whatsapp 相关(六) -frida hook file

夏沫琅琊2024-01-30 11:05

whatsapp 相关(六) -frida hook file

本文主要讲述下frida 下对文件的监听. 从而可以明确的获取到相关的文件存储路径等.

1: 脚本

代码如下:

js 复制代码 
Java.perform(function() {
  var File = Java.use("java.io.File");
  var FileInputStream = Java.use("java.io.FileInputStream");
  var FileOutputStream = Java.use("java.io.FileOutputStream");

    // Hook File类的构造函数
    File.$init.overload('java.lang.String').implementation = function (path) {
      console.log("文件路径：" + path);
      // 调用原始的构造函数
      this.$init(path);
    };
  // 监听文件的读取操作
  FileInputStream.read.overload('[B').implementation = function(buffer) {
    var result = this.read(buffer);
    console.log("File read: " + buffer.length + " bytes");
    return result;
  };

  // 监听文件的写入操作
  FileOutputStream.write.overload('[B').implementation = function(buffer) {
    console.log("File write: " + buffer.length + " bytes");
    return this.write(buffer);
  };

  // 监听文件的创建操作
  File.createNewFile.implementation = function() {
    console.log("File created: " + this.getAbsolutePath());
    return this.createNewFile();
  };

  // 监听文件的删除操作
  File.delete.implementation = function() {
    console.log("File deleted: " + this.getAbsolutePath());
    return this.delete();
  };
});

2: 测试

我们还已whatsapp为例.

shell 复制代码 
frida -U -f com.whatsapp -l /home/zh/workSpace/test/Xpose/app/src/main/java/com/zh/xpose/js/file.js

     ____
    / _  |   Frida 16.0.2 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to LEX820 (id=6b4a96b2)
Spawned `com.whatsapp`. Resuming main thread!

file 的create与delete操作频繁, 我们来测试发送多媒体消息为例:

  1. 点击表情-加载gif ,可以看到控制台输出如下:

    shell 复制代码 
    文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/5d8ff0ffa4fb72c36b1a7674de1940a9.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/5d8ff0ffa4fb72c36b1a7674de1940a9.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6b4d76fec710b0e88e1d5c6072905712.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6b4d76fec710b0e88e1d5c6072905712.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6bf2d6d0123e4a8e1221590d3ed3653f.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6bf2d6d0123e4a8e1221590d3ed3653f.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bffa199d5eab481d05d52a466fdfb10c.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bffa199d5eab481d05d52a466fdfb10c.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/5d8ff0ffa4fb72c36b1a7674de1940a9.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6b4d76fec710b0e88e1d5c6072905712.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6bf2d6d0123e4a8e1221590d3ed3653f.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bffa199d5eab481d05d52a466fdfb10c.gif

    可以看到,当我们加载完gif的请求接口后, 会将所有的gif缓存下来.

  2. 发送对应的gif后:

    shell 复制代码 
    文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bb01ee5d786c0005d5661fb48515ceca.gif
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
File deleted: /data/user/0/com.whatsapp/shared_prefs/time_spent_logging_prefs.xml.bak
File created: /storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/9c3b7e6d-707e-4aa4-8a5d-e9efd875f343
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/9c3b7e6d-707e-4aa4-8a5d-e9efd875f343
文件路径：/storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/9c3b7e6d-707e-4aa4-8a5d-e9efd875f343
File created: /storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/6579b4e1-31aa-4594-a086-f9b908b80298
File deleted: /storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/6579b4e1-31aa-4594-a086-f9b908b80298
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/129f22f2-f580-4123-babf-d99a796f2870
File write: 345 bytes
File deleted: /data/user/0/com.whatsapp/files/network_statistics.json
File deleted: /data/user/0/com.whatsapp/shared_prefs/com.whatsapp_preferences_light.xml.bak

    可以看到点击gif后, 在图片预览页面, whatsapp 将图片切换成了mp4文件.

    点击发送按钮:

    shell 复制代码 
    File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/2e7909f3-2262-4a93-97cc-4512f6f3b4b9
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/2e7909f3-2262-4a93-97cc-4512f6f3b4b9
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/2e7909f3-2262-4a93-97cc-4512f6f3b4b9
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/cc8c524c-30b9-4925-b3f9-3a44cdda4530
File deleted: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/cc8c524c-30b9-4925-b3f9-3a44cdda4530
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
File deleted: /data/user/0/com.whatsapp/files/crash_in_video_sentinel
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
File deleted: /storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/proc/self
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/storage/emulated/0
文件路径：/storage/emulated/0
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
File deleted: /data/user/0/com.whatsapp/shared_prefs/com.whatsapp_preferences.xml.bak
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
File deleted: /data/user/0/com.whatsapp/shared_prefs/media_engagement_daily_preferences_v1.xml.bak
File deleted: /data/user/0/com.whatsapp/shared_prefs/media_daily_usage_preferences_v1.xml.bak
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
File deleted: /data/user/0/com.whatsapp/shared_prefs/route_selector_prefs.xml.bak
File deleted: /data/user/0/com.whatsapp/shared_prefs/time_spent_logging_prefs.xml.bak
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/a64db587-2f7c-4030-8d9e-2d12abf222bb
File write: 549 bytes
File deleted: /data/user/0/com.whatsapp/files/statistics.json
File deleted: /data/user/0/com.whatsapp/files/statistics
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/6192ed6e-70d1-4c47-846b-161ab6f9eb18
File write: 345 bytes
File deleted: /data/user/0/com.whatsapp/files/network_statistics.json
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4

    最终whatsapp自带的gif图片,在发送成功后,文件存储在了

    java 复制代码 
    /storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent
相关推荐
AI2中文网1 小时前
安卓 15/16 手机软键盘遮挡输入框、布局顶不上去？已解决：重新编译即可
android·智能手机
吴凡wudianmei1 小时前
从 0 搭一个 AI Agent（四）：SSE 跑通之后，三处“契约错配”与它们的修复边界
前端·后端·aigc
不可能片场1 小时前
Electron 发布 别拿 load 事件当页面就绪
前端·electron
字节暗面1 小时前
Android APP 加固横评记录：爱加密、梆梆、网易易盾与腾讯 ACE
android·逆向工程·加固
paopaokaka_luck2 小时前
灾害应急物资管理系统（AI应急助手、Echarts可视化数据看板、捐赠入库联动、 物资全流程管理、库存变动追溯、灾情资讯与互动反馈、物资发放公示）
java·前端·javascript·spring boot·mysql·tomcat·echarts
kyriewen2 小时前
我验了 7 种 sticky 失效说法：3 种根本不成立
前端·javascript·程序员
程序边界2 小时前
一台数据集成软件的拆解笔记（下）：一致性、容错、跑批与迁移，KFS 真正难的地方在这
java·前端·笔记
健康活着就好2 小时前
# 前端图片优化实战，首屏加载提速60%
前端
落魄Android在线炒饭2 小时前
Android 实战问题反推 OpenGL 概念（上）
android·opengl
booboosui2 小时前
DeepSeek 的 Worker 调得动 GitHub，调不动微信：三类 Worker 的实现差别
android
热门推荐
01国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）02历年考研数学一、数学二、数学三真题试卷及答案PDF03GitHub 镜像站点04几个好用的ip纯净度检测网站05苹果iPA游戏软件资源下载网站06如何新建文件夹？ 电脑新建文件夹的4种方法07蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接08昇腾910B系列芯片完全指南：四款型号对比、服务器选型与大模型部署实战09Dify：一站式AI应用开发平台全解析与Windows部署指南10Android 屏幕适配系列开篇：核心概念、官方机制与主流方案