Giter Club home page Giter Club logo

fartext's Introduction

FartExt

在FART的基础上进行优化并实现更深的主动调用,来实现脱抽取壳。适用AOSP10

本人的测试版本是android 10r2,测试手机是pixel3。如需其他版本,请自行编译。

编译的版本是sailfish Pixel binaries for Android 10.0.0 (QP1A.191005.007.A1)

下载

链接: https://pan.baidu.com/s/1lgG8P3H2Q5B6e7rZr58cXw 密码: 033p

使用

1、完整主动调用

echo "packageName" > /data/local/tmp/fext.config

打开应用等待60秒后开始完整的主动调用。

adb logcat |grep fartext查看日志。出现fart over就是脱壳完成了

2、指定类主动调用

将要dump的所有类名写入/data/local/tmp/目标进程包名中。

格式可以是com.myClass也可以是Lcom\myClass;内部会自动解析

3、frida辅助调用

可以使用fridaUiTools中的fart功能中的rom主动调用来触发

image-20210805100343385

也可以自己使用frida脚本

function romClassesInvoke(classes){
    Java.perform(function(){
        klog("romClassesInvoke start load");
        var fartExt=Java.use("cn.mik.Fartext");
        if(!fartExt.fartWithClassList){
            klog("fartExt中未找到fartWithClassList函数,可能是未使用Fartext的rom")
            return ;
        }
        fartExt.fartWithClassList(classes);
    })
}

function romFartAllClassLoader(){
    Java.perform(function(){
       var fartExt=Java.use("cn.mik.Fartext");
       if(!fartExt.fartWithClassLoader){
           klog("fartExt中未找到fartWithClassLoader函数,可能是未使用Fartext的rom");
           return;
       }
       Java.enumerateClassLoadersSync().forEach(function(loader){
           klog("romFartAllClassLoader to loader:"+loader);
           if(loader.toString().indexOf("BootClassLoader")==-1){
               klog("fart start loader:"+loader);
               fartExt.fartWithClassLoader(loader);
           }
       })
    });
}

4、修复dex

脱壳的结果是保存在/sdcard/fext/目标进程包名

使用dexfixer修复

java -jar ./dexfixer.jar dexpath binpath outpath

或者使用fridaUiTools的辅助功能进行修复

image-20210805100310939

5、日志查看

logcat搜索fartext即可搜到所有相关日志。

6、流程图

image-20210804190809645

7、实现原理及案例

FartExt之优化更深主动调用的FART10

fartext's People

Contributors

dqzg12300 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.