*   [Hameçonnage](#phishing)
    *   [Signalement et suppression](#reporting-and-takedown)
    *   [Simulation et sensibilisation](#simulation-and-awareness)
    *   [Tests](#testing)```sh
$ ./android-ndk/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android21-clang++ a.cpp -o a -shared -static-libstdc++ && adb push a /data/local/tmp/a

| Command | Description |
|---------|-------------|
| `set TARGETS` | Sets the target hosts. Can be one or multiple hosts, host list file, or IP range. |
| `set MODULES` | Sets the modules to use. Can be one or multiple modules. |
| `set WORKERS` | Sets the number of workers (threads). Defaults to `(Number of CPU Cores * 5)`. |
| `set SCANSPEED` | Sets the global scan speed (delay between port scanning connections). |
| `set TIMEOUT` | Sets the timeout (in seconds) for TCP connections. |
| `set NMAP` | Sets whether to perform Nmap scans. Default is `true`. |
``````js
[device]-> 
function readStdString(str) {
  if ((str.readU8() & 1) === 1) { // size LSB (=1) indicates if it's a long string
    return str.add(2 * Process.pointerSize).readPointer().readUtf8String();    
  }
  return str.add(1).readUtf8String();  
}
[device]-> Module.load('/data/local/tmp/a');
[device]-> var fp_create_stdstr = Module.findExportByName('a', 'create_stdstr');
[device]-> var createStdString = new NativeFunction(fp_create_stdstr, 'pointer', ['pointer', 'int']);
[device]-> var stdstr1 = createStdString(Memory.allocUtf8String("abcd"), 3);
"0x07691234567"
[device]-> readStdString(stdstr1);
"abc"

, selon la configuration de l'outil.```c
#include <stdio.h>
#include <stdlib.h>
#include <android/log.h>    

#define TAG "TEST1"
#define LOGI(...) __android_log_print(ANDROID_LOG_INFO, TAG, __VA_ARGS__)
#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, TAG, __VA_ARGS__)

void test(void) {
  FILE* fp = popen("ls -l /sdcard 2>&1", "r");
  if (fp == NULL)
    LOGE("executing cmd failed");
  char b[256];
  while (fgets(b, sizeof(b), fp) != NULL) {
    LOGI("%s", b);
  }
  pclose(fp);
}

<br>[⬆ Retour en haut](#table-of-contents)



#### Point de surveillance unique

Interceptez `funcPtr` & enregistrez qui lit/écrit sur `x2` en supprimant les permissions avec `mprotect`.```js
Process.setExceptionHandler(function(exp) {
  console.warn(JSON.stringify(Object.assign(exp, { _lr: DebugSymbol.fromAddress(exp.context.lr), _pc: DebugSymbol.fromAddress(exp.context.pc) }), null, 2));
  Memory.protect(exp.memory.address, Process.pointerSize, 'rw-');
  // can also use `new NativeFunction(Module.findExportByName(null, 'mprotect'), 'int', ['pointer', 'uint', 'int'])(parseInt(this.context.x2), 2, 0)`
  return true; // goto PC 
});

Interceptor.attach(funcPtr, {
  onEnter: function (args) {
    console.log('onEnter', JSON.stringify({
      x2: this.context.x2,
      mprotect_ret: Memory.protect(this.context.x2, 2, '---'),
      errno: this.errno
    }, null, 2));
  },
  onLeave: function (retval) {
    console.log('onLeave');
  }
});

<details>
<summary>Exemple de sortie</summary>
	
Exemple Android```sh
# wrap the script above inside Java.perform
$ frida -Uf com.example.app -l script.js --no-pause
[Android Model-X::com.example.app]-> 117 write 5.0.2.1:5242
117 read 5.0.2.1:5242
135 write 5.0.2.1:4244
135 read 5.0.2.1:4244
135 read 5.0.2.1:4244

</details>

<br>[⬆ Back to top](#table-of-contents)

#### Journaliser les arguments des méthodes```python
def on_message(m, _data):
    if m['type'] == 'send':
        print(m['payload'])
    elif m['type'] == 'error':
        print(m)


def switch(argument_key, idx):
    """
    c/c++ variable type to javascript reader switch implementation
    # TODO handle other arguments, [long, longlong..]
    :param argument_key: variable type
    :param idx: index in symbols array
    :return: javascript to read the type of variable
    """
    argument_key = argument_key.replace(' ', '')
    return '%d: %s' % (idx, {
        'int': 'args[%d].toInt32(),',
        'unsignedint': 'args[%d].toInt32(),',
        'std::string': 'Memory.readUtf8String(Memory.readPointer(args[%d])),',
        'bool': 'Boolean(args[%d]),'
    }[argument_key] % idx)


def list_symbols_from_object_files(module_id):
    import subprocess
    return subprocess.getoutput('nm --demangle --dynamic %s' % module_id)


def parse_nm_output(nm_stdout, symbols):
    for line in nm_stdout.splitlines():
        split = line.split()
        open_parenthesis_idx = line.find('(')
        raw_arguments = [] if open_parenthesis_idx == -1 else line[open_parenthesis_idx + 1:-1]
        if len(raw_arguments) > 0:  # ignore methods without arguments
            raw_argument_list = raw_arguments.split(',')
            symbols.append({
                'address': split[0],
                'type': split[1],  # @see Symbol Type Table
                'name': split[2][:split[2].find('(')],  # method name
                'args': raw_argument_list
            })


def get_js_script(method, module_id):
    js_script = """
        var moduleName = "{{moduleName}}", nativeFuncAddr = {{methodAddress}};
        Interceptor.attach(Module.findExportByName(null, "dlopen"), {
            onEnter: function(args) {
                this.lib = Memory.readUtf8String(args[0]);
                console.log("[*] dlopen called with: " + this.lib);
            },
            onLeave: function(retval) {
                if (this.lib.endsWith(moduleName)) {
                    Interceptor.attach(Module.findBaseAddress(moduleName).add(nativeFuncAddr), {
                        onEnter: function(args) {
                            console.log("[*] hook invoked", JSON.stringify({{arguments}}, null, '\t'));
                        }
                    });
                }
            }
        });
    """
    replace_map = {
        '{{moduleName}}': module_id,
        '{{methodAddress}}': '0x' + method['address'],
        '{{arguments}}': '{' + ''.join([switch(method['args'][i], i + 1) for i in range(len(method['args']))]) + '}'
    }
    for k, v in replace_map.items():
        js_script = js_script.replace(k, v)
    print('[+] JS Script:\n', js_script)
    return js_script


def main(app_id, module_id, method):
    """
    $ python3.x+ script.py --method SomeClass::someMethod --app com.company.app --module libfoo.so
    :param app_id: application identifier / bundle id 
    :param module_id: shared object identifier / known suffix, will iterate loaded modules (@see dlopen) 
    :param method: method/symbol name
    :return: hook native method and print arguments when invoked
    """
    # TODO extract all app's modules via `adb shell -c 'ls -lR /data/app/' + app_if + '*' | grep "\.so"`

    nm_stdout = list_symbols_from_object_files(module_id)

    symbols = []
    parse_nm_output(nm_stdout, symbols)

    selection_idx = None
    for idx, symbol in enumerate(symbols):
        if method is None:  # if --method flag is not passed
            print("%4d) %s (%d)" % (idx, symbol['name'], len(symbol['args'])))
        elif method == symbol['name']:
            selection_idx = idx
            break
    if selection_idx is None:
        if method is None:
            selection_idx = input("Enter symbol number: ")
        else:
            print('[+] Method not found, remove method flag to get list of methods to select from, `nm` stdout:')
            print(nm_stdout)
            exit(2)

    method = symbols[int(selection_idx)]
    print('[+] Selected method: %s' % method['name'])
    print('[+] Method arguments: %s' % method['args'])

    from frida import get_usb_device
    device = get_usb_device()
    pid = device.spawn([app_id])
    session = device.attach(pid)
    script = session.create_script(get_js_script(method, module_id))
    script.on('message', on_message)
    script.load()
    device.resume(app_id)
    # keep hook alive
    from sys import stdin
    stdin.read()


if __name__ == '__main__':
    from argparse import ArgumentParser
    parser = ArgumentParser()
    parser.add_argument('--app', help='app identifier "com.company.app"')
    parser.add_argument('--module', help='loaded module name "libfoo.2.so"')
    parser.add_argument('--method', help='method name "SomeClass::someMethod", if empty it will print select-list')
    args = parser.parse_args()
    main(args.app, args.module, args.method)

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)



#### Description de la classe

Obtenir les méthodes et membres de la classe.```js
Object.getOwnPropertyNames(Java.use('com.company.CustomClass').__proto__).join('\n\t')

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)

#### Désactiver le WiFi

Cela désactivera le WiFi lors de la création de la première activité.```js
var WifiManager = Java.use("android.net.wifi.WifiManager");
Java.use("android.app.Activity").onCreate.overload("android.os.Bundle").implementation = function(bundle) {
    var wManager = Java.cast(this.getSystemService("wifi"), WifiManager);
    console.log('isWifiEnabled ?', wManager.isWifiEnabled());
    wManager.setWifiEnabled(false);
    this.$init(bundle);
}

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)

#### Obtenir IMEI

Peut également intercepter et changer l'IMEI.```js
function getIMEI(){
    console.log('IMEI =', Java.use("android.telephony.TelephonyManager").$new().getDeviceId());
}
Java.perform(getIMEI)

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)

#### Android faire un Toast```js
// 0 = // https://developer.android.com/reference/android/widget/Toast#LENGTH_LONG
Java.scheduleOnMainThread(() => {
  Java.use("android.widget.Toast")
    .makeText(Java.use("android.app.ActivityThread").currentApplication().getApplicationContext(), Java.use("java.lang.StringBuilder").$new("Text to Toast here"), 0).show();
});

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)


#### Webview URLS

Journaliser chaque fois que WebView change d'URL.```js
Java.use("android.webkit.WebView").loadUrl.overload("java.lang.String").implementation = function (s) {
    send(s.toString());
    this.loadUrl.overload("java.lang.String").call(this, s);
};

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)

#### Afficher les mises à jour des préférences partagées```js
Java.perform(function() {
    var shared_pref_class = Java.use('android.app.SharedPreferencesImpl$EditorImpl');

    shared_pref_class.putString.overload('java.lang.String', 'java.lang.String').implementation = function(k, v) {
        console.log('Shared preference updated: ', k, '=', v);
        return this.putString(k, v);
    }

    shared_pref_class.putInt.overload('java.lang.String', 'int').implementation = function(k, v) {
        console.log('Shared preference updated: ', k, '=', v);
        return this.putInt(k, v);
    }


    shared_pref_class.putFloat.overload('java.lang.String', 'float').implementation = function(k, v) {
        console.log('Shared preference updated: ', k, '=', v);
        return this.putFloat(k, v);
    }

    shared_pref_class.putBoolean.overload('java.lang.String', 'boolean').implementation = function(k, v) {
        console.log('Shared preference updated: ', k, '=', v);
        return this.putBoolean(k, v);
    }

    shared_pref_class.putLong.overload('java.lang.String', 'long').implementation = function(k, v) {
        console.log('Shared preference updated: ', k, '=', v);
        return this.putLong(k, v);
    }

    shared_pref_class.putStringSet.overload('java.lang.String', java.util.Set).implementation = function(k, v) {
        console.log('Shared preference updated: ', k, '=', v);
        return this.putStringSet(k, v);
    }
});

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)

#### Hook JNI by address

Hameçonner une méthode native par nom de module et adresse de méthode et afficher les arguments.```js
var moduleName = "libfoo.so"; 
var nativeFuncAddr = 0x1234; // $ nm --demangle --dynamic libfoo.so | grep "Class::method("

Interceptor.attach(Module.findExportByName(null, "dlopen"), {
    onEnter: function(args) {
        this.lib = Memory.readUtf8String(args[0]);
        console.log("dlopen called with: " + this.lib);
    },
    onLeave: function(retval) {
        if (this.lib.endsWith(moduleName)) {
            console.log("ret: " + retval);
            var baseAddr = Module.findBaseAddress(moduleName);
            Interceptor.attach(baseAddr.add(nativeFuncAddr), {
                onEnter: function(args) {
                    console.log("[-] hook invoked");
                    console.log(JSON.stringify({
                        a1: args[1].toInt32(),
                        a2: Memory.readUtf8String(Memory.readPointer(args[2])),
                        a3: Boolean(args[3])
                    }, null, '\t'));
                }
            });
        }
    }
});

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)

#### Hook reflection

`java.lang.reflect.Method#invoke(Object obj, Object... args, boolean bool)````javascript
  Java.use('java.lang.reflect.Method').invoke.overload('java.lang.Object', '[Ljava.lang.Object;', 'boolean').implementation = function(a,b,c) {
      console.log('hooked!', a, b, c);
      return this.invoke(a,b,c);
  };

var methods = hook.class.getDeclaredMethods();
hook.$dispose();

var parsedMethods = [];
methods.forEach(function (method) {
    var methodStr = method.toString();
    var methodReplace = methodStr.replace(targetClass + ".", "TOKEN").match(/\sTOKEN(.*)\(/)[1];
     parsedMethods.push(methodReplace);
});

uniqBy(parsedMethods, JSON.stringify).forEach(function (targetMethod) {
    traceMethod(targetClass + '.' + targetMethod);
});

    var targetClass = targetClassMethod.slice(0, delim);
    var targetMethod = targetClassMethod.slice(delim + 1, targetClassMethod.length);

    var hook = Java.use(targetClass);
    var overloadCount = hook[targetMethod].overloads.length;

    LOG({ tracing: targetClassMethod, overloaded: overloadCount }, { c: Color.Green });

    for (var i = 0; i < overloadCount; i++) {
        hook[targetMethod].overloads[i].implementation = function () {
            var log = { '#': targetClassMethod, args: [] };

            for (var j = 0; j < arguments.length; j++) {
                var arg = arguments[j];
                // quick&dirty fix for java.io.StringWriter char[].toString() impl because frida prints [object Object]
                if (j === 0 && arguments[j]) {
                    if (arguments[j].toString() === '[object Object]') {
                        var s = [];
                        for (var k = 0, l = arguments[j].length; k < l; k++) {
                            s.push(arguments[j][k]);
                        }
                        arg = s.join('');
                    }
                }
                log.args.push({ i: j, o: arg, s: arg ? arg.toString(): 'null'});
            }

            var retval;
            try {
                retval = this[targetMethod].apply(this, arguments); // might crash (Frida bug?)
                log.returns = { val: retval, str: retval ? retval.toString() : null };
            } catch (e) {
                console.error(e);
            }
            LOG(log, { c: Color.Blue });
            return retval;
        }
    }
} catch(error) {
    LOG({ tracing: targetClassMethod, "overloaded": 0}, { c: Color.Red });
}

    Java.use('java.net.Socket').isConnected.overload().implementation = function () {
        LOG('Socket.isConnected.overload', { c: Color.Light.Cyan });
        printBacktrace();
        return true;
    }
});

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)

#### Obtenir l'ID Android
L'[ANDROID_ID](https://developer.android.com/reference/android/provider/Settings.Secure.html#ANDROID_ID) est unique pour chaque application dans Android.```javascript
function getContext() {
  return Java.use('android.app.ActivityThread').currentApplication().getApplicationContext().getContentResolver();
}

function logAndroidId() {
  console.log('[-]', Java.use('android.provider.Settings$Secure').getString(getContext(), 'android_id'));
}

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)



#### Contournement de FLAG_SECURE
Contournement de la protection contre les captures d'écran [question Stack Overflow](https://stackoverflow.com/questions/9822076/how-do-i-prevent-android-taking-a-screenshot-when-my-app-goes-to-the-background)```javascript
Java.perform(function() {
    Java.use('android.view.SurfaceView').setSecure.overload('boolean').implementation = function(flag){
        console.log('[1] flag:', flag);
        this.call(false);
    };
    var LayoutParams = Java.use('android.view.WindowManager$LayoutParams');
    Java.use('android.view.ViewWindow').setFlags.overload('int', 'int').implementation = function(flags, mask){
        console.log('flag secure: ', LayoutParams.FLAG_SECURE.value);
        console.log('before:', flags);
        flags = (flags.value & ~LayoutParams.FLAG_SECURE.value);
        console.log('after:', flags);
        this.call(this, flags, mask);
    };
});

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)

#### Surcharges de hooks```javascript
function hookOverloads(className, func) {
  var clazz = Java.use(className);
  var overloads = clazz[func].overloads;
  for (var i in overloads) {
    if (overloads[i].hasOwnProperty('argumentTypes') || overloads[i]['argumentTypes'] != undefined) {
      var parameters = [];

      var curArgumentTypes = overloads[i].argumentTypes, args = [], argLog = '[';
      for (var j in curArgumentTypes) {
        var cName = curArgumentTypes[j].className;
        parameters.push(cName);
        argLog += "'(" + cName + ") ' + v" + j + ",";
        args.push('v' + j);
      }
      argLog += ']';

      var script = "var ret = this." + func + '(' + args.join(',') + ") || '';\n"
        + "console.log(JSON.stringify(" + argLog + "));\n"
        + "return ret;"

      args.push(script);
      clazz[func].overload.apply(this, parameters).implementation = Function.apply(null, args);
    }
  }
}

Java.perform(function() {
  hookOverloads('java.lang.StringBuilder', '$init');
})

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)


#### lister les classes implémentant une interface```js
function listClassesImplementsInterface(aInterface) {
  let classLoaders = Java.enumerateClassLoadersSync()
  Java.enumerateLoadedClassesSync().forEach(className => {
    for (let i = 0; i < classLoaders.length; i++) {
      let classLoader = classLoaders[i]
      Java.classFactory.loader = classLoader
      try {
        let jclass = Java.use(className).class
        let ifaces = jclass.getInterfaces().toString()
        jclass = null
        if (ifaces.indexOf(aInterface) != -1) {
          console.log(JSON.stringify({
            name: className,
            loader: classLoader.toString(),
            interfaces: ifaces
          }))
          break // we found one ClassLoader, that's enough
        }
      } catch (e) {
        // continue to next ClassLoader
      }
    }
  })
}

  if (curSteps < totalNumberOfRequiredSteps) {
    setTimeout(() => {
      curSteps += 50;
      incSteps();
    }, 1500)
  }
});

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)

#### Journal OS```js
var m = 'libsystem_trace.dylib';
// bool os_log_type_enabled(os_log_t oslog, os_log_type_t type);
var isEnabledFunc = Module.findExportByName(m, 'os_log_type_enabled');
// _os_log_impl(void *dso, os_log_t log, os_log_type_t type, const char *format, uint8_t *buf, unsigned int size);
var logFunc = Module.findExportByName(m, '_os_log_impl');

// Enable all logs
Interceptor.attach(isEnabledFunc, {
  onLeave: function (ret) {
    ret.replace(0x1);
  }
});

Interceptor.attach(logFunc, {
  onEnter: function (a) {
/*
OS_ENUM(os_log_type, uint8_t,
	OS_LOG_TYPE_DEFAULT = 0x00,
	OS_LOG_TYPE_INFO    = 0x01,
	OS_LOG_TYPE_DEBUG   = 0x02,
	OS_LOG_TYPE_ERROR   = 0x10,
	OS_LOG_TYPE_FAULT   = 0x11);
*/
    var type = a[2]; 
    var format = a[3];
    if (type !== 0x2) {
      console.log(JSON.stringify({
        type: type,
        format: format.readCString(),
        //buf: a[4].readPointer().readCString() // TODO
      }, null, 2));
    }
  }
})

<details>
<summary>Exemple de sortie</summary>
TODO
</details>

<br>[⬆ Retour en haut](#table-of-contents)


#### Accès aux fichiers

Enregistrer chaque ouverture de fichier```js
Interceptor.attach(ObjC.classes.NSFileManager['- fileExistsAtPath:'].implementation, {
    onEnter: function (args) {
        console.log('open' , ObjC.Object(args[2]).toString());
    }
});

            this.log.push(
                Thread.backtrace(this.context, Backtracer.ACCURATE)
                    .map(DebugSymbol.fromAddress)
                    .join('\n')
            );
        },

        onLeave: function(r) {
            try {
                this.log.push('RET: ' + new ObjC.Object(r).toString());
            } catch (e) {
                this.log.push('RET: ' + r.toString());
            }

            console.log(this.log.join('\n') + '\n');
        }
    });
});

<details>
<summary>Exemple de sortie</summary>
	
`observeClass('Someclass$innerClass');````
Observing Someclass$innerClass - func
Observing Someclass$innerClass - empty
(0x174670040,parameterName) Someclass$innerClass - func
0x10048dd6c libfoo!0x3bdd6c
0x1005a5dd0 libfoo!0x4d5dd0
0x1832151c0 libdispatch.dylib!_dispatch_client_callout
0x183215fb4 libdispatch.dylib!dispatch_once_f
RET: 0xabcdef