Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

关于怎么在frida使用反射调用方法 #1

Open
zxhubo opened this issue Mar 27, 2019 · 0 comments
Open

关于怎么在frida使用反射调用方法 #1

zxhubo opened this issue Mar 27, 2019 · 0 comments

Comments

@zxhubo
Copy link

zxhubo commented Mar 27, 2019

大佬,请教个关于frida里面反射调用的问题,package com.example.cryptutils.util;里面有个类以及它的构造函数以及获取实例是这样的:
public class CryptoUtils {
public static String TAG = "MainActivity";
private static final String STORE_FILE_NAME = "crypto";
private static final String DEFAULT_SECRETKEY_NAME = "default_secretkey_name";
private static final String KEYSTORETYPE="AndroidKeyStore";
private KeyStore keyStore;
private byte[] iv;
private static Context context;
private static CryptoUtils cryptoUtils;
private CryptoUtils(KeyStore keyStore){
this.keyStore=keyStore;
}

public static CryptoUtils getInstance(Context context){
    KeyStore keyStore;
    File file=new File(context.getFilesDir(),STORE_FILE_NAME);
    if(cryptoUtils==null){
        synchronized (CryptoUtils.class){
            if(cryptoUtils==null){
                CryptoUtils.context=context;
                keyStore=createKeyStore(file);
                initKey(keyStore,file);
                cryptoUtils=new CryptoUtils(keyStore);
            }
        }
    }

    return cryptoUtils;
}

CryptoUtils 这个类里面有一个public byte[] aesEncrypt(String plaintext)方法,我想在frida里面反射调用这个方法,主要代码如下:
var class_name1 = "com.example.cryptutils.util.CryptoUtils";
var Platform1 = Java.use(class_name1);
var clz = Java.use("java.lang.Class");
var objectclass= Java.use("java.lang.Object");
var string=Java.use("java.lang.String");
var b = Java.use("[B");
var method_aes = Platform1.class.getDeclaredMethod("aesEncrypt",Java.array('java.lang.Class', [string.class]) );

//var mainAc = Platform1.$new();

//console.log("orinin:"+mainAc);
var ConstructorParam =Java.array('java.lang.Class',[Java.use("java.security.KeyStore").class]);
var Constructor = Platform1.class.getDeclaredConstructor(ConstructorParam);
//var instance = Constructor.newInstance([Platform1.class]);
//var a = Platform1.class.getDeclaredConstructor([objectclass.class]);
//var ret = method_aes.invoke(instance,Java.array("java.lang.Object",[string.$init("hahaha").class]));

我现在就是在最后一个invoke里面的一个参数instance,构造这个instance这里卡壳了,请问一下这种情况怎么构造这个instance的呢,最好来个示例代码。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant