这周尝试在android上使用frida-dexdump去获取加固的apk里的dex,写了两个版本的脚本,方便大家使用。
在真机上
frida-server下载地址:https://github.com/frida/frida/releases/download/15.1.17/frida-server-15.1.17-android-arm64.xz
set /p text=请确认设备已Root,任意键继续
pip install frida-tools
pip install frida-dexdump
adb push frida-server-15.1.17-linux-arm64 /data/local/tmp
adb shell chmod 777 /data/local/tmp/frida-server-15.1.17-linux-arm64
adb shell "su -c setenforce 0"
adb shell "su -c /data/local/tmp/frida-server-15.1.17-linux-arm64 &"
set /p text=请运行需要脱壳的APK,然后按任意键继续
frida-dexdump -FU -d -o .
补充说明:
1)因为遇到了Unable to load SELinux policy from the kernel: Failed to open file “/sys/fs/selinux/policy”: Permission denied
的问题,在https://github.com/frida/frida/issues/597 这里找到了解决答案,即调用:
setenforce 0
。这个命令会暂时禁用selinux,下次重启后就会恢复。
2)命令结尾加&:后台执行,不阻塞在这里
在夜神模拟器上
frida-server下载地址:https://github.com/frida/frida/releases/download/15.1.17/frida-server-15.1.17-android-x86.xz
set /p text=请确认设备已Root,任意键继续
pip install frida-tools
pip install frida-dexdump
adb push frida-server-15.1.17-linux-x86 /data/local/tmp
adb shell chmod 777 /data/local/tmp/frida-server-15.1.17-linux-x86
adb shell "su -c /data/local/tmp/frida-server-15.1.17-linux-x86 &"
set /p text=请运行需要脱壳的APK,然后按任意键继续
frida-dexdump -FU -d -o .
获取到Dex后
推荐使用Jadx进行反编译
参考:
https://bbs.pediy.com/thread-271617.htm
https://www.jianshu.com/p/c349471bdef7