forked from apkunpacker/FridaScripts
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathDumpDex.js
More file actions
151 lines (142 loc) · 4.47 KB
/
Copy pathDumpDex.js
File metadata and controls
151 lines (142 loc) · 4.47 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
const fork_ptr = Module.getExportByName(null, "fork");
const fork = new NativeFunction(fork_ptr, 'int', []);
Interceptor.replace(fork_ptr, new NativeCallback(function () {
console.warn("Fork Found and Replaced");
return -1;
}, "int", []));
var Color = {
RESET: "\x1b[39;49;00m",
Black: "0;01",
Blue: "4;01",
Cyan: "6;01",
Gray: "7;11",
Green: "2;01",
Purple: "5;01",
Red: "1;01",
Yellow: "3;01",
Light: {
Black: "0;11",
Blue: "4;11",
Cyan: "6;11",
Gray: "7;01",
Green: "2;11",
Purple: "5;11",
Red: "1;11",
Yellow: "3;11"
}
};
var LOG = function(input, kwargs) {
kwargs = kwargs || {};
var logLevel = kwargs['l'] || 'log',
colorPrefix = '\x1b[3',
colorSuffix = 'm';
if (typeof input === 'object')
input = JSON.stringify(input, null, kwargs['i'] ? 2 : null);
if (kwargs['c'])
input = colorPrefix + kwargs['c'] + colorSuffix + input + Color.RESET;
console[logLevel](input);
};
function Blue(str) {
LOG(str, {
c: Color.Blue
});
}
function Green(str) {
LOG(str, {
c: Color.Green
});
}
function Purple(str) {
LOG(str, {
c: Color.Purple
});
}
function Red(str) {
LOG(str, {
c: Color.Red
});
}
function Yellow(str) {
LOG(str, {
c: Color.Yellow
});
}
function ProcessName() {
var openPtr = Module.getExportByName('libc.so', 'open');
var open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
var readPtr = Module.getExportByName('libc.so', 'read');
var read = new NativeFunction(readPtr, 'int', ['int', 'pointer', 'int']);
var closePtr = Module.getExportByName('libc.so', 'close');
var close = new NativeFunction(closePtr, 'int', ['int']);
var path = Memory.allocUtf8String('/proc/self/cmdline');
var fd = open(path, 0);
if (fd != -1) {
var buffer = Memory.alloc(0x1000);
var result = read(fd, buffer, 0x1000);
close(fd);
result = ptr(buffer).readCString();
return result;
}
return -1;
}
function HeaderInfo(Buf, C) {
var ApkUnpacker = new Uint8Array(Buf);
var Check = 0;
var Count = C - 1;
if (ApkUnpacker[0] == 0 || ApkUnpacker[0] != 100)
{
Green("[*] Wiped Header Detected , Repair classes" + Count + ".dex Manually.This May Be Interesting Dex");
Check = 1;
}
return Check;
}
function dump_dex() {
var Pro = ProcessName();
var libart = Process.findModuleByName("libart.so");
var addr_DefineClass = null;
var symbols = libart.enumerateSymbols();
for (var index = 0; index < symbols.length; index++) {
var symbol = symbols[index];
var symbol_name = symbol.name;
if (symbol_name.indexOf("ClassLinker") >= 0 &&
symbol_name.indexOf("DefineClass") >= 0 &&
symbol_name.indexOf("Thread") >= 0 &&
symbol_name.indexOf("DexFile") >= 0) {
addr_DefineClass = symbol.address;
Purple("Symbol Found : Lets Do The Work");
}
}
var dex_maps = {};
var dex_count = 1;
if (addr_DefineClass) {
Interceptor.attach(addr_DefineClass, {
onEnter: function(args) {
var dex_file = args[5];
var base = ptr(dex_file).add(Process.pointerSize).readPointer();
var size = ptr(dex_file).add(Process.pointerSize + Process.pointerSize).readUInt();
if (dex_maps[base] == undefined) {
dex_maps[base] = size;
var dex_dir_path = "/data/data/" + Pro + "/";
// var dex_dir_path = "/data/data/com.your.apk/";
var dex_path = dex_dir_path + "classes" + dex_count + ".dex";
var fd = new File(dex_path, "wb");
if (fd && fd != null) {
dex_count++;
var dex_buffer = ptr(base).readByteArray(size);
var Checks = HeaderInfo(dex_buffer, dex_count);
fd.write(dex_buffer)
fd.flush();
fd.close();
if (Checks == 1) {
Purple("[Dex] :" + dex_path);
} else {
console.log("[Dex] :", dex_path);
}
}
}
},
onLeave: function(retval) {}
});
}
}
setImmediate(dump_dex);