frida hook android system_server报告错误:应为指针

Question

我正在尝试挂接linux上的android11 system_server。frida版本是14.2.13。

脚本如下：

Java.perform(function () {
    var clazz = Java.use("com.android.server.policy.PhoneWindowManager")
    var func = "powerPress"
    console.log(func)
    clazz[func].implementation = function (arg1,arg2,arg3) {
        console.log("Enter " + func + " " + arg1,arg2,arg3)
        this[func](arg1,arg2,arg3)
    }
  }
)

启动frida的命令：

$ frida -U -l script.js -p $(adb shell pidof system_server)
     ____
    / _  |   Frida 14.2.13 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://www.frida.re/docs/home/
Attaching...                                                            
powerPress
Error: expected a pointer
    at value (frida/runtime/core.js:170)
    at yt (frida/node_modules/frida-java-bridge/lib/android.js:889)
    at activate (frida/node_modules/frida-java-bridge/lib/android.js:970)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/android.js:745)
    at forEach (native)
    at St (frida/node_modules/frida-java-bridge/lib/android.js:746)
    at Et (frida/node_modules/frida-java-bridge/lib/android.js:737)
    at vt (frida/node_modules/frida-java-bridge/lib/android.js:696)
    at replace (frida/node_modules/frida-java-bridge/lib/android.js:1021)
    at set (frida/node_modules/frida-java-bridge/lib/class-factory.js:1010)
    at set (frida/node_modules/frida-java-bridge/lib/class-factory.js:925)
    at <anonymous> (/script.js:4)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:16)
    at _performPendingVmOps (frida/node_modules/frida-java-bridge/index.js:238)
    at <anonymous> (frida/node_modules/frida-java-bridge/index.js:213)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:16)
    at _performPendingVmOpsWhenReady (frida/node_modules/frida-java-bridge/index.js:232)
    at perform (frida/node_modules/frida-java-bridge/index.js:192)
    at <eval> (/script.js:10)
[device]-> Enter powerPress 44442 true 1
Enter powerPress 46290 true 1
Enter powerPress 52580 true 1
Enter powerPress 53910 true 1

钩子看起来像是工作，但异常发生了！

Answer 1

这不是你通常挂接函数的方式。看看官方文档https://frida.re/docs/android/，试试这个。

Java.perform(function () {
    Java.Use("com.android.server.policy.PhoneWindowManager").powerPress.overload().implementation = function(arg1, arg2, arg3){
        console.log("Enter Powerpress :" + arg1,arg2,arg3);
        Java.Use("com.android.server.policy.PhoneWindowManager").powerPress.overload().call(this, arg1,arg2,arg3);
    
  }
)

假设您正在传递参数，您将需要指定每个参数的类型并将其传递给重载函数，启动脚本将显示一个错误，并将正确的函数重载复制粘贴到调用行和实现行上