objection -g 进程名 explore --startup-command "android hooking watch class 路径.类名"
objection基础api
1 2
memory list modules -查看内存中加载的库 memory list exports so名称 - 查看库的导出函数
1 2 3 4 5 6 7 8 9
com.zj.wuaipojie on (OnePlus: 11) [usb] # memory list exports libandroidio.so Save the output by adding `--json exports.json` to this command Type Name Address -------- ------------------------------------------ ------------ function async_close_monitor_create 0x7625e87124 function async_close_monitor_destroy 0x7625e87190 function async_close_monitor_signal_blocked_threads 0x7625e870ac function async_close_monitor_static_init 0x7625e87014 function async_close_monitor_was_signalled 0x7625e87200
1
android hooking list activities -查看内存中加载的activity android hooking list services -查看内存中加载的services
com.zj.wuaipojie on (google: 13) [usb] # android heap search instances com.zj.wuaipojie.Demo Class instance enumeration complete for com.zj.wuaipojie.Demo Hashcode Class toString() --------- --------------------- ----------------------------- 127867717 com.zj.wuaipojie.Demo com.zj.wuaipojie.Demo@79f1b45
调用实例的方法
无参数
1 2 3 4 5
com.zj.wuaipojie on (google: 13) [usb] # android heap execute 127867717 getPublicInt Handle 127867717 is to class com.zj.wuaipojie.Demo Executing method: getPublicInt() 200
有参数
1 2 3 4 5 6 7
com.zj.wuaipojie on (google: 13) [usb] # android heap evaluate 127867717 (The hashcode at `127867717` will be available as the `clazz` variable.) console.log(clazz.a("修改后的")); JavaScript capture complete. Evaluating... Handle 127867717 is to class com.zj.wuaipojie.Demo 这是一个修改后的方法
android hooking list classes -列出内存中所有的类(结果比静态分析的更准确) 这个列出的太多了，一般用不到
com.zj.wuaipojie on (google: 13) [usb] # android hooking search classes wuaipojie Note that Java classes are only loaded when they are used, so if the expected class has not been found, it might not have been loaded yet. com.zj.wuaipojie.Demo com.zj.wuaipojie.Demo$Animal com.zj.wuaipojie.Demo$Companion com.zj.wuaipojie.Demo$InnerClass com.zj.wuaipojie.Demo$test$1 com.zj.wuaipojie.MainApplication com.zj.wuaipojie.databinding.ActivityMainBinding com.zj.wuaipojie.databinding.FragmentHomeBinding com.zj.wuaipojie.ui.Adapter.ChallengeAdapter com.zj.wuaipojie.ui.Adapter.ChallengeAdapter$$ExternalSyntheticLambda0 com.zj.wuaipojie.ui.Adapter.ChallengeAdapter$ViewHolder com.zj.wuaipojie.ui.Challenge com.zj.wuaipojie.ui.ChallengeSixth com.zj.wuaipojie.ui.ChallengeSixth$$ExternalSyntheticLambda0 com.zj.wuaipojie.ui.ChallengeSixth$$ExternalSyntheticLambda1 com.zj.wuaipojie.ui.ChallengeSixth$$ExternalSyntheticLambda2 com.zj.wuaipojie.ui.ChallengeSixth$$ExternalSyntheticLambda3 com.zj.wuaipojie.ui.Fragment.ChallengeFragment com.zj.wuaipojie.ui.Fragment.HomeFragment com.zj.wuaipojie.ui.MainActivity com.zj.wuaipojie.ui.MainActivity$$ExternalSyntheticLambda0 com.zj.wuaipojie.ui.MainActivity$handler$1 com.zj.wuaipojie.ui.MainActivity$inlined$sam$i$androidx_navigation_ui_AppBarConfiguration_OnNavigateUpListener$0 com.zj.wuaipojie.ui.MainActivity$onCreate$$inlined$AppBarConfiguration$default$1 com.zj.wuaipojie.util.SPUtils
com.zj.wuaipojie on (google: 13) [usb] # android hooking list class_methods com.zj.wuaipojie.Demo private final void com.zj.wuaipojie.Demo.complexParameterFunc(java.lang.String,java.util.HashMap<java.lang.Object, java.lang.Object>) private final void com.zj.wuaipojie.Demo.privateFunc(java.lang.String) private final void com.zj.wuaipojie.Demo.refl() private final void com.zj.wuaipojie.Demo.repleaceFunc() private final void com.zj.wuaipojie.Demo.staticPrivateFunc(java.lang.String) public final int com.zj.wuaipojie.Demo.getPublicInt() public final java.lang.String com.zj.wuaipojie.Demo.a(java.lang.String) public final void com.zj.wuaipojie.Demo.Inner(com.zj.wuaipojie.Demo$Animal,java.lang.String) public final void com.zj.wuaipojie.Demo.setPublicInt(int) public final void com.zj.wuaipojie.Demo.test() public static final java.lang.String com.zj.wuaipojie.Demo.access$getStaticField$cp()
Found 11 method(s)
com.zj.wuaipojie on (google: 13) [usb] # android hooking list class_methods com.zj.wuaipojie.ui.ChallengeSixth private static final void com.zj.wuaipojie.ui.ChallengeSixth.onCreate$lambda-0(com.zj.wuaipojie.ui.ChallengeSixth,android.view.View) private static final void com.zj.wuaipojie.ui.ChallengeSixth.onCreate$lambda-1(com.zj.wuaipojie.ui.ChallengeSixth,android.view.View) private static final void com.zj.wuaipojie.ui.ChallengeSixth.onCreate$lambda-2(com.zj.wuaipojie.ui.ChallengeSixth,android.view.View) private static final void com.zj.wuaipojie.ui.ChallengeSixth.onCreate$lambda-3(com.zj.wuaipojie.ui.ChallengeSixth,android.view.View) protected void com.zj.wuaipojie.ui.ChallengeSixth.onCreate(android.os.Bundle) public final java.lang.String com.zj.wuaipojie.ui.ChallengeSixth.hexToString(java.lang.String) public final java.lang.String com.zj.wuaipojie.ui.ChallengeSixth.unicodeToString(java.lang.String) public final void com.zj.wuaipojie.ui.ChallengeSixth.toastPrint(java.lang.String) public static void com.zj.wuaipojie.ui.ChallengeSixth.$r8$lambda$1lrkrgiCEFWXZDHzLRibYURG1h8(com.zj.wuaipojie.ui.ChallengeSixth,android.view.View) public static void com.zj.wuaipojie.ui.ChallengeSixth.$r8$lambda$IUqwMqbTKaOGiTaeOmvy_GjNBso(com.zj.wuaipojie.ui.ChallengeSixth,android.view.View) public static void com.zj.wuaipojie.ui.ChallengeSixth.$r8$lambda$Kc_cRYZjjhjsTl6GYNHbgD-i6sE(com.zj.wuaipojie.ui.ChallengeSixth,android.view.View) public static void com.zj.wuaipojie.ui.ChallengeSixth.$r8$lambda$PDKm2AfziZQo6Lv1HEFkJWkUsoE(com.zj.wuaipojie.ui.ChallengeSixth,android.view.View)
