# 通过链接器注入
root@bm:~/frida/build/frida-linux-x86_64/lib/frida/64# LD_PRELOAD=./frida-gadget.so cat
[Frida INFO] Listening on 127.0.0.1 TCP port 27042

# 与frida-server方式不同，此时它只有一个名为Gadget的进程
root@bm:~/frida# frida-ps -R
  PID  Name
-----  ------
98367  Gadget

# 使用frida-trace追踪，此时会恢复挂起的程序
root@bm:~/frida# frida-trace -i read -R Gadget
Instrumenting...                                                        
read: Auto-generated handler at "/root/frida/__handlers__/libc_2.31.so/read.js"
read: Auto-generated handler at "/root/frida/__handlers__/libpthread_2.31.so/read.js"
Started tracing 2 functions. Press Ctrl+C to stop.                      
           /* TID 0x18348 */
  5428 ms  read(fd=0x0, buf=0x7f57340e2000, count=0x20000)
  6830 ms  read(fd=0x0, buf=0x7f57340e2000, count=0x20000)

/* 附着到目标进程上*/
ptrace (PTRACE_ATTACH, pid, NULL, NULL);
waitpid (pid, &status, 0);
/* 保存线程的原始上下文 */
ptrace (PTRACE_GETREGS, pid, NULL, saved_regs);
/* 解析目标的mmap位置并调用以分配一块可读写执行的内存，此时它还是用的原线程的栈 */
ptrace (PTRACE_GETREGS, pid, NULL, &regs)
regs.rip = resolve_remote_libc_function (pid, “mmap”); 
regs.rdi = 0;
regs.rsi = 8192;
regs.rdx = PROT_READ | PROT_WRITE | PROT_EXEC;
regs.rcx = MAP_PRIVATE | MAP_ANONYMOUS;
regs.r8 = -1;
regs.r9 = 0;
regs.rax = 1337;
regs.rsp -= 8;  // 向下压栈
/* 执行mmap并获取分配到的地址*/
ptrace (PTRACE_POKEDATA, pid, regs.rsp, DUMMY_RETURN_ADDRESS)  // 将无效返回地址放入栈上，用于暂停线程返回调试器
ptrace (PTRACE_SETREGS, pid, NULL, &regs)
ptrace (PTRACE_CONT, pid, NULL, NULL)
frida_wait_for_child_signal (pid, SIGTRAP)
ptrace (PTRACE_GETREGS, pid, NULL, &regs)
bootstrapper = regs.rax
/* 执行bootstrapper并等待返回，此时把栈迁移到新分配的空间了 */
ptrace (PTRACE_GETREGS, pid, NULL, &regs)
regs.rip = bootstrapper
regs.rsp = bootstrapper + 8192
ptrace (PTRACE_SETREGS, pid, NULL, &regs)
ptrace (PTRACE_CONT, pid, NULL, NULL)
frida_wait_for_child_signal (pid, SIGTRAP)
/* bootstrapper执行完毕时，已经将agent注入并运行，现在恢复原线程上下文并deattach*/
ptrace (PTRACE_SETREGS, pid, NULL, saved_regs)
ptrace (PTRACE_DETACH, pid, NULL, NULL)

// 创建并执行新线程并陷入返回调试器
so = dlopen (“libpthread.so”, RTLD_LAZY)
thread_create = dlsym (so, “pthread_create”)
thread_create(&worker_thread, NULL, bootstrapper + 128, NULL)
int3() 

// 而在新的线程中，它会打开一个命名管道
fifo = open(fifo_path, O_WRONLY)
write(fifo, “frida_agent_main”, 1)
so = dlopen(“frida-agent.so”, RTLD_LAZY)
entry = dlsym(so, “frida_agent_main”)
entry(DATA_STRING)
close(fifo)

diff --git a/src/linux/frida-helper-backend-glue.c b/src/linux/frida-helper-backend-glue.c
index b99963a1..e46133c2 100644
--- a/src/linux/frida-helper-backend-glue.c
+++ b/src/linux/frida-helper-backend-glue.c
@@ -2982,6 +2982,42 @@ frida_resolve_library_function (pid_t pid, const gchar * library_name, const gch
   GumAddress local_base, remote_base, remote_address;
   gpointer module, local_address;

+  if (g_strcmp0 (library_name, "libc") == 0){
+      remote_base = frida_find_library_base (pid, library_name, &remote_library_path);
+      if (remote_base == 0)
+        return 0;
+      if (g_strcmp0 (function_name, "open") == 0){
+        remote_address = remote_base + 0xE5B60; // open64
+      }else if (g_strcmp0 (function_name, "close") == 0){
+        remote_address = remote_base + 0xE6670;
+      }else if (g_strcmp0 (function_name, "write") == 0){
+        remote_address = remote_base + 0xE5EF0;
+      }else if (g_strcmp0 (function_name, "syscall") == 0){
+        remote_address = remote_base + 0xEF2E0;
+      }else if (g_strcmp0 (function_name, "__libc_dlopen_mode") == 0){
+        remote_address = remote_base + 0x12B410;
+      }else if (g_strcmp0 (function_name, "__libc_dlclose") == 0){
+        remote_address = remote_base + 0x12B520;
+      }else if (g_strcmp0 (function_name, "__libc_dlsym") == 0){
+        remote_address = remote_base + 0x12B490;
+      /*}else if (g_strcmp0 (library_name, "pthread_create") == 0){
+        remote_address = remote_base + ;
+      }else if (g_strcmp0 (library_name, "pthread_detach") == 0){
+        remote_address = remote_base + ;
+      */}else if (g_strcmp0 (function_name, "mmap") == 0){
+        remote_address = remote_base + 0xEF4D0;  // mmap64
+      }else if (g_strcmp0 (function_name, "mprotect") == 0){
+        remote_address = remote_base + 0xEF5F0;
+      }else if (g_strcmp0 (function_name, "munmap") == 0){
+        remote_address = remote_base + 0xEF5C0;
+      }else{
+        printf("Not Found libc func: %s\n", function_name);
+        return 0;
+      }
+      printf("libc func <%s> addr : 0x%08x\n", function_name, remote_address);
+      return remote_address;
+  }
+
   local_base = frida_find_library_base (getpid (), library_name, &local_library_path);
   g_assert (local_base != 0);

pip install frida
pip install frida-tools 

npm install @types/frida-gum    # -g 安装到全局

case $host_os in
  linux)
    host_arch_flags=""
    host_cflags=""
    case $host_arch in
      x86)
        host_arch_flags="-m32 -march=pentium4"
        host_cflags="-mfpmath=sse -mstackrealign"
        host_toolprefix="/usr/bin/"
        ;;
      x86_64)
        host_arch_flags="-m64"
        host_toolprefix="x86_64-linux3.2-linux-gnu-" # 修改
        ;;
   xxxxx)
      OLD_64)                                                                            # 添加
        host_arch_flags="-m64"
        host_toolprefix="x86_64-xxoo-linux-uclibc-"
        ;;

/data2/sysroot # ./frida-server 
sh: ./frida-server: not found

root@bm:~/x-tools/x86_64-linux31-linux-gnu/x86_64-linux31-linux-gnu/sysroot# readelf -l frida-server | grep program
There are 12 program headers, starting at offset 64
      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]


/data2/sysroot # ls /lib64/ld-linux-x86-64.so.2
ls: /lib64/ld-linux-x86-64.so.2: No such file or directory

/data2/sysroot # ln -s /data2/sysroot/lib64/ /lib64

/data2/sysroot # LD_LIBRARY_PATH=/data2/sysroot/lib64 ./frida-server -h
Usage:
  frida [OPTION?]

Help Options:
  -h, --help                            Show help options
...

// 直接跟踪read函数，输出它的参数和返回值
function trace_read() {
    Interceptor.attach(Module.findExportByName(null, "read"),
        {
            onEnter(args) {
                this.fd = args[0].toInt32();
                this.buf = args[1];
                this.len = args[2].toInt32();
            },
            onLeave(ret) {
                console.log(`===>read(${this.fd},0x${this.buf.toString(16)},${this.len}) \n${hexdump(this.buf, {
                    length: ret.toUInt32(),
                    header: false
                })}\n<===`)
            }
        }
    )
}
trace_read()

// 对于未导出的函数，可通过偏移获取，如下
let modName = 'libebk-engine.so';
let ebookkBase = Module.getBaseAddress(modName);
let inflateAddr = ebookkBase.add(0x1368B8);
let inflateRetAddr = ebookkBase.add(0x15FFBC);
function inflateTrace() {
    Interceptor.attach(inflateAddr, {
        onEnter: function (args) {
            if (this.returnAddress == inflateRetAddr) { // 当inflate在指定位置被调用时进行hook
                this.next_in = args[0].readPointer(); // 保存它的参数，此时分析出它的第一个参数值zlib ctx，因此保存想要的信息
                this.avail_in = args[0].add(4).readU32();
                this.next_out = args[0].add(0x0c).readPointer();
                this.avail_out = args[0].add(0x10).readU32();
                console.log(`=============inflate start==============
                ${this.next_in},${this.avail_in}
${dumpmem(this.next_in, min(64, this.avail_in))}
            `)
            } else {
                console.log(`diff=========> ${this.returnAddress}!=${inflateRetAddr}`)
            }

        },
        onLeave: function (ret) {
            if (this.returnAddress == inflateRetAddr) {
            // 在函数结束时，就可以知道函数执行信息了
                console.log(`
${dumpmem(this.next_out, min(64, this.avail_out))}
=============inflate end==============
            `)
            }
        }
    })
}

// repace样例
var ptracePtr = ptr("0x18bad1078"); //直接指定，ptrace函数地址
var OriginPtrace = new NativeFunction(ptracePtr, 'void', ["pointer", "pointer", "pointer", "pointer"]);// 将该地址指定为函数指针
Interceptor.replace(ptracePtr, new NativeCallback(function(arg1, arg2, arg3, arg4) {
        // 此时完全替换了函数，就可以先处理参数，再决定是否要调用原函数，并最终返回结果
    if (arg1 == 31) {
        console.log("Hook ptrace Bypass!!!");
        return 0;
    } 
    else {
        return OriginPtrace(arg1, arg2, arg3, arg4);
    }
},'int', ['int', 'pointer']));

Java.perform( () => {

  // 此处直接hook类的方法，输出它的
  let EncryptionUtil = Java.use("me.betamao.utils.EncryptionUtil");
  EncryptionUtil.encrypt.implementation = function(key, value){
      console.log(`Key: ${key} Value: ${value}`);
      return this.encrypt(key, value); // or EncryptionUtil.encrypt.call(this, key,value);
  }

  // 对于存在重载的方法，可以使用overload指定签名
  secret_key_spec.$init.overload("[B", "java.lang.String").implementation = function (x, y) {
      send('{"my_type" : "KEY"}', new Uint8Array(x));
      return this.$init(x, y);
   }

  // 直接调用类方法
  let Util = Java.use("me.betamao.utils.Util");
  console.log(`encode: ${Util.encode('123')}`);

   // 对于对象方法，需要先用choose获取类的所有对象，此时可以对对象进行读写，也可以调用它的方法
   Java.choose("me.betamao.utils.Util", {
    onMatch: function(instance) {
     console.log(`[ * ] Instance found in memory: ${instance} name: ${instance.name()}`);
    },
    onComplete: function() { }
   });

  // 对于特殊方法，如构造函数，可使用$new
  var string_class = Java.use("java.lang.String");
  var my_string = string_class.$new("hello world")

  // 加载指定类，如一些功能代码使用java编写，可编译为dex/class再加载到vm中调用
    Java.openClassFile("/data/bm.dex").load();

});

  // 嵌入的都需要先初始化Gum  
  gum_init_embedded (); 

  // 选择js引擎后端，还可选v8
  backend = gum_script_backend_obtain_qjs (); 

  // 创建桩代码
  script = gum_script_backend_create_sync (backend, "example",
      "Interceptor.attach(Module.getExportByName(null, 'open'), {\n"
      "  onEnter(args) {\n"
      "    console.log(`[*] open(\"${args[0].readUtf8String()}\")`);\n"
      "  }\n"
      "});\n"
      "Interceptor.attach(Module.getExportByName(null, 'close'), {\n"
      "  onEnter(args) {\n"
      "    console.log(`[*] close(${args[0].toInt32()})`);\n"
      "  }\n"
      "});",
      cancellable, &error);
  g_assert (error == NULL);

  // 指定message回调函数
  gum_script_set_message_handler (script, on_message, NULL, NULL);

  // 加载脚本
  gum_script_load_sync (script, cancellable);

  // 调用open，此时桩会输出trace，注意桩不会跟踪frida gadget的代码，但此处不输入gadget代码
  close (open ("/etc/hosts", O_RDONLY));
  close (open ("/etc/fstab", O_RDONLY));

  context = g_main_context_get_thread_default ();
  while (g_main_context_pending (context))
    g_main_context_iteration (context, FALSE);

  // 结束清理现场
  gum_script_unload_sync (script, cancellable);

  g_object_unref (script);

  gum_deinit_embedded ();

frida -l .\fortigate.js -H 127.0.0.1:5555 -p 3871 --runtime=v8
# -l xx.js 指定HOOK脚本，它会自动监视文件修改并实时加载最新的内容
# -H 远程地址
# -p 要attach的进程ID
# -n name 要附加的进程名，若有多个同名进程则必须使用-p
# -f filename 创建新进程并附加，它能在目标执行前进行hook，连双生进程也能秒
# --debug 在使用v8时可进行调试
# --realm=native|emulated 在调试android模拟器时，需要此选项

import frida
import sys

js=open('hook.js','r').read()
def on_message(message, data):
    ...

pid = device.spawn(['sslvpnd',['-x']])  # 启动程序并挂起
print("[+] Got PID %d" % (pid))
session = device.attach(pid)            # 附着
script = session.create_script(js)      # js为hook代码

# Callback function
script.on('message', on_message)        # 注册回调，on_message用于和debuggee传递数据
script.load()                           # 加载脚本

device.resume(pid)                      # 恢复进程
input()                                 # 卡！不然程序就结束啦

import frida
import sys
session = frida.attach('hello')
script = session.create_script("""
    Interceptor.attach(ptr("0x1400B54b0"), {
        onEnter(args) {
            send(args[0].toInt32());
            }
});""")


def on_message(message, data): 
    """
    message 传递文本数据，它的type表明消息类型，send表述普通数据，error表示异常
    data 用于传输二进制数据，它不必使用json进行编码
    """
    if message['type']=='send':
        print(message['payload'])
        script.post({'type':'poke', 'my_data':'ha?'})

script.on('message', on_message)
api = script.exports        # 此处可以通过api.xxx()调用hook代码导出的函数，hook代码可通过rpc.exports导出任意函数供远程调用
script.load()
input() 

'use strict';
constco = require('co');
constfrida = require('frida');
constload = require('frida-load'); //!!
let session, script;
co(function*() {
        session = yieldfrida.attach('hello');
        constsource = yieldload(require.resolve('./agent.js'));
        script = yieldsession.createScript(source);
        script.events.listen('message', message => {console.log(message);});
        yieldscript.load();
    }
);