一.什么是frida rpc

rpc就是通过hook进行远程过程调用, 在启动app后, 自动调取so函数, 能够轻松的获取到加密的结果，对去分析那些复杂的so层函数省了很大的功夫.

二.frida  rpc调用wtoken

包名：com.****.ceair（以9.4.15版本为例）

通过查看调用栈，我们可以快速的找到wtoken参数生成的位置，通过frida hook跟栈，我们发现wtoken由com.xxx.xxxx.t.B.xxx方法生成

frida支持rpc，直接把这个方法开出来:rpc.js

var result;

function wtoken(str_data, data_length) {
        Java.perform(function () {
        var bCls = Java.use("com.xxxxxxx.x")
        var ByteString = Java.use("com.xxxxxx");
        bCls.xxxx.implementation = function (i, bArr) {
            var result = this.xxxx(i, bArr)
            return result
        }
    });
    return result
}

rpc.exports  = {
    wtoken: wtoken
};

在通过frida进行启动

import os

import frida


def on_message(message, payload):
    message_type = message['type']
    if message_type == 'send':
        print('[* message]', message['payload'])

    elif message_type == 'error':
        stack = message['stack']
        print('[* error]', stack)

    else:
        print(message)


js_code = open("rpc.js", "r", encoding="utf-8").read()
session = frida.get_usb_device().attach("com.xxxxx")
script = session.create_script(js_code)
script.on("message", on_message)
script.load()


def get_wtoken(arg1,arg2):
    res = script.exports.wtoken(arg1,arg2)
    print(res)
    return res
get_wtoken()

运行流程

1.启动app 
2.启动frida-server 
3.端口转发 
4.运行脚本

三.写成接口形式以供调用

import os
import frida
from fastapi import FastAPI
import uvicorn


def on_message(message, payload):
    message_type = message['type']
    if message_type == 'send':
        print('[* message]', message['payload'])

    elif message_type == 'error':
        stack = message['stack']
        print('[* error]', stack)

    else:
        print(message)


js_code = open("rpc_test.js", "r", encoding="utf-8").read()
session = frida.get_usb_device().attach("com.xxx.xxxx")
script = session.create_script(js_code)
script.on("message", on_message)
script.load()


def get_wtoken(arg1,query):
    res = script.exports.wtoken(arg1, query)
    print(res)
    return res


app = FastAPI()


@app.get("/get_wtoken")
def get_oppO_sign(arg1,query):
    print(query)
    sign_str = get_wtoken(arg1,quer)
    dic = {}
    dic["wtoken"] = sign_str
    return dic


if __name__ == '__main__':
    uvicorn.run(app=app)