新手小白，在hook某个app数据库时遇到的问题
本帖最后由 ouyang12138 于 2023-5-1 14:28 编辑新人小白一个，最近心血来潮想学学逆向，想hook某个app实现对消息的监测，开始直接hook sqlitedatabase的.insertwithonconflict，打出来的log一看并没有发现消息内容相关的，然后jadx里面搜了下反编译的代码，发现了有个sqlcipher的database，然后查了下资料大部分聊天记录等隐私数据就是用的sqlcipher去存，然后看到源码 package net.sqlcipher.database
public long insertWithOnConflict(String str, String str2, ContentValues contentValues, int i)
我的hook代码
public class HookEntry implements IXposedHookLoadPackage {
public static String TAG = "Demo";
public static ClassLoader dexClassLoader = null;
public static ClassLoader classLoader = null;
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
if (loadPackageParam.packageName.equals(HookUtils.XPOSED_HOOK_PACKAGE)) {
classLoader = loadPackageParam.classLoader;
XposedBridge.log(TAG + " has Hooked!");
XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Context context = (Context) param.args;
dexClassLoader = context.getClassLoader();
if (dexClassLoader == null) {
XposedBridge.log("cannot get classloader return ");
return;
}
XposedBridge.log(TAG + " has Hooked!");
final Class<?> sqliteDatabase = XposedHelpers.findClass("net.sqlcipher.database.SQLiteDatabase", dexClassLoader);
final Method insertWithOnConflictMethod = XposedHelpers.findMethodExact(sqliteDatabase, "insertWithOnConflict", String.class, String.class, ContentValues.class, int.class);
XC_MethodHook methodHook = new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log(TAG + " insertWithOnConflictMethod");
String table = (String) param.args;
ContentValues contentValues = (ContentValues) param.args;
if (table != null && table.toLowerCase().startsWith("insert into")) {
LogUtil.PrintInsert(table, contentValues, "sqlcipher insert");
}
}
};
// Hook insertWithOnConflict 方法
XposedBridge.hookMethod(insertWithOnConflictMethod, methodHook);
}
});
}
}
}
;
}
});然后我发送消息，发现lsp里看模块日志并没有打印，该apphook是成功了的，打印了两次has hooked。不明白，想问问大佬们有没有相关经验，解解疑惑
用同样的代码去hook某个漂流瓶是成功的，看来只能是这个app做了特殊处理了。 public class HookEntry implements IXposedHookLoadPackage {
public static String TAG = "Demo";
public static ClassLoader dexClassLoader = null;
public static ClassLoader classLoader = null;
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
if (loadPackageParam.packageName.equals(HookUtils.XPOSED_HOOK_PACKAGE)) {
classLoader = loadPackageParam.classLoader;
XposedBridge.log(TAG + " has Hooked!");
XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() {
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Context context = (Context) param.args;
dexClassLoader = context.getClassLoader();
if (dexClassLoader == null) {
XposedBridge.log("cannot get classloader return ");
return;
}
XposedBridge.log(TAG + " has Hooked!");
final Class<?> sqliteDatabase = XposedHelpers.findClass("net.sqlcipher.database.SQLiteDatabase", dexClassLoader);
final Method insertWithOnConflictMethod = XposedHelpers.findMethodExact(sqliteDatabase, "insertWithOnConflict", String.class, String.class, ContentValues.class, int.class);
XC_MethodHook methodHook = new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
XposedBridge.log(TAG + " insertWithOnConflictMethod");
String table = (String) param.args;
ContentValues contentValues = (ContentValues) param.args;
if (table != null && table.toLowerCase().startsWith("insert into")) {
LogUtil.PrintInsert(table, contentValues, "sqlcipher insert");
}
}
};
// Hook insertWithOnConflict 方法
XposedBridge.hookMethod(insertWithOnConflictMethod, methodHook);
}
});
}
}
}
XposedHelpers.findAndHookMethod(Application.class, "attach", Context.class, new XC_MethodHook() { protected void afterHookedMethod(MethodHookParam param) throws Throwable {
Context context = (Context) param.args;
dexClassLoader = context.getClassLoader();
XposedBridge.log("hook suucess ");
if (dexClassLoader == null) {
XposedBridge.log("cannot get classloader return ");
return;
}
}
}); 网上没找到相关的。。。不然也不会来问了，困扰好久了 可以在控制台里打印日志信息那样知道自己哪里有问题 wwwhhhlll 发表于 2023-4-14 18:48
可以在控制台里打印日志信息那样知道自己哪里有问题
是没发现问题的，classloader找到了，方法也找到了，没报错但是表现看起来是这个插入函数没有被执行过，但是不应该 help，有人救救吗 数据库打开了么？ wykdz 发表于 2023-4-18 08:55
数据库打开了么？
sqlite是打开了的 sqlcipher，我发送了消息，总得存消息？也没hook到 wykdz 发表于 2023-4-18 08:55
数据库打开了么？
hook构造函数看数据库路径和密码，都为空，确实没有打开 但是hook了数据库总会被使用的，为啥一直不会输出呢，不合理 so里直接调用，hook so里的才有