|
|
@@ -36,39 +36,20 @@ setImmediate(() => {
|
|
|
console.log(`\x1b[30m[system_server] ${msg}\x1b[0m`)
|
|
|
Log.d('frida-system_server', msg + '')
|
|
|
}
|
|
|
- log(Java.classFactory.loader)
|
|
|
-
|
|
|
- Java.enumerateClassLoadersSync().forEach((loader) => {
|
|
|
- log(loader)
|
|
|
+ const classLoaders = Java.enumerateClassLoadersSync()
|
|
|
+ classLoaders.forEach((classLoader) => {
|
|
|
+ log(classLoader)
|
|
|
})
|
|
|
-
|
|
|
- // const SystemServiceManager = Java.use('com.android.server.SystemServiceManager')
|
|
|
- // log(SystemServiceManager.class.getClassLoader())
|
|
|
- // const SystemServerClassLoaderFactory = Java.use('com.android.internal.os.SystemServerClassLoaderFactory')
|
|
|
- // const classLoader = SystemServerClassLoaderFactory.getOrCreateClassLoader(
|
|
|
- // '/apex/com.android.wifi/javalib/service-wifi.jar',
|
|
|
- // SystemServiceManager.class.getClassLoader(),
|
|
|
- // false
|
|
|
- // )
|
|
|
- // log(classLoader)
|
|
|
- // Java.classFactory.loader = classLoader
|
|
|
- // // Java.enumerateLoadedClasses({
|
|
|
- // // onMatch: function (className) {
|
|
|
- // // if (className == 'com.android.server.wifi.WifiServiceImpl') {
|
|
|
- // // const WifiService = Java.use('com.android.server.wifi.WifiService')
|
|
|
- // // }
|
|
|
- // // },
|
|
|
- // // onComplete: function () {
|
|
|
- // // console.log('枚举结束')
|
|
|
- // // }
|
|
|
- // // })
|
|
|
- // const WifiServiceImpl = Java.use('com.android.server.wifi.WifiServiceImpl')
|
|
|
- // log(WifiServiceImpl)
|
|
|
- // WifiServiceImpl.getFactoryMacAddresses.overload().implementation = function () {
|
|
|
- // const original = this.getFactoryMacAddresses()
|
|
|
- // const spoof = ['00:00:00:00:00:00']
|
|
|
- // log(`WifiServiceImpl.getFactoryMacAddresses() called, returning: ${spoof}, original: ${original}`)
|
|
|
- // return spoof
|
|
|
- // }
|
|
|
+ const wifiClassLoader = classLoaders.find((i) => i.toString().includes('wifi'))
|
|
|
+ Java.classFactory.loader = wifiClassLoader
|
|
|
+ const WifiServiceImpl = Java.use('com.android.server.wifi.WifiServiceImpl')
|
|
|
+ log(WifiServiceImpl)
|
|
|
+ WifiServiceImpl.getFactoryMacAddresses.overload().implementation = function () {
|
|
|
+ const original = this.getFactoryMacAddresses()
|
|
|
+ const spoof = ['00:00:00:00:00:00']
|
|
|
+ log(`WifiServiceImpl.getFactoryMacAddresses() called, returning: ${spoof}, original: ${original}`)
|
|
|
+ return spoof
|
|
|
+ }
|
|
|
+ WifiServiceImpl.getConnectionInfo.overload('int').implementation = function (arg) {}
|
|
|
})
|
|
|
})
|
