function trace(tag) { Log.e((tag || '') + Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Throwable').$new())) } class Log { static TAG = '[GMS]' static Debug = false static format(...msg) { let m = [] for (let i = 0; i < msg.length; i++) { if (typeof msg[i] === 'object') { m.push(msg[i] + '') } else { m.push(msg[i]) } } m = m.join(' ') return m } static i(...msg) { if (!this.Debug) return console.log(`\x1b[30m${this.TAG} ${this.format(...msg)}\x1b[0m`) } static w(...msg) { console.log(`\x1b[33m${this.TAG} ${this.format(...msg)}\x1b[0m`) } static e(...msg) { console.log(`\x1b[31m${this.TAG} ${this.format(...msg)}\x1b[0m`) } static s(...msg) { console.log(`\x1b[32m${this.TAG} ${this.format(...msg)}\x1b[0m`) } } Java.perform(function () { const System = Java.use('java.lang.System') // System.load.overload('java.lang.String').implementation = function (library) { // Log.e('Loading library:', library) // return this.load(library) // } // System.loadLibrary.overload('java.lang.String').implementation = function (library) { // Log.e('Loading library1:', library) // return this.loadLibrary(library) // } // 定位 __system_property_read_callback 函数地址 // 假设我们已经 hook 了 __system_property_read_callback,并获得参数 args[0] 为 pi // Interceptor.attach(Module.findExportByName(null, '__system_property_read_callback'), { // onEnter: function (args) { // var pi = args[0] // console.log('-------------------------') // console.log('prop_info 地址: ' + pi) // // 读取 serial(4 字节) // var serial = Memory.readU32(pi) // console.log('serial: ' + serial) // // 定义 offset 值,PROP_VALUE_MAX 一般为 92 // var PROP_VALUE_MAX = 92 // // 读取 name,name 在 union 后,即 pi + 4 + PROP_VALUE_MAX // var namePtr = pi.add(4 + PROP_VALUE_MAX) // var nameStr = Memory.readCString(namePtr) // console.log('name: ' + nameStr) // var valueStr = '' // // 判断是否为 long 属性(is_long() 判断逻辑) // if ((serial & (1 << 16)) !== 0) { // // long 属性: offset 存在于 union.long_property.offset, // // offset 地址 = pi + 4 (union 开始) + 56(error_message 长度) // var offset = Memory.readU32(pi.add(4 + 56)) // var longValuePtr = pi.add(offset) // console.log('long_property.offset: ' + offset) // try { // valueStr = Memory.readCString(longValuePtr) // } catch (e) { // valueStr = '读取 long_value 出错: ' + e // } // } else { // // 非 long 属性,值直接存储在 union.value 中,起始于 pi + 4 // try { // valueStr = Memory.readCString(pi.add(4)) // } catch (e) { // valueStr = '读取 inline value 出错: ' + e // } // } // console.log('value: ' + valueStr) // } // }) const SIOCGIFHWADDR = 0x8927 // Interceptor.attach(Module.findExportByName(null, 'open'), { // onEnter: function (args) { // var path = Memory.readCString(args[0]) // Log.e('fopen', path) // }, // onLeave: function (retval) { // } // }) // // var libart = Process.getModuleByName('libart.so') // const NetworkInterface = Java.use('java.net.NetworkInterface') // NetworkInterface.getNetworkInterfaces.implementation = function () { // Log.e('getNetworkInterfaces') // return this.getNetworkInterfaces() // } const File = Java.use('java.io.File') const BufferedReader = Java.use('java.io.BufferedReader') const FileInputStream = Java.use('java.io.FileInputStream') const FileOutputStream = Java.use('java.io.FileOutputStream') const InputStreamReader = Java.use('java.io.InputStreamReader') const OutputStreamWriter = Java.use('java.io.OutputStreamWriter') function readFile(file) { if (!file.exists()) { return null } var fileInputStream = FileInputStream.$new(file) var inputStreamReader = InputStreamReader.$new(Java.cast(fileInputStream, Java.use('java.io.InputStream'))) var bufferedReader = BufferedReader.$new(inputStreamReader) var line var content = '' while ((line = bufferedReader.readLine()) !== null) { content += line + '\n' } bufferedReader.close() inputStreamReader.close() fileInputStream.close() return content } const NetworkInterface = Java.use('java.net.NetworkInterface') NetworkInterface.getNetworkInterfaces.overload().implementation = function () { const res = this.getNetworkInterfaces() Log.e(`NetworkInterface.getNetworkInterfaces() -> ${res}`) return res } const ifs = NetworkInterface.getNetworkInterfaces() while (ifs.hasMoreElements()) { const ni = ifs.nextElement() Log.e(`NetworkInterface: ${ni}`) const name = ni.getClass() Log.e(`NetworkInterface.getName() -> ${name}`) } })