Frida检测下frida-dexdump的使用姿势

最近在逆向某app的时候，碰到了360加固，我这个刚入门的萌新只会frida-dexdump

一把梭下去直接报错了

看看加载了哪个so，发现是经典的libmsaoaidsec.so多线程反调

直接hook clone绕过

function nop_64(addr) {
    Memory.protect(addr, 4 , 'rwx');
    var w = new Arm64Writer(addr);
    w.putRet();
    w.flush();
    w.dispose();
}

function hook_clone(soname)
{
    var clone = Module.findExportByName('libc.so', 'clone');
    Interceptor.attach(clone, {
        onEnter: function(args) {
            // args[3] 子线程的栈地址。如果这个值为 0，可能意味着没有指定栈地址
            if(args[3] != 0){
                var addr = args[3].add(96).readPointer()
                var so_name = Process.findModuleByAddress(addr).name;
                var so_base = Module.getBaseAddress(so_name);
                var offset = (addr - so_base);
                //console.log("===============>", so_name, addr,offset, offset.toString(16));
                if(so_name.indexOf(soname) >= 0) {
                    console.log("===============>", so_name, addr,offset, offset.toString(16));
                    nop_64(addr)
                }
            }
        },
        onLeave: function(retval) {
     
        }
    });
     
}

setImmediate(hook_clone, "libmsaoaidsec.so")