCamera() {
var action = '调用摄像头';
hook('android.hardware.Camera', [
{'methodName': 'open', 'action': action, 'messages': action},
]);
hook('android.hardware.camera2.CameraManager', [
{'methodName': 'openCamera', 'action': action, 'messages': action},
]);
hook('androidx.camera.core.ImageCapture', [
{'methodName': 'takePicture', 'action': action, 'messages': '调用摄像头拍照'},
]);
}
//获取网络信息
function getNetwork() {
var action = '获取网络信息';
hook('android.net.wifi.WifiInfo', [
{'methodName': 'getMacAddress', 'action': action, 'messages': '获取Mac地址'},
{'methodName': 'getSSID', 'action': action, 'messages': '获取wifi SSID'},
{'methodName': 'getBSSID', 'action': action, 'messages': '获取wifi BSSID'},
]);
hook('android.net.wifi.WifiManager', [
{'methodName': 'getConnectionInfo', 'action': action, 'messages': '获取wifi信息'},
{'methodName': 'getConfiguredNetworks', 'action': action, 'messages': '获取wifi信息'},
{'methodName': 'getScanResults', 'action': action, 'messages': '获取wifi信息'},
{'methodName': 'getWifiState', 'action': action, 'messages': '获取wifi状态信息'},
]);
hook('java.net.InetAddress', [
{'methodName': 'getHostAddress', 'action': action, 'messages': '获取IP地址'},
{'methodName': 'getAddress', 'action': action, 'messages': '获取网络address信息'},
{'methodName': 'getHostName', 'action': action, 'messages': '获取网络hostname信息'},
]);
hook('java.net.Inet4Address', [
{'methodName': 'getHostAddress', 'action': action, 'messages': '获取IP地址'},
]);
hook('java.net.Inet6Address', [
{'methodName': 'getHostAddress', 'action': action, 'messages': '获取IP地址'},
]);
hook('java.net.NetworkInterface', [
{'methodName': 'getHardwareAddress', 'action': action, 'messages': '获取Mac地址'}
]);
hook('android.net.NetworkInfo', [
{'methodName': 'getType', 'action': action, 'messages': '获取网络类型'},
{'methodName': 'getTypeName', 'action': action, 'messages': '获取网络类型名称'},
{'methodName': 'getExtraInfo', 'action': action, 'messages': '获取网络名称'},
{'methodName': 'isAvailable', 'action': action, 'messages': '获取网络是否可用'},
{'methodName': 'isConnected', 'action': action, 'messages': '获取网络是否连接'},
]);
hook('android.net.ConnectivityManager', [
{'methodName': 'getActiveNetworkInfo', 'action': action, 'messages': '获取网络状态信息'},
]);
hook('java.net.InetSocketAddress', [
{'methodName': 'getHostAddress', 'action': action, 'messages': '获取网络hostaddress信息'},
{'methodName': 'getAddress', 'action': action, 'messages': '获取网络address信息'},
{'methodName': 'getHostName', 'action': action, 'messages': '获取网络hostname信息'},
]);
// ip地址
try {
var _WifiInfo = Java.use('android.net.wifi.WifiInfo');
//获取ip
_WifiInfo.getIpAddress.implementation = function () {
var temp = this.getIpAddress();
var _ip = new Array();
_ip[0] = (temp >>> 24) >>> 0;
_ip[1] = ((temp << 8) >>> 24) >>> 0;
_ip[2] = (temp << 16) >>> 24;
_ip[3] = (temp << 24) >>> 24;
var _str = String(_ip[3]) + "." + String(_ip[2]) + "." + String(_ip[1]) + "." + String(_ip[0]);
rv = JSON.stringify(temp);
alertSend(action, '获取IP地址:' + _str, '', rv);
return temp;
}
} catch (e) {
console.log(e)
}
}
//获取蓝牙设备信息
function getBluetooth() {
var action = '获取蓝牙设备信息';
hook('android.bluetooth.BluetoothDevice', [
{'methodName': 'getName', 'action': action, 'messages': '获取蓝牙设备名称'},
{'methodName': 'getAddress', 'action': action, 'messages': '获取蓝牙设备mac'},
]);
hook('android.bluetooth.BluetoothAdapter', [
{'methodName': 'getName', 'action': action, 'messages': '获取蓝牙设备名称'}
]);
}
//读写文件
function getFileMessage() {
var action = '文件操作';
hook('java.io.RandomAccessFile', [
{'methodName': '$init', 'action': action, 'messages': 'RandomAccessFile写文件'}
]);
hook('java.io.File', [
{'methodName': 'mkdirs', 'action': action, 'messages': '尝试写入sdcard创建小米市场审核可能不通过'},
{'methodName': 'mkdir', 'action': action, 'messages': '尝试写入sdcard创建小米市场审核可能不通过'}
]);
}
//获取麦克风信息
function getMedia() {
var action = '获取麦克风'
hook('android.media.MediaRecorder', [
{'methodName': 'start', 'action': action, 'messages': '获取麦克风'},
]);
hook('android.media.AudioRecord', [
{'methodName': 'startRecording', 'action': action, 'messages': '获取麦克风'},
]);
}
//获取传感器信息
function getSensor() {
var action = '获取传感器信息'
hook('android.hardware.SensorManager', [
{'methodName': 'getSensorList', 'action': action, 'messages': '获取传感器信息'},
]);
}
function customHook() {
var action = '用户自定义hook';
//自定义hook函数,可自行添加。格式如下:
// hook('com.zhengjim.myapplication.HookTest', [
// {'methodName': 'getPassword', 'action': action, 'messages': '获取zhengjim密码'},
// {'methodName': 'getUser', 'action': action, 'messages': '获取zhengjim用户名'},
// ]);
}
function useModule(moduleList) {
var _module = {
// 'permission': [checkRequestPermission],
'phone': [getPhoneState],
'system': [getSystemData],
// 'app': [getPackageManager],
// 'location': [getGSP],
'network': [getNetwork],
// 'camera': [getCamera],
'bluetooth': [getBluetooth],
// 'file': [getFileMessage],
// 'media': [getMedia],
// 'sensor': [getSensor],
'custom': [customHook]
};
var _m = Object.keys(_module);
var tmp_m = []
if (moduleList['type'] !== 'all') {
var input_module_data = moduleList['data'].split(',');
for (i = 0; i < input_module_data.length; i++) {
if (_m.indexOf(input_module_data[i]) === -1) {
send({'type': 'noFoundModule', 'data': input_module_data[i]})
} else {
tmp_m.push(input_module_data[i])
}
}
}
switch (moduleList['type']) {
case 'use':
_m = tmp_m;
break;
case 'nouse':
for (var i = 0; i < input_module_data.length; i++) {
for (var j = 0; j < _m.length; j++) {
if (_m[j] == input_module_data[i]) {
_m.splice(j, 1);
j--;
}
}
}
break;
}
send({'type': 'loadModule', 'data': _m})
if (_m.length !== 0) {
for (i = 0; i < _m.length; i++) {
for (j = 0; j < _module[_m[i]].length; j++) {
_module[_m[i]][j]();
}
}
}
}
function main() {
try {
Java.perform(function () {
console.log('[*] ' + get_format_time() + ' 隐私合规检测敏感接口开始监控...');
send({"type": "isHook"})
console.log('[*] ' + get_format_time() + ' 检测到安卓版本:' + Java.androidVersion);
var moduleList;
recv(function (received_json_object) {
moduleList = received_json_object.use_module;
}).wait();
useModule(moduleList);
});
} catch (e) {
console.log(e)
}
}
// 绕过TracerPid检测 默认关闭,有必要时再自行打开
// setImmediate(ByPassTracerPid);
//在spawn模式下,hook系统API时如javax.crypto.Cipher建议使用setImmediate立即执行,不需要延时
//在spawn模式下,hook应用自己的函数或含壳时,建议使用setTimeout并给出适当的延时(500~5000)
// main();
//setImmediate(main)
// setTimeout(main, 3000);