frida-rcs-hack/scripts/gms.js

function trace(tag) {
    Log.e((tag || '') + Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Throwable').$new()))
}

class Log {
    static TAG = '[GMS]'
    static Debug = false
    static format(...msg) {
        let m = []
        for (let i = 0; i < msg.length; i++) {
            if (typeof msg[i] === 'object') {
                m.push(msg[i] + '')
            } else {
                m.push(msg[i])
            }
        }
        m = m.join(' ')
        return m
    }
    static i(...msg) {
        if (!this.Debug) return
        console.log(`\x1b[30m${this.TAG} ${this.format(...msg)}\x1b[0m`)
    }
    static w(...msg) {
        console.log(`\x1b[33m${this.TAG} ${this.format(...msg)}\x1b[0m`)
    }
    static e(...msg) {
        console.log(`\x1b[31m${this.TAG} ${this.format(...msg)}\x1b[0m`)
    }
    static s(...msg) {
        console.log(`\x1b[32m${this.TAG} ${this.format(...msg)}\x1b[0m`)
    }
}

Java.perform(function () {
    const System = Java.use('java.lang.System')
    // System.load.overload('java.lang.String').implementation = function (library) {
    //     Log.e('Loading library:', library)
    //     return this.load(library)
    // }
    // System.loadLibrary.overload('java.lang.String').implementation = function (library) {
    //     Log.e('Loading library1:', library)
    //     return this.loadLibrary(library)
    // }
    // 定位 __system_property_read_callback 函数地址
    // 假设我们已经 hook 了 __system_property_read_callback，并获得参数 args[0] 为 pi
    // Interceptor.attach(Module.findExportByName(null, '__system_property_read_callback'), {
    //     onEnter: function (args) {
    //         var pi = args[0]
    //         console.log('-------------------------')
    //         console.log('prop_info 地址: ' + pi)

    //         // 读取 serial（4 字节）
    //         var serial = Memory.readU32(pi)
    //         console.log('serial: ' + serial)

    //         // 定义 offset 值，PROP_VALUE_MAX 一般为 92
    //         var PROP_VALUE_MAX = 92

    //         // 读取 name，name 在 union 后，即 pi + 4 + PROP_VALUE_MAX
    //         var namePtr = pi.add(4 + PROP_VALUE_MAX)
    //         var nameStr = Memory.readCString(namePtr)
    //         console.log('name: ' + nameStr)

    //         var valueStr = ''
    //         // 判断是否为 long 属性（is_long() 判断逻辑）
    //         if ((serial & (1 << 16)) !== 0) {
    //             // long 属性: offset 存在于 union.long_property.offset，
    //             // offset 地址 = pi + 4 (union 开始) + 56（error_message 长度）
    //             var offset = Memory.readU32(pi.add(4 + 56))
    //             var longValuePtr = pi.add(offset)
    //             console.log('long_property.offset: ' + offset)
    //             try {
    //                 valueStr = Memory.readCString(longValuePtr)
    //             } catch (e) {
    //                 valueStr = '读取 long_value 出错: ' + e
    //             }
    //         } else {
    //             // 非 long 属性，值直接存储在 union.value 中，起始于 pi + 4
    //             try {
    //                 valueStr = Memory.readCString(pi.add(4))
    //             } catch (e) {
    //                 valueStr = '读取 inline value 出错: ' + e
    //             }
    //         }
    //         console.log('value: ' + valueStr)
    //     }
    // })
    const SIOCGIFHWADDR = 0x8927
    // Interceptor.attach(Module.findExportByName(null, 'open'), {
    //     onEnter: function (args) {
    //         var path = Memory.readCString(args[0])
    //         Log.e('fopen', path)
    //     },
    //     onLeave: function (retval) {
    //     }
    // })
    // // var libart = Process.getModuleByName('libart.so')

    // const NetworkInterface = Java.use('java.net.NetworkInterface')
    // NetworkInterface.getNetworkInterfaces.implementation = function () {
    //     Log.e('getNetworkInterfaces')
    //     return this.getNetworkInterfaces()
    // }

    const File = Java.use('java.io.File')

    const BufferedReader = Java.use('java.io.BufferedReader')
    const FileInputStream = Java.use('java.io.FileInputStream')
    const FileOutputStream = Java.use('java.io.FileOutputStream')
    const InputStreamReader = Java.use('java.io.InputStreamReader')
    const OutputStreamWriter = Java.use('java.io.OutputStreamWriter')
    function readFile(file) {
        if (!file.exists()) {
            return null
        }
        var fileInputStream = FileInputStream.$new(file)

        var inputStreamReader = InputStreamReader.$new(Java.cast(fileInputStream, Java.use('java.io.InputStream')))
        var bufferedReader = BufferedReader.$new(inputStreamReader)
        var line
        var content = ''
        while ((line = bufferedReader.readLine()) !== null) {
            content += line + '\n'
        }

        bufferedReader.close()
        inputStreamReader.close()
        fileInputStream.close()

        return content
    }

    const NetworkInterface = Java.use('java.net.NetworkInterface')
    NetworkInterface.getNetworkInterfaces.overload().implementation = function () {
        const res = this.getNetworkInterfaces()
        Log.e(`NetworkInterface.getNetworkInterfaces() -> ${res}`)
        return res
    }

    const ifs = NetworkInterface.getNetworkInterfaces()
    while (ifs.hasMoreElements()) {
        const ni = ifs.nextElement()
        Log.e(`NetworkInterface: ${ni}`)
        const name = ni.getClass()
        Log.e(`NetworkInterface.getName() -> ${name}`)
    }
})