"/data/local/bin/su",    "/data/local/su",    "/data/local/xbin/su",    "/dev/com.koushikdutta.superuser.daemon/",    "/sbin/su",    "/system/app/Superuser.apk",    "/system/bin/failsafe/su",    "/system/bin/su",    "/su/bin/su",    "/system/etc/init.d/99SuperSUDaemon",    "/system/sd/xbin/su",    "/system/xbin/busybox",    "/system/xbin/daemonsu",    "/system/xbin/su",    "/system/sbin/su",    "/vendor/bin/su",    "/cache/su",    "/data/su",    "/dev/su",    "/system/bin/.ext/su",    "/system/usr/we-need-root/su",    "/system/app/Kinguser.apk",    "/data/adb/magisk",    "/sbin/.magisk",    "/cache/.disable_magisk",    "/dev/.magisk.unblock",    "/cache/magisk.log",    "/data/adb/magisk.img",    "/data/adb/magisk.db",    "/data/adb/magisk_simple",    "/init.magisk.rc",    "/system/xbin/ku.sud"

   "com.noshufou.android.su",    "com.noshufou.android.su.elite",    "eu.chainfire.supersu",    "com.koushikdutta.superuser",    "com.thirdparty.superuser",    "com.yellowes.su",    "com.koushikdutta.rommanager",    "com.koushikdutta.rommanager.license",    "com.dimonvideo.luckypatcher",    "com.chelpus.lackypatch",    "com.ramdroid.appquarantine",    "com.ramdroid.appquarantinepro",    "com.topjohnwu.magisk",    "com.kingroot.kinguser",    "com.kingo.root",    "com.smedialink.oneclickroot",    "com.zhiqupk.root.global",    "com.alephzain.framaroot",    "com.android.vending.billing.InAppBillingService.COIN",    "com.android.vending.billing.InAppBillingService.LUCK",    "com.chelpus.luckypatcher",    "com.blackmartalpha",    "org.blackmart.market",    "com.allinone.free",    "com.repodroid.app",    "org.creeplays.hack",    "com.baseappfull.fwd",    "com.zmapp",    "com.dv.marketmod.installer",    "org.mobilism.android",    "com.android.wp.net.log",    "com.android.camera.update",    "cc.madkite.freedom",    "com.solohsu.android.edxp.manager",    "org.meowcat.edxposed.manager",    "com.xmodgame",    "com.cih.game_cih",    "com.charles.lpoqasert",    "catch_.me_.if_.you_.can_"

frida -U -f com.xxxx.xxxx -l anti_root.js --no-pause

frida-dexdump -FU

  function htddecrypt(param,key){        var result;        Java.perform(function () {                        var hclass = Java.use("com.xxxx.xxxx.utils.http.DESHelp");            var hexarry = hclass.parseHexStr2Byte(param);            param = byteToString(hexarry);            console.log("[*] Hooking ...");            result = hclass.decrypt(param, key);            //console.log(result);         });        return result;    }

    function htdencrypt(param,key){        var result;        var enc        Java.perform(function () {            var hclass = Java.use("com.xxxx.xxxx.utils.http.DESHelp");            console.log(param);            enc = hclass.encrypt(param, key);            //console.log(result);             var hexarry = stringToByte(enc);            result = hclass.parseByte2HexStr(hexarry);        });        return result;    }    

    rpc.exports = {          rpcfunc: htdencrypt,        rpcfunc1: htddecrypt

    }

session = frida.get_usb_device().attach("com.xxxx.xxxx")   script = frida_rpc(session)param = str(sys.argv[2])ret = script.exports.rpcfunc(param,"CCCk+H%b6.MMMMkoKKK")print(ret)