frida_minimal.py
1.42 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
import sys, time, subprocess
sys.path.insert(0, '/Users/yibo/Library/Python/3.9/lib/python/site-packages')
import frida
pid = int(subprocess.run(['pgrep','-x','WeChat'], capture_output=True, text=True).stdout.strip().split('\n')[0])
print(f'PID={pid}')
# Step 1: bare minimum - just send a message
JS = """
send({type:'step', n:1, msg:'JS loaded'});
var addr = Module.findExportByName(null, 'CCCryptorCreate');
send({type:'step', n:2, msg:'findExportByName done', addr: addr ? addr.toString() : 'null'});
if (addr) {
try {
Interceptor.attach(addr, {
onEnter: function(args) {
try {
send({type:'step', n:3, msg:'hook fired',
arg1: args[1].toInt32(),
arg4: args[4].toInt32()});
} catch(e) {
send({type:'step', n:3, msg:'hook error: ' + e.toString()});
}
}
});
send({type:'step', n:4, msg:'Interceptor.attach OK'});
} catch(e) {
send({type:'step', n:4, msg:'Interceptor.attach FAILED: ' + e.toString()});
}
}
"""
session = frida.attach(pid)
script = session.create_script(JS)
def on_msg(msg, data):
if msg['type'] == 'error':
print(f'[ERR] {msg}')
elif msg['type'] == 'send':
print(f'[OK] {msg["payload"]}')
script.on('message', on_msg)
script.load()
print('loaded, waiting 5s...')
time.sleep(5)
session.detach()