frida_api_check.py
1.23 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
import sys, time, subprocess
sys.path.insert(0, '/Users/yibo/Library/Python/3.9/lib/python/site-packages')
import frida
pid = int(subprocess.run(['pgrep','-x','WeChat'], capture_output=True, text=True).stdout.strip().split('\n')[0])
JS = """
// Check what Module API looks like in this Frida version
send({type:'info',
findExportByName: typeof Module.findExportByName,
getExportByName: typeof Module.getExportByName,
load: typeof Module.load,
keys: Object.getOwnPropertyNames(Module).join(',')
});
// Try enumerateModules approach instead
var found = null;
try {
Process.enumerateModules().forEach(function(m) {
if (found) return;
try {
var e = m.findExportByName('CCCryptorCreate');
if (e) found = e.toString();
} catch(x) {}
});
send({type:'result', found: found});
} catch(e) {
send({type:'result', err: e.toString()});
}
"""
session = frida.attach(pid)
script = session.create_script(JS)
def on_msg(msg, data):
if msg['type'] == 'error':
print(f'ERR: {msg["description"]} @ line {msg["lineNumber"]}')
else:
print(f'OK: {msg["payload"]}')
script.on('message', on_msg)
script.load()
time.sleep(3)
session.detach()