[iOS] frida hooking

class 추출

frida -U -l classes.js PID

classes.js

for (var className in ObjC.classes) {
    if (ObjC.classes.hasOwnProperty(className)) {
        console.log(className);
    }
}

method 추출

frida -U -l methodofclass.js PID

methodofclass.js

console.log("[*] Started: Find All Methods of a Specific Class");
if (ObjC.available) {
    try {
        var className = "JailbreakDetectionVC";
        var methods = eval('ObjC.classes.' + className + '.$methods');
        for (var i = 0; i < methods.length; i++) {
            try {
                console.log("[-] " + methods[i]);
            } catch (err) {
                console.log(" [!] Exception1: " + err.message);
            }
        }
    } catch (err) {
        console.log(" [!] Exception2: " + err.message);
    }
} else {
    console.log(" Objective-C Runtime is not available!");
}
console.log("[*] Completed: Find All Methods of a Specific Class");

return 값 확인

returnvalue.js

if (ObjC.available) { 
    try {
        var className = "ANSMetadata"; 
        var funcName = "- isJailbroken"; 
        var funcName2 = "- computeIsJailbroken"
        var hook = eval('ObjC.classes.' + className + '["' + funcName + '"]');
        var hook2 = eval('ObjC.classes.' + className + '["' + funcName2 + '"]');
//        console.log("ho");
        Interceptor.attach(hook.implementation, { 
//            onEnter: function(args) {
//                console.log("starrrrr");
//            }
//        } );
            onLeave: function(retval) { console.log("[*] Class Name: " + className);
            console.log("[*] Method Name: " + funcName); 
            console.log("\t[-] Type of return value: " + typeof retval);
            console.log("\t[-] Return Value: " + retval); } }); 

        Interceptor.attach(hook2.implementation, { 
            //            onEnter: function(args) {
            //                console.log("starrrrr");
            //            }
            //        } );
                        onLeave: function(retval2) { console.log("[*] Class Name: " + className);
                        console.log("[*] Method Name: " + funcName2); 
                        console.log("\t[-] Type of return value: " + typeof retval2);
                        console.log("\t[-] Return Value: " + retval2); } });
    } 
    catch(err) { console.log("[!] Exception2: " + err.message); } 
}  
else { console.log("Objective-C Runtime is not available!"); }

return 값 변조

if (ObjC.available) { 

try { 
var className = "ANSMetadata"; 
var funcName = "- isJailbroken";
var funcName2 = "- computeIsJailbroken";  
var hook = eval('ObjC.classes.' + className + '["' + funcName + '"]');
var hook2 = eval('ObjC.classes.' + className + '["' + funcName2 + '"]');

Interceptor.attach(hook2.implementation, {
    onEnter: function(args2){
        //onEnter는 후킹함수 진입 시 실행되며, args[0]에는 self객체가
        //args[1]에는 selector객체가 들어있어 접근 가능하며
        //args[2]에는 해당 함수의 매개변수들이 들어있다.
        //매개변수를 변경하고 싶다면 이곳에서 변경한다.
        console.log(args2[0]);
        console.log(args2[1]);
        console.log(args2[2]);
        console.log(args2[3]);
    } ,
    onLeave: function(retval2) { 
    console.log("[*] Class Name: " + className); 
    console.log("[*] Method Name: " + funcName2); 
    console.log("\t[-] Type of return value: " + typeof retval2); 
    console.log("\t[-] Original Return Value: " + retval2); 
    var newretval2 = ptr("0") 
    retval2.replace(newretval2) 
    console.log("\t[-] New Return Value: " + newretval2) } });

Interceptor.attach(hook.implementation, { 
    onEnter: function(args1){
        console.log(args1[0]);
        console.log(args1[1]);
        console.log(args1[2]);
    } ,
    onLeave: function(v1) { 
        console.log("[*] Class Name: " + className);
        console.log("[*] Method Name: " + funcName);
        console.log("\t[-] Type of return value: " + typeof(v1));
        console.log("\t[-] Original Return Value: " + v1);
        var newretval = ptr("0");
        v1.replace(newretval);
        console.log("\t[-] New Return Value: " + newretval);
    } });
} 

catch(err) { console.log("[!] Exception2: " + err.message); } } 

else { console.log("Objective-C Runtime is not available!"); }

js 후킹코드 실행 방법

λ frida -U -f 앱패키지명 -l C:\Users\chaem_handlers____ANSMetadata_isJailbroken.js

frida-trace 사용

앱패키지명을 이용한 방법 : frida-trace -U -f 앱패키지명 -i *

PID를 이용한 방법 : frida-trace -U -i "*Crypto*" PID

open하는 클래스 추출

frida-trace -U -f 앱패키지명 -i “open*”

init으로 시작하는 클래스 추출

λ frida-trace -U -i “init*” PID

handler 생성

λ frida-trace.exe -U -i “*” -p 5907

λ frida-trace -U net.cross-dev.sbikabu2sp-stg -m “*[ANSMetadata isJailbroken]” -p 5624
Waiting for USB device to appear… Instrumenting functions… -[ANSMetadata isJailbroken]: Loaded handler at “C:\Users\chaem_handlers____ANSMetadata_isJailbroken.js” Started tracing 1 function. Press Ctrl+C to stop.