function load_all_class() {
if (Java.available) {
Java.perform(function () {
var DexFileclass = Java.use("dalvik.system.DexFile");
var BaseDexClassLoaderclass = Java.use("dalvik.system.BaseDexClassLoader");
var DexPathListclass = Java.use("dalvik.system.DexPathList");
var hookedClasses = new Set(); // 用于跟踪已经 hook 的类
Java.enumerateClassLoaders({
onMatch: function (loader) {
console.log("loader:", loader);
// 为了排除 BootClassLoader 和不相关的 ClassLoader
if ((loader.toString().indexOf("java.lang.BootClassLoader") === -1)) {
try {
var BaseDexClassLoader_obj = Java.cast(loader, BaseDexClassLoaderclass);
var pathList = BaseDexClassLoader_obj.pathList.value;
var pathList_obj = Java.cast(pathList, DexPathListclass);
var ElementsArray = pathList_obj.dexElements.value;
console.log("ElementsArray---->", ElementsArray);
if(hookedClasses.has(className)){return}
// 遍历 ElementsArray，查找指定的 .apk 文件
for (var index in ElementsArray) {
var element = ElementsArray[index];
try {
try { var dexfile = element.dexFile.value; } catch (e) {}
if (dexfile) {
var dexfileobj = Java.cast(dexfile, DexFileclass);
const classNames = [];
const enumeratorClassNames = dexfileobj.entries();
// 查找指定的 .apk 文件
if (dexfileobj.toString().indexOf("/data/app/com.dlxx.mam.Internal-dJ7kxt_bZ0UnShdkHHubMg==/base.apk") >= 0 ) {
console.log("Found .apk file in dexfile: ", dexfileobj);
while (enumeratorClassNames.hasMoreElements()) {
var className = enumeratorClassNames.nextElement().toString();
// console.log("ClassName : " + className);
classNames.push(className);
// 指定加载某个类
if (className=="com.tencent.tbs.core.webkit.WebView" ) {
var webviewClass = Java.use("com.tencent.tbs.core.webkit.WebView");
console.log("ClassName : " + className);
// Hook WebView 的构造方法
var constructors = webviewClass['$init'].overloads;
for (var i = 0; i < constructors.length; i++) {
var constructor = constructors[i];
var signature = constructor.signature;
// Hook 构造方法
constructor.implementation = function () {
console.log('WebView constructor called with signature: ' + signature);
var instance = constructor.call(this, arguments);
// 在 WebView 实例创建后立即调用 setWebContentsDebuggingEnabled
if (instance) {
instance.setWebContentsDebuggingEnabled(true);
}
return instance;
};
}
// Hook setWebContentsDebuggingEnabled 方法
webviewClass.setWebContentsDebuggingEnabled.implementation = function (enabled) {
console.log('setWebContentsDebuggingEnabled called with enabled: ' + enabled);
this.setWebContentsDebuggingEnabled(enabled);
};
loader.loadClass(className);
// 标记为已 hook
hookedClasses.add(className);
}
}
}
}
} catch (e) {
console.log('异常了' + e);
}
}
} catch (e) {
console.log('异常了2' + e);
}
}
},
onComplete: function () {
console.log("[*]load_all_class success！");
}
})
});
}
[复制链接]
发表于 2024-8-5 17:36
发表于 2024-8-5 23:29
|
发表于 2024-8-5 17:39
