编译官方fridaserver或者strongFrida并替换系统内置版本

主要内容:

下载官方frida源码并编译安卓版本的fridaserver，然后替换内置版本

编译反检测版本fridaserver工程strongFrida并替换系统内置版本

1.编译环境前期准备

1.1 操作系统准备

ubuntu系统:
ubuntu-20.04
java环境:
JDK1.8
Python环境:
>=3.7

git工具:
安装任一版本就行。

1.2 ndk下载准备

当前最新frida源码编译安卓版本需要ndk-r22版本，不然会提示错误。

ndk下载地址:

https://dl.google.com/android/repository/android-ndk-r22-linux-x86_64.zip

下载以后解压到一个目录后续使用。比如我个人的存放目录:

/home/qiang/androidndk/android-ndk-r22

1.3 安装依赖

分别执行如下命令:

qiang@ubuntu:~/myproject/frida/frida$sudoapt-getupdate

qiang@ubuntu:~/myproject/frida/frida$sudoapt-getinstallbuild-essentialtreeninja-buildgcc-multilibg++-multiliblib32stdc++-9-devflexbisonxz-utilsrubyruby-devpython3-requestspython3-setuptoolspython3-devpython3-piplibc6-devlibc6-dev-i386-y

qiang@ubuntu:~/myproject/frida/frida$sudopython-mpipinstallcoloramaprompt-toolkitpygments

qiang@ubuntu:~/myproject/frida/frida$python-mpipinstalllief

1.4 frida源码下载

执行如下命令下载:

gitclone--recurse-submoduleshttps://github.com/frida/frida

比如我下载存储目录:

/home/qiang/myproject/frida/frida

2.编译操作

2.1 官方版本编译

(1).设置ANDROID_NDK_ROOT变量

qiang@ubuntu:~/myproject/frida/frida$exportANDROID_NDK_ROOT=/home/qiang/androidndk/android-ndk-r22

(2).进入frida源码根目录分别执行如下命令编译android版本的frida

qiang@ubuntu:~/myproject/frida/frida/frida$pwd
/home/qiang/myproject/frida/frida/frida
qiang@ubuntu:~/myproject/frida/frida/frida$ls
buildCOPYINGfrida-gumfrida-qmlfrida-toolsMakefile.macos.mkREADME.md
config.mkfrida-clrfrida-nodefrida.slnMakefileMakefile.sdk.mkreleng
CONTRIBUTING.mdfrida-corefrida-pythonfrida-swiftMakefile.linux.mkMakefile.toolchain.mk
qiang@ubuntu:~/myproject/frida/frida/frida$
qiang@ubuntu:~/myproject/frida/frida/frida$makecore-android-arm64
qiang@ubuntu:~/myproject/frida/frida/frida$
qiang@ubuntu:~/myproject/frida/frida/frida$makecore-android-arm
qiang@ubuntu:~/myproject/frida/frida/frida$

(3).编译完成之后的目标存储目录

frida-android-arm存放目录:

qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm/bin$
qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm/bin$pwd
/home/qiang/myproject/frida/frida/frida/build/frida-android-arm/bin
qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm/bin$ls-la
total36316
drwxr-xr-x2qiangqiang40963月3122:25.
drwxrwxr-x6qiangqiang40963月3122:25..
-rwxr-xr-x1qiangqiang178460123月3122:25frida-inject
-rwxr-xr-x1qiangqiang176698443月3122:25frida-server
-rwxr-xr-x1qiangqiang16609003月3122:25gum-graft
qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm/bin$
qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm/bin$

frida-android-arm64存储目录:

qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm64/bin$ls-la
total83204
drwxr-xr-x2qiangqiang40963月3122:28.
drwxrwxr-x6qiangqiang40963月3122:28..
-rwxr-xr-x1qiangqiang416208723月3122:28frida-inject
-rwxr-xr-x1qiangqiang413832163月3122:28frida-server
-rwxr-xr-x1qiangqiang21820963月3122:28gum-graft
qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm64/bin$pwd
/home/qiang/myproject/frida/frida/frida/build/frida-android-arm64/bin
qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm64/bin$
qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm64/bin$ls
frida-injectfrida-servergum-graft
qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm64/bin$
qiang@ubuntu:~/myproject/frida/frida/frida/build/frida-android-arm64/bin$

2.2 strongR-frida-android版本编译

2.2.1 简介

strongR-frida-android主要是通过patch代码的方式，为frida官方源码进行一些修改，抹除一些关键特征,为Android构建反检测版本的frida-server。

2.2.2 patch补丁文件

patch补丁项目地址:

https://github.com/AAAA-Project/Patchs

2.2.3 编译以及测试流程

strongR-frida-android编译和官方frida编译方式是一样的，差异在于编译frida源码之前，需要先下载frida官方的源码，然后使用git am命令将patch代码应用到frida官方源码中。以下说一下具体patch补丁的流程。

(1)、为frida源码patch 反检测补丁

详细流程参考如下命令:

qiang@ubuntu:~/myproject/frida/frida$
qiang@ubuntu:~/myproject/frida/frida$gitclonehttps://github.com/AAAA-Project/Patchs
Cloninginto'Patchs'...
remote:Enumeratingobjects:40,done.
remote:Countingobjects:100%(40/40),done.
remote:Compressingobjects:100%(22/22),done.
remote:Total40(delta19),reused32(delta11),pack-reused0
Unpackingobjects:100%(40/40),12.04KiB|280.00KiB/s,done.
qiang@ubuntu:~/myproject/frida/frida$cdfrida/frida-core/
qiang@ubuntu:~/myproject/frida/frida/frida/frida-core$gitam../../Patchs/strongR-frida/frida-core/*.patch
Applying:strongR-frida:string_frida_rpc
Applying:strongR-frida:io_re_frida_server
Applying:strongR-frida:pipe_linjector
Applying:strongR-frida:io_frida_agent_so
Applying:strongR-frida:symbol_frida_agent_main
Applying:strongR-frida:thread_gum_js_loop
Applying:strongR-frida:thread_gmain
Applying:strongR-frida:protocol_unexpected_command
qiang@ubuntu:~/myproject/frida/frida/frida/frida-core$
qiang@ubuntu:~/myproject/frida/frida/frida/frida-core$
qiang@ubuntu:~/myproject/frida/frida/frida/frida-core$

(2)、编译源码操作

和编译官方frida源码一样的流程。

(3). 替换手机内置版本测试

通过adb push进去替换。具体请参考"不用刷机情况下升级或者降级系统中的fridaserver"。

4. 可参考的集成编译脚本

编译官方frida的shell脚本参考:

#buildforfridaandroid
#
sudoapt-getupdate

sudoapt-getinstallbuild-essentialtreeninja-buildgcc-multilibg++-multiliblib32stdc++-9-devflexbisonxz-utilsrubyruby-devpython3-requestspython3-setuptoolspython3-devpython3-piplibc6-devlibc6-dev-i386-y

sudopython-mpipinstallcoloramaprompt-toolkitpygments

#setANDROID_NDK_ROOT
exportANDROID_NDK_ROOT=/home/qiang/androidndk/android-ndk-r22
#deletefrida
rm-rffrida
#downloadagain
gitclone--recurse-submoduleshttps://github.com/frida/frida

cdfrida
#cleanbuildingcache
makeclean
#buildingfridaandroidarm
makecore-android-arm
#buildingfridaandroidarm64
makecore-android-arm64

编译strong frida脚本参考如下:

#buildforstrongfridaandroid
#
sudoapt-getupdate
sudoapt-getinstallbuild-essentialtreeninja-buildgcc-multilibg++-multiliblib32stdc++-9-devflexbisonxz-utilsrubyruby-devpython3-requestspython3-setuptoolspython3-devpython3-piplibc6-devlibc6-dev-i386-y


sudopython-mpipinstallcoloramaprompt-toolkitpygments


#
exportANDROID_NDK_ROOT=/home/qiang/androidndk/android-ndk-r22

rm-rfPatchs
#DownloadPaths
gitclonehttps://github.com/AAAA-Project/Patchs

rm-rffrida
#Downloadfridasoucecode
gitclone--recurse-submoduleshttps://github.com/frida/frida

cdfrida/frida-core

echo"starttopatchsourcecode
"

gitam../../Patchs/strongR-frida/frida-core/*.patch

echo"finishtopatchsourcecode
"

sleep2

cd..

makeclean

makecore-android-arm
makecore-android-arm64

审核编辑：汤梓红