frida注入脚本持久化从frida-net到frida-inject-526互联

采集APP数据的时候发现需要对参数进行加密，为了简单就没有做算法还原，就想尝试用RPC的方式直接调用

最先开始用frida-net，这个方案有个问题是必须用USB连接手机，方案也能跑通

先下载frida-net

git clone https://github.com/frida/gumjs-net.git

本机的需要nodejs环境

下载完gumjs-net后 cd到

cd gumjs-net\examples\http-server

先安装依赖直接npm install

修改http-server下的agent.js文件

const Koa = require('koa');
const Router = require('koa-router');

const app = new Koa();
const router = new Router();
 
router
  .get('/ranges', (ctx, next) => {
    ctx.body = Process.enumerateRanges({
      protection: '---',
      coalesce: true
    });
  })
  .get('/sign_stamp/:price_type', (ctx, next) => {
    // ctx.body = Process.enumerateModules();
    // ctx.body =hook_post();
   // 获取对应的参数
    let price_type = ctx.params.price_type;
    console.log("参数类型->",price_type);
    // 利用frida的语法hook想要的类库或者方法
    Java.perform(function (){
      // 产品列表url
      let tree_url = "xxx"
      // 产检价格url
      let base_url = "xxx";
      // 价格详情
      let price_detail_url = "xxxxx"
      // 要用到的类库
      let tools = Java.use("com.xxx.utils.Tools");
      let time_stamp = Date.now();
      if(price_type == "tree"){
        let result = tools.a(time_stamp,tree_url);
        ctx.body = {"time_stamp": time_stamp, "result": result};
      }else if(price_type == "price_detail"){
        let result = tools.a(time_stamp,price_detail_url);
        ctx.body = {"time_stamp": time_stamp, "result": result};
      }else{
        let result = tools.a(time_stamp,base_url);
        ctx.body = {"time_stamp": time_stamp, "result": result};
      }
    });
  })
  .get('/modules/:name', (ctx, next) => {
    try {
      ctx.body = Process.getModuleByName(ctx.params.name);
    } catch (e) {
      ctx.status = 404;
      ctx.body = e.message;
    }
  })
  .get('/modules/:name/exports', (ctx, next) => {
    ctx.body = Module.enumerateExports(ctx.params.name);
  })
  .get('/modules/:name/imports', (ctx, next) => {
    ctx.body = Module.enumerateImports(ctx.params.name);
  })
  .get('/objc/classes', (ctx, next) => {
    if (ObjC.available) {
      ctx.body = Object.keys(ObjC.classes);
    } else {
      ctx.status = 404;
      ctx.body = 'Objective-C runtime not available in this process';
    }
  })
  .get('/threads', (ctx, next) => {
    ctx.body = Process.enumerateThreads();
  });

app
  .use(router.routes())
  .use(router.allowedMethods())
  .listen(1337);