0x01 前言

刚好有个小需求，需要使用 Frida 读取 Android 中的文件数据，不难但是麻烦，做个小总结，也方便以后遇到问题时能够快速解决。

0x02 frida 写文件

方法一：frida 提供了文件写入的api 使用起来极为方便

       function write_mes_1() {
      
       /
       /
       frida 的api来写文件
      
       var 
       file 
       = 
       new 
       File
       (
       "/sdcard/test.txt"
       , 
       "w"
       );
      
       file
       .write(
       "Hello Word!"
       );
      
       file
       .flush();
      
       file
       .close();
      
       }

方法二：主动调用 libc api 写文件

       function write_mes_2() {
      

           
       var addr_fopen 
       = 
       Module.findExportByName(
       "libc.so"
       , 
       "fopen"
       );
      

           
       var addr_fputs 
       = 
       Module.findExportByName(
       "libc.so"
       , 
       "fputs"
       );
      

           
       var addr_fclose 
       = 
       Module.findExportByName(
       "libc.so"
       , 
       "fclose"
       );
      

        
      

           
       var fopen 
       = 
       new NativeFunction(addr_fopen, 
       "pointer"
       , [
       "pointer"
       , 
       "pointer"
       ]);
      

           
       var fputs 
       = 
       new NativeFunction(addr_fputs, 
       "int"
       , [
       "pointer"
       , 
       "pointer"
       ]);
      

           
       var fclose 
       = 
       new NativeFunction(addr_fclose, 
       "int"
       , [
       "pointer"
       ]);
      

           
       var filename 
       = 
       Memory.allocUtf8String(
       "/sdcard/test.txt"
       );
      

           
       var open_mode 
       = 
       Memory.allocUtf8String(
       "w+"
       );
      

           
       var 
       file 
       = 
       fopen(filename, open_mode);
      

           
       console.log(
       "fopen file:"
       , 
       file
       );
      

        
      

           
       var 
       buffer 
       = 
       Memory.allocUtf8String(
       "Hello Word!"
       );
      

           
       var ret 
       = 
       fputs(
       buffer
       , 
       file
       );
      

           
       console.log(
       "fputs ret:"
       , ret);
      

           
       fclose(
       file
       );
      

       }
      

0x03、frida 读文件

方法一：反射调用 Java api 实现文件读取

       function readFile_1(fileName){
      
       console.log(
       "> Reading file: "
       , fileName);
      
       var JString 
       = 
       Java.use(
       "java.lang.String"
       );
      
       var Files 
       = 
       Java.use(
       "java.nio.file.Files"
       );
      
       var Paths 
       = 
       Java.use(
       "java.nio.file.Paths"
       );
      
       var URI 
       = 
       Java.use(
       "java.net.URI"
       );
      
       var pathName 
       = 
       "file://" 
       + 
       fileName;
      
       var path 
       = 
       Paths.get(URI.create(pathName));
      
       var fileBytes 
       = 
       Files.readAllBytes(path);
      
       var ret 
       = 
       JString.$new(fileBytes);
      
       console.log(ret)
      
       return 
       ret;
      
       }
      
       readFile_1(
       "/sdcard/test.txt"
       );

方法二：主动调用 libc api 实现文件读取

       function readFile_2(fileName){
      

           
       var addr_fopen 
       = 
       Module.findExportByName(
       "libc.so"
       , 
       "fopen"
       );
      

           
       var addr_fread 
       = 
       Module.findExportByName(
       "libc.so"
       , 
       "fread"
       );
      

           
       var addr_fseek 
       = 
       Module.findExportByName(
       "libc.so"
       , 
       "fseek"
       );
      

           
       var addr_ftell 
       = 
       Module.findExportByName(
       "libc.so"
       , 
       "ftell"
       );
      

           
       var addr_fclose 
       = 
       Module.findExportByName(
       "libc.so"
       , 
       "fclose"
       );
      

            
      

           
       var fopenptr 
       = 
       new NativeFunction(addr_fopen, 
       "pointer"
       , [
       "pointer"
       , 
       "pointer"
       ]);
      

           
       var freadptr 
       = 
       new NativeFunction(addr_fread, 
       'int'
       , [
       'pointer'
       , 
       'int'
       ,
       'int'
       ,
       'pointer'
       ]);
      

           
       var fseekptr 
       = 
       new NativeFunction(addr_fseek, 
       'int'
       , [
       'pointer'
       , 
       'int'
       ,
       'int'
       ]);
      

           
       var ftellptr 
       = 
       new NativeFunction(addr_ftell, 
       "int"
       , [
       "pointer"
       ]);
      

           
       var fcloseptr 
       = 
       new NativeFunction(addr_fclose, 
       "int"
       , [
       "pointer"
       ]);
      

        
      

           
       var pf 
       = 
       fopenptr(Memory.allocUtf8String(fileName), Memory.allocUtf8String(
       "rb"
       ))
      

           
       fseekptr(pf, 
       0
       , 
       2
       );
      

           
       var size 
       = 
       fseekptr(fp);
      

           
       fseekptr(pf, 
       0
       , 
       0
       );
      

           
       console.log(size)
      

           
       var databuffer 
       = 
       Memory.alloc(size);
      

           
       freadptr(databuffer, 
       1
       , size, pf);
      

           
       console.log(databuffer.readByteArray(size))
      

           
       fcloseptr(
       file
       );
      

       }
      

       var fileName 
       = 
       "/sdcard/test.txt"
      

       readFile_2(fileName);
      

0x04 总结

理论上Java层和so层都可以实现文件的读写操作，但是在不同的Android系统上总是会遇到不同的问题，Java层无法使用的情况居多，大部分版本中so层的脚本都是能够解决的。

更多【使用 frida 实现 Android 本地文件读写】相关视频教程：www.yxfzedu.com

使用 frida 实现 Android 本地文件读写

0x01 前言

0x02 frida 写文件

0x03、frida 读文件

0x04 总结

相关文章推荐

友情链接

课程目录

技术交流QQ群