debug_provider.js
5.21 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
// Frida script to debug WeChat ContentProvider
// Hook ExtControlProviderMsg and ExtContentProviderBase to understand why query/insert return null
Java.perform(function() {
var TAG = "HermesProvider";
function logMethodCalls(clsName) {
try {
var cls = Java.use(clsName);
var methods = cls.class.getDeclaredMethods();
methods.forEach(function(m) {
var sig = m.getName() + "(" + m.getParameterTypes().map(function(p) { return p.getName(); }).join(", ") + ")";
console.log("[Provider] " + clsName + " method: " + sig);
});
} catch(e) {
console.log("[Provider] Cannot list methods for " + clsName + ": " + e);
}
}
// Hook ExtContentProviderBase methods
try {
var base = Java.use("com.tencent.mm.plugin.ext.provider.ExtContentProviderBase");
base.h.implementation = function() {
var ret = this.h();
console.log("[Provider] ExtContentProviderBase.h() -> " + ret);
return 1;
};
base.b.implementation = function() {
var ret = this.b();
console.log("[Provider] ExtContentProviderBase.b() -> " + ret);
return true;
};
try {
base.i.overload("android.content.Context").implementation = function(ctx) {
var ret = this.i(ctx);
console.log("[Provider] ExtContentProviderBase.i(ctx) -> " + ret);
return true;
};
} catch(e) {}
console.log("[Provider] ExtContentProviderBase hooks installed");
} catch(e) {
console.log("[Provider] ExtContentProviderBase hook failed: " + e);
}
// Hook ExtControlProviderMsg
try {
var msgProvider = Java.use("com.tencent.mm.plugin.ext.provider.ExtControlProviderMsg");
msgProvider.query.overload("android.net.Uri", "[Ljava.lang.String;", "java.lang.String", "[Ljava.lang.String;", "java.lang.String").implementation = function(uri, projection, selection, selectionArgs, sortOrder) {
console.log("[Provider] query called:");
console.log(" uri=" + uri);
console.log(" projection=" + (projection ? projection.join(",") : "null"));
console.log(" selection=" + selection);
console.log(" selectionArgs=" + (selectionArgs ? selectionArgs.join(",") : "null"));
console.log(" sortOrder=" + sortOrder);
var ret = this.query(uri, projection, selection, selectionArgs, sortOrder);
console.log("[Provider] query returned: " + ret);
return ret;
};
msgProvider.insert.overload("android.net.Uri", "android.content.ContentValues").implementation = function(uri, values) {
console.log("[Provider] insert called:");
console.log(" uri=" + uri);
console.log(" values=" + values);
if (values) {
var keys = values.keySet().toArray();
for (var i = 0; i < keys.length; i++) {
var k = keys[i];
var v = values.get(k);
console.log(" " + k + "=" + v);
}
}
var ret = this.insert(uri, values);
console.log("[Provider] insert returned: " + ret);
return ret;
};
msgProvider.call.overload("java.lang.String", "java.lang.String", "android.os.Bundle").implementation = function(method, arg, extras) {
console.log("[Provider] call called: method=" + method + " arg=" + arg + " extras=" + extras);
var ret = this.call(method, arg, extras);
console.log("[Provider] call returned: " + ret);
return ret;
};
console.log("[Provider] ExtControlProviderMsg hooks installed");
} catch(e) {
console.log("[Provider] ExtControlProviderMsg hook failed: " + e);
}
// Also hook all ContentProvider query/insert methods to catch any provider
try {
var ContentProvider = Java.use("android.content.ContentProvider");
ContentProvider.query.overload("android.net.Uri", "[Ljava.lang.String;", "java.lang.String", "[Ljava.lang.String;", "java.lang.String").implementation = function(uri, projection, selection, selectionArgs, sortOrder) {
var uriStr = uri ? uri.toString() : "null";
if (uriStr.indexOf("ext") !== -1 || uriStr.indexOf("tencent.mm") !== -1) {
console.log("[Provider] ANY query: uri=" + uriStr);
}
return this.query(uri, projection, selection, selectionArgs, sortOrder);
};
ContentProvider.insert.overload("android.net.Uri", "android.content.ContentValues").implementation = function(uri, values) {
var uriStr = uri ? uri.toString() : "null";
if (uriStr.indexOf("ext") !== -1 || uriStr.indexOf("tencent.mm") !== -1) {
console.log("[Provider] ANY insert: uri=" + uriStr);
}
return this.insert(uri, values);
};
console.log("[Provider] Global ContentProvider hooks installed");
} catch(e) {
console.log("[Provider] Global hook failed: " + e);
}
console.log("[Provider] Script loaded. Send a message to trigger provider calls.");
});