function isLibexecModule(name) { if (!name) return false; return name.includes("libexec") || name.includes("libexec_x86"); } function getModuleNameByAddr(addr) { const mod = Process.findModuleByAddress(addr); return mod ? mod.name : null; } function safeReadUtf8String(ptr) { try { return Memory.readUtf8String(ptr); } catch { return "??"; } } function shouldLogByContext(context) { const modName = getModuleNameByAddr(context.pc); if (isLibexecModule(modName)) return true; const bt = Thread.backtrace(context, Backtracer.ACCURATE) .map(getModuleNameByAddr); return bt.some(isLibexecModule); } // jmethodID / jfieldID -> metadata const methodCache = new Map(); const fieldCache = new Map(); function hookJNI() { Java.perform(() => { const env = Java.vm.getEnv(); const vtablePtr = Memory.readPointer(env.handle); const PTR_SIZE = Process.pointerSize; const indices = { FindClass: 6, GetMethodID: 29, GetStaticMethodID: 100, GetFieldID: 94, GetStaticFieldID: 96, CallObjectMethod: 33, CallBooleanMethod: 35, CallIntMethod: 39, CallLongMethod: 42, CallVoidMethod: 46, CallStaticObjectMethod: 109, CallStaticBooleanMethod: 111, CallStaticIntMethod: 115, CallStaticLongMethod: 118, CallStaticVoidMethod: 122, }; // Track FindClass para mapear ponteiros -> nomes const classPtrMap = new Map(); Interceptor.attach(Memory.readPointer(vtablePtr.add(indices.FindClass * PTR_SIZE)), { onEnter(args) { this.className = safeReadUtf8String(args[1]); this.shouldLog = shouldLogByContext(this.context); }, onLeave(retval) { if (this.shouldLog && !retval.isNull()) { classPtrMap.set(retval.toString(), this.className); const callerMod = getModuleNameByAddr(this.returnAddress) || "desconhecido"; const offset = ptr(this.returnAddress).sub(Process.findModuleByName(callerMod)?.base || ptr(0)); console.log(`\n[JNI] 🔍 FindClass chamado`); console.log(` ↪ Classe: ${this.className}`); console.log(` ↪ Chamador: ${callerMod} + 0x${offset.toString(16)}`); console.log(` ↩ Retorno: ${retval}`); } } }); function hookMethod(methodName, idx, cache, isStatic = false) { const ptrAddr = Memory.readPointer(vtablePtr.add(idx * PTR_SIZE)); Interceptor.attach(ptrAddr, { onEnter(args) { this.classPtr = args[1]; this.name = safeReadUtf8String(args[2]); this.sig = safeReadUtf8String(args[3]); this.className = classPtrMap.get(this.classPtr.toString()) || "??"; this.shouldLog = shouldLogByContext(this.context); }, onLeave(retval) { if (this.shouldLog && !retval.isNull()) { cache.set(retval.toString(), { name: this.name, sig: this.sig, className: this.className, }); const callerMod = getModuleNameByAddr(this.returnAddress) || "desconhecido"; console.log(`\n[JNI] 🏷️ ${methodName} chamado`); console.log(` ↪ Classe: ${this.className}`); console.log(` ↪ Nome: ${this.name}`); console.log(` ↪ Assinatura JNI: ${this.sig}`); console.log(` ↪ Chamador: ${callerMod}`); console.log(` ↩ ID: ${retval}`); } } }); } hookMethod("GetMethodID", indices.GetMethodID, methodCache); hookMethod("GetStaticMethodID", indices.GetStaticMethodID, methodCache, true); hookMethod("GetFieldID", indices.GetFieldID, fieldCache); hookMethod("GetStaticFieldID", indices.GetStaticFieldID, fieldCache, true); function hookCallMethod(idx, methodName, cache, isStatic) { const ptrAddr = Memory.readPointer(vtablePtr.add(idx * PTR_SIZE)); Interceptor.attach(ptrAddr, { onEnter(args) { this.methodID = args[2].toString(); this.shouldLog = shouldLogByContext(this.context); }, onLeave(retval) { if (this.shouldLog) { const info = cache.get(this.methodID); const methodDesc = info ? `${info.className}.${info.name} ${info.sig}` : "jmethodID desconhecido"; const callerMod = getModuleNameByAddr(this.returnAddress) || "desconhecido"; const offset = ptr(this.returnAddress).sub(Process.findModuleByName(callerMod)?.base || ptr(0)); console.log(`\n[JNI] 📞 ${methodName} chamado`); console.log(` ↪ Chamador: ${callerMod} + 0x${offset.toString(16)}`); console.log(` ↪ Método: ${methodDesc}`); const trace = Thread.backtrace(this.context, Backtracer.ACCURATE).slice(0, 5); trace.forEach(addr => { const sym = DebugSymbol.fromAddress(addr); console.log(` 🔍 ${addr} (${sym.name || "???"})`); }); console.log(` ↩ Retorno: ${retval}`); } } }); } // CallXXXMethod hookCallMethod(indices.CallObjectMethod, "CallObjectMethod", methodCache); hookCallMethod(indices.CallBooleanMethod, "CallBooleanMethod", methodCache); hookCallMethod(indices.CallIntMethod, "CallIntMethod", methodCache); hookCallMethod(indices.CallLongMethod, "CallLongMethod", methodCache); hookCallMethod(indices.CallVoidMethod, "CallVoidMethod", methodCache); // CallStaticXXXMethod hookCallMethod(indices.CallStaticObjectMethod, "CallStaticObjectMethod", methodCache, true); hookCallMethod(indices.CallStaticBooleanMethod, "CallStaticBooleanMethod", methodCache, true); hookCallMethod(indices.CallStaticIntMethod, "CallStaticIntMethod", methodCache, true); hookCallMethod(indices.CallStaticLongMethod, "CallStaticLongMethod", methodCache, true); hookCallMethod(indices.CallStaticVoidMethod, "CallStaticVoidMethod", methodCache, true); }); } const functionsToHook = ["openat", "openat64", "__openat"]; const skipBacktracePaths = [ "/proc/", "/system/lib", "/system_ext/lib", "/vendor/lib", "/apex/", "/dev/" ]; // Libs suspeitas const suspiciousLibs = ["libziparchive.so"]; function isSensitivePath(path) { return skipBacktracePaths.some(skip => path.startsWith(skip)); } function hookOpenAtFunc(funcName) { const addr = Module.findExportByName("libc.so", funcName); if (!addr) { console.log(`[!] Função ${funcName} não encontrada.`); return; } console.log(`[+] Hookando ${funcName} @ ${addr}`); Interceptor.attach(addr, { onEnter: function (args) { try { const pathPtr = args[1]; if (pathPtr.isNull()) { console.log(`[LOG] ${funcName} chamado com path nulo`); return; } const path = Memory.readUtf8String(pathPtr); console.log(`\n[LOG] ${funcName} chamado com path: ${path}`); // Evita backtrace em paths sensíveis if (isSensitivePath(path)) { console.log(`[LOG] ${funcName} — path sensível, backtrace ignorado.`); return; } // Backtrace (limitado a 4 níveis) const bt = Thread.backtrace(this.context, Backtracer.ACCURATE) .slice(0, 4) .map(addr => { const mod = Process.findModuleByAddress(addr); return { addr: addr, name: mod ? mod.name : "desconhecido", text: `${addr} (${mod ? mod.name : "desconhecido"})` }; }); console.log("[Backtrace - até 4 níveis]:"); bt.forEach(line => console.log(" " + line.text)); // Alerta e substituição de path se for .apk vindo de lib suspeita if (path.includes(".apk")) { const foundSuspicious = bt.some(entry => suspiciousLibs.includes(entry.name)); if (!foundSuspicious) { console.warn(`[ALERTA] Acesso a .apk feito por lib suspeita: ${path}`); // Substituir o path aqui const fakePath = "/data/data/com.mm.droid.livetv.duna.mobile/cache/original.apk"; args[1] = Memory.allocUtf8String(fakePath); console.warn(`[MODIFICADO] Path substituído por: ${fakePath}`); } } } catch (e) { console.error(`[Erro] ${funcName} leitura falhou:`, e); } } }); } function hookProcSelfMaps() { const openPtr = Module.findExportByName("libc.so", "open"); const readPtr = Module.findExportByName("libc.so", "read"); if (!openPtr || !readPtr) { console.error("❌ Não foi possível encontrar as funções open/read."); return; } let fdToHook = -1; Interceptor.attach(openPtr, { onEnter(args) { const path = Memory.readUtf8String(args[0]); if (path === "/proc/self/maps") { console.log("[HOOK] Abertura de /proc/self/maps detectada."); this.shouldHook = true; } }, onLeave(retval) { if (this.shouldHook && retval.toInt32() > 0) { fdToHook = retval.toInt32(); console.log(`[HOOK] File descriptor de /proc/self/maps: ${fdToHook}`); } } }); Interceptor.attach(readPtr, { onEnter(args) { this.fd = args[0].toInt32(); this.buf = args[1]; this.count = args[2].toInt32(); }, onLeave(retval) { const len = retval.toInt32(); if (this.fd === fdToHook && len > 0) { try { const byteArray = Memory.readByteArray(this.buf, len); const content = new Uint8Array(byteArray); const text = String.fromCharCode.apply(null, content); const realApkRegex = /\/data\/app\/[^\/]+\/base\.apk/g; const fakeApk = "/data/data/com.mm.droid.livetv.duna.mobile/cache/original.apk"; if (realApkRegex.test(text)) { const patchedText = text.replace(realApkRegex, fakeApk); Memory.writeUtf8String(this.buf, patchedText); console.log(`[HOOK] /proc/self/maps modificado:\n${patchedText}`); return patchedText.length; } } catch (e) { console.error("[HOOK] Erro ao modificar /proc/self/maps:", e); } } } }); } const ActivityThread = Java.use("android.app.ActivityThread"); const ArrayList = Java.use("java.util.ArrayList"); const WeakReference = Java.use("java.lang.ref.WeakReference"); const ArrayMap = Java.use("android.util.ArrayMap"); const apkPath = "/data/data/com.mm.droid.livetv.duna.mobile/cache/original.apk"; // Cores ANSI para logs no terminal Frida const colors = { reset: "\x1b[0m", red: "\x1b[31m", green: "\x1b[32m", yellow: "\x1b[33m", cyan: "\x1b[36m", magenta: "\x1b[35m", white: "\x1b[37m", blue: "\x1b[34m", }; function safeGetValue(field) { try { return field && field.value; } catch (e) { return undefined; } } function logInfo(tag, message, color = colors.white) { console.log(color + `[${tag}] ${message}` + colors.reset); } function logSuccess(tag, message) { logInfo(tag, "✅ " + message, colors.green); } function logWarning(tag, message) { logInfo(tag, "⚠️ " + message, colors.yellow); } function logError(tag, message) { logInfo(tag, "❌ " + message, colors.red); } function logStep(tag, message) { logInfo(tag, "🔷 " + message, colors.cyan); } function patchApplicationInfo(appInfo) { const tag = "ApplicationInfo"; if (!appInfo) { logWarning(tag, "ApplicationInfo é null, pulando..."); return; } try { const origSourceDir = appInfo.sourceDir.value; const origPublicSourceDir = appInfo.publicSourceDir.value; logStep(tag, `sourceDir: ORIGINAL="${origSourceDir}", FAKE="${apkPath}"`); logStep(tag, `publicSourceDir: ORIGINAL="${origPublicSourceDir}", FAKE="${apkPath}"`); appInfo.sourceDir.value = apkPath; appInfo.publicSourceDir.value = apkPath; logSuccess(tag, "Campos sourceDir e publicSourceDir atualizados"); } catch (e) { logError(tag, "Erro ao patch ApplicationInfo: " + e); } } function patchLoadedApk(loadedApk) { const tag = "LoadedApk"; if (!loadedApk) { logWarning(tag, "LoadedApk é null, pulando..."); return; } try { const mApplicationInfo = loadedApk.mApplicationInfo ? loadedApk.mApplicationInfo.value : null; const mAppDir = loadedApk.mAppDir ? loadedApk.mAppDir.value : null; const mResDir = loadedApk.mResDir ? loadedApk.mResDir.value : null; logStep(tag, `mApplicationInfo: ${mApplicationInfo ? mApplicationInfo.toString() : "null"}`); logStep(tag, `mAppDir: ORIGINAL="${mAppDir}", FAKE="${apkPath}"`); logStep(tag, `mResDir: ORIGINAL="${mResDir}", FAKE="${apkPath}"`); if (mApplicationInfo) { patchApplicationInfo(mApplicationInfo); } if (loadedApk.mAppDir) loadedApk.mAppDir.value = apkPath; if (loadedApk.mResDir) loadedApk.mResDir.value = apkPath; logSuccess(tag, "Campos mAppDir e mResDir atualizados"); } catch (e) { logError(tag, "Erro ao patch LoadedApk: " + e); } } function patchAppBindData(appBindData) { const tag = "AppBindData"; if (!appBindData) { logWarning(tag, "AppBindData é null, pulando..."); return; } try { const info = safeGetValue(appBindData.info); const appInfo = safeGetValue(appBindData.appInfo); logStep(tag, `info (LoadedApk): ${info ? info.toString() : "null"}`); logStep(tag, `appInfo (ApplicationInfo): ${appInfo ? appInfo.toString() : "null"}`); patchLoadedApk(info); patchApplicationInfo(appInfo); logSuccess(tag, "Patch concluído"); } catch (e) { logError(tag, "Erro patch AppBindData: " + e); } } function patchApplication(app) { const tag = "Application"; if (!app) { logWarning(tag, "Application é null, pulando..."); return; } try { const loadedApk = safeGetValue(app.mLoadedApk); logStep(tag, `mLoadedApk: ${loadedApk ? loadedApk.toString() : "null"}`); patchLoadedApk(loadedApk); logSuccess(tag, "Patch concluído"); } catch (e) { logError(tag, "Erro patch Application: " + e); } } function logAndPatch() { const tag = "mBoundApplication"; try { const ActivityThread = Java.use("android.app.ActivityThread"); const appThread = ActivityThread.currentActivityThread(); const mBoundApplication = safeGetValue(appThread.mBoundApplication); if (mBoundApplication !== null) { logSuccess(tag, "mBoundApplication encontrado!"); const loadedApk = safeGetValue(mBoundApplication.info); const appInfo = safeGetValue(mBoundApplication.appInfo); logStep(tag, `info (LoadedApk): ${loadedApk}`); logStep(tag, `appInfo (ApplicationInfo): ${appInfo}`); if (loadedApk !== null) { const origAppInfo = safeGetValue(loadedApk.mApplicationInfo); const origAppDir = safeGetValue(loadedApk.mAppDir); const origResDir = safeGetValue(loadedApk.mResDir); logStep(tag, `LoadedApk.mApplicationInfo: ${origAppInfo}`); logStep(tag, `LoadedApk.mAppDir: ORIGINAL="${origAppDir}", FAKE="${apkPath}"`); logStep(tag, `LoadedApk.mResDir: ORIGINAL="${origResDir}", FAKE="${apkPath}"`); loadedApk.mAppDir.value = apkPath; loadedApk.mResDir.value = apkPath; logSuccess(tag, "LoadedApk.mAppDir e mResDir atualizados"); } else { logWarning(tag, "LoadedApk (info) está null"); } if (appInfo !== null) { const origSourceDir = safeGetValue(appInfo.sourceDir); const origPublicSourceDir = safeGetValue(appInfo.publicSourceDir); logStep(tag, `ApplicationInfo.sourceDir: ORIGINAL="${origSourceDir}", FAKE="${apkPath}"`); logStep(tag, `ApplicationInfo.publicSourceDir: ORIGINAL="${origPublicSourceDir}", FAKE="${apkPath}"`); appInfo.sourceDir.value = apkPath; appInfo.publicSourceDir.value = apkPath; logSuccess(tag, "ApplicationInfo sourceDir e publicSourceDir atualizados"); } else { logWarning(tag, "ApplicationInfo (appInfo) está null"); } } else { logInfo(tag, "⏳ mBoundApplication é null, tentando novamente...", colors.yellow); setTimeout(logAndPatch, 500); } } catch (e) { logError(tag, "Erro no logAndPatch: " + e); } } function main(currentActivityThread) { logAndPatch(); const tag = "ActivityThread"; try { const mBoundApplication = safeGetValue(currentActivityThread.mBoundApplication); patchAppBindData(mBoundApplication); const mInitialApplication = safeGetValue(currentActivityThread.mInitialApplication); patchApplication(mInitialApplication); const mAllApplications = safeGetValue(currentActivityThread.mAllApplications); if (mAllApplications !== null) { const list = Java.cast(mAllApplications, ArrayList); logStep("mAllApplications", `size: ${list.size()}`); for (let i = 0; i < list.size(); i++) { const app = list.get(i); logStep("mAllApplications", `Application #${i}: ${app.toString()}`); patchApplication(app); } logSuccess("mAllApplications", "Todos os applications foram patchados"); } else { logWarning("mAllApplications", "é null ou vazio"); } const mPackages = safeGetValue(currentActivityThread.mPackages); if (mPackages !== null) { const map = Java.cast(mPackages, ArrayMap); logStep("mPackages", `size: ${map.size()}`); for (let i = 0; i < map.size(); i++) { const weakRef = Java.cast(map.valueAt(i), WeakReference); const loadedApk = weakRef.get(); logStep("mPackages", `LoadedApk #${i}: ${loadedApk ? loadedApk.toString() : "null"}`); patchLoadedApk(loadedApk); map.setValueAt(i, Java.use("java.lang.ref.WeakReference").$new(loadedApk)); } logSuccess("mPackages", "Todos os LoadedApk foram patchados"); } else { logWarning("mPackages", "é null ou vazio"); } const mResourcePackages = safeGetValue(currentActivityThread.mResourcePackages); if (mResourcePackages !== null) { const mapRes = Java.cast(mResourcePackages, ArrayMap); logStep("mResourcePackages", `size: ${mapRes.size()}`); for (let i = 0; i < mapRes.size(); i++) { const weakRef = Java.cast(mapRes.valueAt(i), WeakReference); const loadedApk = weakRef.get(); logStep("mResourcePackages", `LoadedApk #${i}: ${loadedApk ? loadedApk.toString() : "null"}`); patchLoadedApk(loadedApk); mapRes.setValueAt(i, Java.use("java.lang.ref.WeakReference").$new(loadedApk)); } logSuccess("mResourcePackages", "Todos os LoadedApk foram patchados"); } else { logWarning("mResourcePackages", "é null ou vazio"); } } catch (e) { logError("main", "Erro geral patching: " + e); } } function waitForActivityThreadReady(callback, retryDelay = 1, maxRetries = 100) { let attempts = 0; function check() { try { const ActivityThread = Java.use("android.app.ActivityThread"); const current = ActivityThread.currentActivityThread(); if (current && current.mInitialApplication.value !== null) { logSuccess("Watcher", "ActivityThread está pronto!"); callback(current); } else { if (attempts < maxRetries) { attempts++; setTimeout(check, retryDelay); } else { logError("Watcher", "Timeout esperando ActivityThread"); } } } catch (e) { logError("Watcher", "Erro ao checar ActivityThread: " + e); if (attempts < maxRetries) { attempts++; setTimeout(check, retryDelay); } } } check(); } Java.perform(() => { function main() { logAndPatch(); const tag = "ActivityThread"; const currentActivityThread = ActivityThread.currentActivityThread(); if (!currentActivityThread) { logError(tag, "currentActivityThread é null"); return; } try { // Patch AppBindData (mBoundApplication) const mBoundApplication = safeGetValue(currentActivityThread.mBoundApplication); patchAppBindData(mBoundApplication); // Patch mInitialApplication const mInitialApplication = safeGetValue(currentActivityThread.mInitialApplication); patchApplication(mInitialApplication); // Patch mAllApplications (ArrayList) const mAllApplications = safeGetValue(currentActivityThread.mAllApplications); if (mAllApplications !== null) { const list = Java.cast(mAllApplications, ArrayList); logStep("mAllApplications", `size: ${list.size()}`); for (let i = 0; i < list.size(); i++) { const app = list.get(i); logStep("mAllApplications", `Application #${i}: ${app.toString()}`); patchApplication(app); } logSuccess("mAllApplications", "Todos os applications foram patchados"); } else { logWarning("mAllApplications", "é null ou vazio"); } // Patch mPackages (ArrayMap>) const mPackages = safeGetValue(currentActivityThread.mPackages); if (mPackages !== null) { const map = Java.cast(mPackages, ArrayMap); logStep("mPackages", `size: ${map.size()}`); for (let i = 0; i < map.size(); i++) { const weakRef = Java.cast(map.valueAt(i), WeakReference); const loadedApk = weakRef.get(); logStep("mPackages", `LoadedApk #${i}: ${loadedApk ? loadedApk.toString() : "null"}`); patchLoadedApk(loadedApk); // Substitui WeakReference para evitar referência velha const newWeak = Java.use("java.lang.ref.WeakReference").$new(loadedApk); map.setValueAt(i, newWeak); } logSuccess("mPackages", "Todos os LoadedApk foram patchados"); } else { logWarning("mPackages", "é null ou vazio"); } // Patch mResourcePackages (ArrayMap) const mResourcePackages = safeGetValue(currentActivityThread.mResourcePackages); if (mResourcePackages !== null) { const mapRes = Java.cast(mResourcePackages, ArrayMap); logStep("mResourcePackages", `size: ${mapRes.size()}`); for (let i = 0; i < mapRes.size(); i++) { const weakRef = Java.cast(mapRes.valueAt(i), WeakReference); const loadedApk = weakRef.get(); logStep("mResourcePackages", `LoadedApk #${i}: ${loadedApk ? loadedApk.toString() : "null"}`); patchLoadedApk(loadedApk); const newWeak = Java.use("java.lang.ref.WeakReference").$new(loadedApk); mapRes.setValueAt(i, newWeak); } logSuccess("mResourcePackages", "Todos os LoadedApk foram patchados"); } else { logWarning("mResourcePackages", "é null ou vazio"); } } catch (e) { logError("main", "Erro geral patching: " + e); } } main(); }); setImmediate(() => { console.log("[*] Iniciando hooks JNI filtrados por libexec/libexec_x86..."); hookJNI(); // Inicia hooks functionsToHook.forEach(hookOpenAtFunc); hookProcSelfMaps(); });

Project: Hook OpenAt