Frida16.5.7字符特征去除

admin 2026-05-06 05:00:26 网络安全文章 来源:ZONE.CI 全球网 0 阅读模式

文章总结: 本文详细介绍了如何通过修改Frida16.5.7源码去除其字符特征以避免检测。核心步骤包括编译环境配置(NDKr25b和Nodev20.18.0)、修改agent文件名(如frida-agent改为nova-agent)、调整memfd注入路径模板及相关符号文件。关键原则是源码层修改可不等长替换,二进制patch需等长替换。文档提供了完整的sed命令和文件路径,最终通过meson构建验证修改效果。 综合评分: 84 文章分类: 逆向分析,免杀,移动安全,安全工具


cover_image

Frida 16.5.7字符特征去除

原创

十月的进阶之路 十月的进阶之路

十月的进阶之路

2026年5月5日 12:15 中国香港

在小说阅读器读本章

去阅读

从前的锁也好看,钥匙精美有样子。现在的代码也好看,跑起来就没影子。

目录

一、Frida编译

二、思路

三、特征清单与修改位置

四、修改汇总

五、编译与验证

六、注意事项


一、Frida编译

克隆frida 16.5.7分支的源码:

git clone --recurse-submodules -b 16.5.7 https://github.com/frida/frida

查找搭配的ndk和node版本:

┌──(shiyue㉿kali)-[~/frdia/frida]
└─$ grep -E 'ANDROID_NDK_VERSION|NODE_TARGETS|node-version' .github/workflows/ci.yml
  ANDROID_NDK_VERSION: r25b
  NODE_TARGETS_DEFAULT: '16.0.0 18.0.0 20.0.0 22.0.0'
  NODE_TARGETS_FREEBSD: '20.0.0'
          $nodeTargets = '${{ env.NODE_TARGETS_DEFAULT }}'.Split(' ')
            [node]="${{ env.NODE_TARGETS_DEFAULT }}"
            [node]="${{ env.NODE_TARGETS_DEFAULT }}"
          ndk-version: ${{ env.ANDROID_NDK_VERSION }}
          ndk-version: ${{ env.ANDROID_NDK_VERSION }}
          ndk-version: ${{ env.ANDROID_NDK_VERSION }}

选择ndk r25b和node v20.18.0,并构建环境变量。

┌──(shiyue㉿kali)-[~/frdia/node/node-v20.18.0-linux-x64/bin]
└─$ cat > ~/frdia/frida-build-env.sh << 'EOF'
#!/bin/bash
export ANDROID_NDK_ROOT=$HOME/frdia/ndk/android-ndk-r25b
export NODE_HOME=$HOME/frdia/node/node-v20.18.0-linux-x64
export PATH=$NODE_HOME/bin:$PATH
export PATH=$HOME/frdia/frida/deps/toolchain-linux-x86_64/bin:$PATH
EOF

┌──(shiyue㉿kali)-[~/frdia/node/node-v20.18.0-linux-x64/bin]
└─$ source ~/frdia/frida-build-env.sh

┌──(shiyue㉿kali)-[~/frdia/node/node-v20.18.0-linux-x64/bin]
└─$ echo "ANDROID_NDK_ROOT = $ANDROID_NDK_ROOT"
ANDROID_NDK_ROOT = /home/shiyue/frdia/ndk/android-ndk-r25b

┌──(shiyue㉿kali)-[~/frdia/node/node-v20.18.0-linux-x64/bin]
└─$ echo "NODE_HOME = $NODE_HOME"
NODE_HOME = /home/shiyue/frdia/node/node-v20.18.0-linux-x64

┌──(shiyue㉿kali)-[~/frdia/node/node-v20.18.0-linux-x64/bin]
└─$ node --version
v20.18.0

┌──(shiyue㉿kali)-[~/frdia/node/node-v20.18.0-linux-x64/bin]
└─$ cat $ANDROID_NDK_ROOT/source.properties | grep "Pkg.Revision"
Pkg.Revision = 25.1.8937393

报错提示32位交叉编译环境缺失,frida-core 的 compat 层需要编译 x86(32位)的 helper/agent,但系统缺少 32 位编译支持库。

sudo apt update
sudo apt install -y gcc-multilib g++-multilib lib32stdc++-14-dev

编译Android版本的frida-server:

cd ~/frdia/frida
source ~/frdia/frida-build-env.sh
export PATH=$HOME/frdia/frida/deps/toolchain-linux-x86_64/bin:$PATH
rm -rf build

python3 -c "
import sys
sys.path.insert(0, '.')
from releng.meson_configure import main
sys.argv = [
&nbsp; &nbsp; 'configure', '.',
&nbsp; &nbsp; '--host=android-arm64',
&nbsp; &nbsp; '--enable-server',
&nbsp; &nbsp; '--disable-frida-tools',
&nbsp; &nbsp; '--disable-frida-python'
]
main()
"

deps/toolchain-linux-x86_64/bin/ninja -C build

编译成功后再如下命令获取您的frida-server:

┌──(shiyue㉿kali)-[~/frdia/frida]
└─$ ls build/subprojects/frida-core/server
frida-server &nbsp;frida-server-raw &nbsp;frida-server-raw.p

二、思路

  • /proc//maps— 内存映射文件名
  • /proc//task/*/comm— 线程名
  • /proc/net/unix— Unix socket 路径
  • 导出符号表 — so 文件的导出函数名

源码层修改优于二进制patch,但预编译库只能binary patch。

关键原则:

  • 源码层修改:字符串长度不需要保持一致
  • 二进制 patch:必须等长替换(否则破坏对齐)
  • 字符串字面量(有引号)可以安全修改
  • 函数名/变量名修改需要同步所有引用

三、特征清单与修改位置

3.1 frida-agent.so 文件名(maps 中最明显的特征)

原理:agent以memfd方式注入,文件名来自PathTemplate和agent_name变量。

修改点1— agent主名称定义:

  • 文件:subprojects/frida-core/meson.build第195行
  • 原文:agent_name = frida-agent + shlib_suffix
  • 改为:agent_name = nova-agent + shlib_suffix
sed -i "s/agent_name = 'frida-agent'/agent_name = 'nova-agent'/" subprojects/frida-core/meson.build

修改点 2 — compat 构建脚本:

  • 文件:subprojects/frida-core/compat/build.py
  • 第639-642行:
# 原文
&nbsp; AGENT_TARGET = "frida-agent"
&nbsp; AGENT_FILE_WINDOWS = Path("lib") / "agent" / "frida-agent.dll"
&nbsp; AGENT_FILE_DARWIN = Path("lib") / "agent" / "frida-agent.dylib"
&nbsp; AGENT_FILE_ELF = Path("lib") / "agent" / "frida-agent.so"
&nbsp; # 改为
&nbsp; AGENT_TARGET = "nova-agent"
&nbsp; AGENT_FILE_WINDOWS = Path("lib") / "agent" / "nova-agent.dll"
&nbsp; AGENT_FILE_DARWIN = Path("lib") / "agent" / "nova-agent.dylib"
&nbsp; AGENT_FILE_ELF = Path("lib") / "agent" / "nova-agent.so"
  • 第301行:name=”frida-agent-arm.so” → name=”nova-agent-arm.so”
  • 第308行:name=”frida-agent-arm64.so” → name=”nova-agent-arm64.so”
sed -i 's/AGENT_TARGET = "frida-agent"/AGENT_TARGET = "nova-agent"/' subprojects/frida-core/compat/build.py
sed -i 's|AGENT_FILE_WINDOWS = Path("lib") / "agent" / "frida-agent.dll"|AGENT_FILE_WINDOWS = Path("lib") / "agent" / "nova-agent.dll"|' subprojects/frida-core/compat/build.py
sed -i 's|AGENT_FILE_DARWIN = Path("lib") / "agent" / "frida-agent.dylib"|AGENT_FILE_DARWIN = Path("lib") / "agent" / "nova-agent.dylib"|' subprojects/frida-core/compat/build.py
sed -i 's|AGENT_FILE_ELF = Path("lib") / "agent" / "frida-agent.so"|AGENT_FILE_ELF = Path("lib") / "agent" / "nova-agent.so"|' subprojects/frida-core/compat/build.py
sed -i 's/name="frida-agent-arm.so"/name="nova-agent-arm.so"/' subprojects/frida-core/compat/build.py
sed -i 's/name="frida-agent-arm64.so"/name="nova-agent-arm64.so"/' subprojects/frida-core/compat/build.py

修改点 3 — memfd 注入时的文件名模板:

  • 文件:subprojects/frida-core/src/linux/linux-host-session.vala约131行
  • 原文:agent = new AgentDescriptor (PathTemplate (“frida-agent-.so”),
  • 改为:agent = new AgentDescriptor (PathTemplate (“nova-agent-.so”),
  • 同行附近还有:
# 原文
&nbsp; new AgentResource ("frida-agent-arm.so", ...)
&nbsp; new AgentResource ("frida-agent-arm64.so", ...)
&nbsp; # 改为
&nbsp; new AgentResource ("nova-agent-arm.so", ...)
&nbsp; new AgentResource ("nova-agent-arm64.so", ...)

sed -i 's#new&nbsp;AgentDescriptor (PathTemplate ("frida-agent-<arch>.so")#new&nbsp;AgentDescriptor (PathTemplate ("nova-agent-<arch>.so")#' subprojects/frida-core/src/linux/linux-host-session.vala
sed -i 's/new AgentResource ("frida-agent-arm.so"/new AgentResource ("nova-agent-arm.so"/' subprojects/frida-core/src/linux/linux-host-session.vala
sed -i 's/new AgentResource ("frida-agent-arm64.so"/new AgentResource ("nova-agent-arm64.so"/' subprojects/frida-core/src/linux/linux-host-session.vala

修改点 4 — meson 构建目标名:

  • 文件:subprojects/frida-core/lib/agent/meson.build第72行
  • 原文:agent = custom_target(‘frida-agent’,
  • 改为:agent = custom_target(‘nova-agent’,
sed -i "s/agent = custom_target('frida-agent'/agent = custom_target('nova-agent'/" subprojects/frida-core/lib/agent/meson.build

修改点 5 — 符号文件重命名(实际文件):

cd subprojects/frida-core/lib/agent/
mv frida-agent.symbols nova-agent.symbols
mv frida-agent-x86.symbols nova-agent-x86.symbols
mv frida-agent.version nova-agent.version
mv frida-agent.def nova-agent.def
cd ../../../

同步更新 meson.build 里的引用(第24、31、44、48行)。

sed -i 's/frida-agent-x86\.symbols/nova-agent-x86.symbols/g' subprojects/frida-core/lib/agent/meson.build
sed -i 's/frida-agent\.symbols/nova-agent.symbols/g' subprojects/frida-core/lib/agent/meson.build
sed -i 's/frida-agent\.version/nova-agent.version/g' subprojects/frida-core/lib/agent/meson.build
sed -i 's/frida-agent\.def/nova-agent.def/g' subprojects/frida-core/lib/agent/meson.build

修改点 6 — agent-glue.c 头文件引用:

  • 文件:subprojects/frida-core/lib/agent/agent-glue.c第1行
  • 原文:#include “frida-agent.h”
  • 改为:#include “nova-agent.h”
sed -i 's/#include&nbsp;"frida-agent.h"/#include&nbsp;"nova-agent.h"/' subprojects/frida-core/lib/agent/agent-glue.c

注意:改完构建目标后需要重新跑配置步骤,必要时清理 build 目录后再重新生成构建文件。

3.2 frida_agent_main 导出符号

原理:frida_agent_main由Vala编译器从namespace Frida { public void main(…) }自动生成。不改 namespace,而是在C层加包装函数对外导出新符号名。

修改点 1 — 添加包装函数:

文件:subprojects/frida-core/lib/agent/agent-glue.c末尾添加:

void
&nbsp; nova_agent_main (const gchar* agent_parameters, FridaUnloadPolicy* unload_policy, void* injector_state)
&nbsp; {
&nbsp; &nbsp; frida_agent_main (agent_parameters, unload_policy, injector_state);
&nbsp; }

# 先删除可能存在的旧版本(symbol alias 等)
sed -i '/void nova_agent_main.*__attribute__/d' subprojects/frida-core/lib/agent/agent-glue.c
sed -i '/^nova_agent_main (.*alias/d' subprojects/frida-core/lib/agent/agent-glue.c

# 追加正确的包装函数
cat >> subprojects/frida-core/lib/agent/agent-glue.c << 'EOF'

void
nova_agent_main (const gchar* agent_parameters, FridaUnloadPolicy* unload_policy, void* injector_state)
{
&nbsp; frida_agent_main (agent_parameters, unload_policy, injector_state);
}
EOF

修改点 2 — 符号导出文件:

文件:subprojects/frida-core/lib/agent/nova-agent.version

{ global: nova_agent_main; JNI_OnLoad; local: *; };

文件:subprojects/frida-core/lib/agent/nova-agent.symbols

nova_agent_main

修改:

sed -i 's/frida_agent_main/nova_agent_main/' subprojects/frida-core/lib/agent/nova-agent.version
sed -i 's/frida_agent_main/nova_agent_main/' subprojects/frida-core/lib/agent/nova-agent.symbols

修改点 3 — 所有注入调用处(字符串引用):

  • subprojects/frida-core/src/linux/linux-host-session.vala
  • subprojects/frida-core/src/darwin/darwin-host-session.vala
  • subprojects/frida-core/src/windows/windows-host-session.vala
  • subprojects/frida-core/src/freebsd/freebsd-host-session.vala
  • subprojects/frida-core/src/qnx/qnx-host-session.vala
  • subprojects/frida-core/src/agent-container.vala

以上文件中把”frida_agent_main”字符串替换为”nova_agent_main”。

sed -i 's/"frida_agent_main"/"nova_agent_main"/g' subprojects/frida-core/src/linux/linux-host-session.vala
sed -i 's/"frida_agent_main"/"nova_agent_main"/g' subprojects/frida-core/src/darwin/darwin-host-session.vala
sed -i 's/"frida_agent_main"/"nova_agent_main"/g' subprojects/frida-core/src/windows/windows-host-session.vala
sed -i 's/"frida_agent_main"/"nova_agent_main"/g' subprojects/frida-core/src/freebsd/freebsd-host-session.vala
sed -i 's/"frida_agent_main"/"nova_agent_main"/g' subprojects/frida-core/src/qnx/qnx-host-session.vala
sed -i 's/"frida_agent_main"/"nova_agent_main"/g' subprojects/frida-core/src/agent-container.vala

注意:agent-glue.c中JNI_OnLoad内部调用frida_agent_main(…)和包装函数本身引用frida_agent_main都不需要修改,这是正确的内部调用。

3.3 gum-js-loop 线程名

原理:纯字符串字面量,传给g_thread_new()作为线程名,与功能无关。

  • 文件:subprojects/frida-gum/bindings/gumjs/gumscriptscheduler.c第117行
  • 原文:g_thread_new (“gum-js-loop”,
  • 改为:g_thread_new (“js-worker”,
sed -i 's/"gum-js-loop"/"js-worker"/g' subprojects/frida-gum/bindings/gumjs/gumscriptscheduler.c

3.4 gmain/gdbus 线程名

原理:这两个线程名来自 GLib 预编译静态库内部,不在 frida 源码中。需要对预编译库做二进制等长 patch,同时对最终编译产物 frida-server 也做 binary patch(因为 64 位 agent blob 是预编译嵌入的)。

等长替换:

  • gmain(5字节) → gloop(5字节)
  • gdbus(5字节) → gconn(5字节)

需要 patch 的库文件:

subprojects/frida-core/deps/sdk-android-arm/lib/libglib-2.0.a &nbsp;→ gmain
subprojects/frida-core/deps/sdk-android-arm/lib/libgio-2.0.a &nbsp; → gdbus
subprojects/frida-core/deps/sdk-linux-x86_64/lib/libglib-2.0.a → gmain
subprojects/frida-core/deps/sdk-linux-x86_64/lib/libgio-2.0.a &nbsp;→ gdbus

Python binary patch 脚本(对预编译库):

python3 << 'EOF'
import os

files_gmain = [
&nbsp; &nbsp; "subprojects/frida-core/deps/sdk-android-arm/lib/libglib-2.0.a",
&nbsp; &nbsp; "subprojects/frida-core/deps/sdk-linux-x86_64/lib/libglib-2.0.a",
]
files_gdbus = [
&nbsp; &nbsp; "subprojects/frida-core/deps/sdk-android-arm/lib/libgio-2.0.a",
&nbsp; &nbsp; "subprojects/frida-core/deps/sdk-linux-x86_64/lib/libgio-2.0.a",
]

def patch_file(path, old, new):
&nbsp; &nbsp; with open(path, 'rb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; data = f.read()
&nbsp; &nbsp; count = data.count(old)
&nbsp; &nbsp; if count == 0:
&nbsp; &nbsp; &nbsp; &nbsp; print(f" &nbsp;NOT FOUND in {path}")
&nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; data = data.replace(old, new)
&nbsp; &nbsp; with open(path, 'wb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; f.write(data)
&nbsp; &nbsp; print(f" &nbsp;Patched {count} occurrence(s) in {path}")

print("Patching gmain -> gloop:")
for f in files_gmain:
&nbsp; &nbsp; patch_file(f, b'gmain\x00', b'gloop\x00')

print("Patching gdbus -> gconn:")
for f in files_gdbus:
&nbsp; &nbsp; patch_file(f, b'gdbus\x00', b'gconn\x00')

print("Done")
EOF

编译后还需对产物做 binary patch:

(包括预编译嵌入的 64 位 agent blob 和最终 server)

# 对中间 agent so 进行 patch
python3 << 'EOF'
def patch_file(path, old, new):
&nbsp; &nbsp; with open(path, 'rb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; data = f.read()
&nbsp; &nbsp; count = data.count(old)
&nbsp; &nbsp; if count == 0:
&nbsp; &nbsp; &nbsp; &nbsp; print(f" &nbsp;NOT FOUND in {path}")
&nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; data = data.replace(old, new)
&nbsp; &nbsp; with open(path, 'wb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; f.write(data)
&nbsp; &nbsp; print(f" &nbsp;Patched {count} occurrence(s) in {path}")

files = [
&nbsp; &nbsp; "build/subprojects/frida-core/lib/agent/nova-agent.so",
&nbsp; &nbsp; "build/subprojects/frida-core/compat/nova-agent.so",
]

for f in files:
&nbsp; &nbsp; print(f"Patching {f}:")
&nbsp; &nbsp; patch_file(f, b'gmain\x00', b'gloop\x00')
&nbsp; &nbsp; patch_file(f, b'gdbus\x00', b'gconn\x00')

print("Done")
EOF

# 扩大范围,确保所有 agent 及 frida-server 都被覆盖
python3 << 'EOF'
def patch_file(path, old, new):
&nbsp; &nbsp; try:
&nbsp; &nbsp; &nbsp; &nbsp; with open(path, 'rb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; data = f.read()
&nbsp; &nbsp; &nbsp; &nbsp; count = data.count(old)
&nbsp; &nbsp; &nbsp; &nbsp; if count == 0:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print(f" &nbsp;NOT FOUND: {path}")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; &nbsp; &nbsp; data = data.replace(old, new)
&nbsp; &nbsp; &nbsp; &nbsp; with open(path, 'wb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; f.write(data)
&nbsp; &nbsp; &nbsp; &nbsp; print(f" &nbsp;Patched {count}x in {path}")
&nbsp; &nbsp; except FileNotFoundError:
&nbsp; &nbsp; &nbsp; &nbsp; print(f" &nbsp;SKIP (not found): {path}")

import glob
all_agents = glob.glob("build/**/nova-agent*.so", recursive=True) + \
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;glob.glob("build/**/frida-agent*.so", recursive=True)

for f in all_agents:
&nbsp; &nbsp; patch_file(f, b'gmain\x00', b'gloop\x00')
&nbsp; &nbsp; patch_file(f, b'gdbus\x00', b'gconn\x00')

print("Done")
EOF

# 最终 patch frida-server
python3 << 'EOF'
def patch_file(path, old, new):
&nbsp; &nbsp; with open(path, 'rb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; data = f.read()
&nbsp; &nbsp; count = data.count(old)
&nbsp; &nbsp; if count == 0:
&nbsp; &nbsp; &nbsp; &nbsp; print(f" &nbsp;NOT FOUND")
&nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; data = data.replace(old, new)
&nbsp; &nbsp; with open(path, 'wb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; f.write(data)
&nbsp; &nbsp; print(f" &nbsp;Patched {count}x")

path = "build/subprojects/frida-core/server/frida-server"
print("Patching frida-server:")
patch_file(path, b'gmain\x00', b'gloop\x00')
patch_file(path, b'gdbus\x00', b'gconn\x00')
print("Done")
EOF

注意:每次重新编译后需重新对 frida-server 做 binary patch,因为编译会覆盖产物。 建议把 binary patch 做成脚本在编译后自动执行。

3.5 Unix Socket 路径 @/frida-xxx

原理: Frida创建了Unix socket,并使用硬编码路径前缀。

修改点 1:

  • 文件:subprojects/frida-core/src/linux/frida-helper-process.vala约318行
  • 原文:string socket_path = “/frida-” + Uuid.string_random ();
  • 改为:string socket_path = “/nova-” + Uuid.string_random ();
sed -i 's#string&nbsp;socket_path = "/frida-" + Uuid.string_random ();#string&nbsp;socket_path = "/nova-" + Uuid.string_random ();#' subprojects/frida-core/src/linux/frida-helper-process.vala

修改点 2:

  • 文件:subprojects/frida-core/src/linux/frida-helper-backend.vala约1245行
  • 原文:return “/frida-” + Uuid.string_random ();
  • 改为:return “/nova-” + Uuid.string_random ();
sed -i 's#return&nbsp;"/frida-" + Uuid.string_random ();#return&nbsp;"/nova-" + Uuid.string_random ();#' subprojects/frida-core/src/linux/frida-helper-backend.vala

3.6 frida:rpc 协议标识(需客户端同步修改)

原理:frida RPC 通信的消息类型标识,服务端和客户端都硬编码了这个字符串,必须同步修改,否则通信中断。

服务端修改(3处):

  • 文件:subprojects/frida-core/lib/base/rpc.vala
  • 第20行:.add_string_value (“frida:rpc”) → .add_string_value (“nova:rpc”)
  • 第73行:json.index_of (“\”frida:rpc\””)`→ json.index_of (“\”nova:rpc\””)
  • 第102行:type != “frida:rpc”type != “nova:rpc”
sed -i 's/.add_string_value ("frida:rpc")/.add_string_value ("nova:rpc")/' subprojects/frida-core/lib/base/rpc.vala
sed -i 's|json.index_of ("\\"frida:rpc\\"")|json.index_of ("\\"nova:rpc\\"")|' subprojects/frida-core/lib/base/rpc.vala
sed -i 's/type != "frida:rpc"/type != "nova:rpc"/' subprojects/frida-core/lib/base/rpc.vala

JS 运行时修改:

  • 文件:subprojects/frida-gum/bindings/gumjs/runtime/worker.js
  • 文件:subprojects/frida-gum/bindings/gumjs/runtime/message-dispatcher.js
sed -i "s/'frida:rpc'/'nova:rpc'/g" subprojects/frida-gum/bindings/gumjs/runtime/worker.js
sed -i "s/'frida:rpc'/'nova:rpc'/g" subprojects/frida-gum/bindings/gumjs/runtime/message-dispatcher.js

客户端修改(Windows 已安装的 frida-python):

  • 文件:\Lib\site-packages\frida\core.py
  • 第511行:self.post([“frida:rpc”, …)→ self.post([“nova:rpc”, …)
  • 第554行:payload[0] == “frida:rpc” → payload[0] == “nova:rpc”

客户端路径根据实际安装位置调整。

3.7 DBus Helper 服务名(补充特征)

原理:Frida Helper的DBus 接口名包含re.frida.Helper,也是明显特征。

  • 文件:subprojects/frida-core/src/linux/frida-helper-types.vala第45行
  • 原文:[DBus (name = “re.frida.Helper”)]
  • 改为:[DBus (name = “re.nova.Helper”)]

四、修改汇总

| | | | | | — | — | — | — | | 特征 | 位置 | 修改方式 | 结果 | | frida-agent.so in maps | meson.build / linux-host-session.vala | 源码修改 | → nova-agent-64.so | | frida_agent_main 导出符号 | agent-glue.c/ 符号文件 | 添加包装函数 | 新增 nova_agent_main | | gum-js-loop 线程名 | gumscriptscheduler.c | 源码修改 | → js-worker | | gmain 线程名 | libglib-2.0.a + frida-server | binary patch | → gloop | | gdbus 线程名 | libgio-2.0.a + frida-server | binary patch | → gconn | | @/frida-xxx socket | frida-helper-process.vala / frida-helper-backend.vala | 源码修改 | → @/nova-xxx | | frida:rpc 协议标识 | rpc.vala / worker.js / message-dispatcher.js / core.py | 源码修改 | → nova:rpc | | re.frida.Helper DBus 接口 | frida-helper-types.vala | 源码修改 | → re.nova.Helper |

五、编译与验证

编译命令

cd ~/frdia/frida
source ~/frdia/frida-build-env.sh
export PATH=$HOME/frdia/frida/deps/toolchain-linux-x86_64/bin:$PATH
rm -rf build

python3 -c "
import sys
sys.path.insert(0, '.')
from releng.meson_configure import main
sys.argv = [
&nbsp; &nbsp; 'configure', '.',
&nbsp; &nbsp; '--host=android-arm64',
&nbsp; &nbsp; '--enable-server',
&nbsp; &nbsp; '--disable-frida-tools',
&nbsp; &nbsp; '--disable-frida-python'
]
main()
"
# 有时需要强制重新链接 agent(删除旧产物)
find build/subprojects/frida-core/compat -name "*.so" -delete
find build/subprojects/frida-core/lib/agent -name "*.so" -delete

deps/toolchain-linux-x86_64/bin/ninja -C build

编译后 binary patch(每次编译后执行)

# 对最终 frida-server 执行 gmain/gdbus patch
python3 << 'EOF'
def patch_file(path, old, new):
&nbsp; &nbsp; with open(path, 'rb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; data = f.read()
&nbsp; &nbsp; count = data.count(old)
&nbsp; &nbsp; if count == 0:
&nbsp; &nbsp; &nbsp; &nbsp; print(f" &nbsp;NOT FOUND")
&nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; data = data.replace(old, new)
&nbsp; &nbsp; with open(path, 'wb') as f:
&nbsp; &nbsp; &nbsp; &nbsp; f.write(data)
&nbsp; &nbsp; print(f" &nbsp;Patched {count}x")

path = "build/subprojects/frida-core/server/frida-server"
print("Patching frida-server:")
patch_file(path, b'gmain\x00', b'gloop\x00')
patch_file(path, b'gdbus\x00', b'gconn\x00')
print("Done")
EOF

验证命令(设备上执行)

六、注意事项

  1. binary patch会被编译覆盖:每次重新编译 frida-server 后,需要重新执行 binary patch 脚本(尤其是 gmain/gdbus)。
  2. FRIDA_XXX 枚举常量不需要处理:FRIDA_AGENT_MODE_*等是 GObject 类型系统生成的调试字符串,不出现在可被外部扫描的位置。
  3. frida:rpc 客户端必须同步:只改服务端会导致 RPC 通信完全失败。
  4. 64位 agent blob 是预编译嵌入的:arm64 的 GLib 库不在本地 deps 目录,需要对编译产物直接做 binary patch,已在 2.4 节涵盖。
  5. meson 构建目标改名后需要 reconfigure:否则 ninja 报target not found错误,运行make触发重新 configure。若仍失败,可尝试rm -rf build后重新make。

免责声明:

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景,旨在提升网络安全防护能力,具有明确的技术研究属性。

任何单位或个人未经授权,将本文内容用于攻击、破坏等非法用途的,由此引发的全部法律责任、民事赔偿及连带责任,均由行为人独立承担,本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布,若存在版权侵权或其他异议,请通过邮件联系处理,具体联系方式可点击页面上方的联系我

本文转载自:十月的进阶之路 十月的进阶之路 十月的进阶之路《Frida 16.5.7字符特征去除》

评论:0   参与:  0