whatsapp 相关(六) -frida hook file

夏沫琅琊2024-01-30 11:05

whatsapp 相关(六) -frida hook file

本文主要讲述下frida 下对文件的监听. 从而可以明确的获取到相关的文件存储路径等.

1: 脚本

代码如下:

js 复制代码 
Java.perform(function() {
  var File = Java.use("java.io.File");
  var FileInputStream = Java.use("java.io.FileInputStream");
  var FileOutputStream = Java.use("java.io.FileOutputStream");

    // Hook File类的构造函数
    File.$init.overload('java.lang.String').implementation = function (path) {
      console.log("文件路径：" + path);
      // 调用原始的构造函数
      this.$init(path);
    };
  // 监听文件的读取操作
  FileInputStream.read.overload('[B').implementation = function(buffer) {
    var result = this.read(buffer);
    console.log("File read: " + buffer.length + " bytes");
    return result;
  };

  // 监听文件的写入操作
  FileOutputStream.write.overload('[B').implementation = function(buffer) {
    console.log("File write: " + buffer.length + " bytes");
    return this.write(buffer);
  };

  // 监听文件的创建操作
  File.createNewFile.implementation = function() {
    console.log("File created: " + this.getAbsolutePath());
    return this.createNewFile();
  };

  // 监听文件的删除操作
  File.delete.implementation = function() {
    console.log("File deleted: " + this.getAbsolutePath());
    return this.delete();
  };
});

2: 测试

我们还已whatsapp为例.

shell 复制代码 
frida -U -f com.whatsapp -l /home/zh/workSpace/test/Xpose/app/src/main/java/com/zh/xpose/js/file.js

     ____
    / _  |   Frida 16.0.2 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to LEX820 (id=6b4a96b2)
Spawned `com.whatsapp`. Resuming main thread!

file 的create与delete操作频繁, 我们来测试发送多媒体消息为例:

  1. 点击表情-加载gif ,可以看到控制台输出如下:

    shell 复制代码 
    文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/5d8ff0ffa4fb72c36b1a7674de1940a9.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/5d8ff0ffa4fb72c36b1a7674de1940a9.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6b4d76fec710b0e88e1d5c6072905712.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6b4d76fec710b0e88e1d5c6072905712.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6bf2d6d0123e4a8e1221590d3ed3653f.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6bf2d6d0123e4a8e1221590d3ed3653f.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bffa199d5eab481d05d52a466fdfb10c.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bffa199d5eab481d05d52a466fdfb10c.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/5d8ff0ffa4fb72c36b1a7674de1940a9.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6b4d76fec710b0e88e1d5c6072905712.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/6bf2d6d0123e4a8e1221590d3ed3653f.gif
文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bffa199d5eab481d05d52a466fdfb10c.gif

    可以看到,当我们加载完gif的请求接口后, 会将所有的gif缓存下来.

  2. 发送对应的gif后:

    shell 复制代码 
    文件路径：/storage/emulated/0/Android/data/com.whatsapp/cache/gif/gif_preview_cache/bb01ee5d786c0005d5661fb48515ceca.gif
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
File deleted: /data/user/0/com.whatsapp/shared_prefs/time_spent_logging_prefs.xml.bak
File created: /storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/9c3b7e6d-707e-4aa4-8a5d-e9efd875f343
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/9c3b7e6d-707e-4aa4-8a5d-e9efd875f343
文件路径：/storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/9c3b7e6d-707e-4aa4-8a5d-e9efd875f343
File created: /storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/6579b4e1-31aa-4594-a086-f9b908b80298
File deleted: /storage/emulated/0/WhatsApp/.trash/e9bde8e1-89a3-4314-9718-e59f844b415d/6579b4e1-31aa-4594-a086-f9b908b80298
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/129f22f2-f580-4123-babf-d99a796f2870
File write: 345 bytes
File deleted: /data/user/0/com.whatsapp/files/network_statistics.json
File deleted: /data/user/0/com.whatsapp/shared_prefs/com.whatsapp_preferences_light.xml.bak

    可以看到点击gif后, 在图片预览页面, whatsapp 将图片切换成了mp4文件.

    点击发送按钮:

    shell 复制代码 
    File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/917f730d-76b5-4d98-92ee-12f7e81cb25e
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/2e7909f3-2262-4a93-97cc-4512f6f3b4b9
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/2e7909f3-2262-4a93-97cc-4512f6f3b4b9
文件路径：/data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/2e7909f3-2262-4a93-97cc-4512f6f3b4b9
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/cc8c524c-30b9-4925-b3f9-3a44cdda4530
File deleted: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/cc8c524c-30b9-4925-b3f9-3a44cdda4530
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
File deleted: /data/user/0/com.whatsapp/files/crash_in_video_sentinel
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
File deleted: /storage/emulated/0/WhatsApp/.Shared/94582489004f488d8dbb701d2f0712e3.mp4
文件路径：/proc/self
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/storage/emulated/0
文件路径：/storage/emulated/0
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/data/user/0/com.whatsapp/files/.Shared/afed8b7b-e3ae-489e-9079-b3554f36d6dc.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
File deleted: /data/user/0/com.whatsapp/shared_prefs/com.whatsapp_preferences.xml.bak
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
File deleted: /data/user/0/com.whatsapp/shared_prefs/media_engagement_daily_preferences_v1.xml.bak
File deleted: /data/user/0/com.whatsapp/shared_prefs/media_daily_usage_preferences_v1.xml.bak
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0033.mp4
File deleted: /data/user/0/com.whatsapp/shared_prefs/route_selector_prefs.xml.bak
File deleted: /data/user/0/com.whatsapp/shared_prefs/time_spent_logging_prefs.xml.bak
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/a64db587-2f7c-4030-8d9e-2d12abf222bb
File write: 549 bytes
File deleted: /data/user/0/com.whatsapp/files/statistics.json
File deleted: /data/user/0/com.whatsapp/files/statistics
File created: /data/user/0/com.whatsapp/files/.trash/c6748b26-9a9a-4e13-9bbc-9cf935339b74/6192ed6e-70d1-4c47-846b-161ab6f9eb18
File write: 345 bytes
File deleted: /data/user/0/com.whatsapp/files/network_statistics.json
文件路径：/storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent/VID-20240129-WA0034.mp4

    最终whatsapp自带的gif图片,在发送成功后,文件存储在了

    java 复制代码 
    /storage/emulated/0/WhatsApp/Media/WhatsApp Animated Gifs/Sent
相关推荐
霍先生的虚拟宇宙网络23 分钟前
webp 网页如何录屏？
开发语言·前端·javascript
温吞-ing25 分钟前
第十章JavaScript的应用
开发语言·javascript·ecmascript
彪82526 分钟前
第十章 JavaScript的应用 习题
javascript·css·ecmascript·html5
jessezappy43 分钟前
jQuery-Word-Export 使用记录及完整修正文件下载 jquery.wordexport.js
前端·word·jquery·filesaver·word-export
旧林8431 小时前
第八章 利用CSS制作导航菜单
前端·css
yngsqq1 小时前
c#使用高版本8.0步骤
java·前端·c#
Myli_ing2 小时前
考研倒计时-配色+1
前端·javascript·考研
大白要努力！2 小时前
Android opencv使用Core.hconcat 进行图像拼接
android·opencv
余道各努力，千里自同风2 小时前
前端 vue 如何区分开发环境
前端·javascript·vue.js
PandaCave2 小时前
vue工程运行、构建、引用环境参数学习记录
javascript·vue.js·学习
热门推荐
01(欧拉)openEuler系统添加网卡文件配置流程、(欧拉)openEuler系统手动配置ipv6地址流程、(欧拉)openEuler系统网络管理说明02PyTorch机器学习实现液态神经网络03【HarmonyOS】HUAWEI DevEco Studio 下载地址汇总04玄机平台应急响应—webshell查杀05Coze扣子平台完整体验和实践（附国内和国际版对比）06Ubuntu 20.04使用Livox mid 360 测试 FAST_LIO07怎样让音频速度变慢？请跟随以下方法进行操作08Unity中PICO实现 隔空取物 和 接触抓取物体09RAG 实践- Ollama+RagFlow 部署本地知识库10【目标跟踪】相机运动补偿