diff --git a/.gitignore b/.gitignore
index 514dcd6..4e0fd3d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,5 +23,3 @@ logs/
data/doc/
data/test/
.vscode/
-com.*
-cn.com.*
diff --git a/JUSTTRUSTME.md b/JUSTTRUSTME.md
new file mode 100644
index 0000000..cfa809e
--- /dev/null
+++ b/JUSTTRUSTME.md
@@ -0,0 +1,94 @@
+# Twitter实战测试
+
+### 不使用just_trust_me情况下，抓包失败展示
+![抓包失败展示.png-443.6kB][2]
+
+### spawn方式启动just_trust_me.js
+建议任何app都以spawn方式启动just_trust_me.js。不是建议！是必须，因为要在app完成初始化之前hook住所有的hook点，只有spawn模式下才能做到，attach时机太晚了。所以大家明白？
+![启动just_trust_me.gif-2756.5kB][3]
+
+
+
+### 启动just_trust_me.js之后正常抓包展示
+久违的请求出来了！！！看！！！
+![启动just_trust_me之后.gif-2307.9kB][4]
+
+
+# 某头条资讯APP实战测试
+
+### 启动just_trust_me.js
+![WechatIMG417.png-1098.4kB][5]
+
+### 正常抓包展示
+![qutoutiao_result.gif-2120.1kB][6]
+
+
+# 某买菜APP实战测试
+
+### 启动just_trust_me.js
+![WechatIMG420.png-1185.2kB][7]
+
+### 正常抓包展示
+![WechatIMG422.png-763.4kB][8]
+
+
+#### 就是这么的简单粗暴，我们继续......
+
+# 某汽车资讯APP实战测试
+### 启动just_trust_me.js
+![111.png-1099.8kB][9]
+
+### 正常抓包展示
+![222.png-772.2kB][10]
+
+# 某国内免费小说APP实战测试
+### 启动just_trust_me.js
+![333.png-1054.4kB][11]
+
+### 正常抓包展示
+![444.png-678.5kB][12]
+
+# 某宝购物APP
+### 启动just_trust_me.js
+![666.png-1151.4kB][13]
+
+### 正常抓包展示
+![555.png-879.3kB][14]
+
+
+还要测吗？这个frida版本的just_trust_me怎么样？有些okhttp库在编译的时候混淆了，你可以通过[just_trust_me_okhttp_hook_finder.js](https://github.com/CreditTone/hooker/blob/master/js/just_trust_me_okhttp_hook_finder.js)把混淆类找回来。如何使用just_trust_me_okhttp_hook_finder请看《实现frida版的JustTrustMe（三）frida版JustTrustMe升级和混淆对抗》
+
+
+# 再次强调实现frida版JustTrustMe的意义
+
+### 快速使用
+ 不用我说了吧，大家上面都看到了。xposed有我frida这么洒脱吗？批量刷机都是问题吧？frida只要你手机root即可，这才叫活好不粘人！！！
+
+### frida的反检测性比xposed好很多
+ xposed虽然有许多山寨版，在某些方面魔改可以对抗一些检测。但是依然是投入产出比不高，付出了那么多精力结果反检测性并没有实质性的上去。原因是xposed在设计的时候就走错了，等他发现基于替换zygote进程孵化容易被检测的时候已经晚了。所以xposed一直是错着往前！感兴趣的去看我《实现frida版的JustTrustMe（一）JustTrustMe官方源码学习》在开头讲的。
+
+### 对抗混淆
+ 我提供了[just_trust_me_okhttp_hook_finder.js](https://github.com/CreditTone/hooker/blob/master/com.twitter.android/just_trust_me_okhttp_hook_finder.js)使你可以快速定位到okhttp[3-4]的混淆点，让你可以快速对每个app进行定制。
+
+### frida可定制性好
+ frida方面你只要会js就可以修改[just_trust_me.js](https://github.com/CreditTone/hooker/blob/master/com.twitter.android/just_trust_me.js)，而xposed要求你至少会基本的java、android开发和熟悉xposed框架api。
+
+# 后记
+没有100%能把所有包都抓住，都要基于每个app的反抓包策略进行一些调整。还有包括双向认证，需要在抓包工具上配置客户端证书、还有要vpn转发的、还有走私有协议的是不能用httpproxy类的抓包工具来抓包的等等吧。但是我会尽最大可能，让大家在操作相对简单的情况下帮大家抓到包。节省大家一点点时间，工具的本质就是提效。懒人出科技就是这样！
+
+
+
+ [1]: http://static.zybuluo.com/1273568669/0gjhwhbgg8yw6nyot1lgsfrw/WechatIMG415.png
+ [2]: http://static.zybuluo.com/1273568669/pakmqbet9bfkthi3tn1420dk/%E6%8A%93%E5%8C%85%E5%A4%B1%E8%B4%A5%E5%B1%95%E7%A4%BA.png
+ [3]: http://static.zybuluo.com/1273568669/ayyj2o1o6m9ndluea7p4uaal/%E5%90%AF%E5%8A%A8just_trust_me.gif
+ [4]: http://static.zybuluo.com/1273568669/vhrma5jzvzjyjtwit99ojxtn/%E5%90%AF%E5%8A%A8just_trust_me%E4%B9%8B%E5%90%8E.gif
+ [5]: http://static.zybuluo.com/1273568669/al811jvk2act05mhvyzpywp8/WechatIMG417.png
+ [6]: http://static.zybuluo.com/1273568669/xufqyh60yjfutidit3bbarf1/qutoutiao_result.gif
+ [7]: http://static.zybuluo.com/1273568669/agierqyhvh78b6vt2m25rs2a/WechatIMG420.png
+ [8]: http://static.zybuluo.com/1273568669/6xy4b84vnch2i1zjbfu5iqiy/WechatIMG422.png
+ [9]: http://static.zybuluo.com/1273568669/pmaug9o12xyaofd6kf7vl6z3/111.png
+ [10]: http://static.zybuluo.com/1273568669/xyf0czutgr1ho2vuxswe5tk9/222.png
+ [11]: http://static.zybuluo.com/1273568669/qvzlycuwjkfil7i0mz7765sh/333.png
+ [12]: http://static.zybuluo.com/1273568669/1e6ykjjfsqf8kr4u7d9jldff/444.png
+ [13]: http://static.zybuluo.com/1273568669/lnikbsd36yq6q8zfw3kp0b5g/666.png
+ [14]: http://static.zybuluo.com/1273568669/pt49hc31pjy8del9ssh9s2iv/555.png
\ No newline at end of file
diff --git a/LICENSE.md b/LICENSE.md
new file mode 100644
index 0000000..29cac8c
--- /dev/null
+++ b/LICENSE.md
@@ -0,0 +1,201 @@
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright 2021, guozhong
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
diff --git a/README.md b/README.md
index fc045ea..367b0c2 100644
--- a/README.md
+++ b/README.md
@@ -1,1129 +1,748 @@
-[](https://mseep.ai/app/credittone-hooker)
+### 欢迎使用hooker逆向工作台
-免责声明
-本项目的所有内容仅供学习与技术交流使用，旨在帮助开发者理解移动应用的结构和工作原理。
+hooker是一个基于frida实现的逆向工具包。为逆向开发人员提供统一化的脚本包管理方式、通杀脚本、自动化生成hook脚本、内存漫游探测activity和service、frida版JustTrustMe。
-本项目不包含任何针对特定应用的破解操作或侵权内容。
-针对某些app存在的简单解包技术内容在各大技术论坛网站均大量存在，并无对这些app造成实际损害
-本项目无意协助任何非法用途，包括但不限于绕过版权保护、修改应用功能或获取未经授权的数据。
-请确保在使用本项目工具时遵守相关法律法规，并仅用于个人学习或研究目的。
+# [hooker开源协议](https://github.com/CreditTone/hooker/blob/master/LICENSE.md)
+https://github.com/CreditTone/hooker/blob/master/LICENSE.md
-简体中文 | English
+hooker使用[Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0)开源协议，协议核心规范如下
-# 欢迎使用hooker逆向工作台
-
-
-
-
-
+ 1.授权使用者免费使用个人专利
-hooker是一个基于frida实现的逆向工具包。旨在为安卓逆向开发人员提供一个舒适的命令行界面和一些常用的通杀脚本、自动化生成hook脚本、内存漫游探测activity和service、frida版JustTrustMe、boringssl unpinning全网app通杀
+ 2.使用者必须放置协议说明
+ 3.使用者需要对修改部分声明
+ 4.禁止用作者的名号进行商业广告
+
+ 5.原作者不承担代码使用后风险
+
+
+本项目仅作为学习使用，不参与任何入侵、破解计算机信息系统的行为。如有影响您app信息安全的地方，请立即与我联系删除，谢谢！邮箱：1273568669@qq.com
+
+
+### radar增强项目源码
+https://github.com/CreditTone/radar4hooker
-为什么你需要hooker？
=================
-* [1. frida版JustTrustMe，通杀全网APP，且作者一直在持续维护升级](#12-frida版JustTrustMe包括boringgssl)
-* [2. 嵌入式webserver支持把App内部能力快速暴露成HTTP接口，便于做自动化和接口化](#7-嵌入式webserver)
-* [3. 快捷设置socks5代理，无需额外安装socksdroid等三方app实现无感知代理](#11-快捷设置socks5无感代理)
-
+# 快速定位
+##### [自动化生成frida hook脚本](#j---生成指定类的hook脚本)
+
+##### [frida版just_trust_me](#11-just_trust_mejs)
+##### [frida版just_trust_me实战测试报告](https://github.com/CreditTone/hooker/blob/master/JUSTTRUSTME.md)
----
+##### [disable_sslpinning](#7-disable_sslpinning)
目录
=================
-* [快速开始](#快速开始)
+* [hooker和frida、objection有什么不同](#hooker和frida-objection有什么不同)
+* [hooker环境部署](#环境部署)
* [1. git clone项目](#1-git-clone项目)
- * [2. 安装依赖](#2-安装python3依赖)
- * [3. root手机usb连接](#3-root手机usb连接PC)
- * [4. 启动hooker](#4-启动hooker)
- * [5. 输入调试应用包名](#5-输入调试应用包名)
- * [6. 查看help信息](#6-查看help信息)
- * [7. 嵌入式webserver](#7-嵌入式webserver)
- * [8. 自动化生成frida脚本](#8-自动化生成frida脚本)
- * [9. 列出所有frida脚本](#9-列出应用目录所有frida脚本)
- * [10. attach执行frida脚本](#10-attach执行frida脚本)
- * [11. 快捷设置socks5无感代理](#11-快捷设置socks5无感代理)
- * [12. frida版JustTrustMe](#12-frida版JustTrustMe包括boringgssl)
- * [13. spawn执行frida脚本](#13-spawn执行frida脚本)
- * [14. 取消代理设置](#14-取消代理设置)
- * [15. 重启app](#15-重启app)
- * [16. 获取uid和pid](#16-获取uid和pid)
- * [17. pull文件](#17-pull文件)
- * [18. r0capture](#18-r0capture)
- * [19. hooker自动升级](#19-upgrade)
-* [开发手机API接口](#开发手机api接口)
-* [hooker原生提供的操作API](#hooker原生提供的操作api)
-* [应用工作目录脚本](#应用工作目录脚本)
- * [url.js](#urljs)
- * [just_trust_me.js](#just_trust_mejs)
- * [activity_events.js](#activity_eventsjs)
- * [click.js](#clickjs)
- * [android_ui.js](#android_uijs)
- * [keystore_dump.js](#keystore_dumpjs)
- * [edit_text.js](#edit_textjs)
- * [hook_register_natives.js](#hook_register_nativesjs)
- * [text_view.js](#text_viewjs)
- * [ssl_log.js](#ssllogjs)
- * [just_trust_me_for_ios.js](#just_trust_me_for_iosjs)
- * [dump_dex.js](#dump_dexjs)
- * [trace_init_proc.js](#trace_init_procjs)
- * [hook_artmethod_register.js](#hook_artmethod_registerjs)
- * [find_anit_frida_so.js](#find_anit_frida_sojs)
- * [jni_method_trace.js](#hook_jni_method_tracejs)
- * [replace_dlsym_get_pthread_create.js](#replace_dlsym_get_pthread_createjs)
- * [find_boringssl_custom_verify_func.js](#find_boringssl_custom_verify_funcjs)
- * [get_device_info.js](#get_device_infojs)
- * [apk_shell_scanner.js](#apk_shell_scannerjs)
- * [bypass_frida_svc_detect.js](#bypass_frida_svc_detectjs)
- * [bypass_root_detect.js](#bypass_root_detectjs)
- * [bypass_vpn_detect.js](#bypass_vpn_detectjs)
- * [hook_encryption_algo.js](#hook_encryption_algojs)
- * [hook_encryption_algo2.js](#hook_encryption_algo2js)
- * [webview_enable_debug.js](#webview_enable_debugjs)
-* [Windows安装WSL](#windows安装wsl)
- * [1. 安装wsl ubuntn24.04](#1-安装wsl-ubuntn2404)
- * [2. 进入wsl，配置代理](#2-进入wsl配置代理)
- * [3. 安装python3.8和frida](#3-安装python38和frida)
-* [自定义frida-server](#自定义frida-server)
-* [hooker命令行快捷键](#hooker命令行快捷键)
-
-
-
-手机保证root，无需任何手动启动frida-server等一切配置，hooker会帮你搞定一切。x86架构的模拟器不兼容
-
-# Mac/Linux配置hooker运行环境
-
-Windows请先完成[WSL安装](#windows%E5%AE%89%E8%A3%85wsl)，然后跳回到这里
+ * [2. 安装依赖](#2-安装依赖)
+ * [3. 手机连接adb](#3-手机连接adb)
+ * [4. 手机开发环境部署](#4-手机开发环境部署)
+ * [5. 指定fridaserver端口的手机开发环境部署](#5-指定fridaserver端口的手机开发环境部署)
+ * [6. 部署之后手机的增强功能](#6-部署之后手机的增强功能)
+* [快速开始](#快速开始)
+ * [1. 查看可调试进程](#1-查看可调试进程)
+ * [2. attach一个应用](#2-attach一个应用)
+ * [3. 应用工作目录](#3-应用工作目录)
+* [应用工作目录的命令](#应用工作目录的命令)
+ * [1. hooking](#1-hooking)
+ * [2. attach](#2-attach)
+ * [3. spawn](#3-spawn)
+ * [4. objection](#4-objection)
+ * [5. xinitdeploy](#5-xinitdeploy)
+ * [6. kill](#6-kill)
+ * [7. disable_sslpinning](#7-disable_sslpinning)
+* [应用工作目录的通杀脚本](#应用工作目录的通杀脚本)
+ * [1. url.js](#1-urljs)
+ * [2. activity_events.js](#2-activity_eventsjs)
+ * [3. click.js](#3-clickjs)
+ * [4. android_ui.js](#4-android_uijs)
+ * [5. keystore_dump.js](#5-keystore_dumpjs)
+ * [6. edit_text.js](#6-edit_textjs)
+ * [7. text_view.js](#7-text_viewjs)
+ * [8. ssl_log.js](#8-ssl_logjs)
+ * [9. object_store.js](#9-object_storejs)
+ * [10. hook_RN.js](#10-hook_RNjs)
+ * [11. just_trust_me.js](#11-just_trust_mejs)
+ * [12. just_trust_me_okhttp_hook_finder.js](#12-just_trust_me_okhttp_hook_finderjs)
+* [hooker调试命令行](#hooker调试命令行)
+ * [a-打印Activity栈](#a---打印activity栈)
+ * [b-打印Service栈](#b---打印Service栈)
+ * [c-扫描指定Object](#c---扫描指定Object)
+ * [d-展开Object[]、List或Map](#d---%E5%B1%95%E5%BC%80objectlist%E6%88%96map)
+ * [v-以View方式查看对象](#v---以view的方式查看对象)
+ * [e-检测类在内存中是否存在](#e---检测类在内存中是否存在)
+ * [s-正则表达式扫描类](#s---正则表达式扫描类)
+ * [j-生成指定类的hook脚本](#j---生成指定类的hook脚本)
+ * [k-生成字符串hook脚本](#k---%E7%94%9F%E6%88%90%E5%AD%97%E7%AC%A6%E4%B8%B2hook%E8%84%9A%E6%9C%AC)
+* [hooker高级应用](#hooker高级应用)
+ * [radar.dex](#radardex)
+ * [脚本的内置函数](#脚本的内置函数)
+ * [1. loadDexfile(dexfile)](#1-loaddexfiledexfile)
+ * [2. checkLoadDex(className，dexfile)](#2-checkloaddexclassname-dexfile)
+ * [3. loadXinitDexfile(dexfile)](#3-loadxinitdexfiledexfile)
+ * [4. loadXRadarDexfile()](#4-loadxradardexfile)
+ * [5. fastTojson(javaObject)](#5-fasttojsonjavaobject)
+ * [6. getPrettyString(javaObject)](#6-getprettystringjavaobject)
+ * [7. getField(javaObject, fieldName)](#7-getfieldjavaobject-fieldname)
+ * [8. storeObjectAndLog(javaObject)](#8-storeobjectandlogjavaobject)
+ * [原生ui自动化](#原生ui自动化)
+ * [1. startActivity(activityName)](#1-startactivityactivityname)
+ * [2. contextStartActivity(activityName)](#1-startactivityactivityname)
+ * [3. contextStartActivity(activityName)](#1-startactivityactivityname)
+ * [4. home()](#1-startactivityactivityname)
+ * [5. back()](#1-startactivityactivityname)
+ * [6. finishCurrentActivity()](#1-startactivityactivityname)
+ * [7. clickByText(text)](#1-startactivityactivityname)
+ * [8. clickById(id)](#1-startactivityactivityname)
+ * [9. hover(x,y,upStepLength)](#1-startactivityactivityname)
+ * [10. viewTree()](#1-startactivityactivityname)
+ * [远程frida支持](#远程frida支持)
+* [更新教程](#更新教程)
+ * [1. clone最新项目](#1-clone最新项目)
+ * [2. 方式一覆盖核心文件到你的hooker](#2-方式一覆盖核心文件到你的hooker)
+ * [3. 方式二覆盖你的应用工作目录到最新hooker](#3-方式二覆盖你的应用工作目录到最新hooker)
+
+# hooker和frida、objection有什么不同
+- 职责不同：frida注重打造调试引擎、objection注重将frida的api简单封装一下让你好快速上手frida。而hooker是重新站在一个安卓应用开发和安卓逆向工程师的角度去打造的更加专业Android逆向工作台，重新定义了逆向android的工作方式。
+- 封装不同：frida是基于gumjs（V8）、C/C++封装的调试引擎，用于动态Hook跟踪、拦截和主动调用函数等。hooker是基于frida作为引擎和自己打造的Dex库（radar）调用Android Framework层代码完成的。
+- 交互方式不一样：frida和objection只有attach上才能操作各种指令，而hooker提供shell命令行交互式让你可以通过jadx进行动静结合分析。
+- 更注提供重Android逆向思路和线索：frida和objection没有对任何Android Freamwork层的hook和能主动调用代码点位进行封装，这使得难以有逆向思路。而hooker的几乎所有命令都是围绕Android Freamwork进行封装，让一个即使没有Android开发经验的人也能快速找到逆向分析思路。
+- hook脚本产出方式不一样：frida你需要先进行很多语法方面的学习，才能完成对各种类的各种方法进行frida脚本的编写。hooker不需要你了解frida语法细节，比如你只需通过j okhttp3.OkHttpClient:newCall 就可以生成一个hook okhttp3.OkHttpClient类的newCall方法的脚本, 即使对于任何一个被混淆的类操作也是如此。（你应该把更多的时间和精力放在逆向思路上，而不是熟悉某些语法上。）
+- 提供操作原生AndroidUI功能：你可以./attach每个app目录下的android_ui.js脚本，它提供了通过ViewId、ViewText找到Android原生的View并点击，或者你想强制打开某个Activity（比如某个界面只有会员才能进入，这时候你就可以采用Android"原生代码"打开的方式）。
+
+# 环境部署
+前言：hooker仅支持在Linux和MacOS下运行，并且现在和将来都不会支持windows操作系统！windows做开发是没有灵魂的！
### 1. git clone项目
```shell
-stephen@Mac:~$ git clone https://github.com/CreditTone/hooker.git
-stephen@Mac:~$ cd hooker
+stephen@ubuntu:~$ git clone https://github.com/CreditTone/hooker.git
+stephen@ubuntu:~$ cd hooker
+stephen@ubuntu:~$ ls
+colorful.py com.mokee.aegis mobile-deploy.tar
+com.alibaba.wireless com.sankuai.meituan org.mokee.lawnchair
+com.changba com.sdiread.kt.ktandroid org.mokee.weatherservice
+com.google.android.youtube com.smile.gifmaker __pycache__
+com.jifen.qukan com.ss.android.article.news radar.dex
+com.jzg.jzgoto.phone com.ss.android.ugc.aweme README.md
+com.koudai.weidian.buyer com.tencent.karaoke run_env.py
+com.kugou.shiqutouch com.tencent.mm sogou.mobile.explorer
+com.lululemon.shop hooker spider.py
+com.meicai.mall hooker.py traceJNI
+com.meitu.meipaimv js xapk
+com.miui.screenrecorder mobile-deploy.sh xinitdeploy.py
```
-### 2. 安装python3依赖
+### 2. 安装依赖
```shell
-stephen@Mac:~/hooker$ pip3 install -r requirements.txt
+stephen@ubuntu:~/hooker$ pip3 install -r requirements.txt
```
-### 3. root手机usb连接PC
+### 3. 手机连接adb
```shell
-stephen@Mac:~/hooker$ adb devices
+stephen@ubuntu:~/hooker$ adb devices
List of devices attached
FA77C0301476 device
```
-### 4. 启动hooker
-
-这里注意，不要用绝对路径去执行，一定要cd到hooker目录下执行python3 hooker.py
+### 4. 手机开发环境部署
+如果你的手机已经启动了frida-server，可以忽略这步。
-hooker启动后将收集所有可调试app的信息，字段含义如下
-- PID：当前app的主进程id，如果app没有启动则为0
-- APP：app的名称
-- IDENTIFIER：app的包名
-- EXIST_REVERSE_DIRECTORY：如果app曾经被调试过就是✅，从没被调试过就是❌
+注意:部分手机出现部署之后adb连不上的问题，那请使用deploy2.sh。
```shell
-stephen@Mac:~/hooker$ python3 hooker.py
-hooker Let's enjoy reverse engineering together
------------------------------------------------------------------------------------------------
-PID APP IDENTIFIER EXIST_REVERSE_DIRECTORY
-0 全球上网 com.miui.virtualsim ❌
-0 爱奇艺 com.qiyi.video ❌
-0 红手指云手机 com.redfinger.app ❌
-0 Reqable com.reqable.android ❌
-0 美团 com.sankuai.meituan ✅
-0 得物 com.shizhuang.duapp ❌
-0 某皮 cxm.shxpxx.sg ✅
-0 微博 com.sina.weibo ❌
-0 今日头条 com.ss.android.article.news ✅
-0 西瓜视频 com.ss.android.article.video ✅
-0 懂车帝 com.ss.android.auto ✅
-0 抖音火山版 com.ss.android.ugc.live ✅
-0 抖音精选 com.ss.android.yumme.video ❌
-0 淘宝 com.taobao.taobao ✅
-0 腾讯视频 com.tencent.qqlive ❌
-0 Termux com.termux ❌
-0 轻奢 com.tm.bachelorparty ✅
-0 WiFi ADB com.ttxapps.wifiadb ❌
-0 VMOS Pro com.vmos.pro ✅
-0 游戏中心 com.xiaomi.gamecenter ❌
-0 小米商城 com.xiaomi.shop ❌
-0 米家 com.xiaomi.smarthome ❌
-0 小米有品 com.xiaomi.youpin ✅
-0 小红书 com.xingin.xhs ✅
-0 运满满货主 com.xiwei.logistics.consignor ✅
-0 拼多多 com.xunmeng.pinduoduo ✅
-0 EnvCheck com.yimian.envcheck ✅
-0 check_env com.yuuki.check_env ❌
-0 TikTok com.zhiliaoapp.musically ❌
-0 XPrivacyLua eu.faircode.xlua ❌
-0 imToken im.token.app ❌
-0 SocksDroid net.typeblog.socks ❌
-0 F-Droid org.fdroid.fdroid ❌
-0 ProxyDroid org.proxydroid ❌
-3457 手机管家 com.miui.securitycenter ✅
-3509 优信拍 com.uxin.buyerphone ✅
-18780 抖音 com.ss.android.ugc.aweme ✅
-20174 应用商店 com.xiaomi.market ❌
-20913 设置 com.android.settings ❌
-30500 小爱同学 com.miui.voiceassist ❌
-32163 相机 com.android.camera ✅
-Please enter the identifier that needs to be reversed
-hooker(Identifier):
+#以piexl2为例
+stephen@ubuntu:~/hooker$ adb push mobile-deploy/ /sdcard/
+stephen@ubuntu:~/hooker$ adb shell #进入手机命令行界面
+sailfish:/ $ su #进入root权限命令行模式
+sailfish:/ $ sh /sdcard/mobile-deploy/deploy.sh
+disable android firewall.
+start frida-server
+start network adb.
+deploy successfull.
+stephen@ubuntu:~/hooker$ #如果你看到你的adb命令被弹出来了，表示已经正常部署。
```
+
***
-
-### 5. 输入调试应用包名
-
-- 输入调试应用包名回车后，如果是第一次调试应用，hooker将创建应用目录，应用目录名称为应用的Identifier，用于存放所有js脚本和快捷命令。
-
-- hooker将帮你检测当前app是否启动且在手机前台，如不在启动帮你启动，如不在前台帮你切到前台
-
-- frida通杀脚本可以在hooker交互式命令行下用attach/spawn执行，也可以手动cd到应用目录用快捷命令或原生的frida命令执行。
-
-- 你可以修改应用工作目录下任何脚本
-
+### 5. 指定fridaserver端口的手机开发环境部署
```shell
-hooker(Identifier): cxm.shxpxx.sg
-✅ App cxm.shxpxx.sg is already in the foreground
-Creating working directory: cxm.shxpxx.sg
-Generating frida shortcut command...
-Generating built-in frida script...
-pull /data/app/cxm.shxpxx.sg-L8zkrpFVICv0-hOrtmPPxA==/base.apk to cxm.shxpxx.sg/ShopeeSG_3.43.40.apk successful
-Working directory create successful
-just_trust_me.js empty.js keystore_dump.js
-edit_text.js activity_events.js find_boringssl_custom_verify_func.js
-ssl_log.js hook_register_natives.js click.js
-get_device_info.js apk_shell_scanner.js dump_dex.js
-object_store.js hook_artmethod_register.js replace_dlsym_get_pthread_create.js
-just_trust_me_for_ios.js trace_initproc.js android_ui.js
-jni_method_trace.js url.js just_trust_me_okhttp_hook_finder_for_android.js
-text_view.js find_anit_frida_so.js
-某皮 >
+stephen@ubuntu:~/hooker$ adb shell #进入手机命令行界面
+sailfish:/ $ su #进入root权限命令行模式
+sailfish:/ $ sh /sdcard/mobile-deploy/deploy.sh 6666 #deploy.sh启动失败的同样可以尝试deploy2.sh
+disable android firewall.
+set firda_server_bind_port to 6666
+start frida-server
+start network adb.
+deploy successfull.
+stephen@ubuntu:~/hooker$ #如果你看到你的adb命令被弹出来了，表示已经正常部署。
```
-
***
+注意：自定义frida server端口的开发环境必须走host:post的方式调试，因为usb默认找27042端口。所以请务必[更改本地.hooker_driver文件](#远程frida支持)，否则hooker无法正常工作。
-
-
-### 6. 查看help信息
-
-在使用hooker过程中，如不记得命令，可随时调出help查看操作手册。
-
-```shell
-某皮 > help
-h, help show this help message
-a, activitys show the activity stack
-s, services show the service stack
-o, object [object_id] show object info by object_id
-v, view [view_id] show view info by view_id of view
-gs, generatescript [class_name:method_name] specify the class name and method name to generate a frida hook java script file. For example: generatescript
- okhttp3.Request$Builder:addHeader
-p, proxy [socks5_proxy_server] set up a socks5 proxy for this app. For example: proxy socks5://192.168.0.100:9998
-up, unproxy remove socks5 proxy for this app
-trust, justtrustme quickly spawn just_trust_me.js script to kill all ssl pinning
-ls list all the frida scripts of the current app
-attach [script_file_name] quickly execute a frida script, similar to executing the command "frida -U com.example.app -l xxx.js". For example: attach url.js
-spawn [script_file_name] quickly spawn a frida script, similar to executing the command "frida -U -f -n com.example.app -l xxx.js". For example: spawn
- just_trust_me.js
-restart restart this app
-pid get pid of this app main process
-uid get pid of this app
-exit return to the previous level
-某皮 >
-```
-
+### 6. 部署之后手机的增强功能
+- 1.关闭iptables防火墙，解决部分手机默认防火墙开启的问题
+- 2.启动frida-server，如果你的手机是arm64他将优先启动arm64位的frida-server
+- 3.在/data/mobile-deploy目录生成tools_env.rc 当你有内网穿透和网络服务转发、编辑文件、检测网络方面的需求时可以执行source /data/mobile-deploy/tools_env.rc，它将临时生成vi、telnet、frpc、tcpforward、ll命令以便你进行更便捷的开发，如图
+
***
-
-
-
-### 7. 嵌入式webserver
-
-hooker 支持在手机中注入一个轻量级 webserver。启动后会在目标 App 进程内开启一个 HTTP 服务，默认端口是 `8080`。这个服务既可以暴露 patch 项目里自定义的 controller，也会自动挂载一组内置调试接口。
-
-- 启动内置 webserver
-
-```shell
-某音火山版 > webserver start
-Http server port: 8080
-Http server: http://10.112.101.249:8080
-```
-
-启动内置 webserver 后，浏览器打开首页即可看到当前已注册的 API 列表。常用能力包括：
-
-- 服务管理：`/` 查看欢迎页和接口清单，`/stop` 停止当前 webserver。
-- UI 自动化：`/hooker/ui/...` 提供点击控件、按文本点击、按坐标点击、设置输入框文本、触发返回/Home、启动 Activity、获取屏幕信息、翻页、滚动 RecyclerView、尝试关闭弹窗等能力，适合做半自动化操作和页面联调。
-- 页面结构导出：`/hooker/uiauto/dump`、`/hooker/uiauto/window_dump.xml`、`/hooker/uiauto/window_dump.json` 可以导出当前窗口层级，方便定位控件和分析页面结构。
-- 截图能力：`/hooker/screencap/screenshot` 可直接调用系统 `screencap` 截图；`/hooker/mediaprojection/...` 支持申请 MediaProjection 权限并抓取整屏 PNG，更适合做远程观察和自动化闭环。
-- App 信息读取：`/hooker/appinfo` 可读取包名、版本、组件、权限、签名和目录信息；`/hooker/appinfo/shared_prefs`、`/hooker/appinfo/databases`、`/hooker/appinfo/read_table` 可以直接查看 `shared_prefs`、数据库结构和表数据。
-- 类/对象辅助调用：`/hooker/classhelper/invoke_static_method`、`/hooker/classhelper/invoke_method` 支持通过 HTTP 直接调用静态方法或已缓存对象的方法，便于快速验证算法、补环境或调试业务逻辑。
-- 文件回传：`/file?filename=...` 可以把绝对路径文件或 webserver 缓存目录里的文件直接通过 HTTP 返回。
-- MCP 风格 UI 工具：`/hooker/mcp/ui/tools` 和 `/hooker/mcp/ui/call` 把常用 UI 操作封装成统一工具接口，便于外部脚本或 Agent 通过 HTTP 驱动当前 App。
-
-
-- 7.1 启动自定义 webserver
-
-给定一个patch工程的jar包，将爬虫接口启动为webserver。
-
-```shell
-某宝 > webserver start taxbax-patch.jar
-Converting taxbax-patch.jar to taxbax-patch.dex...
-Successfully converted to taxbax-patch.dex (7160 bytes)
-push file OK /data/user/0/com.taxbax.taxbax/hooker_server.dex
-Http server port: 2026
-Http server: http://10.112.101.249:2026
-```
-
-这里的 `taxbax-patch.jar` 可以理解成“运行在目标 App 进程里的业务插件”。`hooker` 会先把 jar 转成 dex，再注入到目标进程中，扫描其中带注解的类，然后把这些类注册成 HTTP 路由。
-
-- 7.2 自定义 webserver 适合做这类事情：
-
-- 暴露目标 App 内部已经存在的业务能力，比如搜索、评论、详情页、签名、加解密、用户资料、直播接口等。
-- 直接复用目标 App 自己的登录态、网络栈、环境参数和对象实例，避免在外部重复补协议。
-- 把异步回调、Observable、Listener、页面对象调用收敛成一个同步 HTTP 接口，对外统一返回 JSON 或文本。
-
-你可以像开发springboot一样优雅的开发嵌入式的httpserver，并调用目标app的任何java代码而无需像有些xposed插件一样TMD的反射、反射、再反射，跟SB一样😊
-
-- 用 `@HookerWebServerConfiguration(port = 2026)` 指定端口，不写时默认走 `8080`。
-- 用 `@HookerController("/taobao")`、`@HookerController("/douyin")` 这类注解定义业务前缀。
-- 用 `@HookerRequestMapping(path = "/getProductDetail")` 之类的注解暴露具体接口。
-- 用 `@HookerRequestParam`、`@HookerRequestPostJson` 接收查询参数和 POST JSON。
-
-
-具体开发文档，将在https://github.com/CreditTone/radar4hooker详细介绍
-
-
-- 7.3 webserver 持久化
-
-如果你已经为某个 App 开发好了 patch 工程，并且需要在多台设备上长期部署，那么 `frida + hooker` 的临时注入方式会比较重。针对这种场景，作者提供了 Xposed 插件 `HookerServer`：
-
-`https://github.com/CreditTone/HookerServer`
-
-只要手机支持 Xposed/LSPosed，就可以借助这个插件把 webserver 持久化到目标 App 中。
-
-操作步骤：
-
-1. 从 `https://github.com/CreditTone/HookerServer/releases` 下载最新 APK。
-2. 把 `patch.dex` 推送到 `/data/user/0/{package}/hooker_server.dex`。
-3. 在 Xposed/LSPosed 中启用 `HookerServer`，并勾选目标 App。
-4. 重启 App，webserver 即可自动启动。
-
-其中 `patch.dex` 可以在第一次部署 `patch.jar` 后获得，hooker 会自动完成 jar 转 dex，并把生成结果放到目标应用的工作目录中。
-
-
+- 4.启动网络adb，即你可以直接通过远程adb调试手机。例如:adb connect 192.168.0.105
+
***
+# 快速开始
-### 8. 自动化生成frida脚本
-自动化生成脚本是hooker的杀器。虽然现在AI大模型也可以写，但是我们离内存近，更快，也不需要联网。生成的脚本自带打印堆栈等信息，和一些你可能需要的扩展方法。
-另外在生成脚本的过程中，命令行类名、方法名提示也可以当作搜索使用，能通过关键词快速搜索定位类方法。hooker搜索类比jadx快很多，不信就试试......
-
-
-- Command语法：gs, generatescript [class_name:method_name]
-
-
-- 8.1 生成指定方法的frida hook脚本：
-gs okhttp3.Request$Builder:addHeader，参数部分(String, String)不是必须写的
-
+### 1. 查看可调试进程
```shell
-某信拍 > gs okhttp3.Request$Builder:addHeader(String, String)
-Generating frida script, please wait for a few seconds
-frida hook script: okhttp3.Request.Builder.addHeader.js
-某信拍 >
-```
-
-```js
-//cat okhttp3.Request.Builder.addHeader.js
-Java.perform(function() {
- var okhttp3_Request_Builder_clz = Java.use('okhttp3.Request$Builder');
- var okhttp3_Request_Builder_clz_method_addHeader_2grl = okhttp3_Request_Builder_clz.addHeader.overload('java.lang.String', 'java.lang.String');
- okhttp3_Request_Builder_clz_method_addHeader_2grl.implementation = function(string, string_x2) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.addHeader(java.lang.String,java.lang.String)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_addHeader_2grl.call(this, string, string_x2);
- console.log("header name:" + string + " header value:" + string_x2);
- printBeat(beat);
- return ret;
- };
-});
+stephen@ubuntu:~/hooker$ ./hooker
+ PID Name Identifier
+----- ----------------------------- -------------------------------------------------------------
+ 2857 Android Auto com.google.android.projection.gearhead
+ 1779 Android Services Library com.google.android.ext.services
+ 929 Android 系统 android
+ 5073 Carrier Services com.google.android.ims
+11051 Device Health Services com.google.android.apps.turbo
+ 2913 Device Personalization S… com.google.android.as
+ 2522 Google com.google.android.googlequicksearchbox
+15189 Google Play 商店 com.android.vending
+ 2101 Google Play 服务 com.google.android.gms
+ 2833 Google VR 服务 com.google.vr.vrcore
+ 7710 Google 服务框架 com.google.android.gsf
+ 2546 NFC服务 com.android.nfc
+ 929 NetworkStack com.android.networkstack.inprocess
+ 929 一体化位置信息 com.android.location.fused
+14468 云端硬盘 com.google.android.apps.docs
+14403 信息 com.google.android.apps.messaging
+12073 存储已屏蔽的号码 com.android.providers.blockednumber
+ 1574 实时数据壁纸 com.ustwo.lwp
+15637 抖音 com.ss.android.ugc.aweme
+ 2480 搜狗输入法 com.sohu.inputmethod.sogou
+12073 用户字典 com.android.providers.userdictionary
+13362 电话 com.google.android.dialer
+ 1704 电话和短信存储 com.android.providers.telephony
+ 1704 电话服务 com.android.phone
+11818 知乎 com.zhihu.android
+ 1451 系统界面 com.android.systemui
+12424 紧急警报 com.android.cellbroadcastreceiver
+12073 联系人存储 com.android.providers.contacts
+ 1431 蓝牙 com.android.bluetooth
+ 929 设置存储 com.android.providers.settings
+10149 运营商设置 com.google.android.wfcactivation
+14376 通讯录 com.google.android.contacts
+ 929 通话管理 com.android.server.telecom
+14807 阿里巴巴 com.alibaba.wireless
+Enter the need to attach package.
+:
```
-***
-
-
-
-- 8.2 生成指定类的所有成员方法的frida hook脚本：
-gs okhttp3.Request$Builder
+### 2. attach一个应用
```shell
-某信拍 > generatescript okhttp3.Request$Builder
-Generating frida script, please wait for a few seconds
-frida hook script: okhttp3.Request.Builder.allfunc.js
+stephen@ubuntu:~/hooker$ ./hooker
+ PID Name Identifier
+----- ----------------------------- -------------------------------------------------------------
+15637 抖音 com.ss.android.ugc.aweme
+ 2480 搜狗输入法 com.sohu.inputmethod.sogou
+12073 用户字典 com.android.providers.userdictionary
+13362 电话 com.google.android.dialer
+ 1704 电话和短信存储 com.android.providers.telephony
+ 1704 电话服务 com.android.phone
+11818 知乎 com.zhihu.android
+ 1451 系统界面 com.android.systemui
+12424 紧急警报 com.android.cellbroadcastreceiver
+12073 联系人存储 com.android.providers.contacts
+ 1431 蓝牙 com.android.bluetooth
+ 929 设置存储 com.android.providers.settings
+10149 运营商设置 com.google.android.wfcactivation
+14376 通讯录 com.google.android.contacts
+ 929 通话管理 com.android.server.telecom
+14807 阿里巴巴 com.alibaba.wireless
+Enter the need to attach package.
+: com.ss.android.ugc.aweme #在此处输入进程的Identifier即可调试应用
+It's com.ss.android.ugc.aweme that you have attached app.
+--------------------------------------------------
+Please enter e, s, j, c or ex command.
+a: Discovering activities.
+b: Discovering services.
+c: Discovering object. eg:'c {objectId}'
+d: Object2Explain. eg:'d {objectId}'
+v: Discovering view. eg:'v {viewId}'
+e: Determines whether a class exists. eg:'e android.app.Application'
+s: Discovering classes by a class'regex. eg:'s com.tencent.mm.Message.*'
+t: Discovering offspring classes by a class'name. eg:'t com.tencent.mm.BasicActivity'
+j: Generating hooked js. eg:'j okhttp3.Request$Builder:build'
+k: Generating hooked the string generation js with a keyword. eg:'k {YourKeyword}'
+l: Generating hooked the param generation js with a param keyword. eg:'l {YourKeyword}'
+m: Discovering so module.
+ex: Exit to the upper layer. eg:'ex'
+:
```
-***
-
-```js
-//cat okhttp3.Request.Builder.allfunc.js
-//okhttp3.Request$Builder
-Java.perform(function() {
- var okhttp3_Request_Builder_clz = Java.use('okhttp3.Request$Builder');
- var okhttp3_Request_Builder_clz_method_header_ng3n = okhttp3_Request_Builder_clz.header.overload('java.lang.String', 'java.lang.String');
- okhttp3_Request_Builder_clz_method_header_ng3n.implementation = function(string, string_x2) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.header(java.lang.String,java.lang.String)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_header_ng3n.call(this, string, string_x2);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_cacheControl_q8q5 = okhttp3_Request_Builder_clz.cacheControl.overload('okhttp3.CacheControl');
- okhttp3_Request_Builder_clz_method_cacheControl_q8q5.implementation = function(cacheControl) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.cacheControl(okhttp3.CacheControl)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_cacheControl_q8q5.call(this, cacheControl);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_method_bjk9 = okhttp3_Request_Builder_clz.method.overload('java.lang.String', 'okhttp3.RequestBody');
- okhttp3_Request_Builder_clz_method_method_bjk9.implementation = function(string, requestBody) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.method(java.lang.String,okhttp3.RequestBody)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_method_bjk9.call(this, string, requestBody);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_head_a5nq = okhttp3_Request_Builder_clz.head.overload();
- okhttp3_Request_Builder_clz_method_head_a5nq.implementation = function() {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.head()';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_head_a5nq.call(this);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_headers_to5i = okhttp3_Request_Builder_clz.headers.overload('okhttp3.Headers');
- okhttp3_Request_Builder_clz_method_headers_to5i.implementation = function(headers) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.headers(okhttp3.Headers)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_headers_to5i.call(this, headers);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_post_heaq = okhttp3_Request_Builder_clz.post.overload('okhttp3.RequestBody');
- okhttp3_Request_Builder_clz_method_post_heaq.implementation = function(requestBody) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.post(okhttp3.RequestBody)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_post_heaq.call(this, requestBody);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_build_rmqx = okhttp3_Request_Builder_clz.build.overload();
- okhttp3_Request_Builder_clz_method_build_rmqx.implementation = function() {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request okhttp3.Request$Builder.build()';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_build_rmqx.call(this);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_patch_hp9u = okhttp3_Request_Builder_clz.patch.overload('okhttp3.RequestBody');
- okhttp3_Request_Builder_clz_method_patch_hp9u.implementation = function(requestBody) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.patch(okhttp3.RequestBody)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_patch_hp9u.call(this, requestBody);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_url_0owi = okhttp3_Request_Builder_clz.url.overload('java.lang.String');
- okhttp3_Request_Builder_clz_method_url_0owi.implementation = function(string) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.url(java.lang.String)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_url_0owi.call(this, string);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_removeHeader_uzb9 = okhttp3_Request_Builder_clz.removeHeader.overload('java.lang.String');
- okhttp3_Request_Builder_clz_method_removeHeader_uzb9.implementation = function(string) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.removeHeader(java.lang.String)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_removeHeader_uzb9.call(this, string);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_url_ykbd = okhttp3_Request_Builder_clz.url.overload('java.net.URL');
- okhttp3_Request_Builder_clz_method_url_ykbd.implementation = function(url) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.url(java.net.URL)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_url_ykbd.call(this, url);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_delete_dqyl = okhttp3_Request_Builder_clz.delete.overload();
- okhttp3_Request_Builder_clz_method_delete_dqyl.implementation = function() {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.delete()';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_delete_dqyl.call(this);
- printBeat(beat);
- return ret;
- };
- //.......省略N行代码
-```
-***
-
+##### 提示1: 第一次调试你的应用时hooker将在当前目录生成以进程Identifier命名的应用专有工作目录，并初始化生成一些你可能会用到的通杀脚本。
+##### 提示2: 成功attach一个应用时，命令将pause在等待输入调试指令的阶段。pause状态下使用命令进行高级调试请直接跳到[hooker调试命令行](#hooker调试命令行)
+##### 提示3: attach时hooker会将[radar.dex](#radardex)文件拷贝到手机的/data/user/0/{package}/目录下
+
-- 8.3 生成指定类的构造方法的frida hook脚本：
-gs okhttp3.Request$Builder:_ 或者gs okhttp3.Request$Builder:\
+### 3. 应用工作目录
+应用工作目录的意义在于提供一个的地方存放和管理frida脚本和快捷命令。hooker在你第一次调试应用时会创建应用工作目录，并初始化一些通杀脚本和快捷命令。
```shell
-某信拍 > gs okhttp3.Request$Builder:()
-Generating frida script, please wait for a few seconds
-frida hook script: okhttp3.Request.Builder._init.js
+stephen@ubuntu:~/hooker/com.ss.android.ugc.aweme$ ls -l
+total 784
+-rw-rw-r-- 1 stephen stephen 7662 3月 16 20:55 activity_events.js
+-rw-rw-r-- 1 stephen stephen 5790 3月 16 20:55 android_ui.js
+-rwxrwxrwx 1 stephen stephen 102 8月 3 2020 attach
+-rw-rw-r-- 1 stephen stephen 2242 8月 3 2020 click.js
+-rw-rw-r-- 1 stephen stephen 12687 3月 23 22:23 com.bytedance.frameworks.core.encrypt.RequestEncryptUtils.js
+-rw-rw-r-- 1 stephen stephen 4322 8月 3 2020 edit_text.js
+-rwxrwxrwx 1 stephen stephen 159 8月 3 2020 hooking
+-rwxrwxrwx 1 stephen stephen 101 8月 3 2020 kill
+-rw-rw-r-- 1 stephen stephen 709448 3月 18 22:11 log
+-rwxrwxr-x 1 stephen stephen 99 3月 16 20:55 objection
+-rw-rw-r-- 1 stephen stephen 1226 3月 16 20:55 object_store.js
+-rw-rw-r-- 1 stephen stephen 2553 3月 16 20:55 spider.py
+-rw-rw-r-- 1 stephen stephen 2371 8月 3 2020 text_view.js
+-rw-rw-r-- 1 stephen stephen 4789 3月 16 20:55 url.js
+drwxrwxr-x 2 stephen stephen 4096 3月 25 21:21 xinit
+-rwxrwxr-x 1 stephen stephen 5552 3月 16 20:55 xinitdeploy
```
-```js
-//cat okhttp3.Request.Builder._init.js
-//okhttp3.Request$Builder:()
-Java.perform(function() {
- var okhttp3_Request_Builder_clz = Java.use('okhttp3.Request$Builder');
- var okhttp3_Request_Builder_clz_init_uw3i = okhttp3_Request_Builder_clz.$init.overload();
- okhttp3_Request_Builder_clz_init_uw3i.implementation = function() {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder()';
- var beat = newMethodBeat(beatText, executor);
- var returnObj = okhttp3_Request_Builder_clz_init_uw3i.call(this);
- printBeat(beat);
- return returnObj;
- };
- var okhttp3_Request_Builder_clz_init_e58t = okhttp3_Request_Builder_clz.$init.overload('okhttp3.Request');
- okhttp3_Request_Builder_clz_init_e58t.implementation = function(v0) {
- var executor = this.hashCode();
- var beatText = 'okhttp3.Request$Builder(okhttp3.Request)';
- var beat = newMethodBeat(beatText, executor);
- var returnObj = okhttp3_Request_Builder_clz_init_e58t.call(this, v0);
- printBeat(beat);
- return returnObj;
- };
-});
-```
-***
-
-
-
+# 应用工作目录的命令
-### 9. 列出应用目录所有frida脚本
-
-- 查看应用目录下所有的脚本，这里有hooker给你生成的通杀脚本，也有您生成的指定hook脚本，您可以修改定制。
-
-- 如果您有自定义的脚本放到应用目录下，ls命令可以将脚本名称刷入命令行提示缓存
+### 1. hooking
+hooking命令需要在后面跟一个脚本文件名作为参数，例如 ./hooking url.js。hooking实际上是在传统frida attach的基础上增加了将hook输出信息持久化到log文件中，比如当你hook一个调用非常频繁的函数比如某些字符串生成，输出的日志量无法短时间去全面，这时候你可以用文本编辑器打开log文件慢慢分析。以抖音工作目录为例，hooking实现如下
```shell
-某皮 > ls
-just_trust_me.js empty.js keystore_dump.js
-okhttp3.Request.Builder.addHeader.js edit_text.js activity_events.js
-find_boringssl_custom_verify_func.js ssl_log.js hook_register_natives.js
-click.js get_device_info.js apk_shell_scanner.js
-dump_dex.js object_store.js hook_artmethod_register.js
-replace_dlsym_get_pthread_create.js just_trust_me_for_ios.js trace_initproc.js
-android_ui.js jni_method_trace.js url.js
-just_trust_me_okhttp_hook_finder_for_android.js text_view.js find_anit_frida_so.js
-某皮 >
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+echo "hooking $1" > log
+date | tee -ai log
+frida $HOOKER_DRIVER -l $1 com.ss.android.ugc.aweme | tee -ai log
```
-***
+
-### 10. attach执行frida脚本
-
-在hooker下执行frida脚本，您只需要输入attach【空格】脚本名称会自动弹出提示。上下选择需要的脚本按tab键即可自动输入全名称。
-这是hooker在追求极致的工匠精神，帮助您从开波音737到开空客320的跳跃。
-
-> **日志同步**：`attach` / `frida` 执行脚本时，Frida 脚本的 `send()` 输出会自动同步保存到应用工作目录下的同名 `.log` 文件。例如 `attach url.js` 会生成 `url.log`，方便喂给 AI 分析。
+### 2. attach
+attach同hooking类似，但是相比hooking少了日志持久化功能，这才是原生frida attach的命令。例如:./attach android_ui.js。以抖音工作目录为例，attach实现如下
```shell
-某信拍 > attach url.js
-Frida output logging -> com.uxin.buyerphone/url.log
-------------startFlag:0755liv1,objectHash:-915348569,thread(id:810,name:Wmda.EventUploadThread),timestamp:1747836814835---------------
-url:https://apiwmxx.xxx.com.cn/report/c?api_v=3&sdk_v=1.7.0.0×tamp=1747836814832&appid=17591177894321&p=2&uuid=248056262e0030b7bb56c0f9237f846d
-public java.net.URL(String)
- at java.net.URL.(Native Method)
- at com.wxbx.wmda.e.b.a(SourceFile:5)
- at com.wxbx.wmda.e.b.a(SourceFile:1)
- at com.wxbx.wmda.h.a.a(SourceFile:162)
- at com.wxbx.wmda.h.a.b(SourceFile:19)
- at com.wxbx.wmda.h.a.a(SourceFile:2)
- at com.wxbx.wmda.h.a$b.handleMessage(SourceFile:3)
- at android.os.Handler.dispatchMessage(Handler.java:106)
- at android.os.Looper.loop(Looper.java:201)
- at android.os.HandlerThread.run(HandlerThread.java:65)
-------------endFlag:0755liv1,usedtime:1---------------
-
-------------startFlag:1ps6go99,objectHash:-237375819,thread(id:810,name:Wmda.EventUploadThread),timestamp:1747836815192---------------
-url:https://apiwmxx.xxx.com.cn/report/c?api_v=3&sdk_v=1.7.0.0×tamp=1747836815188&appid=17591177894321&p=2&uuid=248056262e0030b7bb56c0f9237f846d
-public java.net.URL(String)
- at java.net.URL.(Native Method)
- at com.android.okhttp.HttpUrl.url(HttpUrl.java:327)
- at com.android.okhttp.Request.url(Request.java:53)
- at com.android.okhttp.Request$Builder.build(Native Method)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.newHttpEngine(HttpURLConnectionImpl.java:377)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.initHttpEngine(HttpURLConnectionImpl.java:332)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:124)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getOutputStream(HttpURLConnectionImpl.java:258)
- at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getOutputStream(DelegatingHttpsURLConnection.java:218)
- at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:26)
- at com.wxbx.wmda.e.b.a(SourceFile:14)
- at com.wxbx.wmda.e.b.a(SourceFile:1)
- at com.wxbx.wmda.h.a.a(SourceFile:162)
- at com.wxbx.wmda.h.a.b(SourceFile:19)
- at com.wxbx.wmda.h.a.a(SourceFile:2)
- at com.wxbx.wmda.h.a$b.handleMessage(SourceFile:3)
- at android.os.Handler.dispatchMessage(Handler.java:106)
- at android.os.Looper.loop(Looper.java:201)
- at android.os.HandlerThread.run(HandlerThread.java:65)
-------------endFlag:1ps6go99,usedtime:0---------------
-// 这里省略无数日志.............
-------------startFlag:i7osxvjl,objectHash:134280600,thread(id:810,name:Wmda.EventUploadThread),timestamp:1747836815193---------------
-url:https://apiwmxx.xxx.com.cn/report/c?api_v=3&sdk_v=1.7.0.0×tamp=1747836815188&appid=17591177894321&p=2&uuid=248056262e0030b7bb56c0f9237f846d
-com.android.okhttp.Request.Builder.build()
- at com.android.okhttp.Request$Builder.build(Native Method)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.newHttpEngine(HttpURLConnectionImpl.java:377)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.initHttpEngine(HttpURLConnectionImpl.java:332)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:124)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getOutputStream(HttpURLConnectionImpl.java:258)
- at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getOutputStream(DelegatingHttpsURLConnection.java:218)
- at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:26)
- at com.wxbx.wmda.e.b.a(SourceFile:14)
- at com.wxbx.wmda.e.b.a(SourceFile:1)
- at com.wxbx.wmda.h.a.a(SourceFile:162)
- at com.wxbx.wmda.h.a.b(SourceFile:19)
- at com.wxbx.wmda.h.a.a(SourceFile:2)
- at com.wxbx.wmda.h.a$b.handleMessage(SourceFile:3)
- at android.os.Handler.dispatchMessage(Handler.java:106)
- at android.os.Looper.loop(Looper.java:201)
- at android.os.HandlerThread.run(HandlerThread.java:65)
-------------endFlag:i7osxvjl,usedtime:1---------------
-// 这里省略无数日志.............
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+frida $HOOKER_DRIVER -l $1 com.ss.android.ugc.aweme
```
-***
-
-### 11. 快捷设置socks5无感代理
-
-通过iptables链路层转发包实现一键设置代理，优势是APP完全无感知被代理。推荐使用charles的socks5
-
-设置代理后必须主动去[关闭代理](#14-取消代理设置)，代理不会自动取消
+### 3. spawn
+以spawn模式启动脚本。某些方法在应用启动的时候就初始化了，想要hook这些方法就必须以spawn模式启动了。默认是--no-pause，即不需要手动resume恢复应用。如果需要非--no-pause，请手动编辑spawn文件去除。以抖音工作目录为例，spawn实现如下
```shell
-某音 > proxy socks5://10.112.99.11:9998
-proxy socks5://10.112.99.11:9998 OK
-某音 >
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+frida $HOOKER_DRIVER --no-pause -f com.ss.android.ugc.aweme -l $1
```
-***
-
-### 12. frida版JustTrustMe（包括boringgssl）
-关掉SSL证书校验
+### 4. objection
+快捷执行objection调试命令，执行./objection即可。以抖音工作目录为例，objection实现如下
```shell
-某音 > justtrustme
-Package name: com.ss.xxxx.xxx.aweme
-android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!
-android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!
-android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!
-android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!
-javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-// 这里省略无数日志.............
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+objection -d -g com.ss.android.ugc.aweme explore
```
-***
+
+### 5. xinitdeploy
+xinitdeploy是用于部署资源的命令，它会把xinit目录下所放的文件拷贝到手机上/data/user/0/{packageName}/xinit/。同时保证资源文件的user/group权限和app进程是同一个临时用户。
+
+
-### 13. spawn执行frida脚本
-
-> **日志同步**：`spawn` / `fridaf` 执行脚本时，Frida 脚本的 `send()` 输出同样会自动同步保存到同名 `.log` 文件。例如 `spawn just_trust_me.js` 会生成 `just_trust_me.log`。
+### 6. kill
+如果你想重启app，先执行./kill会杀掉应用的主进程和所有子进程。作为一个Andrioid应用开发工程师出身，然后干到后台，接着干到爬虫，现在干到逆向的我必须告诉你：每个手机厂商都会实现一个自己的“内存清理”工具效果不一定好，且可能app本身也有保活机制。所以不建议你通过操作手机滑动进程列表来杀——有可能杀不干净。以抖音工作目录为例，kill实现如下:
```shell
-某信拍 > spawn just_trust_me.js
-Frida output logging -> com.uxin.buyerphone/just_trust_me.log
-Package name: com.xxx.buyxxphone
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-// 这里省略无数日志.............
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+frida-kill $HOOKER_DRIVER com.ss.android.ugc.aweme
```
-***
-
+
-### 14. 取消代理设置
-一键取消代理
-
-```shell
-某音 > unproxy
-unproxy OK
-某音 >
-```
-***
+### 7. disable_sslpinning
+快速关闭ssl pinning，此命令基于objection源码实现和[frida版just_trust_me](#11-just_trust_mejs)互补。当just_trust_me失效的时候，可以使用disable_sslpinning。反之，使用[just_trust_me](#11-just_trust_mejs)。
+
-### 15. 重启app
+# 应用工作目录的通杀脚本
+### 1. url.js
+需要跟踪url生成时可执行./hooking url.js
+
-```shell
-某信拍 > restart
-restarts com.xxx.buyxxphone
-```
-***
+### 2. activity_events.js
+当你需要跟踪start某个Activity启动时可执行，获取startActivity的intent信息和调用堆栈。/hooking activity_events.js
+
-### 16. 获取uid和pid
+### 3. click.js
+跟踪点击事件时可执行，并获取被点击View的真实VClass（很重要）。获取到了Class，你就可以在jadx找到这个View绑定事件代码。多一种办法定位到关键逻辑不好吗？一定要靠分析网络请求吗？条条大路通罗马，不一定非从网络库分析！ /hooking click.js
+
-```shell
-某信拍 > uid
-10189
-某信拍 > pid
-3509
-```
+### 4. android_ui.js
+封装一些操作原生Android UI的函数。如startActivity(activityName)、home()、back()、finishCurrentActivity()、clickByText(text) 等等，命令使用得用attach './attach android_ui.js' 原理是借助radar.dex作为代理操作Android原生View。（tag）
+
***
+### 5. keystore_dump.js
+在https双向认证的情况下，dump客户端证书为p12。存储位置:/data/user/0/{packagename}/client_keystore_{nowtime}.p12 证书密码: hooker。原理是hook java.security.KeyStore的getPrivateKey和getCertificate方法，因为客户端向服务发送证书必调这个方法。强烈建议keystore_dump.js用spawn模式启动，启动命令为 ./spawn keystore_dump.js 。下面是某app双向认证dump客户端证书过程
+
+
+
+
-### 17. pull文件
+### 6. edit_text.js
+跟踪获取Editview的getText()事件，并获取Editview的真实Class（很重要）。Editview一般绑定Search Action的实现代码，如果你抓取“搜索”接口。那么这个一定可以帮助你定位发送搜索请求的相关代码。多一种办法定位到关键逻辑不好吗？一定要靠分析网络请求吗？条条大路通罗马，不一定非从网络库分析！
+
-快捷拉取文件到本地应用工作目录
+### 7. text_view.js
+跟踪TextView的setText和getText，获取TextView的真实Class。一般setText的堆栈信息会带出业务层的数据model处理逻辑，进而进一步分析到业务层数据bean封装类。
+
-```shell
-转某 > pull /data/app/com.xxx.zhuanmou-o1ZYFILxnOCIpvvqJQKrpQ==/lib/arm64/libmsaoaidsec.so
-pull /data/app/com.xxx.zhuanmou-o1ZYFILxnOCIpvvqJQKrpQ==/lib/arm64/libmsaoaidsec.so to com.xxx.zhuanmou/libmsaoaidsec.so successful
-转某 > pull /data/app/com.xxx.zhuanmou-o1ZYFILxnOCIpvvqJQKrpQ==/lib/arm64/libsignLib.so
-pull /data/app/com.xxx.zhuanmou-o1ZYFILxnOCIpvvqJQKrpQ==/lib/arm64/libsignLib.so to com.xxx.zhuanmou/libsignLib.so successful
-转某 > pull /data/app/com.xxx.zhuanmou-o1ZYFILxnOCIpvvqJQKrpQ==/lib/arm64/libweconvert.so
-pull /data/app/com.xxx.zhuanmou-o1ZYFILxnOCIpvvqJQKrpQ==/lib/arm64/libweconvert.so to com.xxx.zhuanmou/libweconvert.so successful
-```
-***
+### 8. ssl_log.js
+在native层跟踪ssl握手并记录CLIENT RANDOM，tcpdump出来的链路层pacp里面的TLS包可以用CLIENT RANDOM记录文件解出来，将在高级篇讲解使用步骤。
+### 9. object_store.js
+操作ObjectId标识的对象，根据自身分析情况可进行特定的序列化打印、操作对象的私有成员变量。
+实践文章：https://bbs.pediy.com/thread-267245.htm
+### 10. hook_RN.js
+对于动态注册的native函数，我们需要用hook_RN.js来分析。强烈建议hook_RN.js用spawn模式启动，启动命令为 ./spawn hook_RN.js
+
-### 18. r0capture
-hooker集成了r0capture，抓包产生的pcap文件保存在{应用包名}/r0capture_ssl.pcap路径下，如酷安：com.coolapk.market/r0capture_ssl.pcap
+### 11. just_trust_me.js
+frida版本的just_trust_me。如果你需要bypass sslpinning请执行./spawn just_trust_me.js
-```shell
-JqgvBRe45o4QLyGguX+eVDoN0CPLTcPXqRVBhh13z2PTch2W7Hgv\/xlp4x2v\/QemWXrjWuifc2el1gzK1+8YPW+1NyTFCC8P10+zpCAPRgBwxpjKp4ecSQngU32yY2daIbaEwj0fvAg12VZNCdtI8jtpGtgds5xe61cihcBaYg\/CTvUIEylZqE6cbWsbuiBf7OuJLAnofXi3JtUaD+kJxFQ4fsZOTxhpZqANHIVv17GPcG4CoJEMws8UzawN3xPMqVYdzv+bpAnbDRhZy6LsVxS5S6yYtrawQdroJqVfsaLXlzgTBQe6RVPYqWG38QKJ1cuOGttk0ukigGIce3QAUcJl0c3fsi973ydYnSY60PBSKumqZAFh4VM0jk5tmRUtZlrqfQDVmfgIaocPQ=="}
-2025-06-19 11:35:59.794 | INFO | __main__:r0capture_on_message:939 - java.lang.Throwable
- at com.android.org.conscrypt.ConscryptFileDescriptorSocket$SSLOutputStream.write(Native Method)
- at com.android.okhttp.okio.Okio$1.write(Okio.java:76)
- at com.android.okhttp.okio.AsyncTimeout$1.write(AsyncTimeout.java:155)
- at com.android.okhttp.okio.RealBufferedSink.flush(RealBufferedSink.java:221)
- at com.android.okhttp.internal.http.Http1xStream.finishRequest(Http1xStream.java:161)
- at com.android.okhttp.internal.http.HttpEngine.readNetworkResponse(HttpEngine.java:735)
- at com.android.okhttp.internal.http.HttpEngine.readResponse(HttpEngine.java:609)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:471)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:407)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:244)
- at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getInputStream(DelegatingHttpsURLConnection.java:210)
- at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:26)
- at com.tencent.msdk.dns.core.rest.share.a.a(AbsHttpDns.java:23)
- at com.tencent.msdk.dns.core.k$a.run(LookupHelper.java:24)
- at com.tencent.msdk.dns.core.c$b.run(CountDownManager.java:3)
- at com.tencent.msdk.dns.core.c$a.run(CountDownManager.java:3)
- at com.tencent.msdk.dns.base.executor.DnsExecutors$a.run(DnsExecutors.java:38)
- at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
- at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
- at java.lang.Thread.run(Thread.java:764)
-
-CTRL + C to stop >
-Interrupting
-flushing com.coolapk.market/r0capture_ssl.pcap successful
-r0capture.js detach successful
-Restarting 酷安 Please wait for a few seconds
-```
-***
+下面以Twitter为例，启动just_trust_me.js
+启动演示
+
+抓包效果演示
+
-### 19. upgrade
-hooker更新频繁，平均周更约10次。upgrade帮助您随时同步最新代码和相关文件到本地。
+### 12. just_trust_me_okhttp_hook_finder.js
+为配合just_trust_me.js在okhttp混淆场景下辅助你找到混淆点
+jadx打开某资讯apk发现okhttp3如下
+
+执行./hooking just_trust_me_okhttp_hook_finder.js命令扫描hook点
```shell
-MacBook-Pro-32G-2T:hooker stephen256$ python3 hooker.py upgrade
-Upgrading hooker
-Repository updated with 'git pull'.
-Updating mobile-deploy/libext64.so
-Updating mobile-deploy/libext.so
-Updating mobile-deploy/libevent-2.1.so
-Please restart hooker
-```
-***
-
-
-# 应用目录通杀脚本
-
-### url.js
-
-该脚本会 hook 应用中 构造 URL 或 URI 对象的多个关键方法，用于打印或分析网络请求相关的信息（如目标 URL）
-
-Hook 的目标方法
-java.net.URI(String) 构造函数
-
-java.net.URL(String) 构造函数
-
-okhttp3.Request.Builder.build() 方法（常用于创建 HTTP 请求）
-
-com.android.okhttp.Request.Builder.build()（系统自带 okhttp）
-
-android.net.Uri.parse(String) 方法（处理 URI 的常用工具方法）
-
-推荐命令：frida url.js
-
-
-***
-
-### just_trust_me.js
-frida版本的just_trust_me，用于绕过 Android 系统中的证书校验逻辑，允许抓取 HTTPS 流量，适用于基于 OkHttp、HttpURLConnection 等网络库的应用。
-
-支持boringssl unpinning，理论上支持全网所有app，除非像美团一样做了登录风控抓不了。
-
-在hooker命令行模式封装了快捷命令justtrustme
-这在上文 [执行justtrustme kill掉所有ssl验证](#11-执行justtrustme-kill掉所有ssl验证包括boringgssl)有介绍
-
-亦可直接执行脚本 spawn just_trust_me.js
-
-***
-
-### activity_events.js
-当你需要跟踪start某个Activity启动时可执行，获取startActivity的intent信息和调用堆栈。
-
-推荐命令：frida activity_events.js
-
-
-***
-
-### click.js
-用于监听 Android 应用中点击事件（`OnClickListener`），主要用于分析用户交互操作，获取被点击View的真实ViewClass
-
-推荐命令：frida click.js
-
-
-***
-
-### android_ui.js
-封装一些操作原生Android UI的函数。如startActivity(activityName)、home()、back()、finishCurrentActivity()、clickByText(text) 等等，命令使用得用attach './attach android_ui.js' 原理是借助radar.dex作为代理操作Android原生View。
-
-推荐命令：frida android_ui.js
-
-***
-
-### keystore_dump.js
-在https双向认证的情况下，dump客户端证书为p12。存储位置:/data/user/0/{packagename}/client_keystore_{nowtime}.p12 证书密码: hooker。原理是hook java.security.KeyStore的getPrivateKey和getCertificate方法，因为客户端向服务发送证书必调这个方法。强烈建议keystore_dump.js用spawn模式启动，
-
-推荐命令：spawn keystore_dump.js
+-----------------------------------------------------------------------
+原类名：okhttp3.CertificatePinner
+混淆类名：okhttp3.g
-
-
-
-
-***
-
-### edit_text.js
-
-用于跟踪获取 EditText 的 `getText()` 事件，并获取其真实 Class 类型。
-EditText 通常绑定搜索按钮或输入事件，是定位“搜索”接口实现代码的有效入口，辅助识别核心业务逻辑。
-
-推荐命令：frida edit_text.js
-
-
-***
-
-### hook_register_natives.js
-用于拦截 Android JNI RegisterNatives 函数的 Frida 脚本，主要用于分析和修改原生方法(native methods)的注册过程
-
-推荐命令：spawn hook_register_natives.js
-
-
-***
-
-### text_view.js
-
-用于跟踪 TextView 的 `setText()` 和 `getText()` 调用，并输出其真实 Class。
-常用于提取页面展示的明文数据，以及获取堆栈调用信息，从而追踪业务层的 model 构造逻辑和数据源。
-推荐命令：spawn/attach text_view.js
-
+混淆方法0:
+原方法签名：public void okhttp3.CertificatePinner.check(java.lang.String,java.util.List)
+混淆方法签名：public void okhttp3.g.a(java.lang.String,java.util.List) throws javax.net.ssl.SSLPeerUnverifiedException
----
+-----------------------------------------------------------------------
+原类名：okhttp3.OkHttpClient$Builder
+混淆类名：okhttp3.OkHttpClient$Builder
-### activity_events.js
-用于跟踪 Android Activity 生命周期（如 `onCreate`、`onResume`）的 Frida 脚本，帮助分析 Activity 初始化逻辑。
+自动定位混淆方法失败，请去jadx打开okhttp3.OkHttpClient$Builder手动分析混淆方法
+-----------------------------------------------------------------------
+原类名：okhttp3.internal.tls.OkHostnameVerifier
+混淆类名：okhttp3.internal.i.d
-推荐命令：spawn/attach activity_events.js
----
+混淆方法0:
+原方法签名：public boolean okhttp3.internal.tls.OkHostnameVerifier.verify(java.lang.String,javax.net.ssl.SSLSession)
+混淆方法签名：public boolean okhttp3.internal.i.d.verify(java.lang.String,javax.net.ssl.SSLSession)
-### ssl_log.js
+混淆方法1:
+原方法签名：public boolean okhttp3.internal.tls.OkHostnameVerifier.verify(java.lang.String,java.security.cert.X509Certificate)
+混淆方法签名：public boolean okhttp3.internal.i.d.a(java.lang.String,java.security.cert.X509Certificate)
-用于在 native 层跟踪 SSL 握手过程并记录 `CLIENT_RANDOM`，配合 tcpdump 抓包数据后可用于 TLS 明文还原分析。
-
-推荐命令：spawn/attach ssl_log.js
-
----
-
-### just_trust_me_for_ios.js
-
-iOS 版的证书校验绕过脚本，配合抓包代理使用，适用于 SSL Pinning 场景。
-
-推荐命令：spawn/attach just_trust_me_for_ios.js
-
----
-
-### dump_dex.js
-
-执行 spawn dump_dex.js 可直接脱壳，适用于多数简单壳场景。
-Android ART 使用 dex2oat 编译 DEX 为 native 指令，有些脱壳失败时建议手动清除 `/data/app/-*/oat/arm64/`。
-
-推荐命令：spawn dump_dex.js
-
----
-
-### trace_init_proc.js
+-----------------------------------------------------------------------
+```
+根据上面just_trust_me_okhttp_hook_finder.js跑的结果
+把okhttp3的hook点改成混淆的类：
-用于 trace `init_proc` 函数调用流程的脚本。
-需手动指定 `startAddr`、`endAddr` 和模块名 `somodule`，适合分析 native 启动流程。
+
+这个提交记录：https://github.com/CreditTone/hooker/commit/f47d2068320a58306735a623f12bd955cbd20632
-推荐命令：spawn/attach trace_init_proc.js
-
----
+# hooker调试命令行
-### hook_artmethod_register.js
+### a - 打印Activity栈
+打印Activity栈的所有实例，当前界面排最前面。你可以立刻获取当前手机界面的Activity实现类、继承关系、实现接口、Activity中的所有属性值和方法声明。配合jadx动静分析效果最佳，分析Activity对象的内部情况将极快的提供逆向的线索。值得注意的是Activity中每个成员变量hooker会分配一个ObjectId，这是为了让你用c命令对内部成员变量进行扫描的。
+
-用于拦截 Android ART 虚拟机中 `ArtMethod` 的注册函数，适合深入分析虚拟机行为与 native 方法绑定。
-推荐命令：spawn/attach hook_artmethod_register.js
+### b - 打印Service栈
+打印Service栈的所有实例。和a命令一样，获取当前手机界面的Service实现类、继承关系、实现接口、Service中的所有属性值和方法声明。配合jadx动静分析效果最佳，分析Service对象的内部情况将极快的提供逆向的线索。值得注意的是Service中每个成员变量hooker会分配一个ObjectId，这是为了让你用c命令对内部成员变量进行扫描的。
+
----
+### c - 扫描指定Object
+扫描指定ObjectId的对象，a、b命令扫描Activity和Service带出一托线索。结合jadx观察之成员变量的类型和值情况，你一定可以发现一些新的对象，想窥视之。那么请用c命令扫描吧，而c命令扫描完之后又会带出新的你感兴趣的线索（对象）。顺藤摸瓜，你可以找到很多有趣东西。
+
-### find_anit_frida_so.js
+### d - 展开Object[]、List或Map
+展开一个Object[]、List或Map，并以Index/key->value的形式打印出来，从而进一步获取集合对象内部的每个对象类型和ObjectId。比如我们通过a命令查看某Activity发现属性o是一个Fragment数组'name:o static:false fromExtends:false type:[Landroidx.fragment.app.Fragment; objectId:tGErGHXLso value:[Landroidx.fragment.app.Fragment;@94023208'，那么这个数组里面每个成员是什么我们就可以用d命令对其进行展开了。
+
-用于发现 app 中加载的可疑 anti-frida 动态库，识别顺序为：**谁最后加载、谁让 app 崩溃，谁就是反调试的嫌疑人**。
+### v - 以View的方式查看对象
+以View的方式查看一个对象，除了有c命令全部的功能之外。v命令会先强转对象为View,然后获取view绑定的OnClickListener、OnLongClickListener、OnTouchListener、OnFocusChangeListener、OnEditorActionListener、OnItemClickListener等等，这些对象也将完全探测出来。比如对于属性:'name:h static:false fromExtends:false type:com.ttpc.bidding_hall.weight.HomeTabButton viewId:2131297762 objectId:GKuWPZOyY0 value:com.ttpc.bidding_hall.weight.HomeTabButton@227103246' 如下图用v命令查看我们可以发现HomeTabButton绑定了一个点击事件com.ttpai.track.g，这样的话你去jadx找到这个类就知道处理这个按钮的逻辑啦！！！此外，v 命令还可以跟上ViewId，但是ViewId对于每个View不一定都存在并且也不一定唯一，这个具体细节可以了解Android应用开发。
+
-推荐命令：spawn/attach find_anit_frida_so.js
-
+### e - 检测类在内存中是否存在
+检测一个类在内存中是否存在。大部分情况下静态分析的类在内存中会存在，但是有时app会做热更新可能会出现类被替换的情况。作为一个严谨的逆向工程师在对类进行操作之前检测类是否存在内存中是个好习惯。如：e com.bytedance.frameworks.encryptor.EncryptorUtil 输出：True表示存在 False表示不存在
+
----
+### s - 正则表达式扫描类
+用正则表达式在内存中扫描类。比如你对某些关键词类感兴趣，完全可以使用s进行扫描。配合jadx查看类实现代码爽歪歪！当然jadx自带类搜索功能但是只是静态的，并且jadx搜索功能是吃内存的，没有32G内存使用起来好卡。这时候s命令或许你是不错的选择。
+
-### jni_method_trace.js
+### j - 生成指定类的hook脚本
+生成指定类名称的hook脚本，也是hooker最核心的功能之一。相比objection，hooker生成的脚本有标注生产脚本的apk版本和类名。并且每个方法内部已经具备打印堆栈的功能，包括调用时间、线程id、线程名、调用对象的hashcode，调用方法用时都有很详细的描述。
+
+
+
+此脚本参考[RequestEncryptUtils.js](com.ss.android.ugc.aweme/com.bytedance.frameworks.core.encrypt.RequestEncryptUtils.js "RequestEncryptUtils.js")
-用于追踪 Native 层回调 Java 方法的行为，可观察 so 层与 Java 的交互，帮助分析 JNI 层调用栈。
+hooker生成脚本和objection生成脚本优势对比
-推荐命令：spawn/attach jni_method_trace.js
+| 项目 | 生成脚本命令 | 能否打印堆栈 | 包含辅助方法 | 脚本版本信息注释 | 脚本可定制性 |
+| -------- | -----: | :----: | :----: | :----: | :----: |
+| hooker | j [class_name] -o [outputpath].js | 能 | 包含 | 带apk version和生成命令 | 好 |
+| objection | android hooking generate simple [class_name] | 不能（白纸一张） | 不包含 | 不带 | 一般 |
----
+### k - 生成字符串hook脚本
+使用k 1821053，那么应用工作目录下会生成str_1821053.js。只要字符串产生并包含1821053这个关键词，就会打印产生地方的堆栈信息。原理基于java字符串拼接代码，编译后变成StringBuilder做append
-### replace_dlsym_get_pthread_create.js
+```java
+String url = "http://www.example.com/login?"+ "sign=" + getSign();
+```
-专门对抗 `libmsaoaidsec.so` 中使用 `dlsym` 获取 `pthread_create` 的反调试方式。
-本脚本 hook `dlsym`，用于劫持线程创建行为，从而对抗动态加载的反调试代码。
+以上代码编译后会生成如下
-推荐命令：spawn/attach replace_dlsym_get_pthread_create.js
-
+```java
+String url = new StringBuilder("http://www.example.com/login?").append("sign=").append(getSign()).toString();
+```
----
+不过这个思路有点儿类似暴力破解，而且非常影响app进程的运行速度，崩溃也是可能的。我的认为只要能搞出一些线索，崩溃也是值得的。崩溃我重启就是了。你觉得呢？
-### find_boringssl_custom_verify_func.js
-用于查找 `boringssl` 中注册的自定义证书验证函数，通过 hook `SSL_CTX_set_custom_verify` 定位目标函数，并实现强制信任（返回 0）。
-**使用建议：**
-执行前请清除目标 app（如某音）的缓存，以保证函数重新注册。
+hooker高级应用
+=================
-推荐命令：spawn find_boringssl_custom_verify_func.js
-
-
-
+## radar.dex
+在hooker根目录中有一个radar.dex，这是为操作java类的增强库。
----
+## 脚本的内置函数
+脚本是frida的核心，一个脚本不能只做打印堆栈信息的事情。我们还要进一步深挖脚本的潜在价值。比如我们改变被hook对象的内部成员变量的值、直接调用对象的方法、patch我们的dex。所以在hooker生成的每个脚本当中，我还内置了你可能需要用到的方法用于定制脚本。下面我就开始介绍这些方法的作用吧。
-### get_device_info.js
+### 1. loadDexfile(dexfile)
+加载一个dex文件到app进程中。dexfile是dex在手机上绝对路径，调用此方法必须保证dex文件用户和组权限对app进程的可见性。
-用于全面获取设备指纹信息，包括：
+### 2. checkLoadDex(className， dexfile)
+先检测className是否存在内存中，如果不存在加载一个dex文件到app进程中。dexfile是dex在手机上绝对路径，调用此方法必须保证dex文件用户和组权限对app进程的可见性。
-- Android ID、IMEI、指纹、厂商、系统信息
-- 安装的所有应用（含系统 app）
-- 传感器信息（如名称、厂商、延迟）
-- 系统状态（是否 root、运行时、内核信息等）
+### 3. loadXinitDexfile(dexfile)
+加载一个dex文件到app进程中。与loadDexfile、checkLoadDex不同，此方法直接从/data/user/0/{packageName}/xinit/路径下找dex文件。比如我们要加载上面基于[xinitdeploy](#4-xinitdeploy)命令部署的patch.dex，直接loadXinitDexfile("patch.dex");就可以给app进程注入dex了。到了这里你明白[xinitdeploy](#4-xinitdeploy)的良苦用心了没有！
-推荐命令：attach get_device_info.js
-
+### 4. loadXRadarDexfile()
+加载radar.dex文件到app进程中。radar.dex内部包含操作java对象的增强功能，如果你需要使用fastTojson、getPrettyString、storeObjectAndLog等方法，必需在脚本加载时调用一次loadXRadarDexfile()。
-提供以下 4 个调用方法：
+### 5. fastTojson(javaObject)
+基于radar.dex中fastjson序列化一个java对象为json字符串。该方法依赖radar.dex，使用前必须loadXRadarDexfile()。注意loadXRadarDexfile()进行一次即可，无需多次调用。
-- `getBasicInfo()`：基础信息
-- `getInstalledPackages()`：应用列表
-- `getSensos()`：传感器信息
-- `getSystemInfo()`：系统与运行环境
- 
+### 6. getPrettyString(javaObject)
+类似与toString()，与toString()不同的是它将判断子类是否实现toString方法，如果没有现实toString或者类是android.os.Parcelable可能会引起循环调用的异常，所以getPrettyString会根据情况采用[className]@[hashCode]的方法来规避。该方法依赖radar.dex，使用前必须loadXRadarDexfile()。注意loadXRadarDexfile()进行一次即可，无需多次调用。
----
+### 7. getField(javaObject, fieldName)
+获取对象的属性，这是来弥补frida语法中this.a.b.c.d深度查找的不足。该方法依赖radar.dex，使用前必须loadXRadarDexfile()。注意loadXRadarDexfile()进行一次即可，无需多次调用。
-### apk_shell_scanner.js
+在frida中深度查找是不支持的，以下方式获取对象将发生错误。
+```js
+let d = this.a.b.c.d;
+```
+所以你可以使用getField(javaObject, fieldName)来替代以上的逻辑
+```js
+let aObj = getField(this, "a");
+let bObj = getField(aObj, "b");
+let cObj = getField(bObj, "c");
+let dObj = getField(cObj, "d");
+```
-动态识别 APK 加壳技术的脚本，支持多种主流壳，如娜迦、爱加密、360、梆梆、腾讯御、网易易盾等。
+### 8. storeObjectAndLog(javaObject)
+将对象存储至对象缓存中，同时输出对象缓存id。然后你可以用c [objectId]，扫描对象，这将帮助你更好的窥视内存。该方法依赖radar.dex，使用前必须loadXRadarDexfile()。注意loadXRadarDexfile()进行一次即可，无需多次调用。
-推荐命令：attach apk_shell_scanner.js
+## 原生ui自动化
+hooker借助radar.dex中gz.radar.AndroidUI的实现，将代码直接打到app进程当中实现直接操作View对象。这种效率已经超越了所有的三方自动化框架，因为无论哪种自动化框架都是基于C/S架构的，而hooker通过打补丁的方式是直接侵入式的修改app内部的代码逻辑。
-识别结果示例：
-- This app is protected by {爱加密}
-- This app is not protected or uses an unknown protection scheme
+不过android_ui.js只是一个ui简单操作的体验工具，更高效的ui操作还是要结合每个应用实际情况定制patch代码。
----
+应用工作目录输入后./attach android_ui.js进入ui操作命令行，你可以操作以下几个方法
-### bypass_frida_svc_detect.js
+### 1. startActivity(activityName)
+不传intent和action，强制启动一个Activity。比如，2020年4月份某信刚上视频号功能的时候，我的微信小号没有体验资格——也就是没有"视频号"那个按钮，不给我按钮我就启动不了了吗？按钮背后的逻辑就是执行了一个startActivity的操作，所以我就实现了这个方法————强制启动v信视频号的搜索界面。
-绕过 app 对 Frida Server 的检测逻辑，适用于反调试保护较强的目标应用。
+```js
+startActivity("com.tencent.mm.plugin.finder.search.FinderFeedSearchUI")
+```
-推荐命令：spawn/attach bypass_frida_svc_detect.js
+不过startActivity不一定成功，因为应用很多Activity都需要特定的intent和action，这个在应用的AndroidManifest.xml中有定义，另外你还有结合[activity_events.js](#2-activity_eventsjs)去参照原来的启动代码。比如我要强制打开一个用户资料的Activity，那你必须传一个userid或者uid什么数据给他，而且你还得知道它定义的数据方式。这时候你需要定位原来启动Activity代码，这就是[activity_events.js](#2-activity_eventsjs)的意义所在。比如，下面经过我的分析启动某一视频号作者主页面的代码应该这样实现。
----
+```java
+Intent intent = new Intent();
+intent.putExtra("finder_username", username);
+com.tencent.mm.plugin.finder.g.a aVar = com.tencent.mm.plugin.finder.g.a.pPL;
+com.tencent.mm.plugin.finder.g.a.enterFinderProfileUI(Android.getTopActivity(), intent);
+```
-### bypass_root_detect.js
+### 2. contextStartActivity(activityName)
+contextStartActivity与startActivity不同，它会先获取应用的context。然后调用context的startActivity方法。
-用于绕过 root 检测逻辑，使得 root 环境下也能正常运行 app。
+### 3. topActivityStartActivity(activityName)
+topActivityStartActivity先获取栈顶的Activity实例，然后调用实例的startActivity方法。startActivity就是topActivityStartActivity。
-推荐命令：spawn/attach bypass_root_detect.js
+### 4. home()
+模拟点击home按钮
----
+### 5. back()
+模拟点击back按钮
-### bypass_vpn_detect.js
+### 6. finishCurrentActivity()
+退出栈顶Activity。原理是先获取栈顶的Activity实例，然后调用其finish()方法来主动结束。
-用于绕过 VPN 检测逻辑，避免 app 阻止使用代理、VPN 或抓包工具。
+### 7. clickByText(text)
+点击包含text文本的按钮。如果界面上存在多个包含text的按钮会优先选择找到的第一个。
-推荐命令：spawn/attach bypass_vpn_detect.js
+### 8. clickById(id)
+点击指定view id的按钮。你可以用uiautomatorviewer查看viewid，也可以用viewTree()方法输出view的json树来找到你要的元素。uiautomatorviewer在你{AndroidSdk}/tools/bin/路径下。
----
+### 9. hover(x,y,upStepLength)
+滑动屏幕。x,y传数字表示按下坐标，upStepLength的绝对值是步长表示滑动的长度。当upStepLength为正数的时候表示要向上滑动，当upStepLength为负数的时候表示向下滑动。
-### hook_encryption_algo.js
+### 10. viewTree()
+获取json格式的view树
-用于 hook 典型加密算法（如 AES、RSA、HMAC 等）的实现函数，分析加密参数、明文与密文数据。
+
+
+此ViewTree结果参考[viewTree.json](com.ss.android.ugc.aweme/viewTree.json "viewTree.json")
-推荐命令：spawn/attach hook_encryption_algo.js
----
-### hook_encryption_algo2.js
-拓展版本的加密算法 hook 脚本，适用于更复杂的加密场景或多路加密调用链。
+## 远程frida支持
+在hooker根目录有一个.hooker_driver文件，内容默认是-U表示通过usb连接frida-server。
+```shell
+stephen@ubuntu:~/hooker$ cat .hooker_driver
+-U
+```
+如果你的frida-server绑定在0.0.0.0:27042，并且你需要远程连接的话。你需要知晓你的手机局域网ip比如是192.168.0.105，则把.hooker_driver改为如下内容即可实现hooker全局远程调试。
+```shell
+stephen@ubuntu:~/hooker$ cat .hooker_driver
+-H 192.168.0.105:27042
+```
-推荐命令：spawn/attach hook_encryption_algo2.js
-### webview_enable_debug.js
+# 更新教程
+hooker没有版本的概念，更新可以采用两种方式。建议每周一更，更新步骤建议采用如下操作顺序
-该脚本用于 Hook Android 应用中的 WebView 行为，特别是在 WebView 初始化和执行 JavaScript 时进行监控和调试。适用于分析 WebView 加载的页面、动态注入的 JavaScript 代码，以及定位 JS 调用位置，常用于逆向分析、抓取数据或识别加固方案中的 Web 容器。
+### 1. clone最新项目
+```shell
+git clone https://github.com/CreditTone/hooker.git
+```
+如果git clone比较慢，你可以下载文件解压https://github.com/CreditTone/hooker/archive/refs/heads/master.zip
-推荐命令：spawn webview_enable_debug.js
+### 2. 方式一覆盖核心文件到你的hooker
+此种方式适用于你有自己的hooker本地仓库，所以只覆盖最新hooker的核心功能文件是便于你管理自己的hooker的。
+执行以下命令将核心文件覆盖到你本地的hooker
-
+```shell
+export LATEST_HOOKER=~/Download/hooker #这里要设置你下载的最新hooker目录
+export MY_HOOKER=~/hooker #这里要设置你的hooker目录
+
+#上面两个环境变量改好之后，下面的命令可以照抄
+cp -f $LATEST_HOOKER/hooker $MY_HOOKER/hooker
+cp -f $LATEST_HOOKER/hooker.py $MY_HOOKER/hooker.py
+cp -f $LATEST_HOOKER/radar.dex $MY_HOOKER/radar.dex
+cp -f $LATEST_HOOKER/run_env.py $MY_HOOKER/run_env.py
+cp -f $LATEST_HOOKER/xinitdeploy.py $MY_HOOKER/xinitdeploy.py
+cp -f $LATEST_HOOKER/spider.py $MY_HOOKER/spider.py
+cp -f $LATEST_HOOKER/colorful.py $MY_HOOKER/colorful.py
+cp -f $LATEST_HOOKER/requirements.txt $MY_HOOKER/requirements.txt
+cp -rf $LATEST_HOOKER/js/* $MY_HOOKER/js/
+cp -rf $LATEST_HOOKER/mobile-deploy/* $MY_HOOKER/mobile-deploy/
+```
+### 3. 方式二覆盖你的应用工作目录到最新hooker
+如果你不需要维护自己的hooker版本，就可以用这个方式。简单粗暴！
-# Windows安装WSL
+```shell
+export LATEST_HOOKER=~/Download/hooker #这里要设置你下载的最新hooker目录
+export MY_HOOKER=~/hooker #这里要设置你的hooker目录
-WSL是适用于Linux 的Windows 子系统（WSL）允许开发人员直接在Windows 上运行GNU/Linux 环境（包括大多数命令行工具、实用工具和应用程序），无需传统虚拟机或双启动设置的开销。
+#你有多少个目录就拷贝多少个吧
+cp -rf $MY_HOOKER/{your_app_package} $LATEST_HOOKER/
+```
-### 1. 安装wsl ubuntn24.04
-访问：https://learn.microsoft.com/zh-cn/windows/wsl/install-manual#downloading-distributions
+hooker实战应用
+=================
-下载Ubuntu24.04
+### 亲测好用的脱壳工具
+https://github.com/CodingGay/BlackDex
-双击Ubuntu2404-240425.AppxBundle 安装Ubuntu
+https://github.com/GuoQiang1993/Frida-Apk-Unpack
+https://github.com/hanbinglengyue/FART
-### 2. 进入wsl，配置代理
-窗口输入wsl进入ubuntu命令行
+### 通信降级案例（亲测有效）
+https://blog.csdn.net/qq314000558/article/details/105958847
-- cmd
-- wsl
+# 关于作者
-切换到root用户
+```javascript
+var author = {
+ name : "stephen",
+ bilibili : "https://space.bilibili.com/105035514",
+ email : "1273568669@qq.com",
+ experience : ["Android应用开发", "网络爬虫", "Android逆向", "JAVA/Go后台开发", "中间件开发"]
+}
+```
-- sudo su
+# 加密货币打赏
-配置翻墙代理，如果你有
+### Dogecoin tipping
-- export http_proxy="http://10.115.164.50:8080"
-- export https_proxy="http://10.115.164.50:8080"
+
-### 3. 安装python3.8和frida
-- apt update
-- apt install -y build-essential libssl-dev zlib1g-dev libbz2-dev
-libreadline-dev libsqlite3-dev wget curl llvm xz-utils tk-dev
-libffi-dev liblzma-dev
-- apt install -y git
-- apt install -y pyenv
-- pyenv install 3.8.8
-- pyenv local 3.8
+### Kevacoin tipping
-# 自定义frida-server
-- 将您自定义的frida-server文件拷贝到mobile-deploy文件夹下
-- 修改hooker.py，default_frida_server_arm和default_frida_server_arm64变量的名字为你自定义的文件名
+
-```python
-default_frida_server_arm = "your-custom-frida-server-android-arm"
-default_frida_server_arm64 = "your-custom-frida-server-android-arm64"
-```
-# hooker命令行快捷键
+没有Kevacoin的同学可以用你的普通pc进行挖矿。这个币目前全网算力不高，再垃圾的cpu都能挖的动。[挖矿教程https://www.dxpool.com/help/zh/kva-mining-tutorial](https://www.dxpool.com/help/zh/kva-mining-tutorial)，教程中获取钱包地址部分可以跳过，直接填入我的钱包地址VLuXBaaDzGRukEFPwRmzKm4zhYvX4Xmy1R进行挖矿。只要跑半个小时我就有收益，感谢支持！！！
-- Ctrl + U：整行清空
-- Ctrl + W：删除一个单词
-- Ctrl + K：从光标删到行尾
+### End
+[1]: https://github.com/frida/frida "frida"
diff --git a/README_EN.md b/README_EN.md
deleted file mode 100644
index 396aaad..0000000
--- a/README_EN.md
+++ /dev/null
@@ -1,642 +0,0 @@
-⚠️ Disclaimer
-All contents of this project are intended solely for learning and technical exchange purposes. The goal is to help developers understand the structure and internal mechanisms of mobile applications.
-
-This project does not contain any cracking operations or infringing content targeting specific applications.
-Some simple unpacking techniques related to certain apps are widely available on major technical forums and do not cause actual harm to the applications.
-This project is not intended to assist with any illegal activities, including but not limited to bypassing copyright protection, modifying app functionality, or accessing unauthorized data.
-Please ensure compliance with relevant laws and regulations when using the tools provided by this project, and use them only for personal learning or research purposes.
-
-English | 简体中文
-
-# 👋 Welcome to Hooker Reverse Engineering Toolkit
-
-
-
-
-
-
-Hooker is a reverse engineering toolkit based on Frida, designed to provide Android reverse engineers with a comfortable command-line interface,
-
-A unified script package management system
-
-Universal (通杀) scripts
-
-Automated hook script generation
-
-In-memory roaming for detecting Activity and Service components
-
-A Frida-based implementation of JustTrustMe
-
-Global app support for boringssl unpinning
-
-One picture to prove why you need Hooker:
-
-
-- 1. A Frida-based implementation of JustTrustMe for universal SSL pinning bypass, with ongoing maintenance.
-- 2. An embedded webserver that can quickly expose in-app capabilities as HTTP endpoints for automation and API-style workflows.
-- 3. Automated Frida hook script generation with detailed, extensible templates.
-- 4. One-click SOCKS5 proxy setup without requiring third-party apps such as SocksDroid.
-- 5. A highly streamlined command-line workflow that makes daily reversing much more comfortable.
-
-## 📚 Table of Contents
-
-- [Quick Start](#quick-start)
- - [1. Clone the repository](#1-clone-the-repository)
- - [2. Install Python dependencies](#2-install-python-dependencies)
- - [3. Connect your rooted device via USB](#3-connect-your-rooted-device-via-usb)
- - [4. Launch Hooker](#4-launch-hooker)
- - [5. Enter the package name of the target app](#5-enter-the-package-name-of-the-target-app)
- - [6. View help information](#6-view-help-information)
- - [7. Embedded webserver](#7-embedded-webserver)
- - [8. Generate Frida hook scripts for a specific class and method](#8-generate-frida-hook-scripts-for-a-specific-class-and-method)
- - [9. List all available Frida scripts](#9-list-all-available-frida-scripts)
- - [10. Attach and execute a specific Frida script](#10-attach-and-execute-a-specific-frida-script)
- - [11. Set a SOCKS5 proxy for the app](#11-set-a-socks5-proxy-for-the-app)
- - [12. Run JustTrustMe to disable all SSL pinning (including boringssl)](#12-run-justtrustme-to-disable-all-ssl-pinning-including-boringssl)
- - [13. Spawn the app and execute a specific Frida script](#13-spawn-the-app-and-execute-a-specific-frida-script)
- - [14. Clear the proxy settings](#14-clear-the-proxy-settings)
- - [15. Restart the app](#15-restart-the-app)
- - [16. Get the app's UID and PID](#16-get-uid-and-pid)
-
-
-# 🚀 Quick Start
-
-Ensure your device is rooted. No need to manually start frida-server or do any configuration—Hooker handles everything for you.
-
-
-### 1. Clone the repository
-```shell
-stephen@ubuntu:~$ git clone https://github.com/CreditTone/hooker.git
-stephen@ubuntu:~$ cd hooker
-```
-
-### 2. Install Python dependencies
-```shell
-stephen@ubuntu:~/hooker$ pip3 install -r requirements.txt
-```
-
-
-### 3. Connect your rooted device via USB
-```shell
-stephen@ubuntu:~/hooker$ adb devices
-List of devices attached
-FA77C0301476 device
-```
-
-
-### 4. Launch Hooker
-```shell
-stephen@ubuntu:~/hooker$ python3 hooker.py
-hooker Let's enjoy reverse engineering together
------------------------------------------------------------------------------------------------
-PID APP IDENTIFIER EXIST_REVERSE_DIRECTORY
-0 全球上网 com.miui.virtualsim ❌
-0 爱奇艺 com.qiyi.video ❌
-0 红手指云手机 com.redfinger.app ❌
-0 Reqable com.reqable.android ❌
-0 美团 com.sankuai.meituan ✅
-0 得物 com.shizhuang.duapp ❌
-0 某皮 cxm.shxpxx.sg ✅
-0 微博 com.sina.weibo ❌
-0 今日头条 com.ss.android.article.news ✅
-0 西瓜视频 com.ss.android.article.video ✅
-0 懂车帝 com.ss.android.auto ✅
-0 抖音火山版 com.ss.android.ugc.live ✅
-0 抖音精选 com.ss.android.yumme.video ❌
-0 淘宝 com.taobao.taobao ✅
-0 腾讯视频 com.tencent.qqlive ❌
-0 Termux com.termux ❌
-0 轻奢 com.tm.bachelorparty ✅
-0 WiFi ADB com.ttxapps.wifiadb ❌
-0 VMOS Pro com.vmos.pro ✅
-0 游戏中心 com.xiaomi.gamecenter ❌
-0 小米商城 com.xiaomi.shop ❌
-0 米家 com.xiaomi.smarthome ❌
-0 小米有品 com.xiaomi.youpin ✅
-0 小红书 com.xingin.xhs ✅
-0 运满满货主 com.xiwei.logistics.consignor ✅
-0 拼多多 com.xunmeng.pinduoduo ✅
-0 EnvCheck com.yimian.envcheck ✅
-0 check_env com.yuuki.check_env ❌
-0 TikTok com.zhiliaoapp.musically ❌
-0 XPrivacyLua eu.faircode.xlua ❌
-0 imToken im.token.app ❌
-0 SocksDroid net.typeblog.socks ❌
-0 F-Droid org.fdroid.fdroid ❌
-0 ProxyDroid org.proxydroid ❌
-3457 手机管家 com.miui.securitycenter ✅
-3509 优信拍 com.uxin.buyerphone ✅
-18780 抖音 com.ss.android.ugc.aweme ✅
-20174 应用商店 com.xiaomi.market ❌
-20913 设置 com.android.settings ❌
-30500 小爱同学 com.miui.voiceassist ❌
-32163 相机 com.android.camera ✅
-Please enter the identifier that needs to be reversed
-hooker(Identifier):
-```
-***
-
-### 5. Enter the package name of the target app
-```shell
-hooker(Identifier): cxm.shxpxx.sg
-✅ App cxm.shxpxx.sg is already in the foreground
-Creating working directory: cxm.shxpxx.sg
-Generating frida shortcut command...
-Generating built-in frida script...
-pull /data/app/cxm.shxpxx.sg-L8zkrpFVICv0-hOrtmPPxA==/base.apk to cxm.shxpxx.sg/ShopeeSG_3.43.40.apk successful
-Working directory create successful
-just_trust_me.js empty.js keystore_dump.js
-edit_text.js activity_events.js find_boringssl_custom_verify_func.js
-ssl_log.js hook_register_natives.js click.js
-get_device_info.js apk_shell_scanner.js dump_dex.js
-object_store.js hook_artmethod_register.js replace_dlsym_get_pthread_create.js
-just_trust_me_for_ios.js trace_initproc.js android_ui.js
-jni_method_trace.js url.js just_trust_me_okhttp_hook_finder_for_android.js
-text_view.js find_anit_frida_so.js
-某皮 >
-```
-
-***
-
-
-
-
-### 6. View help information
-
-```shell
-某皮 > help
-h, help show this help message
-a, activitys show the activity stack
-s, services show the service stack
-o, object [object_id] show object info by object_id
-v, view [view_id] show view info by view_id of view
-gs, generatescript [class_name:method_name] specify the class name and method name to generate a frida hook java script file. For example: generatescript
- okhttp3.Request$Builder:addHeader
-p, proxy [socks5_proxy_server] set up a socks5 proxy for this app. For example: proxy socks5://192.168.0.100:9998
-up, unproxy remove socks5 proxy for this app
-trust, justtrustme quickly spawn just_trust_me.js script to kill all ssl pinning
-ls list all the frida scripts of the current app
-attach [script_file_name] quickly execute a frida script, similar to executing the command "frida -U com.example.app -l xxx.js". For example: attach url.js
-spawn [script_file_name] quickly spawn a frida script, similar to executing the command "frida -U -f -n com.example.app -l xxx.js". For example: spawn
- just_trust_me.js
-restart restart this app
-pid get pid of this app main process
-uid get pid of this app
-exit return to the previous level
-某皮 >
-```
-
-***
-
-
-### 7. Embedded webserver
-
-Hooker can inject a lightweight webserver into the target app process. Once started, it launches an HTTP service inside the app. The default port is `8080`. This service can expose both your custom patch controllers and a built-in set of debugging endpoints.
-
-- Start the built-in webserver
-
-```shell
-某音火山版 > webserver start
-Http server port: 8080
-Http server: http://10.112.101.249:8080
-```
-
-After the built-in webserver starts, open the root page in a browser to see all registered APIs. Common built-in capabilities include:
-
-- Service management: `/` shows the welcome page and API list, and `/stop` stops the current webserver.
-- UI automation: `/hooker/ui/...` provides view clicking, text-based clicking, coordinate tapping, setting EditText values, triggering Back/Home, launching activities, querying screen info, swiping pagers, scrolling RecyclerView, and dismissing dialogs.
-- UI hierarchy export: `/hooker/uiauto/dump`, `/hooker/uiauto/window_dump.xml`, and `/hooker/uiauto/window_dump.json` export the current window hierarchy for inspection and control discovery.
-- Screenshot capture: `/hooker/screencap/screenshot` uses the system `screencap` command, while `/hooker/mediaprojection/...` supports MediaProjection permission flow and full-screen PNG capture.
-- App information: `/hooker/appinfo`, `/hooker/appinfo/shared_prefs`, `/hooker/appinfo/databases`, and `/hooker/appinfo/read_table` let you inspect package metadata, permissions, signatures, shared preferences, database schemas, and table rows.
-- Class and object helpers: `/hooker/classhelper/invoke_static_method` and `/hooker/classhelper/invoke_method` let you invoke static methods or stored object methods over HTTP.
-- File serving: `/file?filename=...` returns an absolute-path file or a file generated in the webserver cache directory.
-- MCP-style UI tools: `/hooker/mcp/ui/tools` and `/hooker/mcp/ui/call` package common UI actions into a consistent tool interface for external scripts or agents.
-
-- Start a custom webserver
-
-```shell
-某宝 > webserver start taxbax-patch.jar
-Converting taxbax-patch.jar to taxbax-patch.dex...
-Successfully converted to taxbax-patch.dex (7160 bytes)
-push file OK /data/user/0/com.taxbax.taxbax/hooker_server.dex
-Http server port: 2026
-Http server: http://10.112.101.249:2026
-```
-
-Here `taxbax-patch.jar` is essentially a business plugin running inside the target app process. Hooker converts the jar to dex, injects it into the app, scans annotated classes, and registers them as HTTP routes.
-
-Custom webservers are useful for:
-
-- Exposing app-internal business capabilities such as search, comments, product details, signatures, encryption/decryption, user profiles, or live-stream APIs.
-- Reusing the target app's own login state, networking stack, environment values, and in-memory objects instead of rebuilding protocol details externally.
-- Wrapping asynchronous callbacks, observables, listeners, or page-object calls into synchronous HTTP endpoints that return JSON or plain text.
-
-Patch projects typically define endpoints like this:
-
-- Use `@HookerWebServerConfiguration(port = 2026)` to specify the port. If omitted, the default is `8080`.
-- Use `@HookerController("/taobao")` or `@HookerController("/douyin")` to define the route prefix.
-- Use `@HookerRequestMapping(path = "/getProductDetail")` to expose concrete endpoints.
-- Use `@HookerRequestParam` and `@HookerRequestPostJson` to receive query parameters and POST JSON.
-
-This is also the recommended way to build mobile-facing APIs with Hooker: keep generic debugging features in the main repository, keep app-specific business logic in patch projects, and expose those capabilities through the embedded webserver.
-
-- Webserver persistence
-
-If you already have a patch project for an app and need to deploy it at scale, the temporary `frida + hooker` injection model can become heavy. For this scenario, the author provides an Xposed plugin named `HookerServer`:
-
-`https://github.com/CreditTone/HookerServer`
-
-If the device supports Xposed/LSPosed, you can use this plugin to persist the webserver inside the target app.
-
-Steps:
-
-1. Download the latest APK from `https://github.com/CreditTone/HookerServer/releases`.
-2. Push `patch.dex` to `/data/user/0/{package}/hooker_server.dex`.
-3. Enable `HookerServer` for the target app in Xposed/LSPosed.
-4. Restart the app, and the webserver will start automatically.
-
-The `patch.dex` file becomes available after the first time you deploy `patch.jar`; Hooker automatically converts the jar to dex and places the output in the target app's working directory.
-***
-
-
-### 8. Generate Frida hook scripts for a specific class and method
-
-
-
-- Command Syntax：gs, generatescript [class_name:method_name]
-
-
-- 8.1 Generate a Frida hook script for a specific method:
-gs okhttp3.Request$Builder:addHeader — the parameter part (String, String) is not required.
-
-```shell
-某信拍 > gs okhttp3.Request$Builder:addHeader(String, String)
-Generating frida script, please wait for a few seconds
-frida hook script: okhttp3.Request.Builder.addHeader.js
-某信拍 >
-```
-
-```js
-//cat okhttp3.Request.Builder.addHeader.js
-Java.perform(function() {
- var okhttp3_Request_Builder_clz = Java.use('okhttp3.Request$Builder');
- var okhttp3_Request_Builder_clz_method_addHeader_2grl = okhttp3_Request_Builder_clz.addHeader.overload('java.lang.String', 'java.lang.String');
- okhttp3_Request_Builder_clz_method_addHeader_2grl.implementation = function(string, string_x2) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.addHeader(java.lang.String,java.lang.String)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_addHeader_2grl.call(this, string, string_x2);
- console.log("header name:" + string + " header value:" + string_x2);
- printBeat(beat);
- return ret;
- };
-});
-```
-***
-
-
-
-- 8.2 Generate a Frida hook script for all member methods of a specified class:
-gs okhttp3.Request$Builder
-
-```shell
-某信拍 > generatescript okhttp3.Request$Builder
-Generating frida script, please wait for a few seconds
-frida hook script: okhttp3.Request.Builder.allfunc.js
-```
-***
-
-```js
-//cat okhttp3.Request.Builder.allfunc.js
-//okhttp3.Request$Builder
-Java.perform(function() {
- var okhttp3_Request_Builder_clz = Java.use('okhttp3.Request$Builder');
- var okhttp3_Request_Builder_clz_method_header_ng3n = okhttp3_Request_Builder_clz.header.overload('java.lang.String', 'java.lang.String');
- okhttp3_Request_Builder_clz_method_header_ng3n.implementation = function(string, string_x2) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.header(java.lang.String,java.lang.String)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_header_ng3n.call(this, string, string_x2);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_cacheControl_q8q5 = okhttp3_Request_Builder_clz.cacheControl.overload('okhttp3.CacheControl');
- okhttp3_Request_Builder_clz_method_cacheControl_q8q5.implementation = function(cacheControl) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.cacheControl(okhttp3.CacheControl)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_cacheControl_q8q5.call(this, cacheControl);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_method_bjk9 = okhttp3_Request_Builder_clz.method.overload('java.lang.String', 'okhttp3.RequestBody');
- okhttp3_Request_Builder_clz_method_method_bjk9.implementation = function(string, requestBody) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.method(java.lang.String,okhttp3.RequestBody)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_method_bjk9.call(this, string, requestBody);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_head_a5nq = okhttp3_Request_Builder_clz.head.overload();
- okhttp3_Request_Builder_clz_method_head_a5nq.implementation = function() {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.head()';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_head_a5nq.call(this);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_headers_to5i = okhttp3_Request_Builder_clz.headers.overload('okhttp3.Headers');
- okhttp3_Request_Builder_clz_method_headers_to5i.implementation = function(headers) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.headers(okhttp3.Headers)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_headers_to5i.call(this, headers);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_post_heaq = okhttp3_Request_Builder_clz.post.overload('okhttp3.RequestBody');
- okhttp3_Request_Builder_clz_method_post_heaq.implementation = function(requestBody) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.post(okhttp3.RequestBody)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_post_heaq.call(this, requestBody);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_build_rmqx = okhttp3_Request_Builder_clz.build.overload();
- okhttp3_Request_Builder_clz_method_build_rmqx.implementation = function() {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request okhttp3.Request$Builder.build()';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_build_rmqx.call(this);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_patch_hp9u = okhttp3_Request_Builder_clz.patch.overload('okhttp3.RequestBody');
- okhttp3_Request_Builder_clz_method_patch_hp9u.implementation = function(requestBody) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.patch(okhttp3.RequestBody)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_patch_hp9u.call(this, requestBody);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_url_0owi = okhttp3_Request_Builder_clz.url.overload('java.lang.String');
- okhttp3_Request_Builder_clz_method_url_0owi.implementation = function(string) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.url(java.lang.String)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_url_0owi.call(this, string);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_removeHeader_uzb9 = okhttp3_Request_Builder_clz.removeHeader.overload('java.lang.String');
- okhttp3_Request_Builder_clz_method_removeHeader_uzb9.implementation = function(string) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.removeHeader(java.lang.String)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_removeHeader_uzb9.call(this, string);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_url_ykbd = okhttp3_Request_Builder_clz.url.overload('java.net.URL');
- okhttp3_Request_Builder_clz_method_url_ykbd.implementation = function(url) {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.url(java.net.URL)';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_url_ykbd.call(this, url);
- printBeat(beat);
- return ret;
- };
- var okhttp3_Request_Builder_clz_method_delete_dqyl = okhttp3_Request_Builder_clz.delete.overload();
- okhttp3_Request_Builder_clz_method_delete_dqyl.implementation = function() {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder okhttp3.Request$Builder.delete()';
- var beat = newMethodBeat(beatText, executor);
- var ret = okhttp3_Request_Builder_clz_method_delete_dqyl.call(this);
- printBeat(beat);
- return ret;
- };
- //.......省略N行代码
-```
-***
-
-
-
-- 8.3 Generate a Frida hook script for the constructor(s) of a specified class:
-gs okhttp3.Request$Builder:_ or gs okhttp3.Request$Builder:\
-
-```shell
-某信拍 > gs okhttp3.Request$Builder:()
-Generating frida script, please wait for a few seconds
-frida hook script: okhttp3.Request.Builder._init.js
-```
-
-```js
-//cat okhttp3.Request.Builder._init.js
-//okhttp3.Request$Builder:()
-Java.perform(function() {
- var okhttp3_Request_Builder_clz = Java.use('okhttp3.Request$Builder');
- var okhttp3_Request_Builder_clz_init_uw3i = okhttp3_Request_Builder_clz.$init.overload();
- okhttp3_Request_Builder_clz_init_uw3i.implementation = function() {
- var executor = this.hashCode();
- var beatText = 'public okhttp3.Request$Builder()';
- var beat = newMethodBeat(beatText, executor);
- var returnObj = okhttp3_Request_Builder_clz_init_uw3i.call(this);
- printBeat(beat);
- return returnObj;
- };
- var okhttp3_Request_Builder_clz_init_e58t = okhttp3_Request_Builder_clz.$init.overload('okhttp3.Request');
- okhttp3_Request_Builder_clz_init_e58t.implementation = function(v0) {
- var executor = this.hashCode();
- var beatText = 'okhttp3.Request$Builder(okhttp3.Request)';
- var beat = newMethodBeat(beatText, executor);
- var returnObj = okhttp3_Request_Builder_clz_init_e58t.call(this, v0);
- printBeat(beat);
- return returnObj;
- };
-});
-```
-***
-
-### 9. List all available Frida scripts
-```shell
-某皮 > ls
-just_trust_me.js empty.js keystore_dump.js
-okhttp3.Request.Builder.addHeader.js edit_text.js activity_events.js
-find_boringssl_custom_verify_func.js ssl_log.js hook_register_natives.js
-click.js get_device_info.js apk_shell_scanner.js
-dump_dex.js object_store.js hook_artmethod_register.js
-replace_dlsym_get_pthread_create.js just_trust_me_for_ios.js trace_initproc.js
-android_ui.js jni_method_trace.js url.js
-just_trust_me_okhttp_hook_finder_for_android.js text_view.js find_anit_frida_so.js
-某皮 >
-```
-***
-
-### 10. Attach and execute a specific Frida script
-
-> **Auto-logging**: When executing scripts via `attach` / `frida`, Frida `send()` output is automatically saved to a `.log` file with the same name in the app working directory. e.g., `attach url.js` generates `url.log`, making it easy to feed into AI for analysis.
-
-```shell
-某信拍 > attach url.js
-Frida output logging -> com.uxin.buyerphone/url.log
-------------startFlag:0755liv1,objectHash:-915348569,thread(id:810,name:Wmda.EventUploadThread),timestamp:1747836814835---------------
-url:https://apiwmxx.xxx.com.cn/report/c?api_v=3&sdk_v=1.7.0.0×tamp=1747836814832&appid=17591177894321&p=2&uuid=248056262e0030b7bb56c0f9237f846d
-public java.net.URL(String)
- at java.net.URL.(Native Method)
- at com.wxbx.wmda.e.b.a(SourceFile:5)
- at com.wxbx.wmda.e.b.a(SourceFile:1)
- at com.wxbx.wmda.h.a.a(SourceFile:162)
- at com.wxbx.wmda.h.a.b(SourceFile:19)
- at com.wxbx.wmda.h.a.a(SourceFile:2)
- at com.wxbx.wmda.h.a$b.handleMessage(SourceFile:3)
- at android.os.Handler.dispatchMessage(Handler.java:106)
- at android.os.Looper.loop(Looper.java:201)
- at android.os.HandlerThread.run(HandlerThread.java:65)
-------------endFlag:0755liv1,usedtime:1---------------
-
-------------startFlag:1ps6go99,objectHash:-237375819,thread(id:810,name:Wmda.EventUploadThread),timestamp:1747836815192---------------
-url:https://apiwmxx.xxx.com.cn/report/c?api_v=3&sdk_v=1.7.0.0×tamp=1747836815188&appid=17591177894321&p=2&uuid=248056262e0030b7bb56c0f9237f846d
-public java.net.URL(String)
- at java.net.URL.(Native Method)
- at com.android.okhttp.HttpUrl.url(HttpUrl.java:327)
- at com.android.okhttp.Request.url(Request.java:53)
- at com.android.okhttp.Request$Builder.build(Native Method)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.newHttpEngine(HttpURLConnectionImpl.java:377)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.initHttpEngine(HttpURLConnectionImpl.java:332)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:124)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getOutputStream(HttpURLConnectionImpl.java:258)
- at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getOutputStream(DelegatingHttpsURLConnection.java:218)
- at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:26)
- at com.wxbx.wmda.e.b.a(SourceFile:14)
- at com.wxbx.wmda.e.b.a(SourceFile:1)
- at com.wxbx.wmda.h.a.a(SourceFile:162)
- at com.wxbx.wmda.h.a.b(SourceFile:19)
- at com.wxbx.wmda.h.a.a(SourceFile:2)
- at com.wxbx.wmda.h.a$b.handleMessage(SourceFile:3)
- at android.os.Handler.dispatchMessage(Handler.java:106)
- at android.os.Looper.loop(Looper.java:201)
- at android.os.HandlerThread.run(HandlerThread.java:65)
-------------endFlag:1ps6go99,usedtime:0---------------
-// 这里省略无数日志.............
-------------startFlag:i7osxvjl,objectHash:134280600,thread(id:810,name:Wmda.EventUploadThread),timestamp:1747836815193---------------
-url:https://apiwmxx.xxx.com.cn/report/c?api_v=3&sdk_v=1.7.0.0×tamp=1747836815188&appid=17591177894321&p=2&uuid=248056262e0030b7bb56c0f9237f846d
-com.android.okhttp.Request.Builder.build()
- at com.android.okhttp.Request$Builder.build(Native Method)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.newHttpEngine(HttpURLConnectionImpl.java:377)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.initHttpEngine(HttpURLConnectionImpl.java:332)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:124)
- at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getOutputStream(HttpURLConnectionImpl.java:258)
- at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getOutputStream(DelegatingHttpsURLConnection.java:218)
- at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:26)
- at com.wxbx.wmda.e.b.a(SourceFile:14)
- at com.wxbx.wmda.e.b.a(SourceFile:1)
- at com.wxbx.wmda.h.a.a(SourceFile:162)
- at com.wxbx.wmda.h.a.b(SourceFile:19)
- at com.wxbx.wmda.h.a.a(SourceFile:2)
- at com.wxbx.wmda.h.a$b.handleMessage(SourceFile:3)
- at android.os.Handler.dispatchMessage(Handler.java:106)
- at android.os.Looper.loop(Looper.java:201)
- at android.os.HandlerThread.run(HandlerThread.java:65)
-------------endFlag:i7osxvjl,usedtime:1---------------
-// 这里省略无数日志.............
-```
-***
-
-### 11. Set a SOCKS5 proxy for the app
-```shell
-某音 > proxy socks5://10.112.99.11:9998
-proxy socks5://10.112.99.11:9998 OK
-某音 >
-```
-***
-
-
-### 12. Run JustTrustMe to disable all SSL pinning (including boringssl)
-
-```shell
-某音 > justtrustme
-Package name: com.ss.xxxx.xxx.aweme
-android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!
-android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!
-android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!
-android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!
-javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-static void com.android.org.conscrypt.Platform.checkServerTrusted(javax.net.ssl.X509TrustManager,java.security.cert.X509Certificate[],java.lang.String,com.android.org.conscrypt.AbstractConscryptSocket) throws java.security.cert.CertificateException was hooked!
-okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!
-// 这里省略无数日志.............
-```
-***
-
-
-### 13. Spawn the app and execute a specific Frida script
-
-> **Auto-logging**: `spawn` / `fridaf` also auto-saves Frida `send()` output to a `.log` file with the same name. e.g., `spawn just_trust_me.js` generates `just_trust_me.log`.
-
-```shell
-某信拍 > spawn just_trust_me.js
-Frida output logging -> com.uxin.buyerphone/just_trust_me.log
-Package name: com.xxx.buyxxphone
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!
-javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!
-// 这里省略无数日志.............
-```
-***
-
-
-### 14. Clear the proxy settings
-```shell
-某音 > unproxy
-unproxy OK
-某音 >
-```
-***
-
-
-
-### 15. Restart the app
-
-```shell
-某信拍 > restart
-restarts com.xxx.buyxxphone
-```
-***
-
-
-### 16. Get UID and PID
-```shell
-某信拍 > uid
-10189
-某信拍 > pid
-3509
-```
-***
diff --git "a/app\346\263\250\345\205\245js\350\247\243\345\206\263\346\273\221\345\235\227.md" "b/app\346\263\250\345\205\245js\350\247\243\345\206\263\346\273\221\345\235\227.md"
new file mode 100644
index 0000000..bc6ebc6
--- /dev/null
+++ "b/app\346\263\250\345\205\245js\350\247\243\345\206\263\346\273\221\345\235\227.md"
@@ -0,0 +1,126 @@
+## 关于如何对于app中的js调试
+
+### 1.应用场景
+
+我们在爬取数据的过程中难免会碰到的一些`滑块`.而这些滑块web我们可以用我debug大法随意调试模拟他滑动上报提交.很多同学对于嵌入在app在的滑块有时候就束手无策了,这时候我们引入了vconsole进行注入爬取
+
+### 2.使用前提
+
+你必须`web端`调试通过,直接这滑块的js注入点在哪里,如果不知道后续调试难度会增加.
+
+### 3.使用
+
+#### 原理
+
+```python
+1.利用vconsole生成一个终端调试界面
+2.利用拦包工具对于滑块返回的html页面中js外链的引入替换成我们修改后具有埋点打印的内容js,以及HTML最开始部分引入vconsole的js
+```
+
+`实现原理就是如此简单`
+
+js 链接
+
+```Python
+https://unpkg.com/vconsole@latest/dist/vconsole.min.js
+https://cdn.jsdelivr.net/npm/vconsole@latest/dist/vconsole.min.js
+```
+
+### 4.持久化
+
+有些同学会感觉每次拦包我都要替换太麻烦了有没有什么不用手动替换的自动的
+
+面对这个需求我们还是有的
+
+用到的工具
+
+- [Thor HTTP Sniffer](https://itunes.apple.com/app/id1210562295): HTTP 抓包及断点调试。
+- [vConsole 调试脚本](https://github.com/Tencent/vConsole): A lightweight, extendable front-end developer tool for mobile web page.
+- [Eruda 调试脚本](https://github.com/liriliri/eruda): Console for mobile browsers.
+
+#### 第一步：在 Thor 中设置过滤器断点
+
+##### 1、打开 Thor, 创建一个过滤器，取名为：”WebView 注入调试”，并添加一个断点进入编辑
+
+##### 2、因为需要对 WebView 的响应 HTML 内容进行注入，所以选择在 `请求阶段 > 响应消息体回传前 > 新建匹配规则`
+
+
+
+##### » 选择『响应 body 前』
+
+
+
+##### 3、在匹配规则中加入表达式进行替换，以注入 vConsole 工具
+
+**因为对 HTML body 标签注入 js 脚本后可能不会总是生效，所以这里选择优先对 title 标签进行替换**
+
+加入判断条件：判断是否包含 title 标签
+
+```
+@rsp.bodyText CONTAINS[cd] ""
+```
+
+当有 title 标签时，执行以下表达式
+
+```js
+^@rsp.bodyText "<\/title>" ""
+```
+
+没有 title 标签，则找 body 标签替换
+
+```js
+^@rsp.bodyText "<\/body>" " "
+```
+
+- 其中`new VConsole()` 是关键不调用不会生成界面
+- 还有载人方式可以使用chalrs或者fiddler替换js再头部注入
+- *考虑加载速度的原因，没有直接使用 github 上的 vConsole 原地址，而是 dump 了一份到 coding.net 仓库里，所以上面用的是 codeing.net 的脚本地址*
+
+##### » vConsole 注入设置如图
+
+
+
+**同理，再新建一个断点，完成 Eruda 工具的注入（其实可以不用两个调试脚本都注入，这里只是演示效果）**
+
+#### 第二步：在 PPHub 中找一个 WebView 界面进行尝试
+
+##### 1、打开 Thor > 选择 “WebView 注入调试” 过滤器，并启动
+
+
+
+##### » 启动抓包
+
+
+
+##### 2、打开 PPHub
+
+
+
+##### » 并找到一个 WebView, 等待加载完成 (直到出现调试工具入口)
+
+
+
+##### » vConsole 调试效果
+
+
+
+##### » Eruda 调试效果
+
+
+
+### 参考资料 (排名不分先后)
+
+- [JSBox 的网页调试插件](https://itunes.apple.com/app/id1312014438)
+- [三种解密 HTTPS 流量的方法介绍 by Jerry Qu](https://imququ.com/post/how-to-decrypt-https.html)
+- [Content Security Policy Level 2 介绍 by Jerry Qu](https://imququ.com/post/content-security-policy-level-2.html)
+- [eruda - Console for mobile browsers](https://eruda.liriliri.io/)
+- [vConsole by Tencent](https://github.com/Tencent/vConsole)
+
+### Thor 20 天免费试用 TestFlight 申请
+
+1、[Thor 的详细介绍](https://github.com/PixelCyber/Thor/blob/master/README-zh-Hans.md)
+
+2、[TestFlight 申请问卷填写](https://wj.qq.com/s/1607760/e57d)
+
+3、过滤器 “WebView 注入调试” [后期优化版下载](https://github.com/PixelCyber/Thor/raw/master/tips-zh-Hans/bp_res/WebView_debug.f4thor)（下载后直接用 Thor 打开，安装）
diff --git a/assets/a.gif b/assets/a.gif
new file mode 100755
index 0000000..c1d71bd
Binary files /dev/null and b/assets/a.gif differ
diff --git a/assets/activity_events.gif b/assets/activity_events.gif
new file mode 100755
index 0000000..b929a27
Binary files /dev/null and b/assets/activity_events.gif differ
diff --git a/assets/android_ui.gif b/assets/android_ui.gif
new file mode 100644
index 0000000..6123f5a
Binary files /dev/null and b/assets/android_ui.gif differ
diff --git a/assets/android_ui_view_tree.png b/assets/android_ui_view_tree.png
new file mode 100644
index 0000000..4616f26
Binary files /dev/null and b/assets/android_ui_view_tree.png differ
diff --git a/assets/android_ui_view_tree2.gif b/assets/android_ui_view_tree2.gif
new file mode 100644
index 0000000..e194b3a
Binary files /dev/null and b/assets/android_ui_view_tree2.gif differ
diff --git a/assets/b.gif b/assets/b.gif
new file mode 100644
index 0000000..dc7755d
Binary files /dev/null and b/assets/b.gif differ
diff --git a/assets/c.gif b/assets/c.gif
new file mode 100644
index 0000000..487bddb
Binary files /dev/null and b/assets/c.gif differ
diff --git a/assets/click.gif b/assets/click.gif
new file mode 100644
index 0000000..eebea2b
Binary files /dev/null and b/assets/click.gif differ
diff --git a/assets/d.png b/assets/d.png
new file mode 100644
index 0000000..ddca5a7
Binary files /dev/null and b/assets/d.png differ
diff --git a/assets/disable_sslpinning.gif b/assets/disable_sslpinning.gif
new file mode 100644
index 0000000..c982c5d
Binary files /dev/null and b/assets/disable_sslpinning.gif differ
diff --git a/assets/dogecoin.jpeg b/assets/dogecoin.jpeg
new file mode 100644
index 0000000..497ed1b
Binary files /dev/null and b/assets/dogecoin.jpeg differ
diff --git a/assets/edit_text.png b/assets/edit_text.png
new file mode 100644
index 0000000..89e2797
Binary files /dev/null and b/assets/edit_text.png differ
diff --git a/assets/exists_class.gif b/assets/exists_class.gif
new file mode 100644
index 0000000..f0ab001
Binary files /dev/null and b/assets/exists_class.gif differ
diff --git a/assets/hook_RN.gif b/assets/hook_RN.gif
new file mode 100644
index 0000000..1edf536
Binary files /dev/null and b/assets/hook_RN.gif differ
diff --git a/assets/hooker-attach.gif b/assets/hooker-attach.gif
new file mode 100644
index 0000000..5e50e75
Binary files /dev/null and b/assets/hooker-attach.gif differ
diff --git a/assets/hooker-deploy.gif b/assets/hooker-deploy.gif
new file mode 100644
index 0000000..83f675d
Binary files /dev/null and b/assets/hooker-deploy.gif differ
diff --git a/assets/hooking_log.gif b/assets/hooking_log.gif
new file mode 100644
index 0000000..5a4cde2
Binary files /dev/null and b/assets/hooking_log.gif differ
diff --git a/assets/hooking_url.gif b/assets/hooking_url.gif
new file mode 100755
index 0000000..7d27b3c
Binary files /dev/null and b/assets/hooking_url.gif differ
diff --git a/assets/https_bothway_01.png b/assets/https_bothway_01.png
new file mode 100644
index 0000000..3f83191
Binary files /dev/null and b/assets/https_bothway_01.png differ
diff --git a/assets/https_bothway_02.png b/assets/https_bothway_02.png
new file mode 100644
index 0000000..a29bcf9
Binary files /dev/null and b/assets/https_bothway_02.png differ
diff --git a/assets/https_bothway_03.png b/assets/https_bothway_03.png
new file mode 100644
index 0000000..17269a1
Binary files /dev/null and b/assets/https_bothway_03.png differ
diff --git a/assets/https_bothway_04.png b/assets/https_bothway_04.png
new file mode 100644
index 0000000..76b31a2
Binary files /dev/null and b/assets/https_bothway_04.png differ
diff --git a/assets/j0.png b/assets/j0.png
new file mode 100644
index 0000000..3f66002
Binary files /dev/null and b/assets/j0.png differ
diff --git a/assets/j1.png b/assets/j1.png
new file mode 100644
index 0000000..0399703
Binary files /dev/null and b/assets/j1.png differ
diff --git a/assets/j2.png b/assets/j2.png
new file mode 100644
index 0000000..1fc0818
Binary files /dev/null and b/assets/j2.png differ
diff --git a/assets/just_trust_me_show.gif b/assets/just_trust_me_show.gif
new file mode 100755
index 0000000..831e071
Binary files /dev/null and b/assets/just_trust_me_show.gif differ
diff --git a/assets/keystore_dump.png b/assets/keystore_dump.png
new file mode 100644
index 0000000..572b5a3
Binary files /dev/null and b/assets/keystore_dump.png differ
diff --git a/assets/kill.gif b/assets/kill.gif
new file mode 100644
index 0000000..cc12ca1
Binary files /dev/null and b/assets/kill.gif differ
diff --git a/assets/kva.jpeg b/assets/kva.jpeg
new file mode 100644
index 0000000..3e3e30d
Binary files /dev/null and b/assets/kva.jpeg differ
diff --git a/assets/objection.gif b/assets/objection.gif
new file mode 100644
index 0000000..5114f3b
Binary files /dev/null and b/assets/objection.gif differ
diff --git a/assets/okhttp_justhook.png b/assets/okhttp_justhook.png
new file mode 100644
index 0000000..7bb6ddc
Binary files /dev/null and b/assets/okhttp_justhook.png differ
diff --git a/assets/qutoutiao.png b/assets/qutoutiao.png
new file mode 100644
index 0000000..71361a4
Binary files /dev/null and b/assets/qutoutiao.png differ
diff --git a/assets/remote_adb.gif b/assets/remote_adb.gif
new file mode 100644
index 0000000..7924257
Binary files /dev/null and b/assets/remote_adb.gif differ
diff --git a/assets/s.png b/assets/s.png
new file mode 100644
index 0000000..af32ccc
Binary files /dev/null and b/assets/s.png differ
diff --git a/assets/strat_just_trust_me.gif b/assets/strat_just_trust_me.gif
new file mode 100755
index 0000000..fa68fb1
Binary files /dev/null and b/assets/strat_just_trust_me.gif differ
diff --git a/assets/text_view.png b/assets/text_view.png
new file mode 100644
index 0000000..e37519b
Binary files /dev/null and b/assets/text_view.png differ
diff --git a/assets/tools_env.gif b/assets/tools_env.gif
new file mode 100644
index 0000000..8337c16
Binary files /dev/null and b/assets/tools_env.gif differ
diff --git a/assets/v.png b/assets/v.png
new file mode 100644
index 0000000..d064ded
Binary files /dev/null and b/assets/v.png differ
diff --git a/assets/xinit_files.png b/assets/xinit_files.png
new file mode 100644
index 0000000..db4db30
Binary files /dev/null and b/assets/xinit_files.png differ
diff --git a/assets/xinitdeploy.gif b/assets/xinitdeploy.gif
new file mode 100644
index 0000000..65b1dba
Binary files /dev/null and b/assets/xinitdeploy.gif differ
diff --git a/colorful.py b/colorful.py
new file mode 100644
index 0000000..65b06b0
--- /dev/null
+++ b/colorful.py
@@ -0,0 +1,30 @@
+'''
+Created on 2020年6月6日
+
+@author: stephen
+'''
+def withColor(string, fg, bg=49):
+ print("\33[0m\33[%d;%dm%s\33[0m" % (fg, bg, string))
+#front color
+Red = 1
+Green = 2
+Yellow = 3
+Blue = 4
+Magenta = 5
+Cyan = 6
+White = 7
+
+def red(string):
+ return withColor(string, Red+30) # Red
+def green(string):
+ return withColor(string, Green+30) # Green
+def yellow(string):
+ return withColor(string, Yellow+30) # Yellow
+def blue(string):
+ return withColor(string, Blue+30) # Blue
+def magenta(string):
+ return withColor(string, Magenta+30) # Magenta
+def cyan(string):
+ return withColor(string, Cyan+30) # Cyan
+def white(string):
+ return withColor(string, White+30) # White
diff --git a/com.blockchainvault/activity_events.js b/com.blockchainvault/activity_events.js
new file mode 100644
index 0000000..471ab90
--- /dev/null
+++ b/com.blockchainvault/activity_events.js
@@ -0,0 +1,170 @@
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ });
+};
+
+function checkLoadDex(className, dexfile) {
+ Java.perform(function() {
+ if (!classExists(className)) {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ }
+ });
+};
+
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+function getClassName(obj) {
+ if (obj.getClass) {
+ return obj.getClass().getName();
+ }
+ var javaObject = Java.use("java.lang.Object");
+ return Java.cast(obj, javaObject).getClass().getName();
+}
+
+//str1是否包含str2，str2可用正则表示
+function contains(str1, str2) {
+ var reg = RegExp(eval("/"+str2+"/"));
+ if(str1 && str1.match && str1.match(reg)){
+ return true;
+ }else{
+ return false;
+ }
+};
+
+//创建ArrayList对象用这个方法就好了
+function newArrayList() {
+ var ArrayListClz = Java.use('java.util.ArrayList');
+ return ArrayListClz.$new();
+}
+
+//创建HashSet对象用这个方法就好了
+function newHashSet() {
+ var HashSetClz = Java.use('java.util.HashSet');
+ return HashSetClz.$new();
+}
+
+//创建HashMap对象用这个方法就好了
+function newHashMap() {
+ var HashMapClz = Java.use('java.util.HashMap');
+ return HashMapClz.$new();
+}
+
+function newMethodBeat(text, executor) {
+ var threadClz = Java.use("java.lang.Thread");
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var currentThread = threadClz.currentThread();
+ var beat = new Object();
+ beat.invokeId = Math.random().toString(36).slice( - 8);
+ beat.executor = executor;
+ beat.threadId = currentThread.getId();
+ beat.threadName = currentThread.getName();
+ beat.text = text;
+ beat.startTime = new Date().getTime();
+ beat.stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new()).substring(20);
+ return beat;
+};
+
+function printBeat(beat) {
+ var str = ("------------startFlag:" + beat.invokeId + ",objectHash:"+beat.executor+",thread(id:" + beat.threadId +",name:" + beat.threadName + "),timestamp:" + beat.startTime+"---------------\n");
+ str += beat.text + "\n";
+ str += beat.stackInfo;
+ str += ("------------endFlag:" + beat.invokeId + ",usedtime:" + (new Date().getTime() - beat.startTime) +"---------------\n");
+ console.log(str);
+};
+
+function log(str) {
+ console.log(str);
+};
+
+//虽然我们习惯用fastjson一行将对象转成json字符串，但是Android Library里面自带了一个gson可以做到 只是sdk没有暴露出来，很多人不知道。在frida中所有代码都是透明的，你随便调......
+function toJson(javaObject) {
+ var gsonClz = Java.use("com.google.gson.Gson");
+ var toJsonMethod = gsonClz.toJson.overload("java.lang.Object");
+ return toJsonMethod.call(gsonClz.$new(),javaObject);
+};
+
+function getBaseContext() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context; //Java.scheduleOnMainThread(fn):
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while(new Date().getTime() < startTime) {}
+};
+
+function fastTojson(javaObject) {
+ var JSONClz = Java.use("gz.com.alibaba.fastjson.JSON");
+ return JSONClz.toJSONString(javaObject);
+};
+
+loadDexfile('/data/user/0/com.blockchainvault/radar.dex');
+
+Java.perform(function() {
+ var radarAndroidClz = Java.use("gz.radar.Android");
+ var android_content_ContextWrapper_clz = Java.use('android.content.ContextWrapper');
+ var android_content_ContextWrapper_clz_method_startActivity_r7jq = android_content_ContextWrapper_clz.startActivity.overload('android.content.Intent', 'android.os.Bundle');
+ android_content_ContextWrapper_clz_method_startActivity_r7jq.implementation = function(v0, v1) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ log("Bundle>>>>>>>"+radarAndroidClz.getBundleProfile(v1));
+ var executor = this.hashCode();
+ var beatText = 'public void android.content.ContextWrapper.startActivity(android.content.Intent,android.os.Bundle)';
+ var beat = newMethodBeat(beatText, executor);
+ android_content_ContextWrapper_clz_method_startActivity_r7jq.call(this, v0, v1);
+ printBeat(beat);
+ };
+ var android_content_ContextWrapper_clz_method_startActivity_auep = android_content_ContextWrapper_clz.startActivity.overload('android.content.Intent');
+ android_content_ContextWrapper_clz_method_startActivity_auep.implementation = function(v0) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ var executor = this.hashCode();
+ var beatText = 'public void android.content.ContextWrapper.startActivity(android.content.Intent)';
+ var beat = newMethodBeat(beatText, executor);
+ android_content_ContextWrapper_clz_method_startActivity_auep.call(this, v0);
+ printBeat(beat);
+ };
+ var android_content_ContextWrapper_clz_method_startActivityAsUser_adh6 = android_content_ContextWrapper_clz.startActivityAsUser.overload('android.content.Intent', 'android.os.UserHandle');
+ android_content_ContextWrapper_clz_method_startActivityAsUser_adh6.implementation = function(v0, v1) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ var executor = this.hashCode();
+ var beatText = 'public void android.content.ContextWrapper.startActivityAsUser(android.content.Intent,android.os.UserHandle)';
+ var beat = newMethodBeat(beatText, executor);
+ android_content_ContextWrapper_clz_method_startActivityAsUser_adh6.call(this, v0, v1);
+ printBeat(beat);
+ };
+ var android_content_ContextWrapper_clz_method_startActivityAsUser_ilkk = android_content_ContextWrapper_clz.startActivityAsUser.overload('android.content.Intent', 'android.os.Bundle', 'android.os.UserHandle');
+ android_content_ContextWrapper_clz_method_startActivityAsUser_ilkk.implementation = function(v0, v1, v2) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ log("Bundle>>>>>>>"+radarAndroidClz.getBundleProfile(v1));
+ var executor = this.hashCode();
+ var beatText = 'public void android.content.ContextWrapper.startActivityAsUser(android.content.Intent,android.os.Bundle,android.os.UserHandle)';
+ var beat = newMethodBeat(beatText, executor);
+ android_content_ContextWrapper_clz_method_startActivityAsUser_ilkk.call(this, v0, v1, v2);
+ printBeat(beat);
+ };
+ var android_app_Activity_clz = Java.use('android.app.Activity');
+ var android_app_Activity_clz_method_startActivityForResult_6mkb = android_app_Activity_clz.startActivityForResult.overload('android.content.Intent', 'int', 'android.os.Bundle');
+ android_app_Activity_clz_method_startActivityForResult_6mkb.implementation = function(v0, v1, v2) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ log("Flags>>>>>>>"+v1);
+ log("Bundle>>>>>>>"+radarAndroidClz.getBundleProfile(v2));
+ var executor = this.hashCode();
+ var beatText = 'public void android.app.Activity.startActivityForResult(android.content.Intent,int,android.os.Bundle)';
+ var beat = newMethodBeat(beatText, executor);
+ android_app_Activity_clz_method_startActivityForResult_6mkb.call(this, v0, v1, v2);
+ printBeat(beat);
+ };
+});
\ No newline at end of file
diff --git a/com.blockchainvault/android_ui.js b/com.blockchainvault/android_ui.js
new file mode 100644
index 0000000..20c8be2
--- /dev/null
+++ b/com.blockchainvault/android_ui.js
@@ -0,0 +1,194 @@
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ });
+};
+
+function checkLoadDex(className, dexfile) {
+ Java.perform(function() {
+ if (!classExists(className)) {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ }
+ });
+};
+loadDexfile('/data/user/0/com.blockchainvault/radar.dex');
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+function getClassName(obj) {
+ if (obj.getClass) {
+ return obj.getClass().getName();
+ }
+ var javaObject = Java.use("java.lang.Object");
+ return Java.cast(obj, javaObject).getClass().getName();
+}
+
+//str1是否包含str2，str2可用正则表示
+function contains(str1, str2) {
+ var reg = RegExp(eval("/" + str2 + "/"));
+ if (str1 && str1.match && str1.match(reg)) {
+ return true;
+ } else {
+ return false;
+ }
+};
+
+//创建ArrayList对象用这个方法就好了
+function newArrayList() {
+ var ArrayListClz = Java.use('java.util.ArrayList');
+ return ArrayListClz.$new();
+}
+
+//创建HashSet对象用这个方法就好了
+function newHashSet() {
+ var HashSetClz = Java.use('java.util.HashSet');
+ return HashSetClz.$new();
+}
+
+//创建HashMap对象用这个方法就好了
+function newHashMap() {
+ var HashMapClz = Java.use('java.util.HashMap');
+ return HashMapClz.$new();
+}
+
+function log(str) {
+ console.log(str);
+};
+
+//虽然我们习惯用fastjson一行将对象转成json字符串，但是Android Library里面自带了一个gson可以做到 只是sdk没有暴露出来，很多人不知道。在frida中所有代码都是透明的，你随便调......
+function toJson(javaObject) {
+ var gsonClz = Java.use("com.google.gson.Gson");
+ var toJsonMethod = gsonClz.toJson.overload("java.lang.Object");
+ return toJsonMethod.call(gsonClz.$new(), javaObject);
+};
+
+function getBaseContext() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context; //Java.scheduleOnMainThread(fn):
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while (new Date().getTime() < startTime) {}
+};
+
+function fastTojson(javaObject) {
+ var JSONClz = Java.use("gz.com.alibaba.fastjson.JSON");
+ return JSONClz.toJSONString(javaObject);
+};
+
+function findViewById(viewId) {
+ var report = "";
+ Java.perform(function() {
+ var radarAndroidClz = Java.use("gz.radar.Android");
+ var viewInfo = radarAndroidClz.getViewInfo(viewId + "");
+ if (!viewInfo) {
+ report += "Not Found View."
+ return;
+ }
+ report += ("------------------View--------------------") + "\n";
+ report += ("View Id: " + viewInfo.getViewId()) + "\n";
+ report += ("View IdName: " + viewInfo.getViewIdName()) + "\n";
+ report += ("View Class: " + viewInfo.getName()) + "\n";
+ report += ("View SuperClass: " + viewInfo.getSuperClazz()) + "\n";
+ report += ("View ImplementInterfaces: " + viewInfo.getImplementInterfaces()) + "\n";
+ var androidApkFields = viewInfo.getAndroidApkFields();
+ report += ("View Fields: " + androidApkFields.length) + "\n";
+ for (var j = 0; j < androidApkFields.length; j++) {
+ report += ("\t" + androidApkFields[j].toLine()) + "\n";
+ }
+ var methods = viewInfo.methods();
+ report += ("View Methods: " + methods.length) + "\n";
+ for (var j = 0; j < methods.length; j++) {
+ report += ("\t" + methods[j]) + "\n";
+ }
+ });
+ log(report);
+}
+
+function startActivity(activityName) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.startActivity(activityName);
+ });
+}
+
+function contextStartActivity(activityName) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.contextStartActivity(activityName);
+ });
+}
+
+function contextStartActivityForNewTask(activityName) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.contextStartActivityForNewTask(activityName);
+ });
+}
+
+function topActivityStartActivity(activityName) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.topActivityStartActivity(activityName);
+ });
+}
+
+function home() {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.home();
+ });
+}
+
+function back() {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.back();
+ });
+}
+
+function finishCurrentActivity() {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.finishCurrentActivity();
+ });
+}
+
+function clickByText(text) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ log(androidUIClz.clickByText(text));
+ });
+}
+
+function clickById(id) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ log(androidUIClz.clickById(id));
+ });
+}
+
+function hover(x,y,upStepLength) {
+ Java.perform(function() {
+ var androidui = Java.use("gz.radar.AndroidUI");
+ androidui.hover(x,y,upStepLength);
+ });
+}
+
+function viewTree() {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ log(androidUIClz.viewTree());
+ });
+}
\ No newline at end of file
diff --git a/com.blockchainvault/attach b/com.blockchainvault/attach
new file mode 100755
index 0000000..8e2f637
--- /dev/null
+++ b/com.blockchainvault/attach
@@ -0,0 +1,3 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+frida $HOOKER_DRIVER -l $1 com.blockchainvault
\ No newline at end of file
diff --git a/com.blockchainvault/click.js b/com.blockchainvault/click.js
new file mode 100644
index 0000000..501045c
--- /dev/null
+++ b/com.blockchainvault/click.js
@@ -0,0 +1,49 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ var str = ("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id:" + currentThread.getId() +",name:" + currentThread.getName() + "),timestamp:" + startTime+"---------------\n");
+ str += methodName + "\n";
+ str += stackInfo.substring(20);
+ str += ("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+ console.log(str);
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while (new Date().getTime() < startTime) {}
+};
+
+function makeClass(className) {
+ var classClz = Java.use("java.lang.Class");
+ var forNameFunc = classClz.forName.overload("java.lang.String");
+ return forNameFunc.call(classClz, className);
+};
+
+function isClass(obj, superClzName) {
+ var objClz = obj.getClass();
+ var superClz = makeClass(superClzName);
+ return superClz.isAssignableFrom(objClz);
+};
+
+Java.perform(function() {
+ var textViewClz = Java.use("android.widget.TextView");
+ var android_view_View_clz = Java.use('android.view.View');
+ var android_view_View_clz_method_performClick_u6ef = android_view_View_clz.performClick.overload();
+ android_view_View_clz_method_performClick_u6ef.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'obj:' + this.hashCode();
+ var ret = android_view_View_clz_method_performClick_u6ef.call(this);
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ //console.log("ViewText: " + Java.cast(this, textViewClz).getText());
+ console.log("ViewClz: " + clz);
+ console.log("ViewId: " + viewId);
+ methodInBeat(invokeId, startTime, 'public boolean android.view.View.performClick()', executor);
+ return ret;
+ };
+});
\ No newline at end of file
diff --git a/com.blockchainvault/edit_text.js b/com.blockchainvault/edit_text.js
new file mode 100644
index 0000000..ec2c5ba
--- /dev/null
+++ b/com.blockchainvault/edit_text.js
@@ -0,0 +1,97 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ var str = ("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id:" + currentThread.getId() +",name:" + currentThread.getName() + "),timestamp:" + startTime+"---------------\n");
+ str += methodName + "\n";
+ str += stackInfo.substring(20);
+ str += ("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+ console.log(str);
+};
+
+function makeClass(className) {
+ var classClz = Java.use("java.lang.Class");
+ var forNameFunc = classClz.forName.overload("java.lang.String");
+ return forNameFunc.call(classClz, className);
+};
+
+function isClass(obj, superClzName) {
+ var objClz = obj.getClass();
+ var superClz = makeClass(superClzName);
+ return superClz.isAssignableFrom(objClz);
+};
+
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+Java.perform(function() {
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var textViewClz = Java.use("android.widget.TextView");
+ var charSequenceClz = Java.use("java.lang.CharSequence");
+ if (textViewClz.setText) {
+ var setTextFunc = textViewClz.setText.overload("java.lang.CharSequence");
+ setTextFunc.implementation = function(v0) {
+ var startTime = new Date().getTime();
+ setTextFunc.call(this, v0);
+ if (isClass(this, "android.widget.EditText")) {
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("EditTextClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("text: " + v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'android.widget.EditText.setText()', executor);
+ }
+ };
+ }
+ //EditText的getText继承自TextView
+ if (textViewClz.getText) {
+ var getTextFunc = textViewClz.getText.overload();
+ getTextFunc.implementation = function() {
+ var startTime = new Date().getTime();
+ var editable = getTextFunc.call(this);
+ if (isClass(this, "android.widget.EditText")) {
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("EditTextClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text: " + Java.cast(editable, charSequenceClz));
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'android.widget.EditText.getText()', executor);
+ }
+ return editable;
+ };
+ }
+ //AppCompatEditText 有自定义的getText所以单独hook
+ if (classExists("androidx.appcompat.widget.AppCompatEditText")) {
+ var appCompatEditTextClz = Java.use("androidx.appcompat.widget.AppCompatEditText");
+ var appCompatEditTextClzGetTextFunc = appCompatEditTextClz.getText.overload();
+ appCompatEditTextClzGetTextFunc.implementation = function() {
+ var startTime = new Date().getTime();
+ var editable = appCompatEditTextClzGetTextFunc.call(this);
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("EditTextClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text: " + Java.cast(editable, charSequenceClz));
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'androidx.appcompat.widget.AppCompatEditText.getText()', executor);
+ return editable;
+ };
+ }
+});
\ No newline at end of file
diff --git a/com.blockchainvault/hook_RN.js b/com.blockchainvault/hook_RN.js
new file mode 100644
index 0000000..de44671
--- /dev/null
+++ b/com.blockchainvault/hook_RN.js
@@ -0,0 +1,46 @@
+
+function hook_RegisterNatives() {
+ var symbols = Module.enumerateSymbolsSync("libart.so");
+ var addrRegisterNatives = null;
+ for (var i = 0; i < symbols.length; i++) {
+ var symbol = symbols[i];
+
+ //_ZN3art3JNI15RegisterNativesEP7_JNIEnvP7_jclassPK15JNINativeMethodi
+ if (symbol.name.indexOf("art") >= 0 &&
+ symbol.name.indexOf("JNI") >= 0 &&
+ symbol.name.indexOf("RegisterNatives") >= 0 &&
+ symbol.name.indexOf("CheckJNI") < 0) {
+ addrRegisterNatives = symbol.address;
+ console.log("RegisterNatives is at ", symbol.address, symbol.name);
+ }
+ }
+
+ if (addrRegisterNatives != null) {
+ Interceptor.attach(addrRegisterNatives, {
+ onEnter: function (args) {
+ console.log("[RegisterNatives] method_count:", args[3]);
+ var env = args[0];
+ var java_class = args[1];
+ var class_name = Java.vm.tryGetEnv().getClassName(java_class);
+ //console.log(class_name);
+
+ var methods_ptr = ptr(args[2]);
+
+ var method_count = parseInt(args[3]);
+ for (var i = 0; i < method_count; i++) {
+ var name_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3));
+ var sig_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize));
+ var fnPtr_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize * 2));
+
+ var name = Memory.readCString(name_ptr);
+ var sig = Memory.readCString(sig_ptr);
+ var find_module = Process.findModuleByAddress(fnPtr_ptr);
+ console.log("[RegisterNatives] java_class:", class_name, "name:", name, "sig:", sig, "fnPtr:", fnPtr_ptr, "module_name:", find_module.name, "module_base:", find_module.base, "offset:", ptr(fnPtr_ptr).sub(find_module.base));
+
+ }
+ }
+ });
+ }
+}
+
+setImmediate(hook_RegisterNatives);
diff --git a/com.blockchainvault/hooking b/com.blockchainvault/hooking
new file mode 100755
index 0000000..8830d21
--- /dev/null
+++ b/com.blockchainvault/hooking
@@ -0,0 +1,5 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+echo "hooking $1" > log
+date | tee -ai log
+frida $HOOKER_DRIVER -l $1 com.blockchainvault | tee -ai log
\ No newline at end of file
diff --git a/com.blockchainvault/java_util_HashMap_put.js b/com.blockchainvault/java_util_HashMap_put.js
new file mode 100644
index 0000000..8d145e7
--- /dev/null
+++ b/com.blockchainvault/java_util_HashMap_put.js
@@ -0,0 +1,169 @@
+//crack by com.blockchainvault 1.29.0
+//java.util.HashMap:put
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ });
+};
+
+function checkLoadDex(className, dexfile) {
+ Java.perform(function() {
+ if (!classExists(className)) {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ }
+ });
+};
+
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+function getClassName(obj) {
+ if (obj.getClass) {
+ return obj.getClass().getName();
+ }
+ var javaObject = Java.use("java.lang.Object");
+ return Java.cast(obj, javaObject).getClass().getName();
+}
+
+//str1是否包含str2，str2可用正则表示
+function contains(str1, str2) {
+ var reg = RegExp(eval("/"+str2+"/"));
+ if(str1 && str1.match && str1.match(reg)){
+ return true;
+ }else{
+ return false;
+ }
+};
+
+//创建ArrayList对象用这个方法就好了
+function newArrayList() {
+ var ArrayListClz = Java.use('java.util.ArrayList');
+ return ArrayListClz.$new();
+}
+
+//创建HashSet对象用这个方法就好了
+function newHashSet() {
+ var HashSetClz = Java.use('java.util.HashSet');
+ return HashSetClz.$new();
+}
+
+//创建HashMap对象用这个方法就好了
+function newHashMap() {
+ var HashMapClz = Java.use('java.util.HashMap');
+ return HashMapClz.$new();
+}
+
+function newMethodBeat(text, executor) {
+ var threadClz = Java.use("java.lang.Thread");
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var processClz = Java.use("android.os.Process");
+ var currentThread = threadClz.currentThread();
+ var beat = new Object();
+ beat.invokeId = Math.random().toString(36).slice( - 8);
+ beat.executor = executor;
+ beat.myPid = processClz.myPid();
+ beat.threadId = currentThread.getId();
+ beat.threadName = currentThread.getName();
+ beat.text = text;
+ beat.startTime = new Date().getTime();
+ beat.stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new()).substring(20);
+ return beat;
+};
+
+function printBeat(beat) {
+ var str = ("------------pid:" + beat.myPid + ",startFlag:" + beat.invokeId + ",objectHash:"+beat.executor+",thread(id:" + beat.threadId +",name:" + beat.threadName + "),timestamp:" + beat.startTime+"---------------\n");
+ str += beat.text + "\n";
+ str += beat.stackInfo;
+ str += ("------------endFlag:" + beat.invokeId + ",usedtime:" + (new Date().getTime() - beat.startTime) +"---------------\n");
+ console.log(str);
+};
+
+var log = console.log;
+
+var print = console.log;
+
+function getBaseContext() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context; //Java.scheduleOnMainThread(fn):
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while(new Date().getTime() < startTime) {}
+};
+
+
+
+var loadedXRadar = false;
+
+function loadXinitDexfile(dexfile) {
+ loadDexfile('/data/user/0/com.blockchainvault/xinit/'+dexfile);
+};
+
+function loadXRadarDexfile() {
+ loadedXRadar = true;
+ loadDexfile('/data/user/0/com.blockchainvault/radar.dex');
+};
+
+function fastTojson(javaObject) {
+ var JSONClz = Java.use("gz.com.alibaba.fastjson.JSON");
+ return JSONClz.toJSONString(javaObject);
+};
+
+function getPrettyString(javaObject) {
+ var XPretty = Java.use("gz.util.XPretty");
+ return XPretty.getPrettyString(javaObject);
+};
+
+function xPretty(javaObject) {
+ var str = getPrettyString(javaObject);
+ console.log(str);
+};
+
+function getField(javaObject, fieldName) {
+ var X = Java.use("gz.util.X");
+ return X.getField(javaObject, fieldName);
+};
+
+function storeObjectAndLog(javaObject) {
+ try {
+ var className = getClassName(javaObject);
+ var ObjectsStore = Java.use("gz.radar.objects.ObjectsStore");
+ var objectId = ObjectsStore.storeObject(javaObject);
+ console.log(className + " ObjectsStoreId: " +objectId);
+ } catch (error) {
+ console.error("你传的不是一个有效的java对象!");
+ }
+};
+
+
+
+//java.util.HashMap:put
+Java.perform(function() {
+ var java_util_HashMap_clz = Java.use('java.util.HashMap');
+ var java_util_HashMap_clz_method_put_7333 = java_util_HashMap_clz.put.overload('java.lang.Object', 'java.lang.Object');
+ java_util_HashMap_clz_method_put_7333.implementation = function(v0, v1) {
+
+
+ if (v0 == "captcha_token") {
+ var executor = this.hashCode();
+ var beatText = 'public java.lang.Object java.util.HashMap.put(java.lang.Object,java.lang.Object)';
+ var beat = newMethodBeat(beatText, executor);
+ printBeat(beat);
+ }
+ var ret = java_util_HashMap_clz_method_put_7333.call(this, v0, v1);
+ return ret;
+ };
+});
\ No newline at end of file
diff --git a/com.blockchainvault/just_trust_me.js b/com.blockchainvault/just_trust_me.js
new file mode 100644
index 0000000..bd8bc97
--- /dev/null
+++ b/com.blockchainvault/just_trust_me.js
@@ -0,0 +1,318 @@
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ });
+};
+
+var loadedXRadar = false;
+function loadXRadarDexfile() {
+ loadedXRadar = true;
+ loadDexfile('/data/user/0/com.blockchainvault/radar.dex');
+};
+
+
+loadXRadarDexfile();
+
+function hasTrustManagerImpl() {
+ return classExists("com.android.org.conscrypt.TrustManagerImpl");
+}
+
+function newArrayList() {
+ var ArrayListClz = Java.use('java.util.ArrayList');
+ return ArrayListClz.$new();
+}
+
+
+function processOkHttp() {
+ //知道你为什么有时候用JustTrustMe失败吗，因为app代码混淆了下面这些类你改到对应的类和方法就行啦
+ if (classExists("com.squareup.okhttp.CertificatePinner")) {
+ var squareupOkhttp3CertificatePinnerClz = Java.use('com.squareup.okhttp.CertificatePinner');
+ var squareupOkhttp3CertificatePinnerClzCheck = squareupOkhttp3CertificatePinnerClz.check.overload('java.lang.String', 'java.util.List');
+ squareupOkhttp3CertificatePinnerClzCheck.implementation = function(v0, v1) {
+ //什么都不做
+ console.log("com.squareup.okhttp.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!");
+ };
+ }else{
+ console.error("没找到com.squareup.okhttp.CertificatePinner类，这是android系统自带的类没找到就算求了。不同系统不一样，不用找了!!!");
+ }
+
+ if (classExists("okhttp3.CertificatePinner")) {
+ try {
+ var okhttp3CertificatePinnerClz = Java.use('okhttp3.CertificatePinner');
+ var okhttp3CertificatePinnerClzCheck = okhttp3CertificatePinnerClz.check.overload('java.lang.String', 'java.util.List');
+ okhttp3CertificatePinnerClzCheck.implementation = function(v0, v1) {
+ //什么都不做
+ console.log("okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!");
+ };
+ } catch (error) {
+ console.error("okhttp3.CertificatePinner的check方法可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+ }else{
+ console.error("没找到okhttp3.CertificatePinner类，可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+
+ if (classExists("okhttp3.internal.tls.OkHostnameVerifier")) {
+ try {
+ var OkHostnameVerifierClz = Java.use('okhttp3.internal.tls.OkHostnameVerifier');
+ var OkHostnameVerifierClzVerify_5791 = OkHostnameVerifierClz.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession');
+ OkHostnameVerifierClzVerify_5791.implementation = function(v0, v1) {
+ //强制返回true
+ console.log("okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!");
+ return true;
+ };
+ var OkHostnameVerifierVerify_8978 = OkHostnameVerifierClz.verify.overload('java.lang.String', 'java.security.cert.X509Certificate');
+ OkHostnameVerifierVerify_8978.implementation = function(v0, v1) {
+ //强制返回true
+ console.log("okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'java.security.cert.X509Certificate') was hooked!");
+ return true;
+ };
+ } catch (error) {
+ console.error("okhttp3.internal.tls.OkHostnameVerifier的verify方法可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+ }else{
+ console.error("没找到okhttp3.internal.tls.OkHostnameVerifier类，可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+
+ if (classExists("okhttp3.OkHttpClient$Builder")) {
+ try{
+ var okhttp3_OkHttpClient_Builder_clz = Java.use('okhttp3.OkHttpClient$Builder');
+ var okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_one = okhttp3_OkHttpClient_Builder_clz.sslSocketFactory.overload('javax.net.ssl.SSLSocketFactory');
+ okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_one.implementation = function(sSLSocketFactory) {
+ //把参数替换成EmptySSLFactory
+ var ret = okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_one.call(this, Java.use("gz.justtrustme.Helper").getEmptySSLFactory());
+ return ret;
+ };
+ var okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_two = okhttp3_OkHttpClient_Builder_clz.sslSocketFactory.overload('javax.net.ssl.SSLSocketFactory', 'javax.net.ssl.X509TrustManager');
+ okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_two.implementation = function(sSLSocketFactory, x509TrustManager) {
+ //把参数替换成EmptySSLFactory
+ var ret = okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_two.call(this, Java.use("gz.justtrustme.Helper").getEmptySSLFactory(), x509TrustManager);
+ return ret;
+ };
+ } catch(error) {
+ console.error("okhttp3.OkHttpClient$Builder的sslSocketFactory方法可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+ }else{
+ console.error("没找到okhttp3.OkHttpClient$Builder类，可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+}
+
+
+function processXutils() {
+ if (classExists("org.xutils.http.RequestParams")) {
+ var RequestParamsClass = Java.use("org.xutils.http.RequestParams");
+ var RequestParamsClassSetSslSocketFactory = RequestParamsClass.setSslSocketFactory.overload('javax.net.ssl.SSLSocketFactory');
+ RequestParamsClassSetSslSocketFactory.implementation = function(v0) {
+ console.log("org.xutils.http.RequestParams.setSslSocketFactory('javax.net.ssl.SSLSocketFactory') was hooked!");
+ var Helper = Java.use("gz.justtrustme.Helper");
+ //替换javax.net.ssl.SSLSocketFactory参数为我们的EmptySSLFactory
+ RequestParamsClassSetSslSocketFactory.call(this, Helper.getEmptySSLFactory());
+ };
+ var RequestParamsClassSetHostnameVerifier = RequestParamsClass.setHostnameVerifier.overload('javax.net.ssl.HostnameVerifier');
+ RequestParamsClassSetHostnameVerifier.implementation = function(v0) {
+ console.log("org.xutils.http.RequestParams.setHostnameVerifier('javax.net.ssl.HostnameVerifier') was hooked!");
+ var ImSureItsLegitHostnameVerifier = Java.use("gz.justtrustme.ImSureItsLegitHostnameVerifier");
+ //替换javax.net.ssl.HostnameVerifier参数为我们的ImSureItsLegitHostnameVerifier
+ RequestParamsClassSetHostnameVerifier.call(this, ImSureItsLegitHostnameVerifier.$new());
+ };
+ }
+}
+
+function processHttpClientAndroidLib() {
+ if (classExists("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier")) {
+ var AbstractVerifierClass = Java.use("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier");
+ var OkHostnameVerifierClzVerify_5791 = AbstractVerifierClass.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;', 'boolean');
+ OkHostnameVerifierClzVerify_5791.implementation = function(v0, v1, v2, v3) {
+ //什么都不做
+ console.log("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier.verify('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;', 'boolean') was hooked!");
+ };
+ }else{
+ console.error("没找到ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier类，但是这个类用的少。不用找了!");
+ }
+}
+
+//这是hooker添加的hook点，原JustTrustMe中没有的
+function processConscryptPlatform() {
+ if (!classExists("com.android.org.conscrypt.Platform")) {
+ return;
+ }
+ var com_android_org_conscrypt_Platform_clz = Java.use('com.android.org.conscrypt.Platform');
+ var com_android_org_conscrypt_Platform_clz_method_checkServerTrusted_9565 = com_android_org_conscrypt_Platform_clz.checkServerTrusted.overload('javax.net.ssl.X509TrustManager', '[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'com.android.org.conscrypt.OpenSSLEngineImpl');
+ com_android_org_conscrypt_Platform_clz_method_checkServerTrusted_9565.implementation = function(v0, v1, v2, v3) {
+ //什么都不做
+ };
+ var com_android_org_conscrypt_Platform_clz_method_checkServerTrusted_6928 = com_android_org_conscrypt_Platform_clz.checkServerTrusted.overload('javax.net.ssl.X509TrustManager', '[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'com.android.org.conscrypt.OpenSSLSocketImpl');
+ com_android_org_conscrypt_Platform_clz_method_checkServerTrusted_6928.implementation = function(v0, v1, v2, v3) {
+ //什么都不做
+ };
+}
+
+
+//这是hooker添加的hook点，原JustTrustMe中没有的
+function processPinningTrustManager() {
+ if (!classExists("appcelerator.https.PinningTrustManager")) {
+ return;
+ }
+ var pinningTrustManagerClass = Java.use('appcelerator.https.PinningTrustManager');
+ var pinningTrustManagerClass_checkServerTrusted = pinningTrustManagerClass.checkServerTrusted.overload();
+ pinningTrustManagerClass_checkServerTrusted.implementation = function() {
+ //什么都不做
+ };
+}
+
+
+Java.perform(function() {
+ var Helper = Java.use("gz.justtrustme.Helper");
+ var DefaultHttpClientClass = Java.use("org.apache.http.impl.client.DefaultHttpClient");
+ //被强奸的构造方法
+ var DefaultHttpClientClassRapeConstructor = DefaultHttpClientClass.$init.overload('org.apache.http.conn.ClientConnectionManager', 'org.apache.http.params.HttpParams');
+ DefaultHttpClientClassRapeConstructor.implementation = function(v0, v1) {
+ //被强奸的构造方法被调用的话，我们替换调ClientConnectionManager参数为我们的
+ var returnObj = DefaultHttpClientClassRapeConstructor.call(this, Helper.getCCM(v0, v1), v1);
+ console.log("org.apache.http.impl.client.DefaultHttpClient.$init('org.apache.http.conn.ClientConnectionManager', 'org.apache.http.params.HttpParams') was hooked!");
+ return returnObj;
+ };
+ var DefaultHttpClientClassInit_1602 = DefaultHttpClientClass.$init.overload();
+ DefaultHttpClientClassInit_1602.implementation = function() {
+ //使用DefaultHttpClientClassRapeConstructor强奸它
+ var returnObj = DefaultHttpClientClassRapeConstructor.call(this, Helper.getSCCM(), null);
+ console.log("org.apache.http.impl.client.DefaultHttpClient.$init() was hooked!");
+ return returnObj;
+ };
+ var DefaultHttpClientClassInit_1603 = DefaultHttpClientClass.$init.overload('org.apache.http.params.HttpParams');
+ DefaultHttpClientClassInit_1603.implementation = function(v0) {
+ //使用DefaultHttpClientClassRapeConstructor强奸它
+ var returnObj = DefaultHttpClientClassRapeConstructor.call(this, Helper.getSCCM(), v0);
+ console.log("org.apache.http.impl.client.DefaultHttpClient.$init('org.apache.http.params.HttpParams') was hooked!");
+ return returnObj;
+ };
+ //以上DefaultHttpClient的三个构造方法逻辑全部被我们替换了
+ var X509TrustManagerExtensionsClass = Java.use('android.net.http.X509TrustManagerExtensions');
+ var X509TrustManagerExtensionsClassCheckServerTrusted = X509TrustManagerExtensionsClass.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String');
+ X509TrustManagerExtensionsClassCheckServerTrusted.implementation = function(certsArr, v1, v2) {
+ console.log("android.net.http.X509TrustManagerExtensions.checkServerTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String') was hooked!");
+ return Java.use('java.util.Arrays$ArrayList').$new(certsArr);
+ };
+ var NetworkSecurityTrustManagerClass = Java.use('android.security.net.config.NetworkSecurityTrustManager');
+ var NetworkSecurityTrustManagerClassCheckPins = NetworkSecurityTrustManagerClass.checkPins.overload('java.util.List');
+ NetworkSecurityTrustManagerClassCheckPins.implementation = function(v0) {
+ //什么都不做
+ console.log("android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!");
+ };
+
+ //替换trustmanagers参数
+ var SSLSocketFactory = Java.use('org.apache.http.conn.ssl.SSLSocketFactory');
+ var SSLSocketFactoryRapeConstructor = SSLSocketFactory.$init.overload('java.lang.String', 'java.security.KeyStore', 'java.lang.String', 'java.security.KeyStore', 'java.security.SecureRandom', 'org.apache.http.conn.scheme.HostNameResolver');
+ SSLSocketFactoryRapeConstructor.implementation = function(v0, v1, v2, v3, v4, v5) {
+ var returnObj = SSLSocketFactoryRapeConstructor.call(this, v0, v1, v2, v3, v4, v5);
+ console.log("org.apache.http.conn.ssl.SSLSocketFactory.$init('java.lang.String', 'java.security.KeyStore', 'java.lang.String', 'java.security.KeyStore', 'java.security.SecureRandom', 'org.apache.http.conn.scheme.HostNameResolver') was hooked!");
+ if (Helper.reInitSSLSocketFactory(returnObj, v0, v1, v2, v3, v4, v5)) {
+ console.log("替换trustmanagers参数成功!");
+ }else{
+ console.log("替换trustmanagers参数失败!");
+ }
+ return returnObj;
+ };
+
+ var SSLSocketFactoryGetSocketFactoryMethod = SSLSocketFactory.getSocketFactory.overload();
+ var SSLSocketFactoryEmptyConstructor = SSLSocketFactory.$init.overload();
+ SSLSocketFactoryGetSocketFactoryMethod.implementation = function() {
+ //强制用空的构造方法
+ console.log("org.apache.http.conn.ssl.SSLSocketFactory.getSocketFactory() was hooked!");
+ return SSLSocketFactoryEmptyConstructor.call(this);
+ };
+
+ var SSLSocketFactoryIsSecure = SSLSocketFactory.isSecure.overload('java.net.Socket');
+ SSLSocketFactoryIsSecure.implementation = function(v0) {
+ //强制返回true
+ console.log("org.apache.http.conn.ssl.SSLSocketFactory.isSecure('java.net.Socket') was hooked!");
+ return true;
+ };
+
+ var TrustManagerFactory = Java.use('javax.net.ssl.TrustManagerFactory');
+ var TrustManagerFactoryGetTrustManagers = TrustManagerFactory.getTrustManagers.overload();
+ TrustManagerFactoryGetTrustManagers.implementation = function() {
+ var ret = TrustManagerFactoryGetTrustManagers.call(this);
+ //替换getTrustManagers方法逻辑
+ console.log("javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!");
+ return Helper.replaceGetTrustManagers(this, ret);
+ };
+
+ var HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection");
+ var HttpsURLConnectionSetDefaultHostnameVerifier = HttpsURLConnection.setDefaultHostnameVerifier.overload('javax.net.ssl.HostnameVerifier');
+ HttpsURLConnectionSetDefaultHostnameVerifier.implementation = function(v0) {
+ //什么都不做
+ console.log("javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier('javax.net.ssl.HostnameVerifier') was hooked!");
+ };
+
+ var HttpsURLConnectionSetHostnameVerifier = HttpsURLConnection.setHostnameVerifier.overload('javax.net.ssl.HostnameVerifier');
+ HttpsURLConnectionSetHostnameVerifier.implementation = function(v0) {
+ //什么都不做
+ console.log("javax.net.ssl.HttpsURLConnection.setHostnameVerifier('javax.net.ssl.HostnameVerifier') was hooked!");
+ };
+
+ var HttpsURLConnectionSetSSLSocketFactory = HttpsURLConnection.setSSLSocketFactory.overload('javax.net.ssl.SSLSocketFactory');
+ HttpsURLConnectionSetSSLSocketFactory.implementation = function(v0) {
+ //什么都不做
+ console.log("javax.net.ssl.SSLSocketFactory.setSSLSocketFactory('javax.net.ssl.SSLSocketFactory') was hooked!");
+ };
+
+ var SSLContextClz = Java.use('javax.net.ssl.SSLContext');
+ var SSLContextClzInit = SSLContextClz.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom');
+ SSLContextClzInit.implementation = function(v0, v1, v2) {
+ //将第二个参数强制替换为我们自己构造的不安全的TrustManagers
+ SSLContextClzInit.call(this, v0, Helper.getImSureTrustManagers(), v2);
+ console.log("javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!");
+ };
+
+ var ApplicationClz = Java.use('android.app.Application');
+ var ApplicationClzAttach = ApplicationClz.attach.overload('android.content.Context');
+ ApplicationClzAttach.implementation = function(context) {
+ ApplicationClzAttach.call(this, context);
+ //注意justTrustMe使用的是afterHookedMethod，所以我们用frida也必须在原方法call完之后执行我们的代码
+ var classLoader = context.getClassLoader();
+
+ };
+
+ if (hasTrustManagerImpl()) {
+ var TrustManagerImplClz = Java.use('com.android.org.conscrypt.TrustManagerImpl');
+ var TrustManagerImplCheckServerTrusted_8813 = TrustManagerImplClz.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String');
+ TrustManagerImplCheckServerTrusted_8813.implementation = function(v0, v1, v2) {
+ console.log("com.android.org.conscrypt.TrustManagerImpl.checkServerTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String') was hooked!");
+ return newArrayList();
+ };
+ var TrustManagerImplCheckServerTrusted_7015 = TrustManagerImplClz.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'javax.net.ssl.SSLSession');
+ TrustManagerImplCheckServerTrusted_7015.implementation = function(v0, v1, v2) {
+ console.log("com.android.org.conscrypt.TrustManagerImpl.checkServerTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'javax.net.ssl.SSLSession') was hooked!");
+ return newArrayList();
+ };
+ var TrustManagerImplCheckTrusted_5587 = TrustManagerImplClz.checkTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String', 'boolean');
+ TrustManagerImplCheckTrusted_5587.implementation = function(v0, v1, v2, v3) {
+ console.log("com.android.org.conscrypt.TrustManagerImpl.checkTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String', 'boolean') was hooked!");
+ return newArrayList();
+ };
+ var TrustManagerImplCheckTrusted_9999 = TrustManagerImplClz.checkTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'javax.net.ssl.SSLSession', 'javax.net.ssl.SSLParameters', 'boolean');
+ TrustManagerImplCheckTrusted_9999.implementation = function(v0, v1, v2, v3, v4) {
+ console.log("com.android.org.conscrypt.TrustManagerImpl.checkTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'javax.net.ssl.SSLSession', 'javax.net.ssl.SSLParameters', 'boolean') was hooked!");
+ return newArrayList();
+ };
+ }
+
+ processOkHttp();
+ processXutils();
+ processHttpClientAndroidLib();
+ //hooker添加的hook点
+ processConscryptPlatform();
+ processPinningTrustManager();
+})
\ No newline at end of file
diff --git a/com.blockchainvault/just_trust_me_okhttp_hook_finder.js b/com.blockchainvault/just_trust_me_okhttp_hook_finder.js
new file mode 100644
index 0000000..2748df6
--- /dev/null
+++ b/com.blockchainvault/just_trust_me_okhttp_hook_finder.js
@@ -0,0 +1,72 @@
+function loadDexfile(dexfile) {
+ Java.perform(function () {
+ Java.openClassFile(dexfile).load();
+ });
+};
+
+
+loadDexfile('/data/user/0/com.blockchainvault/radar.dex');
+
+
+function printOkhttp3FakeClass(okhttp3FakeClassObject) {
+ if (okhttp3FakeClassObject) {
+ console.log("-----------------------------------------------------------------------");
+ console.log("原类名：" + okhttp3FakeClassObject.getOriginalClassName());
+ console.log("混淆类名：" + okhttp3FakeClassObject.getFakeClassName());
+ console.log("\n");
+ for (let k = 0; k < okhttp3FakeClassObject.fakeMethodSize(); k ++) {
+ let fakeMethod = okhttp3FakeClassObject.getFakeMethod(k);
+ console.log("混淆方法" + k + ":");
+ console.log("原方法签名：" + fakeMethod.getOriginalMethod());
+ console.log("混淆方法签名：" + fakeMethod.getFakeMethod());
+ console.log("\n");
+ }
+ if (okhttp3FakeClassObject.fakeMethodSize() == 0) {
+ //手动找混淆方法
+ console.error("自动定位混淆方法失败，请去jadx打开"+okhttp3FakeClassObject.getFakeClassName()+"手动分析混淆方法");
+ }
+ }
+}
+
+//设置下混淆okhttp混淆类包名的前戳，以便加快扫描速度
+//一般okhttp用的版本是3，并且混淆没有到包名级别所以我这里默认给^okhttp3
+//如果你的apk混淆的到了包名级别。先用jadx静态分析找到包名前戳改到这即可
+//你可以用.*，但是全量扫描太慢了。frida不是那么的耐操，容易崩溃！
+var matchClassNameRegExp = RegExp(/^okhttp3/);
+
+
+Java.perform(function() {
+ var OkHttp3FakeFinder = Java.use("gz.justtrustme.OkHttp3FakeFinder");
+ Java.enumerateLoadedClasses({
+ onMatch: function(className) {
+ if (className.match(matchClassNameRegExp)) {
+ try {
+ let tempClassHandle = Java.use(className).class;
+ let matchOkHttpClientBuilderCheckResult = OkHttp3FakeFinder.okHttpClientBuilderCheck(tempClassHandle);
+ if (matchOkHttpClientBuilderCheckResult) {
+ printOkhttp3FakeClass(matchOkHttpClientBuilderCheckResult);
+ continue;
+ }
+
+ let matchOk3CertificatePinnerCheckResult = OkHttp3FakeFinder.okHttpCertificatePinnerCheck(tempClassHandle);
+ if (matchOk3CertificatePinnerCheckResult) {
+ printOkhttp3FakeClass(matchOk3CertificatePinnerCheckResult);
+ continue;
+ }
+
+ let matchOk3OkHostnameVerifierVerifyResult = OkHttp3FakeFinder.okHttpOkHostnameVerifierVerify(tempClassHandle);
+ if (matchOk3OkHostnameVerifierVerifyResult) {
+ printOkhttp3FakeClass(matchOk3OkHostnameVerifierVerifyResult);
+ continue;
+ }
+
+ } catch(error) {
+ //console.error(error);
+ }
+ }
+ },
+ onComplete: function() {}
+ });
+});
+
+
diff --git a/com.blockchainvault/keystore_dump.js b/com.blockchainvault/keystore_dump.js
new file mode 100644
index 0000000..d58589b
--- /dev/null
+++ b/com.blockchainvault/keystore_dump.js
@@ -0,0 +1,110 @@
+//在https双向认证的情况下，dump客户端证书为p12. 证书密码: hooker
+var password = "hooker";
+
+
+
+function dateFormat(fmt, date) {
+ let ret;
+ const opt = {
+ "Y+": date.getFullYear().toString(),
+ // 年
+ "m+": (date.getMonth() + 1).toString(),
+ // 月
+ "d+": date.getDate().toString(),
+ // 日
+ "H+": date.getHours().toString(),
+ // 时
+ "M+": date.getMinutes().toString(),
+ // 分
+ "S+": date.getSeconds().toString() // 秒
+ };
+ for (let k in opt) {
+ ret = new RegExp("(" + k + ")").exec(fmt);
+ if (ret) {
+ fmt = fmt.replace(ret[1], (ret[1].length == 1) ? (opt[k]) : (opt[k].padStart(ret[1].length, "0")))
+ };
+ };
+ return fmt;
+}
+
+function random(min, max) {
+ return Math.floor(Math.random() * (max - min)) + min;
+}
+
+function getNowTime() {
+ return dateFormat("YYYY_mm_dd_HH_MM_SS", new Date()) + "_" + random(1, 100);
+}
+
+function getPackageName() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context.getPackageName();
+};
+
+function newMethodBeat(text, executor) {
+ var threadClz = Java.use("java.lang.Thread");
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var processClz = Java.use("android.os.Process");
+ var currentThread = threadClz.currentThread();
+ var beat = new Object();
+ beat.invokeId = Math.random().toString(36).slice( - 8);
+ beat.executor = executor;
+ beat.myPid = processClz.myPid();
+ beat.threadId = currentThread.getId();
+ beat.threadName = currentThread.getName();
+ beat.text = text;
+ beat.startTime = new Date().getTime();
+ beat.stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new()).substring(20);
+ return beat;
+};
+
+function printBeat(beat) {
+ var str = ("------------pid:" + beat.myPid + ",startFlag:" + beat.invokeId + ",objectHash:"+beat.executor+",thread(id:" + beat.threadId +",name:" + beat.threadName + "),timestamp:" + beat.startTime+"---------------\n");
+ str += beat.text + "\n";
+ str += beat.stackInfo;
+ str += ("------------endFlag:" + beat.invokeId + ",usedtime:" + (new Date().getTime() - beat.startTime) +"---------------\n");
+ console.log(str);
+};
+
+function dump2sdcard(pri, p7, filePath) {
+ console.log("dump:" + filePath);
+ var X509CertificateClass = Java.use("java.security.cert.X509Certificate");
+ var myX509 = Java.cast(p7, X509CertificateClass);
+ var chain = Java.array("java.security.cert.X509Certificate", [myX509]);
+ var ks = Java.use("java.security.KeyStore").getInstance("PKCS12", "BC");
+ ks.load(null, null);
+ ks.setKeyEntry("client", pri, Java.use('java.lang.String').$new(password).toCharArray(), chain);
+ try {
+ var out = Java.use("java.io.FileOutputStream").$new(filePath);
+ ks.store(out, Java.use('java.lang.String').$new(password).toCharArray());
+ } catch(error) {
+ console.log(error);
+ }
+}
+
+
+
+Java.perform(function() {
+ var packageName = getPackageName();
+ console.log("在https双向认证的情况下，dump客户端证书为p12. 存储位置:/data/user/0/"+packageName+"/client_keystore_{nowtime}.p12 证书密码: hooker");
+ Java.use("java.security.KeyStore$PrivateKeyEntry").getPrivateKey.implementation = function() {
+ var executor = this.hashCode();
+ var beatText = 'public java.security.cert.Certificate java.security.KeyStore$PrivateKeyEntry.getPrivateKey()';
+ var beat = newMethodBeat(beatText, executor);
+ var result = this.getPrivateKey();
+ let filePath = '/data/user/0/' + packageName + "/client_keystore_" + "_" + getNowTime() + '.p12';
+ dump2sdcard(this.getPrivateKey(), this.getCertificate(), filePath);
+ printBeat(beat);
+ return result;
+ }
+ Java.use("java.security.KeyStore$PrivateKeyEntry").getCertificateChain.implementation = function() {
+ var executor = this.hashCode();
+ var beatText = 'public java.security.cert.Certificate java.security.KeyStore$PrivateKeyEntry.getCertificate()';
+ var beat = newMethodBeat(beatText, executor);
+ var result = this.getCertificateChain();
+ let filePath = '/data/user/0/' + packageName + "/client_keystore_" + getNowTime() + '.p12';
+ dump2sdcard(this.getPrivateKey(), this.getCertificate(), filePath);
+ return result;
+ }
+})
diff --git a/com.blockchainvault/kill b/com.blockchainvault/kill
new file mode 100755
index 0000000..1f8f766
--- /dev/null
+++ b/com.blockchainvault/kill
@@ -0,0 +1,3 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+frida-kill $HOOKER_DRIVER com.blockchainvault
\ No newline at end of file
diff --git a/com.blockchainvault/object_store.js b/com.blockchainvault/object_store.js
new file mode 100644
index 0000000..cc4181d
--- /dev/null
+++ b/com.blockchainvault/object_store.js
@@ -0,0 +1,61 @@
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ });
+};
+
+loadDexfile('/data/user/0/com.blockchainvault/radar.dex');
+
+
+function log(str) {
+ console.log(str);
+};
+
+function getBaseContext() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context; //Java.scheduleOnMainThread(fn):
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while (new Date().getTime() < startTime) {}
+};
+
+function fastTojson(javaObject) {
+ var JSONClz = Java.use("gz.com.alibaba.fastjson.JSON");
+ return JSONClz.toJSONString(javaObject);
+};
+
+function object2Json(objectId) {
+ var radarPropertiesClz = Java.use("gz.radar.objects.ObjectsStore");
+ var obj = radarPropertiesClz.getObject(objectId+"");
+ if (obj) {
+ log(fastTojson(obj));
+ }else{
+ log("Not found this object.");
+ }
+}
+
+function object2String(objectId) {
+ var radarPropertiesClz = Java.use("gz.radar.objects.ObjectsStore");
+ var obj = radarPropertiesClz.getObject(objectId+"");
+ if (obj) {
+ log(obj.toString());
+ }else{
+ log("Not found this object.");
+ }
+}
+
+function getObject(objectId) {
+ var radarPropertiesClz = Java.use("gz.radar.objects.ObjectsStore");
+ var obj = radarPropertiesClz.getObject(objectId+"");
+ return obj;
+}
+
+
+function getField(javaObject, fieldName) {
+ var X = Java.use("gz.util.X");
+ return X.getField(javaObject, fieldName);
+};
+
diff --git a/com.blockchainvault/objection b/com.blockchainvault/objection
new file mode 100755
index 0000000..a073f6b
--- /dev/null
+++ b/com.blockchainvault/objection
@@ -0,0 +1,3 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+objection -d -g com.blockchainvault explore
\ No newline at end of file
diff --git a/com.blockchainvault/spawn b/com.blockchainvault/spawn
new file mode 100755
index 0000000..ad0fbca
--- /dev/null
+++ b/com.blockchainvault/spawn
@@ -0,0 +1,4 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+
+frida $HOOKER_DRIVER --no-pause -f com.blockchainvault -l $1
\ No newline at end of file
diff --git a/com.blockchainvault/spider.py b/com.blockchainvault/spider.py
new file mode 100644
index 0000000..77ef6bb
--- /dev/null
+++ b/com.blockchainvault/spider.py
@@ -0,0 +1,97 @@
+import frida
+import os
+import io
+import traceback
+import time
+
+def withColor(string, fg, bg=49):
+ print("\33[0m\33[%d;%dm%s\33[0m" % (fg, bg, string))
+
+Red = 1
+Green = 2
+Yellow = 3
+Blue = 4
+Magenta = 5
+Cyan = 6
+White = 7
+
+def red(string):
+ return withColor(string, Red+30) # Red
+def yellow(string):
+ return withColor(string, Yellow+30) # Yellow
+
+warn = red
+info = yellow
+
+jscode = io.open('wxspider.js', 'r', encoding= 'utf8').read()
+
+jscode += """
+rpc.exports = {
+ log: function(str) {
+ console.log(str);
+ },
+};
+"""
+
+def runCommand(cmd):
+ print(cmd);
+ lines = os.popen(cmd).readlines();
+ for line in lines:
+ print(line);
+
+def on_message(message, data):
+ pass
+
+def attach(packageName, hookerDriverFridaServer, runningTime):
+ hasException = False
+ online_session = None
+ online_script = None
+ try:
+ rdev = frida.get_device_manager().add_remote_device(hookerDriverFridaServer)
+ online_session = rdev.attach(packageName)
+ if online_session == None:
+ warn("attaching fail to " + packageName)
+ online_script = online_session.create_script(jscode)
+ online_script.on('message', on_message)
+ online_script.load()
+ for i in range(1, runningTime):
+ if i % 2 == 0:
+ online_script.exports.log(mobileIP + " spider has running been " + str(i) + " seconds.");
+ time.sleep(1)
+ except Exception:
+ hasException = True
+ warn(traceback.format_exc())
+ finally:
+ if online_session != None and hasException == False:
+ online_session.detach()
+ return online_session,online_script
+
+def restartApp(packageName, mobileIP, adb):
+ try:
+ runCommand(adb + " connect "+mobileIP);
+ time.sleep(3)
+ runCommand(adb + " -s "+mobileIP+" shell am force-stop " + appPackageName);
+ time.sleep(5)
+ runCommand(adb + " -s "+mobileIP+" shell am start " + appPackageName + "/" + mainActivity);
+ time.sleep(20)
+ runCommand(adb + " disconnect "+mobileIP);
+ except Exception:
+ warn(traceback.format_exc())
+
+appPackageName = "com.tencent.mm"
+mainActivity = "com.tencent.mm.ui.LauncherUI"
+#手机ip
+mobileIP = "192.168.0.102"
+#重启周期 秒
+runningTime = 3600
+
+adb="adb"
+
+while True:
+ restartApp(appPackageName, mobileIP, adb)
+ print("inject spider.js");
+ print(jscode);
+ attach(appPackageName, mobileIP + ":27042", runningTime)
+ print("restarting spider.", appPackageName, mainActivity, mobileIP, runningTime)
+
+
\ No newline at end of file
diff --git a/com.blockchainvault/ssl_log.js b/com.blockchainvault/ssl_log.js
new file mode 100644
index 0000000..69eff81
--- /dev/null
+++ b/com.blockchainvault/ssl_log.js
@@ -0,0 +1,21 @@
+function startTLSKeyLogger() {
+
+ const SSL_CTX_new_addr = Module.findExportByName('libssl.so', 'SSL_CTX_new');
+ const SSL_CTX_set_keylog_callback_addr = Module.findExportByName('libssl.so', 'SSL_CTX_set_keylog_callback');
+
+
+ const keyLogCallback = new NativeCallback(function (ssl, line) {
+ console.log(new NativePointer(line).readCString());
+ }, 'void', ['pointer', 'pointer']);
+
+ const SSL_CTX_set_keylog_callbackFn = new NativeFunction(SSL_CTX_set_keylog_callback_addr, 'void', ['pointer', 'pointer']);
+
+ Interceptor.attach(SSL_CTX_new_addr, {
+ onLeave: function(retval) {
+ const ssl = new NativePointer(retval);
+ SSL_CTX_set_keylog_callbackFn(ssl, keyLogCallback);
+ }
+ });
+}
+
+startTLSKeyLogger();
\ No newline at end of file
diff --git a/com.blockchainvault/text_view.js b/com.blockchainvault/text_view.js
new file mode 100644
index 0000000..84f1c7e
--- /dev/null
+++ b/com.blockchainvault/text_view.js
@@ -0,0 +1,50 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ var str = ("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id:" + currentThread.getId() +",name:" + currentThread.getName() + "),timestamp:" + startTime+"---------------\n");
+ str += methodName + "\n";
+ str += stackInfo.substring(20);
+ str += ("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+ console.log(str);
+};
+
+Java.perform(function() {
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var textViewClz = Java.use("android.widget.TextView");
+
+ if (textViewClz.setText) {
+ var setTextFunc = textViewClz.setText.overload("java.lang.CharSequence");
+ setTextFunc.implementation = function(v0) {
+ var startTime = new Date().getTime();
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("TextViewClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text:" + v0);
+ setTextFunc.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, "android.widget.TextView.setText()", executor);
+ };
+ }
+ if (textViewClz.getText) {
+ var getTextFunc = textViewClz.getText.overload();
+ getTextFunc.implementation = function() {
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ var editable = getTextFunc.call(this);
+ console.log("TextViewClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text: " + editable.toString());
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, "android.widget.TextView.getText()", executor);
+ return editable;
+ };
+ }
+});
\ No newline at end of file
diff --git a/com.blockchainvault/url.js b/com.blockchainvault/url.js
new file mode 100644
index 0000000..ecd954b
--- /dev/null
+++ b/com.blockchainvault/url.js
@@ -0,0 +1,132 @@
+function tryGetClass(className) {
+ var clz = undefined;
+ try {
+ clz = Java.use(className);
+ } catch(e) {}
+ return clz;
+}
+
+function newMethodBeat(text, executor) {
+ var threadClz = Java.use("java.lang.Thread");
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var currentThread = threadClz.currentThread();
+ var beat = new Object();
+ beat.invokeId = Math.random().toString(36).slice( - 8);
+ beat.executor = executor;
+ beat.threadId = currentThread.getId();
+ beat.threadName = currentThread.getName();
+ beat.text = text;
+ beat.startTime = new Date().getTime();
+ beat.stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new()).substring(20);
+ return beat;
+};
+
+function printBeat(beat) {
+ var str = ("------------startFlag:" + beat.invokeId + ",objectHash:" + beat.executor + ",thread(id:" + beat.threadId + ",name:" + beat.threadName + "),timestamp:" + beat.startTime + "---------------\n");
+ str += beat.text + "\n";
+ str += beat.stackInfo;
+ str += ("------------endFlag:" + beat.invokeId + ",usedtime:" + (new Date().getTime() - beat.startTime) + "---------------\n");
+ console.log(str);
+};
+
+var containRegExps = new Array()
+
+var notContainRegExps = new Array(RegExp(/\.jpg/), RegExp(/\.png/))
+
+function check(str) {
+ str = str.toString();
+ if (! (str && str.match)) {
+ return false;
+ }
+ for (var i = 0; i < containRegExps.length; i++) {
+ if (!str.match(containRegExps[i])) {
+ return false;
+ }
+ }
+ for (var i = 0; i < notContainRegExps.length; i++) {
+ if (str.match(notContainRegExps[i])) {
+ return false;
+ }
+ }
+ return true;
+}
+
+Java.perform(function() {
+ var uriParseClz = Java.use('java.net.URI');
+ var uriParseClzConstruct = uriParseClz.$init.overload("java.lang.String");
+ uriParseClzConstruct.implementation = function(url) {
+ var result = uriParseClzConstruct.call(this, url);
+ var executor = this.hashCode();
+ var beatText = "url:" + url + "\npublic java.net.URI(String)";
+ var beat = newMethodBeat(beatText, executor);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return result;
+ };
+
+ // URL
+ var URLClz = Java.use('java.net.URL');
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var urlConstruct = URLClz.$init.overload("java.lang.String");
+ urlConstruct.implementation = function(url) {
+ var result = urlConstruct.call(this, url);
+ var executor = this.hashCode();
+ var beatText = "url:" + url + "\npublic java.net.URL(String)";
+ var beat = newMethodBeat(beatText, executor);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return result;
+ };
+
+ //ok系统原生支持
+ var sysBuilderClz = tryGetClass('com.android.okhttp.Request$Builder');
+ if (sysBuilderClz) {
+ sysBuilderClz.build.implementation = function() {
+ var okRequestResult = this.build();
+ var httpUrl = okRequestResult.url();
+ var url = httpUrl.toString();
+ var executor = this.hashCode();
+ var beatText = "url:" + url + "\ncom.android.okhttp.Request.Builder.build()";
+ var beat = newMethodBeat(beatText, executor);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return okRequestResult
+ };
+ }
+
+ //ok本地依赖
+ var builderClz = tryGetClass('okhttp3.Request$Builder');
+ if (builderClz) {
+ var buildFunc = builderClz.build.overload();
+ buildFunc.implementation = function() {
+ var okRequestResult = buildFunc.call(this);
+ var httpUrl = okRequestResult.url();
+ var url = httpUrl.toString();
+ var executor = this.hashCode();
+ var beatText = "url:" + url + "\nokhttp3.Request.Builder.build()";
+ var beat = newMethodBeat(beatText, executor);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return okRequestResult
+ };
+ }
+
+ var android_net_Uri_clz = Java.use('android.net.Uri');
+ var android_net_Uri_clz_method_parse_u5rj = android_net_Uri_clz.parse.overload('java.lang.String');
+ android_net_Uri_clz_method_parse_u5rj.implementation = function(url) {
+ var executor = 'Class';
+ var beatText = url + '\npublic static android.net.Uri android.net.Uri.parse(java.lang.String)';
+ var beat = newMethodBeat(beatText, executor);
+ var ret = android_net_Uri_clz_method_parse_u5rj.call(android_net_Uri_clz, url);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return ret;
+ };
+});
\ No newline at end of file
diff --git a/com.blockchainvault/xinitdeploy b/com.blockchainvault/xinitdeploy
new file mode 100755
index 0000000..05e9fd6
--- /dev/null
+++ b/com.blockchainvault/xinitdeploy
@@ -0,0 +1,175 @@
+#! /Library/Frameworks/Python.framework/Versions/3.8/bin/python3
+
+import frida
+import os
+import io
+import traceback
+import base64
+import platform
+
+def withColor(string, fg, bg=49):
+ print("\33[0m\33[%d;%dm%s\33[0m" % (fg, bg, string))
+
+Red = 1
+Green = 2
+Yellow = 3
+Blue = 4
+Magenta = 5
+Cyan = 6
+White = 7
+
+def red(string):
+ return withColor(string, Red+30) # Red
+def yellow(string):
+ return withColor(string, Yellow+30) # Yellow
+
+warn = red
+info = yellow
+
+rpc_jscode = """
+function mkdirs(dirpath) {
+ var FileClz = Java.use("java.io.File");
+ var file = FileClz.$new(dirpath);
+ if (!file.exists()) {
+ file.mkdirs();
+ }
+}
+
+function writeFileAsBase64Content(filepath, base64) {
+ try {
+ var FileUtilsClz = Java.use("android.os.FileUtils");
+ var StringClz = Java.use('java.lang.String');
+ var Base64Clz = Java.use("android.util.Base64");
+ var ByteArrayInputStreamClz = Java.use("java.io.ByteArrayInputStream");
+ var FileOutputStreamClz = Java.use("java.io.FileOutputStream");
+ var FileClz = Java.use("java.io.File");
+ var distFilepath = FileClz.$new(filepath);
+ mkdirs(distFilepath.getParent());
+ var javaBase64String = StringClz.$new(base64);
+ var getBytesMehtod = StringClz.getBytes.overload('java.lang.String');
+ var bytes = getBytesMehtod.call(javaBase64String, 'UTF-8');
+ var decodeMethod = Base64Clz.decode.overload('[B', 'int');
+ var originalBinary = decodeMethod.call(Base64Clz, bytes, 0);
+ var bais = ByteArrayInputStreamClz.$new(originalBinary);
+ if (FileUtilsClz.copy) {
+ var copyMehtod = FileUtilsClz.copy.overload('java.io.InputStream', 'java.io.OutputStream');
+ var fos = FileOutputStreamClz.$new(distFilepath);
+ copyMehtod.call(FileUtilsClz, bais, fos);
+ } else if (FileUtilsClz.copyToFile) {
+ var copyMehtod = FileUtilsClz.copyToFile.overload('java.io.InputStream', 'java.io.File');
+ copyMehtod.call(FileUtilsClz, bais, distFilepath);
+ }
+ } catch(err) {
+ console.warn(err);
+ }
+};
+
+function checkFile(filepath, checkLength) {
+ var FileClz = Java.use("java.io.File");
+ var file = FileClz.$new(filepath);
+ return file.exists() && file.length() == checkLength;
+};
+
+rpc.exports = {
+ write: function(filename, contentAsBase64) {
+ Java.perform(function() {
+ //console.log(contentAsBase64);
+ writeFileAsBase64Content(filename, contentAsBase64);
+ });
+ },
+ checkfile: function(filename, filelength) {
+ var ret = false;
+ Java.perform(function() {
+ ret = checkFile(filename, filelength);
+ });
+ return ret;
+ },
+};
+
+"""
+
+def getHookerDriverHost():
+ try:
+ hookerDriver = io.open('../.hooker_driver', 'r', encoding= 'utf8').read()
+ hookerDriver = hookerDriver.replace("-H", "").strip()
+ return hookerDriver
+ except Exception:
+ return "-U"
+
+class XinitFile:
+ def __init__(self, filename, filepath):
+ self.filename = filename
+ self.filepath = filepath
+
+ def fileData(self):
+ fopen = open(self.filepath,"rb")
+ data = fopen.read()
+ fopen.close()
+ return data
+
+def readXinitFiles():
+ xinitFiles = []
+ if not os.path.exists("./xinit"):
+ return xinitFiles
+ allFiles = os.listdir("./xinit")
+ for filename in allFiles:
+ filepath = "./xinit/" + filename
+ if os.path.isdir(filepath):
+ continue
+ xinitFile = XinitFile(filename, filepath)
+ xinitFiles.append(xinitFile)
+ return xinitFiles
+
+def on_message(message, data):
+ pass
+
+def attach(packageName):
+ online_session = None
+ online_script = None
+ hookerDriver = getHookerDriverHost()
+ try:
+ if hookerDriver != "-U":
+ rdev = frida.get_device_manager().add_remote_device(hookerDriver)
+ elif platform.system().find("Windows") != -1:
+ warn("推荐使用linux或mac操作系统获得更好的兼容性.")
+ rdev = frida.get_remote_device()
+ else:
+ rdev = frida.get_usb_device(1000)
+ online_session = rdev.attach(packageName)
+ if online_session == None:
+ warn("attaching fail to " + packageName)
+ online_script = online_session.create_script(rpc_jscode)
+ online_script.on('message', on_message)
+ online_script.load()
+ except Exception:
+ warn(traceback.format_exc())
+ return online_session,online_script
+
+
+def detach(online_session):
+ if online_session != None:
+ online_session.detach()
+
+
+def xinitDeploy(packageName):
+ xinitFiles = readXinitFiles()
+ if xinitFiles == None or len(xinitFiles) == 0:
+ warn("deploying aborted. because not found any file in the path xinit.")
+ return
+ online_session = None
+ online_script = None
+ try:
+ online_session,online_script = attach(packageName);
+ for xinitFile in xinitFiles:
+ dataBase64 = base64.b64encode(xinitFile.fileData()).decode()
+ distPath = "/data/user/0/" + packageName + "/xinit/" + xinitFile.filename
+ info("copying " + xinitFile.filename + " to that path " + distPath + ".")
+ online_script.exports.write(distPath, dataBase64)
+ info("deploying xinit finished.")
+ except Exception:
+ warn("deploying xinit failure.")
+ warn(traceback.format_exc())
+ finally:
+ detach(online_session)
+
+xinitDeploy('com.blockchainvault')
\ No newline at end of file
diff --git a/com.cubic.autohome/activity_events.js b/com.cubic.autohome/activity_events.js
new file mode 100644
index 0000000..4ddb9e5
--- /dev/null
+++ b/com.cubic.autohome/activity_events.js
@@ -0,0 +1,170 @@
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ });
+};
+
+function checkLoadDex(className, dexfile) {
+ Java.perform(function() {
+ if (!classExists(className)) {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ }
+ });
+};
+
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+function getClassName(obj) {
+ if (obj.getClass) {
+ return obj.getClass().getName();
+ }
+ var javaObject = Java.use("java.lang.Object");
+ return Java.cast(obj, javaObject).getClass().getName();
+}
+
+//str1是否包含str2，str2可用正则表示
+function contains(str1, str2) {
+ var reg = RegExp(eval("/"+str2+"/"));
+ if(str1 && str1.match && str1.match(reg)){
+ return true;
+ }else{
+ return false;
+ }
+};
+
+//创建ArrayList对象用这个方法就好了
+function newArrayList() {
+ var ArrayListClz = Java.use('java.util.ArrayList');
+ return ArrayListClz.$new();
+}
+
+//创建HashSet对象用这个方法就好了
+function newHashSet() {
+ var HashSetClz = Java.use('java.util.HashSet');
+ return HashSetClz.$new();
+}
+
+//创建HashMap对象用这个方法就好了
+function newHashMap() {
+ var HashMapClz = Java.use('java.util.HashMap');
+ return HashMapClz.$new();
+}
+
+function newMethodBeat(text, executor) {
+ var threadClz = Java.use("java.lang.Thread");
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var currentThread = threadClz.currentThread();
+ var beat = new Object();
+ beat.invokeId = Math.random().toString(36).slice( - 8);
+ beat.executor = executor;
+ beat.threadId = currentThread.getId();
+ beat.threadName = currentThread.getName();
+ beat.text = text;
+ beat.startTime = new Date().getTime();
+ beat.stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new()).substring(20);
+ return beat;
+};
+
+function printBeat(beat) {
+ var str = ("------------startFlag:" + beat.invokeId + ",objectHash:"+beat.executor+",thread(id:" + beat.threadId +",name:" + beat.threadName + "),timestamp:" + beat.startTime+"---------------\n");
+ str += beat.text + "\n";
+ str += beat.stackInfo;
+ str += ("------------endFlag:" + beat.invokeId + ",usedtime:" + (new Date().getTime() - beat.startTime) +"---------------\n");
+ console.log(str);
+};
+
+function log(str) {
+ console.log(str);
+};
+
+//虽然我们习惯用fastjson一行将对象转成json字符串，但是Android Library里面自带了一个gson可以做到 只是sdk没有暴露出来，很多人不知道。在frida中所有代码都是透明的，你随便调......
+function toJson(javaObject) {
+ var gsonClz = Java.use("com.google.gson.Gson");
+ var toJsonMethod = gsonClz.toJson.overload("java.lang.Object");
+ return toJsonMethod.call(gsonClz.$new(),javaObject);
+};
+
+function getBaseContext() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context; //Java.scheduleOnMainThread(fn):
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while(new Date().getTime() < startTime) {}
+};
+
+function fastTojson(javaObject) {
+ var JSONClz = Java.use("gz.com.alibaba.fastjson.JSON");
+ return JSONClz.toJSONString(javaObject);
+};
+
+loadDexfile('/data/user/0/com.cubic.autohome/radar.dex');
+
+Java.perform(function() {
+ var radarAndroidClz = Java.use("gz.radar.Android");
+ var android_content_ContextWrapper_clz = Java.use('android.content.ContextWrapper');
+ var android_content_ContextWrapper_clz_method_startActivity_r7jq = android_content_ContextWrapper_clz.startActivity.overload('android.content.Intent', 'android.os.Bundle');
+ android_content_ContextWrapper_clz_method_startActivity_r7jq.implementation = function(v0, v1) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ log("Bundle>>>>>>>"+radarAndroidClz.getBundleProfile(v1));
+ var executor = this.hashCode();
+ var beatText = 'public void android.content.ContextWrapper.startActivity(android.content.Intent,android.os.Bundle)';
+ var beat = newMethodBeat(beatText, executor);
+ android_content_ContextWrapper_clz_method_startActivity_r7jq.call(this, v0, v1);
+ printBeat(beat);
+ };
+ var android_content_ContextWrapper_clz_method_startActivity_auep = android_content_ContextWrapper_clz.startActivity.overload('android.content.Intent');
+ android_content_ContextWrapper_clz_method_startActivity_auep.implementation = function(v0) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ var executor = this.hashCode();
+ var beatText = 'public void android.content.ContextWrapper.startActivity(android.content.Intent)';
+ var beat = newMethodBeat(beatText, executor);
+ android_content_ContextWrapper_clz_method_startActivity_auep.call(this, v0);
+ printBeat(beat);
+ };
+ var android_content_ContextWrapper_clz_method_startActivityAsUser_adh6 = android_content_ContextWrapper_clz.startActivityAsUser.overload('android.content.Intent', 'android.os.UserHandle');
+ android_content_ContextWrapper_clz_method_startActivityAsUser_adh6.implementation = function(v0, v1) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ var executor = this.hashCode();
+ var beatText = 'public void android.content.ContextWrapper.startActivityAsUser(android.content.Intent,android.os.UserHandle)';
+ var beat = newMethodBeat(beatText, executor);
+ android_content_ContextWrapper_clz_method_startActivityAsUser_adh6.call(this, v0, v1);
+ printBeat(beat);
+ };
+ var android_content_ContextWrapper_clz_method_startActivityAsUser_ilkk = android_content_ContextWrapper_clz.startActivityAsUser.overload('android.content.Intent', 'android.os.Bundle', 'android.os.UserHandle');
+ android_content_ContextWrapper_clz_method_startActivityAsUser_ilkk.implementation = function(v0, v1, v2) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ log("Bundle>>>>>>>"+radarAndroidClz.getBundleProfile(v1));
+ var executor = this.hashCode();
+ var beatText = 'public void android.content.ContextWrapper.startActivityAsUser(android.content.Intent,android.os.Bundle,android.os.UserHandle)';
+ var beat = newMethodBeat(beatText, executor);
+ android_content_ContextWrapper_clz_method_startActivityAsUser_ilkk.call(this, v0, v1, v2);
+ printBeat(beat);
+ };
+ var android_app_Activity_clz = Java.use('android.app.Activity');
+ var android_app_Activity_clz_method_startActivityForResult_6mkb = android_app_Activity_clz.startActivityForResult.overload('android.content.Intent', 'int', 'android.os.Bundle');
+ android_app_Activity_clz_method_startActivityForResult_6mkb.implementation = function(v0, v1, v2) {
+ log("Intent>>>>>>>"+radarAndroidClz.getIntentProfile(v0));
+ log("Flags>>>>>>>"+v1);
+ log("Bundle>>>>>>>"+radarAndroidClz.getBundleProfile(v2));
+ var executor = this.hashCode();
+ var beatText = 'public void android.app.Activity.startActivityForResult(android.content.Intent,int,android.os.Bundle)';
+ var beat = newMethodBeat(beatText, executor);
+ android_app_Activity_clz_method_startActivityForResult_6mkb.call(this, v0, v1, v2);
+ printBeat(beat);
+ };
+});
\ No newline at end of file
diff --git a/com.cubic.autohome/android_ui.js b/com.cubic.autohome/android_ui.js
new file mode 100644
index 0000000..8b3a0be
--- /dev/null
+++ b/com.cubic.autohome/android_ui.js
@@ -0,0 +1,194 @@
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ });
+};
+
+function checkLoadDex(className, dexfile) {
+ Java.perform(function() {
+ if (!classExists(className)) {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ }
+ });
+};
+loadDexfile('/data/user/0/com.cubic.autohome/radar.dex');
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+function getClassName(obj) {
+ if (obj.getClass) {
+ return obj.getClass().getName();
+ }
+ var javaObject = Java.use("java.lang.Object");
+ return Java.cast(obj, javaObject).getClass().getName();
+}
+
+//str1是否包含str2，str2可用正则表示
+function contains(str1, str2) {
+ var reg = RegExp(eval("/" + str2 + "/"));
+ if (str1 && str1.match && str1.match(reg)) {
+ return true;
+ } else {
+ return false;
+ }
+};
+
+//创建ArrayList对象用这个方法就好了
+function newArrayList() {
+ var ArrayListClz = Java.use('java.util.ArrayList');
+ return ArrayListClz.$new();
+}
+
+//创建HashSet对象用这个方法就好了
+function newHashSet() {
+ var HashSetClz = Java.use('java.util.HashSet');
+ return HashSetClz.$new();
+}
+
+//创建HashMap对象用这个方法就好了
+function newHashMap() {
+ var HashMapClz = Java.use('java.util.HashMap');
+ return HashMapClz.$new();
+}
+
+function log(str) {
+ console.log(str);
+};
+
+//虽然我们习惯用fastjson一行将对象转成json字符串，但是Android Library里面自带了一个gson可以做到 只是sdk没有暴露出来，很多人不知道。在frida中所有代码都是透明的，你随便调......
+function toJson(javaObject) {
+ var gsonClz = Java.use("com.google.gson.Gson");
+ var toJsonMethod = gsonClz.toJson.overload("java.lang.Object");
+ return toJsonMethod.call(gsonClz.$new(), javaObject);
+};
+
+function getBaseContext() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context; //Java.scheduleOnMainThread(fn):
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while (new Date().getTime() < startTime) {}
+};
+
+function fastTojson(javaObject) {
+ var JSONClz = Java.use("gz.com.alibaba.fastjson.JSON");
+ return JSONClz.toJSONString(javaObject);
+};
+
+function findViewById(viewId) {
+ var report = "";
+ Java.perform(function() {
+ var radarAndroidClz = Java.use("gz.radar.Android");
+ var viewInfo = radarAndroidClz.getViewInfo(viewId + "");
+ if (!viewInfo) {
+ report += "Not Found View."
+ return;
+ }
+ report += ("------------------View--------------------") + "\n";
+ report += ("View Id: " + viewInfo.getViewId()) + "\n";
+ report += ("View IdName: " + viewInfo.getViewIdName()) + "\n";
+ report += ("View Class: " + viewInfo.getName()) + "\n";
+ report += ("View SuperClass: " + viewInfo.getSuperClazz()) + "\n";
+ report += ("View ImplementInterfaces: " + viewInfo.getImplementInterfaces()) + "\n";
+ var androidApkFields = viewInfo.getAndroidApkFields();
+ report += ("View Fields: " + androidApkFields.length) + "\n";
+ for (var j = 0; j < androidApkFields.length; j++) {
+ report += ("\t" + androidApkFields[j].toLine()) + "\n";
+ }
+ var methods = viewInfo.methods();
+ report += ("View Methods: " + methods.length) + "\n";
+ for (var j = 0; j < methods.length; j++) {
+ report += ("\t" + methods[j]) + "\n";
+ }
+ });
+ log(report);
+}
+
+function startActivity(activityName) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.startActivity(activityName);
+ });
+}
+
+function contextStartActivity(activityName) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.contextStartActivity(activityName);
+ });
+}
+
+function contextStartActivityForNewTask(activityName) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.contextStartActivityForNewTask(activityName);
+ });
+}
+
+function topActivityStartActivity(activityName) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.topActivityStartActivity(activityName);
+ });
+}
+
+function home() {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.home();
+ });
+}
+
+function back() {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.back();
+ });
+}
+
+function finishCurrentActivity() {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ androidUIClz.finishCurrentActivity();
+ });
+}
+
+function clickByText(text) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ log(androidUIClz.clickByText(text));
+ });
+}
+
+function clickById(id) {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ log(androidUIClz.clickById(id));
+ });
+}
+
+function hover(x,y,upStepLength) {
+ Java.perform(function() {
+ var androidui = Java.use("gz.radar.AndroidUI");
+ androidui.hover(x,y,upStepLength);
+ });
+}
+
+function viewTree() {
+ Java.perform(function() {
+ var androidUIClz = Java.use("gz.radar.AndroidUI");
+ log(androidUIClz.viewTree());
+ });
+}
\ No newline at end of file
diff --git a/com.cubic.autohome/attach b/com.cubic.autohome/attach
new file mode 100755
index 0000000..8906a80
--- /dev/null
+++ b/com.cubic.autohome/attach
@@ -0,0 +1,3 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+frida $HOOKER_DRIVER -l $1 com.cubic.autohome
\ No newline at end of file
diff --git a/com.cubic.autohome/click.js b/com.cubic.autohome/click.js
new file mode 100644
index 0000000..501045c
--- /dev/null
+++ b/com.cubic.autohome/click.js
@@ -0,0 +1,49 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ var str = ("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id:" + currentThread.getId() +",name:" + currentThread.getName() + "),timestamp:" + startTime+"---------------\n");
+ str += methodName + "\n";
+ str += stackInfo.substring(20);
+ str += ("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+ console.log(str);
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while (new Date().getTime() < startTime) {}
+};
+
+function makeClass(className) {
+ var classClz = Java.use("java.lang.Class");
+ var forNameFunc = classClz.forName.overload("java.lang.String");
+ return forNameFunc.call(classClz, className);
+};
+
+function isClass(obj, superClzName) {
+ var objClz = obj.getClass();
+ var superClz = makeClass(superClzName);
+ return superClz.isAssignableFrom(objClz);
+};
+
+Java.perform(function() {
+ var textViewClz = Java.use("android.widget.TextView");
+ var android_view_View_clz = Java.use('android.view.View');
+ var android_view_View_clz_method_performClick_u6ef = android_view_View_clz.performClick.overload();
+ android_view_View_clz_method_performClick_u6ef.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'obj:' + this.hashCode();
+ var ret = android_view_View_clz_method_performClick_u6ef.call(this);
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ //console.log("ViewText: " + Java.cast(this, textViewClz).getText());
+ console.log("ViewClz: " + clz);
+ console.log("ViewId: " + viewId);
+ methodInBeat(invokeId, startTime, 'public boolean android.view.View.performClick()', executor);
+ return ret;
+ };
+});
\ No newline at end of file
diff --git a/com.cubic.autohome/edit_text.js b/com.cubic.autohome/edit_text.js
new file mode 100644
index 0000000..ec2c5ba
--- /dev/null
+++ b/com.cubic.autohome/edit_text.js
@@ -0,0 +1,97 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ var str = ("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id:" + currentThread.getId() +",name:" + currentThread.getName() + "),timestamp:" + startTime+"---------------\n");
+ str += methodName + "\n";
+ str += stackInfo.substring(20);
+ str += ("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+ console.log(str);
+};
+
+function makeClass(className) {
+ var classClz = Java.use("java.lang.Class");
+ var forNameFunc = classClz.forName.overload("java.lang.String");
+ return forNameFunc.call(classClz, className);
+};
+
+function isClass(obj, superClzName) {
+ var objClz = obj.getClass();
+ var superClz = makeClass(superClzName);
+ return superClz.isAssignableFrom(objClz);
+};
+
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+Java.perform(function() {
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var textViewClz = Java.use("android.widget.TextView");
+ var charSequenceClz = Java.use("java.lang.CharSequence");
+ if (textViewClz.setText) {
+ var setTextFunc = textViewClz.setText.overload("java.lang.CharSequence");
+ setTextFunc.implementation = function(v0) {
+ var startTime = new Date().getTime();
+ setTextFunc.call(this, v0);
+ if (isClass(this, "android.widget.EditText")) {
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("EditTextClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("text: " + v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'android.widget.EditText.setText()', executor);
+ }
+ };
+ }
+ //EditText的getText继承自TextView
+ if (textViewClz.getText) {
+ var getTextFunc = textViewClz.getText.overload();
+ getTextFunc.implementation = function() {
+ var startTime = new Date().getTime();
+ var editable = getTextFunc.call(this);
+ if (isClass(this, "android.widget.EditText")) {
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("EditTextClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text: " + Java.cast(editable, charSequenceClz));
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'android.widget.EditText.getText()', executor);
+ }
+ return editable;
+ };
+ }
+ //AppCompatEditText 有自定义的getText所以单独hook
+ if (classExists("androidx.appcompat.widget.AppCompatEditText")) {
+ var appCompatEditTextClz = Java.use("androidx.appcompat.widget.AppCompatEditText");
+ var appCompatEditTextClzGetTextFunc = appCompatEditTextClz.getText.overload();
+ appCompatEditTextClzGetTextFunc.implementation = function() {
+ var startTime = new Date().getTime();
+ var editable = appCompatEditTextClzGetTextFunc.call(this);
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("EditTextClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text: " + Java.cast(editable, charSequenceClz));
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'androidx.appcompat.widget.AppCompatEditText.getText()', executor);
+ return editable;
+ };
+ }
+});
\ No newline at end of file
diff --git a/com.cubic.autohome/hook_RN.js b/com.cubic.autohome/hook_RN.js
new file mode 100644
index 0000000..de44671
--- /dev/null
+++ b/com.cubic.autohome/hook_RN.js
@@ -0,0 +1,46 @@
+
+function hook_RegisterNatives() {
+ var symbols = Module.enumerateSymbolsSync("libart.so");
+ var addrRegisterNatives = null;
+ for (var i = 0; i < symbols.length; i++) {
+ var symbol = symbols[i];
+
+ //_ZN3art3JNI15RegisterNativesEP7_JNIEnvP7_jclassPK15JNINativeMethodi
+ if (symbol.name.indexOf("art") >= 0 &&
+ symbol.name.indexOf("JNI") >= 0 &&
+ symbol.name.indexOf("RegisterNatives") >= 0 &&
+ symbol.name.indexOf("CheckJNI") < 0) {
+ addrRegisterNatives = symbol.address;
+ console.log("RegisterNatives is at ", symbol.address, symbol.name);
+ }
+ }
+
+ if (addrRegisterNatives != null) {
+ Interceptor.attach(addrRegisterNatives, {
+ onEnter: function (args) {
+ console.log("[RegisterNatives] method_count:", args[3]);
+ var env = args[0];
+ var java_class = args[1];
+ var class_name = Java.vm.tryGetEnv().getClassName(java_class);
+ //console.log(class_name);
+
+ var methods_ptr = ptr(args[2]);
+
+ var method_count = parseInt(args[3]);
+ for (var i = 0; i < method_count; i++) {
+ var name_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3));
+ var sig_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize));
+ var fnPtr_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize * 2));
+
+ var name = Memory.readCString(name_ptr);
+ var sig = Memory.readCString(sig_ptr);
+ var find_module = Process.findModuleByAddress(fnPtr_ptr);
+ console.log("[RegisterNatives] java_class:", class_name, "name:", name, "sig:", sig, "fnPtr:", fnPtr_ptr, "module_name:", find_module.name, "module_base:", find_module.base, "offset:", ptr(fnPtr_ptr).sub(find_module.base));
+
+ }
+ }
+ });
+ }
+}
+
+setImmediate(hook_RegisterNatives);
diff --git a/com.cubic.autohome/hooking b/com.cubic.autohome/hooking
new file mode 100755
index 0000000..9a556dd
--- /dev/null
+++ b/com.cubic.autohome/hooking
@@ -0,0 +1,5 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+echo "hooking $1" > log
+date | tee -ai log
+frida $HOOKER_DRIVER -l $1 com.cubic.autohome | tee -ai log
\ No newline at end of file
diff --git a/com.cubic.autohome/java_util_Arrays_ArrayList_.js b/com.cubic.autohome/java_util_Arrays_ArrayList_.js
new file mode 100644
index 0000000..4d5fe49
--- /dev/null
+++ b/com.cubic.autohome/java_util_Arrays_ArrayList_.js
@@ -0,0 +1,165 @@
+//crack by com.cubic.autohome 10.19.0
+//java.util.Arrays$ArrayList:_
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ });
+};
+
+function checkLoadDex(className, dexfile) {
+ Java.perform(function() {
+ if (!classExists(className)) {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ }
+ });
+};
+
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+function getClassName(obj) {
+ if (obj.getClass) {
+ return obj.getClass().getName();
+ }
+ var javaObject = Java.use("java.lang.Object");
+ return Java.cast(obj, javaObject).getClass().getName();
+}
+
+//str1是否包含str2，str2可用正则表示
+function contains(str1, str2) {
+ var reg = RegExp(eval("/"+str2+"/"));
+ if(str1 && str1.match && str1.match(reg)){
+ return true;
+ }else{
+ return false;
+ }
+};
+
+//创建ArrayList对象用这个方法就好了
+function newArrayList() {
+ var ArrayListClz = Java.use('java.util.ArrayList');
+ return ArrayListClz.$new();
+}
+
+//创建HashSet对象用这个方法就好了
+function newHashSet() {
+ var HashSetClz = Java.use('java.util.HashSet');
+ return HashSetClz.$new();
+}
+
+//创建HashMap对象用这个方法就好了
+function newHashMap() {
+ var HashMapClz = Java.use('java.util.HashMap');
+ return HashMapClz.$new();
+}
+
+function newMethodBeat(text, executor) {
+ var threadClz = Java.use("java.lang.Thread");
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var processClz = Java.use("android.os.Process");
+ var currentThread = threadClz.currentThread();
+ var beat = new Object();
+ beat.invokeId = Math.random().toString(36).slice( - 8);
+ beat.executor = executor;
+ beat.myPid = processClz.myPid();
+ beat.threadId = currentThread.getId();
+ beat.threadName = currentThread.getName();
+ beat.text = text;
+ beat.startTime = new Date().getTime();
+ beat.stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new()).substring(20);
+ return beat;
+};
+
+function printBeat(beat) {
+ var str = ("------------pid:" + beat.myPid + ",startFlag:" + beat.invokeId + ",objectHash:"+beat.executor+",thread(id:" + beat.threadId +",name:" + beat.threadName + "),timestamp:" + beat.startTime+"---------------\n");
+ str += beat.text + "\n";
+ str += beat.stackInfo;
+ str += ("------------endFlag:" + beat.invokeId + ",usedtime:" + (new Date().getTime() - beat.startTime) +"---------------\n");
+ console.log(str);
+};
+
+var log = console.log;
+
+var print = console.log;
+
+function getBaseContext() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context; //Java.scheduleOnMainThread(fn):
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while(new Date().getTime() < startTime) {}
+};
+
+
+
+var loadedXRadar = false;
+
+function loadXinitDexfile(dexfile) {
+ loadDexfile('/data/user/0/com.cubic.autohome/xinit/'+dexfile);
+};
+
+function loadXRadarDexfile() {
+ loadedXRadar = true;
+ loadDexfile('/data/user/0/com.cubic.autohome/radar.dex');
+};
+
+function fastTojson(javaObject) {
+ var JSONClz = Java.use("gz.com.alibaba.fastjson.JSON");
+ return JSONClz.toJSONString(javaObject);
+};
+
+function getPrettyString(javaObject) {
+ var XPretty = Java.use("gz.util.XPretty");
+ return XPretty.getPrettyString(javaObject);
+};
+
+function xPretty(javaObject) {
+ var str = getPrettyString(javaObject);
+ console.log(str);
+};
+
+function getField(javaObject, fieldName) {
+ var X = Java.use("gz.util.X");
+ return X.getField(javaObject, fieldName);
+};
+
+function storeObjectAndLog(javaObject) {
+ try {
+ var className = getClassName(javaObject);
+ var ObjectsStore = Java.use("gz.radar.objects.ObjectsStore");
+ var objectId = ObjectsStore.storeObject(javaObject);
+ console.log(className + " ObjectsStoreId: " +objectId);
+ } catch (error) {
+ console.error("你传的不是一个有效的java对象!");
+ }
+};
+
+
+
+//java.util.Arrays$ArrayList:_
+Java.perform(function() {
+ var java_util_Arrays_ArrayList_clz = Java.use('java.util.Arrays$ArrayList');
+ var java_util_Arrays_ArrayList_clz_init_5784 = java_util_Arrays_ArrayList_clz.$init.overload('[Ljava.lang.Object;');
+ java_util_Arrays_ArrayList_clz_init_5784.implementation = function(v0) {
+ var executor = this.hashCode();
+ var beatText = 'java.util.Arrays$ArrayList(java.lang.Object[])';
+ var beat = newMethodBeat(beatText, executor);
+ var returnObj = java_util_Arrays_ArrayList_clz_init_5784.call(this, v0);
+ printBeat(beat);
+ return returnObj;
+ };
+});
\ No newline at end of file
diff --git a/com.cubic.autohome/just_trust_me.js b/com.cubic.autohome/just_trust_me.js
new file mode 100644
index 0000000..d990c32
--- /dev/null
+++ b/com.cubic.autohome/just_trust_me.js
@@ -0,0 +1,318 @@
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ //console.log("load " + dexfile);
+ });
+};
+
+var loadedXRadar = false;
+function loadXRadarDexfile() {
+ loadedXRadar = true;
+ loadDexfile('/data/user/0/com.cubic.autohome/radar.dex');
+};
+
+
+loadXRadarDexfile();
+
+function hasTrustManagerImpl() {
+ return classExists("com.android.org.conscrypt.TrustManagerImpl");
+}
+
+function newArrayList() {
+ var ArrayListClz = Java.use('java.util.ArrayList');
+ return ArrayListClz.$new();
+}
+
+
+function processOkHttp() {
+ //知道你为什么有时候用JustTrustMe失败吗，因为app代码混淆了下面这些类你改到对应的类和方法就行啦
+ if (classExists("com.squareup.okhttp.CertificatePinner")) {
+ var squareupOkhttp3CertificatePinnerClz = Java.use('com.squareup.okhttp.CertificatePinner');
+ var squareupOkhttp3CertificatePinnerClzCheck = squareupOkhttp3CertificatePinnerClz.check.overload('java.lang.String', 'java.util.List');
+ squareupOkhttp3CertificatePinnerClzCheck.implementation = function(v0, v1) {
+ //什么都不做
+ console.log("com.squareup.okhttp.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!");
+ };
+ }else{
+ console.error("没找到com.squareup.okhttp.CertificatePinner类，这是android系统自带的类没找到就算求了。不同系统不一样，不用找了!!!");
+ }
+
+ if (classExists("okhttp3.CertificatePinner")) {
+ try {
+ var okhttp3CertificatePinnerClz = Java.use('okhttp3.CertificatePinner');
+ var okhttp3CertificatePinnerClzCheck = okhttp3CertificatePinnerClz.check.overload('java.lang.String', 'java.util.List');
+ okhttp3CertificatePinnerClzCheck.implementation = function(v0, v1) {
+ //什么都不做
+ console.log("okhttp3.CertificatePinner.check('java.lang.String', 'java.util.List') was hooked!");
+ };
+ } catch (error) {
+ console.error("okhttp3.CertificatePinner的check方法可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+ }else{
+ console.error("没找到okhttp3.CertificatePinner类，可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+
+ if (classExists("okhttp3.internal.tls.OkHostnameVerifier")) {
+ try {
+ var OkHostnameVerifierClz = Java.use('okhttp3.internal.tls.OkHostnameVerifier');
+ var OkHostnameVerifierClzVerify_5791 = OkHostnameVerifierClz.verify.overload('java.lang.String', 'javax.net.ssl.SSLSession');
+ OkHostnameVerifierClzVerify_5791.implementation = function(v0, v1) {
+ //强制返回true
+ console.log("okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'javax.net.ssl.SSLSession') was hooked!");
+ return true;
+ };
+ var OkHostnameVerifierVerify_8978 = OkHostnameVerifierClz.verify.overload('java.lang.String', 'java.security.cert.X509Certificate');
+ OkHostnameVerifierVerify_8978.implementation = function(v0, v1) {
+ //强制返回true
+ console.log("okhttp3.internal.tls.OkHostnameVerifier.verify('java.lang.String', 'java.security.cert.X509Certificate') was hooked!");
+ return true;
+ };
+ } catch (error) {
+ console.error("okhttp3.internal.tls.OkHostnameVerifier的verify方法可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+ }else{
+ console.error("没找到okhttp3.internal.tls.OkHostnameVerifier类，可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+
+ if (classExists("okhttp3.OkHttpClient$Builder")) {
+ try{
+ var okhttp3_OkHttpClient_Builder_clz = Java.use('okhttp3.OkHttpClient$Builder');
+ var okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_one = okhttp3_OkHttpClient_Builder_clz.sslSocketFactory.overload('javax.net.ssl.SSLSocketFactory');
+ okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_one.implementation = function(sSLSocketFactory) {
+ //把参数替换成EmptySSLFactory
+ var ret = okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_one.call(this, Java.use("gz.justtrustme.Helper").getEmptySSLFactory());
+ return ret;
+ };
+ var okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_two = okhttp3_OkHttpClient_Builder_clz.sslSocketFactory.overload('javax.net.ssl.SSLSocketFactory', 'javax.net.ssl.X509TrustManager');
+ okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_two.implementation = function(sSLSocketFactory, x509TrustManager) {
+ //把参数替换成EmptySSLFactory
+ var ret = okhttp3_OkHttpClient_Builder_clz_sslSocketFactory_two.call(this, Java.use("gz.justtrustme.Helper").getEmptySSLFactory(), x509TrustManager);
+ return ret;
+ };
+ } catch(error) {
+ console.error("okhttp3.OkHttpClient$Builder的sslSocketFactory方法可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+ }else{
+ console.error("没找到okhttp3.OkHttpClient$Builder类，可能被混淆了。你可以jadx反编译下还原回来！");
+ }
+}
+
+
+function processXutils() {
+ if (classExists("org.xutils.http.RequestParams")) {
+ var RequestParamsClass = Java.use("org.xutils.http.RequestParams");
+ var RequestParamsClassSetSslSocketFactory = RequestParamsClass.setSslSocketFactory.overload('javax.net.ssl.SSLSocketFactory');
+ RequestParamsClassSetSslSocketFactory.implementation = function(v0) {
+ console.log("org.xutils.http.RequestParams.setSslSocketFactory('javax.net.ssl.SSLSocketFactory') was hooked!");
+ var Helper = Java.use("gz.justtrustme.Helper");
+ //替换javax.net.ssl.SSLSocketFactory参数为我们的EmptySSLFactory
+ RequestParamsClassSetSslSocketFactory.call(this, Helper.getEmptySSLFactory());
+ };
+ var RequestParamsClassSetHostnameVerifier = RequestParamsClass.setHostnameVerifier.overload('javax.net.ssl.HostnameVerifier');
+ RequestParamsClassSetHostnameVerifier.implementation = function(v0) {
+ console.log("org.xutils.http.RequestParams.setHostnameVerifier('javax.net.ssl.HostnameVerifier') was hooked!");
+ var ImSureItsLegitHostnameVerifier = Java.use("gz.justtrustme.ImSureItsLegitHostnameVerifier");
+ //替换javax.net.ssl.HostnameVerifier参数为我们的ImSureItsLegitHostnameVerifier
+ RequestParamsClassSetHostnameVerifier.call(this, ImSureItsLegitHostnameVerifier.$new());
+ };
+ }
+}
+
+function processHttpClientAndroidLib() {
+ if (classExists("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier")) {
+ var AbstractVerifierClass = Java.use("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier");
+ var OkHostnameVerifierClzVerify_5791 = AbstractVerifierClass.verify.overload('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;', 'boolean');
+ OkHostnameVerifierClzVerify_5791.implementation = function(v0, v1, v2, v3) {
+ //什么都不做
+ console.log("ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier.verify('java.lang.String', '[Ljava.lang.String;', '[Ljava.lang.String;', 'boolean') was hooked!");
+ };
+ }else{
+ console.error("没找到ch.boye.httpclientandroidlib.conn.ssl.AbstractVerifier类，但是这个类用的少。不用找了!");
+ }
+}
+
+//这是hooker添加的hook点，原JustTrustMe中没有的
+function processConscryptPlatform() {
+ if (!classExists("com.android.org.conscrypt.Platform")) {
+ return;
+ }
+ var com_android_org_conscrypt_Platform_clz = Java.use('com.android.org.conscrypt.Platform');
+ var com_android_org_conscrypt_Platform_clz_method_checkServerTrusted_9565 = com_android_org_conscrypt_Platform_clz.checkServerTrusted.overload('javax.net.ssl.X509TrustManager', '[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'com.android.org.conscrypt.OpenSSLEngineImpl');
+ com_android_org_conscrypt_Platform_clz_method_checkServerTrusted_9565.implementation = function(v0, v1, v2, v3) {
+ //什么都不做
+ };
+ var com_android_org_conscrypt_Platform_clz_method_checkServerTrusted_6928 = com_android_org_conscrypt_Platform_clz.checkServerTrusted.overload('javax.net.ssl.X509TrustManager', '[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'com.android.org.conscrypt.OpenSSLSocketImpl');
+ com_android_org_conscrypt_Platform_clz_method_checkServerTrusted_6928.implementation = function(v0, v1, v2, v3) {
+ //什么都不做
+ };
+}
+
+
+//这是hooker添加的hook点，原JustTrustMe中没有的
+function processPinningTrustManager() {
+ if (!classExists("appcelerator.https.PinningTrustManager")) {
+ return;
+ }
+ var pinningTrustManagerClass = Java.use('appcelerator.https.PinningTrustManager');
+ var pinningTrustManagerClass_checkServerTrusted = pinningTrustManagerClass.checkServerTrusted.overload();
+ pinningTrustManagerClass_checkServerTrusted.implementation = function() {
+ //什么都不做
+ };
+}
+
+
+Java.perform(function() {
+ var Helper = Java.use("gz.justtrustme.Helper");
+ var DefaultHttpClientClass = Java.use("org.apache.http.impl.client.DefaultHttpClient");
+ //被强奸的构造方法
+ var DefaultHttpClientClassRapeConstructor = DefaultHttpClientClass.$init.overload('org.apache.http.conn.ClientConnectionManager', 'org.apache.http.params.HttpParams');
+ DefaultHttpClientClassRapeConstructor.implementation = function(v0, v1) {
+ //被强奸的构造方法被调用的话，我们替换调ClientConnectionManager参数为我们的
+ var returnObj = DefaultHttpClientClassRapeConstructor.call(this, Helper.getCCM(v0, v1), v1);
+ console.log("org.apache.http.impl.client.DefaultHttpClient.$init('org.apache.http.conn.ClientConnectionManager', 'org.apache.http.params.HttpParams') was hooked!");
+ return returnObj;
+ };
+ var DefaultHttpClientClassInit_1602 = DefaultHttpClientClass.$init.overload();
+ DefaultHttpClientClassInit_1602.implementation = function() {
+ //使用DefaultHttpClientClassRapeConstructor强奸它
+ var returnObj = DefaultHttpClientClassRapeConstructor.call(this, Helper.getSCCM(), null);
+ console.log("org.apache.http.impl.client.DefaultHttpClient.$init() was hooked!");
+ return returnObj;
+ };
+ var DefaultHttpClientClassInit_1603 = DefaultHttpClientClass.$init.overload('org.apache.http.params.HttpParams');
+ DefaultHttpClientClassInit_1603.implementation = function(v0) {
+ //使用DefaultHttpClientClassRapeConstructor强奸它
+ var returnObj = DefaultHttpClientClassRapeConstructor.call(this, Helper.getSCCM(), v0);
+ console.log("org.apache.http.impl.client.DefaultHttpClient.$init('org.apache.http.params.HttpParams') was hooked!");
+ return returnObj;
+ };
+ //以上DefaultHttpClient的三个构造方法逻辑全部被我们替换了
+ var X509TrustManagerExtensionsClass = Java.use('android.net.http.X509TrustManagerExtensions');
+ var X509TrustManagerExtensionsClassCheckServerTrusted = X509TrustManagerExtensionsClass.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String');
+ X509TrustManagerExtensionsClassCheckServerTrusted.implementation = function(certsArr, v1, v2) {
+ console.log("android.net.http.X509TrustManagerExtensions.checkServerTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String') was hooked!");
+ return Java.use('java.util.Arrays$ArrayList').$new(certsArr);
+ };
+ var NetworkSecurityTrustManagerClass = Java.use('android.security.net.config.NetworkSecurityTrustManager');
+ var NetworkSecurityTrustManagerClassCheckPins = NetworkSecurityTrustManagerClass.checkPins.overload('java.util.List');
+ NetworkSecurityTrustManagerClassCheckPins.implementation = function(v0) {
+ //什么都不做
+ console.log("android.security.net.config.NetworkSecurityTrustManager.checkPins('java.util.List') was hooked!");
+ };
+
+ //替换trustmanagers参数
+ var SSLSocketFactory = Java.use('org.apache.http.conn.ssl.SSLSocketFactory');
+ var SSLSocketFactoryRapeConstructor = SSLSocketFactory.$init.overload('java.lang.String', 'java.security.KeyStore', 'java.lang.String', 'java.security.KeyStore', 'java.security.SecureRandom', 'org.apache.http.conn.scheme.HostNameResolver');
+ SSLSocketFactoryRapeConstructor.implementation = function(v0, v1, v2, v3, v4, v5) {
+ var returnObj = SSLSocketFactoryRapeConstructor.call(this, v0, v1, v2, v3, v4, v5);
+ console.log("org.apache.http.conn.ssl.SSLSocketFactory.$init('java.lang.String', 'java.security.KeyStore', 'java.lang.String', 'java.security.KeyStore', 'java.security.SecureRandom', 'org.apache.http.conn.scheme.HostNameResolver') was hooked!");
+ if (Helper.reInitSSLSocketFactory(returnObj, v0, v1, v2, v3, v4, v5)) {
+ console.log("替换trustmanagers参数成功!");
+ }else{
+ console.log("替换trustmanagers参数失败!");
+ }
+ return returnObj;
+ };
+
+ var SSLSocketFactoryGetSocketFactoryMethod = SSLSocketFactory.getSocketFactory.overload();
+ var SSLSocketFactoryEmptyConstructor = SSLSocketFactory.$init.overload();
+ SSLSocketFactoryGetSocketFactoryMethod.implementation = function() {
+ //强制用空的构造方法
+ console.log("org.apache.http.conn.ssl.SSLSocketFactory.getSocketFactory() was hooked!");
+ return SSLSocketFactoryEmptyConstructor.call(this);
+ };
+
+ var SSLSocketFactoryIsSecure = SSLSocketFactory.isSecure.overload('java.net.Socket');
+ SSLSocketFactoryIsSecure.implementation = function(v0) {
+ //强制返回true
+ console.log("org.apache.http.conn.ssl.SSLSocketFactory.isSecure('java.net.Socket') was hooked!");
+ return true;
+ };
+
+ var TrustManagerFactory = Java.use('javax.net.ssl.TrustManagerFactory');
+ var TrustManagerFactoryGetTrustManagers = TrustManagerFactory.getTrustManagers.overload();
+ TrustManagerFactoryGetTrustManagers.implementation = function() {
+ var ret = TrustManagerFactoryGetTrustManagers.call(this);
+ //替换getTrustManagers方法逻辑
+ console.log("javax.net.ssl.TrustManagerFactory.getTrustManagers() was hooked!");
+ return Helper.replaceGetTrustManagers(this, ret);
+ };
+
+ var HttpsURLConnection = Java.use("javax.net.ssl.HttpsURLConnection");
+ var HttpsURLConnectionSetDefaultHostnameVerifier = HttpsURLConnection.setDefaultHostnameVerifier.overload('javax.net.ssl.HostnameVerifier');
+ HttpsURLConnectionSetDefaultHostnameVerifier.implementation = function(v0) {
+ //什么都不做
+ console.log("javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier('javax.net.ssl.HostnameVerifier') was hooked!");
+ };
+
+ var HttpsURLConnectionSetHostnameVerifier = HttpsURLConnection.setHostnameVerifier.overload('javax.net.ssl.HostnameVerifier');
+ HttpsURLConnectionSetHostnameVerifier.implementation = function(v0) {
+ //什么都不做
+ console.log("javax.net.ssl.HttpsURLConnection.setHostnameVerifier('javax.net.ssl.HostnameVerifier') was hooked!");
+ };
+
+ var HttpsURLConnectionSetSSLSocketFactory = HttpsURLConnection.setSSLSocketFactory.overload('javax.net.ssl.SSLSocketFactory');
+ HttpsURLConnectionSetSSLSocketFactory.implementation = function(v0) {
+ //什么都不做
+ console.log("javax.net.ssl.SSLSocketFactory.setSSLSocketFactory('javax.net.ssl.SSLSocketFactory') was hooked!");
+ };
+
+ var SSLContextClz = Java.use('javax.net.ssl.SSLContext');
+ var SSLContextClzInit = SSLContextClz.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom');
+ SSLContextClzInit.implementation = function(v0, v1, v2) {
+ //将第二个参数强制替换为我们自己构造的不安全的TrustManagers
+ SSLContextClzInit.call(this, v0, Helper.getImSureTrustManagers(), v2);
+ console.log("javax.net.ssl.SSLContext.init('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom') was hooked!");
+ };
+
+ var ApplicationClz = Java.use('android.app.Application');
+ var ApplicationClzAttach = ApplicationClz.attach.overload('android.content.Context');
+ ApplicationClzAttach.implementation = function(context) {
+ ApplicationClzAttach.call(this, context);
+ //注意justTrustMe使用的是afterHookedMethod，所以我们用frida也必须在原方法call完之后执行我们的代码
+ var classLoader = context.getClassLoader();
+
+ };
+
+ if (hasTrustManagerImpl()) {
+ var TrustManagerImplClz = Java.use('com.android.org.conscrypt.TrustManagerImpl');
+ var TrustManagerImplCheckServerTrusted_8813 = TrustManagerImplClz.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String');
+ TrustManagerImplCheckServerTrusted_8813.implementation = function(v0, v1, v2) {
+ console.log("com.android.org.conscrypt.TrustManagerImpl.checkServerTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String') was hooked!");
+ return newArrayList();
+ };
+ var TrustManagerImplCheckServerTrusted_7015 = TrustManagerImplClz.checkServerTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'javax.net.ssl.SSLSession');
+ TrustManagerImplCheckServerTrusted_7015.implementation = function(v0, v1, v2) {
+ console.log("com.android.org.conscrypt.TrustManagerImpl.checkServerTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'javax.net.ssl.SSLSession') was hooked!");
+ return newArrayList();
+ };
+ var TrustManagerImplCheckTrusted_5587 = TrustManagerImplClz.checkTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String', 'boolean');
+ TrustManagerImplCheckTrusted_5587.implementation = function(v0, v1, v2, v3) {
+ console.log("com.android.org.conscrypt.TrustManagerImpl.checkTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'java.lang.String', 'boolean') was hooked!");
+ return newArrayList();
+ };
+ var TrustManagerImplCheckTrusted_9999 = TrustManagerImplClz.checkTrusted.overload('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'javax.net.ssl.SSLSession', 'javax.net.ssl.SSLParameters', 'boolean');
+ TrustManagerImplCheckTrusted_9999.implementation = function(v0, v1, v2, v3, v4) {
+ console.log("com.android.org.conscrypt.TrustManagerImpl.checkTrusted('[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'javax.net.ssl.SSLSession', 'javax.net.ssl.SSLParameters', 'boolean') was hooked!");
+ return newArrayList();
+ };
+ }
+
+ processOkHttp();
+ processXutils();
+ processHttpClientAndroidLib();
+ //hooker添加的hook点
+ processConscryptPlatform();
+ processPinningTrustManager();
+})
\ No newline at end of file
diff --git a/com.cubic.autohome/just_trust_me_okhttp_hook_finder.js b/com.cubic.autohome/just_trust_me_okhttp_hook_finder.js
new file mode 100644
index 0000000..e22bf3c
--- /dev/null
+++ b/com.cubic.autohome/just_trust_me_okhttp_hook_finder.js
@@ -0,0 +1,69 @@
+function loadDexfile(dexfile) {
+ Java.perform(function () {
+ Java.openClassFile(dexfile).load();
+ });
+};
+
+
+loadDexfile('/data/user/0/com.cubic.autohome/radar.dex');
+
+function printOkhttp3FakeClass(okhttp3FakeClassObject) {
+ if (okhttp3FakeClassObject) {
+ console.log("-----------------------------------------------------------------------");
+ console.log("原类名：" + okhttp3FakeClassObject.getOriginalClassName());
+ console.log("混淆类名：" + okhttp3FakeClassObject.getFakeClassName());
+ console.log("\n");
+ for (let k = 0; k < okhttp3FakeClassObject.fakeMethodSize(); k ++) {
+ let fakeMethod = okhttp3FakeClassObject.getFakeMethod(k);
+ console.log("混淆方法" + k + ":");
+ console.log("原方法签名：" + fakeMethod.getOriginalMethod());
+ console.log("混淆方法签名：" + fakeMethod.getFakeMethod());
+ console.log("\n");
+ }
+ if (okhttp3FakeClassObject.fakeMethodSize() == 0) {
+ //手动找混淆方法
+ console.error("自动定位混淆方法失败，请去jadx打开"+okhttp3FakeClassObject.getFakeClassName()+"手动分析混淆方法");
+ }
+ }
+}
+
+//设置下混淆okhttp混淆类包名的前戳，以便加快扫描速度
+//一般okhttp用的版本是3，并且混淆没有到包名级别所以我这里默认给^okhttp3
+//如果你的apk混淆的到了包名级别。先用jadx静态分析找到包名前戳改到这即可
+var matchClassNameRegExp = RegExp(/^okhttp3/);
+
+Java.perform(function() {
+ var OkHttp3FakeFinder = Java.use("gz.justtrustme.OkHttp3FakeFinder");
+ Java.enumerateLoadedClasses({
+ onMatch: function(className) {
+ if (className.match(matchClassNameRegExp)) {
+ try {
+ let tempClassHandle = Java.use(className).class;
+ let matchOkHttpClientBuilderCheckResult = OkHttp3FakeFinder.okHttpClientBuilderCheck(tempClassHandle);
+ if (matchOkHttpClientBuilderCheckResult) {
+ printOkhttp3FakeClass(matchOkHttpClientBuilderCheckResult);
+ continue;
+ }
+
+ let matchOk3CertificatePinnerCheckResult = OkHttp3FakeFinder.okHttpCertificatePinnerCheck(tempClassHandle);
+ if (matchOk3CertificatePinnerCheckResult) {
+ printOkhttp3FakeClass(matchOk3CertificatePinnerCheckResult);
+ continue;
+ }
+
+ let matchOk3OkHostnameVerifierVerifyResult = OkHttp3FakeFinder.okHttpOkHostnameVerifierVerify(tempClassHandle);
+ if (matchOk3OkHostnameVerifierVerifyResult) {
+ printOkhttp3FakeClass(matchOk3OkHostnameVerifierVerifyResult);
+ continue;
+ }
+
+ } catch(error) {
+ //console.error(error);
+ }
+ }
+ },
+ onComplete: function() {}
+ });
+});
+
+
diff --git a/com.cubic.autohome/keystore_dump.js b/com.cubic.autohome/keystore_dump.js
new file mode 100644
index 0000000..d58589b
--- /dev/null
+++ b/com.cubic.autohome/keystore_dump.js
@@ -0,0 +1,110 @@
+//在https双向认证的情况下，dump客户端证书为p12. 证书密码: hooker
+var password = "hooker";
+
+
+
+function dateFormat(fmt, date) {
+ let ret;
+ const opt = {
+ "Y+": date.getFullYear().toString(),
+ // 年
+ "m+": (date.getMonth() + 1).toString(),
+ // 月
+ "d+": date.getDate().toString(),
+ // 日
+ "H+": date.getHours().toString(),
+ // 时
+ "M+": date.getMinutes().toString(),
+ // 分
+ "S+": date.getSeconds().toString() // 秒
+ };
+ for (let k in opt) {
+ ret = new RegExp("(" + k + ")").exec(fmt);
+ if (ret) {
+ fmt = fmt.replace(ret[1], (ret[1].length == 1) ? (opt[k]) : (opt[k].padStart(ret[1].length, "0")))
+ };
+ };
+ return fmt;
+}
+
+function random(min, max) {
+ return Math.floor(Math.random() * (max - min)) + min;
+}
+
+function getNowTime() {
+ return dateFormat("YYYY_mm_dd_HH_MM_SS", new Date()) + "_" + random(1, 100);
+}
+
+function getPackageName() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context.getPackageName();
+};
+
+function newMethodBeat(text, executor) {
+ var threadClz = Java.use("java.lang.Thread");
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var processClz = Java.use("android.os.Process");
+ var currentThread = threadClz.currentThread();
+ var beat = new Object();
+ beat.invokeId = Math.random().toString(36).slice( - 8);
+ beat.executor = executor;
+ beat.myPid = processClz.myPid();
+ beat.threadId = currentThread.getId();
+ beat.threadName = currentThread.getName();
+ beat.text = text;
+ beat.startTime = new Date().getTime();
+ beat.stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new()).substring(20);
+ return beat;
+};
+
+function printBeat(beat) {
+ var str = ("------------pid:" + beat.myPid + ",startFlag:" + beat.invokeId + ",objectHash:"+beat.executor+",thread(id:" + beat.threadId +",name:" + beat.threadName + "),timestamp:" + beat.startTime+"---------------\n");
+ str += beat.text + "\n";
+ str += beat.stackInfo;
+ str += ("------------endFlag:" + beat.invokeId + ",usedtime:" + (new Date().getTime() - beat.startTime) +"---------------\n");
+ console.log(str);
+};
+
+function dump2sdcard(pri, p7, filePath) {
+ console.log("dump:" + filePath);
+ var X509CertificateClass = Java.use("java.security.cert.X509Certificate");
+ var myX509 = Java.cast(p7, X509CertificateClass);
+ var chain = Java.array("java.security.cert.X509Certificate", [myX509]);
+ var ks = Java.use("java.security.KeyStore").getInstance("PKCS12", "BC");
+ ks.load(null, null);
+ ks.setKeyEntry("client", pri, Java.use('java.lang.String').$new(password).toCharArray(), chain);
+ try {
+ var out = Java.use("java.io.FileOutputStream").$new(filePath);
+ ks.store(out, Java.use('java.lang.String').$new(password).toCharArray());
+ } catch(error) {
+ console.log(error);
+ }
+}
+
+
+
+Java.perform(function() {
+ var packageName = getPackageName();
+ console.log("在https双向认证的情况下，dump客户端证书为p12. 存储位置:/data/user/0/"+packageName+"/client_keystore_{nowtime}.p12 证书密码: hooker");
+ Java.use("java.security.KeyStore$PrivateKeyEntry").getPrivateKey.implementation = function() {
+ var executor = this.hashCode();
+ var beatText = 'public java.security.cert.Certificate java.security.KeyStore$PrivateKeyEntry.getPrivateKey()';
+ var beat = newMethodBeat(beatText, executor);
+ var result = this.getPrivateKey();
+ let filePath = '/data/user/0/' + packageName + "/client_keystore_" + "_" + getNowTime() + '.p12';
+ dump2sdcard(this.getPrivateKey(), this.getCertificate(), filePath);
+ printBeat(beat);
+ return result;
+ }
+ Java.use("java.security.KeyStore$PrivateKeyEntry").getCertificateChain.implementation = function() {
+ var executor = this.hashCode();
+ var beatText = 'public java.security.cert.Certificate java.security.KeyStore$PrivateKeyEntry.getCertificate()';
+ var beat = newMethodBeat(beatText, executor);
+ var result = this.getCertificateChain();
+ let filePath = '/data/user/0/' + packageName + "/client_keystore_" + getNowTime() + '.p12';
+ dump2sdcard(this.getPrivateKey(), this.getCertificate(), filePath);
+ return result;
+ }
+})
diff --git a/com.cubic.autohome/kill b/com.cubic.autohome/kill
new file mode 100755
index 0000000..85425cc
--- /dev/null
+++ b/com.cubic.autohome/kill
@@ -0,0 +1,3 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+frida-kill $HOOKER_DRIVER com.cubic.autohome
\ No newline at end of file
diff --git a/com.cubic.autohome/object_store.js b/com.cubic.autohome/object_store.js
new file mode 100644
index 0000000..7c29328
--- /dev/null
+++ b/com.cubic.autohome/object_store.js
@@ -0,0 +1,61 @@
+function loadDexfile(dexfile) {
+ Java.perform(function() {
+ Java.openClassFile(dexfile).load();
+ });
+};
+
+loadDexfile('/data/user/0/com.cubic.autohome/radar.dex');
+
+
+function log(str) {
+ console.log(str);
+};
+
+function getBaseContext() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context; //Java.scheduleOnMainThread(fn):
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while (new Date().getTime() < startTime) {}
+};
+
+function fastTojson(javaObject) {
+ var JSONClz = Java.use("gz.com.alibaba.fastjson.JSON");
+ return JSONClz.toJSONString(javaObject);
+};
+
+function object2Json(objectId) {
+ var radarPropertiesClz = Java.use("gz.radar.objects.ObjectsStore");
+ var obj = radarPropertiesClz.getObject(objectId+"");
+ if (obj) {
+ log(fastTojson(obj));
+ }else{
+ log("Not found this object.");
+ }
+}
+
+function object2String(objectId) {
+ var radarPropertiesClz = Java.use("gz.radar.objects.ObjectsStore");
+ var obj = radarPropertiesClz.getObject(objectId+"");
+ if (obj) {
+ log(obj.toString());
+ }else{
+ log("Not found this object.");
+ }
+}
+
+function getObject(objectId) {
+ var radarPropertiesClz = Java.use("gz.radar.objects.ObjectsStore");
+ var obj = radarPropertiesClz.getObject(objectId+"");
+ return obj;
+}
+
+
+function getField(javaObject, fieldName) {
+ var X = Java.use("gz.util.X");
+ return X.getField(javaObject, fieldName);
+};
+
diff --git a/com.cubic.autohome/objection b/com.cubic.autohome/objection
new file mode 100755
index 0000000..6beeed3
--- /dev/null
+++ b/com.cubic.autohome/objection
@@ -0,0 +1,3 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+objection -d -g com.cubic.autohome explore
\ No newline at end of file
diff --git a/com.cubic.autohome/spawn b/com.cubic.autohome/spawn
new file mode 100755
index 0000000..e1d651c
--- /dev/null
+++ b/com.cubic.autohome/spawn
@@ -0,0 +1,4 @@
+#!/bin/bash
+HOOKER_DRIVER=$(cat ../.hooker_driver)
+
+frida $HOOKER_DRIVER --no-pause -f com.cubic.autohome -l $1
\ No newline at end of file
diff --git a/com.cubic.autohome/spider.py b/com.cubic.autohome/spider.py
new file mode 100644
index 0000000..77ef6bb
--- /dev/null
+++ b/com.cubic.autohome/spider.py
@@ -0,0 +1,97 @@
+import frida
+import os
+import io
+import traceback
+import time
+
+def withColor(string, fg, bg=49):
+ print("\33[0m\33[%d;%dm%s\33[0m" % (fg, bg, string))
+
+Red = 1
+Green = 2
+Yellow = 3
+Blue = 4
+Magenta = 5
+Cyan = 6
+White = 7
+
+def red(string):
+ return withColor(string, Red+30) # Red
+def yellow(string):
+ return withColor(string, Yellow+30) # Yellow
+
+warn = red
+info = yellow
+
+jscode = io.open('wxspider.js', 'r', encoding= 'utf8').read()
+
+jscode += """
+rpc.exports = {
+ log: function(str) {
+ console.log(str);
+ },
+};
+"""
+
+def runCommand(cmd):
+ print(cmd);
+ lines = os.popen(cmd).readlines();
+ for line in lines:
+ print(line);
+
+def on_message(message, data):
+ pass
+
+def attach(packageName, hookerDriverFridaServer, runningTime):
+ hasException = False
+ online_session = None
+ online_script = None
+ try:
+ rdev = frida.get_device_manager().add_remote_device(hookerDriverFridaServer)
+ online_session = rdev.attach(packageName)
+ if online_session == None:
+ warn("attaching fail to " + packageName)
+ online_script = online_session.create_script(jscode)
+ online_script.on('message', on_message)
+ online_script.load()
+ for i in range(1, runningTime):
+ if i % 2 == 0:
+ online_script.exports.log(mobileIP + " spider has running been " + str(i) + " seconds.");
+ time.sleep(1)
+ except Exception:
+ hasException = True
+ warn(traceback.format_exc())
+ finally:
+ if online_session != None and hasException == False:
+ online_session.detach()
+ return online_session,online_script
+
+def restartApp(packageName, mobileIP, adb):
+ try:
+ runCommand(adb + " connect "+mobileIP);
+ time.sleep(3)
+ runCommand(adb + " -s "+mobileIP+" shell am force-stop " + appPackageName);
+ time.sleep(5)
+ runCommand(adb + " -s "+mobileIP+" shell am start " + appPackageName + "/" + mainActivity);
+ time.sleep(20)
+ runCommand(adb + " disconnect "+mobileIP);
+ except Exception:
+ warn(traceback.format_exc())
+
+appPackageName = "com.tencent.mm"
+mainActivity = "com.tencent.mm.ui.LauncherUI"
+#手机ip
+mobileIP = "192.168.0.102"
+#重启周期 秒
+runningTime = 3600
+
+adb="adb"
+
+while True:
+ restartApp(appPackageName, mobileIP, adb)
+ print("inject spider.js");
+ print(jscode);
+ attach(appPackageName, mobileIP + ":27042", runningTime)
+ print("restarting spider.", appPackageName, mainActivity, mobileIP, runningTime)
+
+
\ No newline at end of file
diff --git a/com.cubic.autohome/ssl_log.js b/com.cubic.autohome/ssl_log.js
new file mode 100644
index 0000000..69eff81
--- /dev/null
+++ b/com.cubic.autohome/ssl_log.js
@@ -0,0 +1,21 @@
+function startTLSKeyLogger() {
+
+ const SSL_CTX_new_addr = Module.findExportByName('libssl.so', 'SSL_CTX_new');
+ const SSL_CTX_set_keylog_callback_addr = Module.findExportByName('libssl.so', 'SSL_CTX_set_keylog_callback');
+
+
+ const keyLogCallback = new NativeCallback(function (ssl, line) {
+ console.log(new NativePointer(line).readCString());
+ }, 'void', ['pointer', 'pointer']);
+
+ const SSL_CTX_set_keylog_callbackFn = new NativeFunction(SSL_CTX_set_keylog_callback_addr, 'void', ['pointer', 'pointer']);
+
+ Interceptor.attach(SSL_CTX_new_addr, {
+ onLeave: function(retval) {
+ const ssl = new NativePointer(retval);
+ SSL_CTX_set_keylog_callbackFn(ssl, keyLogCallback);
+ }
+ });
+}
+
+startTLSKeyLogger();
\ No newline at end of file
diff --git a/com.cubic.autohome/text_view.js b/com.cubic.autohome/text_view.js
new file mode 100644
index 0000000..84f1c7e
--- /dev/null
+++ b/com.cubic.autohome/text_view.js
@@ -0,0 +1,50 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ var str = ("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id:" + currentThread.getId() +",name:" + currentThread.getName() + "),timestamp:" + startTime+"---------------\n");
+ str += methodName + "\n";
+ str += stackInfo.substring(20);
+ str += ("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+ console.log(str);
+};
+
+Java.perform(function() {
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var textViewClz = Java.use("android.widget.TextView");
+
+ if (textViewClz.setText) {
+ var setTextFunc = textViewClz.setText.overload("java.lang.CharSequence");
+ setTextFunc.implementation = function(v0) {
+ var startTime = new Date().getTime();
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("TextViewClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text:" + v0);
+ setTextFunc.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, "android.widget.TextView.setText()", executor);
+ };
+ }
+ if (textViewClz.getText) {
+ var getTextFunc = textViewClz.getText.overload();
+ getTextFunc.implementation = function() {
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ var editable = getTextFunc.call(this);
+ console.log("TextViewClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text: " + editable.toString());
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, "android.widget.TextView.getText()", executor);
+ return editable;
+ };
+ }
+});
\ No newline at end of file
diff --git a/com.cubic.autohome/url.js b/com.cubic.autohome/url.js
new file mode 100644
index 0000000..ecd954b
--- /dev/null
+++ b/com.cubic.autohome/url.js
@@ -0,0 +1,132 @@
+function tryGetClass(className) {
+ var clz = undefined;
+ try {
+ clz = Java.use(className);
+ } catch(e) {}
+ return clz;
+}
+
+function newMethodBeat(text, executor) {
+ var threadClz = Java.use("java.lang.Thread");
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var currentThread = threadClz.currentThread();
+ var beat = new Object();
+ beat.invokeId = Math.random().toString(36).slice( - 8);
+ beat.executor = executor;
+ beat.threadId = currentThread.getId();
+ beat.threadName = currentThread.getName();
+ beat.text = text;
+ beat.startTime = new Date().getTime();
+ beat.stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new()).substring(20);
+ return beat;
+};
+
+function printBeat(beat) {
+ var str = ("------------startFlag:" + beat.invokeId + ",objectHash:" + beat.executor + ",thread(id:" + beat.threadId + ",name:" + beat.threadName + "),timestamp:" + beat.startTime + "---------------\n");
+ str += beat.text + "\n";
+ str += beat.stackInfo;
+ str += ("------------endFlag:" + beat.invokeId + ",usedtime:" + (new Date().getTime() - beat.startTime) + "---------------\n");
+ console.log(str);
+};
+
+var containRegExps = new Array()
+
+var notContainRegExps = new Array(RegExp(/\.jpg/), RegExp(/\.png/))
+
+function check(str) {
+ str = str.toString();
+ if (! (str && str.match)) {
+ return false;
+ }
+ for (var i = 0; i < containRegExps.length; i++) {
+ if (!str.match(containRegExps[i])) {
+ return false;
+ }
+ }
+ for (var i = 0; i < notContainRegExps.length; i++) {
+ if (str.match(notContainRegExps[i])) {
+ return false;
+ }
+ }
+ return true;
+}
+
+Java.perform(function() {
+ var uriParseClz = Java.use('java.net.URI');
+ var uriParseClzConstruct = uriParseClz.$init.overload("java.lang.String");
+ uriParseClzConstruct.implementation = function(url) {
+ var result = uriParseClzConstruct.call(this, url);
+ var executor = this.hashCode();
+ var beatText = "url:" + url + "\npublic java.net.URI(String)";
+ var beat = newMethodBeat(beatText, executor);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return result;
+ };
+
+ // URL
+ var URLClz = Java.use('java.net.URL');
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var urlConstruct = URLClz.$init.overload("java.lang.String");
+ urlConstruct.implementation = function(url) {
+ var result = urlConstruct.call(this, url);
+ var executor = this.hashCode();
+ var beatText = "url:" + url + "\npublic java.net.URL(String)";
+ var beat = newMethodBeat(beatText, executor);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return result;
+ };
+
+ //ok系统原生支持
+ var sysBuilderClz = tryGetClass('com.android.okhttp.Request$Builder');
+ if (sysBuilderClz) {
+ sysBuilderClz.build.implementation = function() {
+ var okRequestResult = this.build();
+ var httpUrl = okRequestResult.url();
+ var url = httpUrl.toString();
+ var executor = this.hashCode();
+ var beatText = "url:" + url + "\ncom.android.okhttp.Request.Builder.build()";
+ var beat = newMethodBeat(beatText, executor);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return okRequestResult
+ };
+ }
+
+ //ok本地依赖
+ var builderClz = tryGetClass('okhttp3.Request$Builder');
+ if (builderClz) {
+ var buildFunc = builderClz.build.overload();
+ buildFunc.implementation = function() {
+ var okRequestResult = buildFunc.call(this);
+ var httpUrl = okRequestResult.url();
+ var url = httpUrl.toString();
+ var executor = this.hashCode();
+ var beatText = "url:" + url + "\nokhttp3.Request.Builder.build()";
+ var beat = newMethodBeat(beatText, executor);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return okRequestResult
+ };
+ }
+
+ var android_net_Uri_clz = Java.use('android.net.Uri');
+ var android_net_Uri_clz_method_parse_u5rj = android_net_Uri_clz.parse.overload('java.lang.String');
+ android_net_Uri_clz_method_parse_u5rj.implementation = function(url) {
+ var executor = 'Class';
+ var beatText = url + '\npublic static android.net.Uri android.net.Uri.parse(java.lang.String)';
+ var beat = newMethodBeat(beatText, executor);
+ var ret = android_net_Uri_clz_method_parse_u5rj.call(android_net_Uri_clz, url);
+ if (check(url)) {
+ printBeat(beat);
+ }
+ return ret;
+ };
+});
\ No newline at end of file
diff --git a/com.cubic.autohome/xinitdeploy b/com.cubic.autohome/xinitdeploy
new file mode 100755
index 0000000..22467bf
--- /dev/null
+++ b/com.cubic.autohome/xinitdeploy
@@ -0,0 +1,175 @@
+#! /Library/Frameworks/Python.framework/Versions/3.8/bin/python3
+
+import frida
+import os
+import io
+import traceback
+import base64
+import platform
+
+def withColor(string, fg, bg=49):
+ print("\33[0m\33[%d;%dm%s\33[0m" % (fg, bg, string))
+
+Red = 1
+Green = 2
+Yellow = 3
+Blue = 4
+Magenta = 5
+Cyan = 6
+White = 7
+
+def red(string):
+ return withColor(string, Red+30) # Red
+def yellow(string):
+ return withColor(string, Yellow+30) # Yellow
+
+warn = red
+info = yellow
+
+rpc_jscode = """
+function mkdirs(dirpath) {
+ var FileClz = Java.use("java.io.File");
+ var file = FileClz.$new(dirpath);
+ if (!file.exists()) {
+ file.mkdirs();
+ }
+}
+
+function writeFileAsBase64Content(filepath, base64) {
+ try {
+ var FileUtilsClz = Java.use("android.os.FileUtils");
+ var StringClz = Java.use('java.lang.String');
+ var Base64Clz = Java.use("android.util.Base64");
+ var ByteArrayInputStreamClz = Java.use("java.io.ByteArrayInputStream");
+ var FileOutputStreamClz = Java.use("java.io.FileOutputStream");
+ var FileClz = Java.use("java.io.File");
+ var distFilepath = FileClz.$new(filepath);
+ mkdirs(distFilepath.getParent());
+ var javaBase64String = StringClz.$new(base64);
+ var getBytesMehtod = StringClz.getBytes.overload('java.lang.String');
+ var bytes = getBytesMehtod.call(javaBase64String, 'UTF-8');
+ var decodeMethod = Base64Clz.decode.overload('[B', 'int');
+ var originalBinary = decodeMethod.call(Base64Clz, bytes, 0);
+ var bais = ByteArrayInputStreamClz.$new(originalBinary);
+ if (FileUtilsClz.copy) {
+ var copyMehtod = FileUtilsClz.copy.overload('java.io.InputStream', 'java.io.OutputStream');
+ var fos = FileOutputStreamClz.$new(distFilepath);
+ copyMehtod.call(FileUtilsClz, bais, fos);
+ } else if (FileUtilsClz.copyToFile) {
+ var copyMehtod = FileUtilsClz.copyToFile.overload('java.io.InputStream', 'java.io.File');
+ copyMehtod.call(FileUtilsClz, bais, distFilepath);
+ }
+ } catch(err) {
+ console.warn(err);
+ }
+};
+
+function checkFile(filepath, checkLength) {
+ var FileClz = Java.use("java.io.File");
+ var file = FileClz.$new(filepath);
+ return file.exists() && file.length() == checkLength;
+};
+
+rpc.exports = {
+ write: function(filename, contentAsBase64) {
+ Java.perform(function() {
+ //console.log(contentAsBase64);
+ writeFileAsBase64Content(filename, contentAsBase64);
+ });
+ },
+ checkfile: function(filename, filelength) {
+ var ret = false;
+ Java.perform(function() {
+ ret = checkFile(filename, filelength);
+ });
+ return ret;
+ },
+};
+
+"""
+
+def getHookerDriverHost():
+ try:
+ hookerDriver = io.open('../.hooker_driver', 'r', encoding= 'utf8').read()
+ hookerDriver = hookerDriver.replace("-H", "").strip()
+ return hookerDriver
+ except Exception:
+ return "-U"
+
+class XinitFile:
+ def __init__(self, filename, filepath):
+ self.filename = filename
+ self.filepath = filepath
+
+ def fileData(self):
+ fopen = open(self.filepath,"rb")
+ data = fopen.read()
+ fopen.close()
+ return data
+
+def readXinitFiles():
+ xinitFiles = []
+ if not os.path.exists("./xinit"):
+ return xinitFiles
+ allFiles = os.listdir("./xinit")
+ for filename in allFiles:
+ filepath = "./xinit/" + filename
+ if os.path.isdir(filepath):
+ continue
+ xinitFile = XinitFile(filename, filepath)
+ xinitFiles.append(xinitFile)
+ return xinitFiles
+
+def on_message(message, data):
+ pass
+
+def attach(packageName):
+ online_session = None
+ online_script = None
+ hookerDriver = getHookerDriverHost()
+ try:
+ if hookerDriver != "-U":
+ rdev = frida.get_device_manager().add_remote_device(hookerDriver)
+ elif platform.system().find("Windows") != -1:
+ warn("推荐使用linux或mac操作系统获得更好的兼容性.")
+ rdev = frida.get_remote_device()
+ else:
+ rdev = frida.get_usb_device(1000)
+ online_session = rdev.attach(packageName)
+ if online_session == None:
+ warn("attaching fail to " + packageName)
+ online_script = online_session.create_script(rpc_jscode)
+ online_script.on('message', on_message)
+ online_script.load()
+ except Exception:
+ warn(traceback.format_exc())
+ return online_session,online_script
+
+
+def detach(online_session):
+ if online_session != None:
+ online_session.detach()
+
+
+def xinitDeploy(packageName):
+ xinitFiles = readXinitFiles()
+ if xinitFiles == None or len(xinitFiles) == 0:
+ warn("deploying aborted. because not found any file in the path xinit.")
+ return
+ online_session = None
+ online_script = None
+ try:
+ online_session,online_script = attach(packageName);
+ for xinitFile in xinitFiles:
+ dataBase64 = base64.b64encode(xinitFile.fileData()).decode()
+ distPath = "/data/user/0/" + packageName + "/xinit/" + xinitFile.filename
+ info("copying " + xinitFile.filename + " to that path " + distPath + ".")
+ online_script.exports.write(distPath, dataBase64)
+ info("deploying xinit finished.")
+ except Exception:
+ warn("deploying xinit failure.")
+ warn(traceback.format_exc())
+ finally:
+ detach(online_session)
+
+xinitDeploy('com.cubic.autohome')
\ No newline at end of file
diff --git a/com.google.android.youtube/cipher.js b/com.google.android.youtube/cipher.js
new file mode 100644
index 0000000..f5afc91
--- /dev/null
+++ b/com.google.android.youtube/cipher.js
@@ -0,0 +1,797 @@
+//javax.crypto.Cipher:?
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+//创建ArrayList对象用这个方法就好了
+function newArrayList() {
+ var ArrayListClz = Java.use('java.util.ArrayList');
+ return ArrayListClz.$new();
+}
+
+//创建HashSet对象用这个方法就好了
+function newHashSet() {
+ var HashSetClz = Java.use('java.util.HashSet');
+ return HashSetClz.$new();
+}
+
+//创建HashMap对象用这个方法就好了
+function newHashMap() {
+ var HashMapClz = Java.use('java.util.HashMap');
+ return HashMapClz.$new();
+}
+
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ console.log("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id,name:" + currentThread.getId() +"," + currentThread.getName() + "),timestamp:" + startTime+"---------------");
+ console.log(methodName);
+ console.log(stackInfo.substring(20));
+ console.log("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+};
+
+function methodOutBeat(invokeId, timestamp) {
+ console.log("------------end:" + invokeId + ",usedtime:" + (new Date().getTime() - timestamp) + "---------------\n");
+}
+
+function toJSONString(obj) {
+ try {
+ var clz = Java.use("com.alibaba.fastjson.JSON");
+ var toJSONStringMehtod = clz.toJSONString.overload("java.lang.Object");
+ return toJSONStringMehtod.call(clz, obj);
+ } catch(err) {
+ console.log("toJSONString:" + err);
+ }
+ return "";
+};
+
+function logJSONString(obj) {
+ console.log(toJSONString(obj));
+}
+
+function log(str) {
+ console.log(str);
+};
+
+function discoverClass(className) {
+ var radarClassResult = undefined;
+ if (!className) {
+ return radarClassResult;
+ }
+ Java.perform(function() {
+ var radarClz = Java.use("gz.radar.ClassRadar");
+ radarClassResult = radarClz.discoverClass(className);
+ console.log(radarClassResult.describ());
+ });
+ return radarClassResult;
+};
+
+function isSubClass(className, parentClassName) {
+ var isSubClass = false;
+ Java.perform(function() {
+ var radarClz = Java.use("gz.radar.ClassRadar");
+ isSubClass = radarClz.isSubClass(className, parentClassName);
+ });
+ return isSubClass;
+}
+
+//查找所有加载的子类
+function findOffspringsClasses(parentClassName, containMethodName) {
+ var radarResults = new Array();
+ //Java.perform(function() {
+ var index = 0;
+ var count = 0;
+ Java.enumerateLoadedClasses({
+ onMatch: function(className) {
+ count++;
+ if (className.startsWith('[') || className.startsWith('org') || className.startsWith('sun') || className.startsWith('com.android') || className.startsWith('java') || className.startsWith('android') || className.startsWith('dalvik') || className.startsWith('com.google') || className.startsWith('libcore') || className.startsWith('gz.')) {
+ return;
+ }
+ var isSubClass = isSubClass(className, parentClassName);
+ if (isSubClass) {
+ var resultItem = discoverClass(className);
+ if (resultItem && resultItem.containsMethod(containMethodName)) {
+ radarResults[index] = resultItem;
+ index++;
+ } else {
+ console.log("Do not get the resultItem:" + className);
+ }
+ }
+ },
+ onComplete: function() {}
+ });
+ //});
+ return radarResults;
+};
+
+function getBaseContext() {
+ var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
+ var context = currentApplication.getApplicationContext();
+ return context; //Java.scheduleOnMainThread(fn):
+};
+
+//根据类名和方法名的正则表达式,匹配所有符合的类
+function scanTargets(scanTargetName, containMethodName) {
+ var radarResults = new Array();
+ Java.perform(function() {
+ if (classExists(scanTargetName)) {
+ var resultItem = discoverClass(scanTargetName);
+ if (resultItem) {
+ radarResults[0] = resultItem;
+ }
+ var offsprings = findOffspringsClasses(scanTargetName, containMethodName);
+ radarResults = radarResults.concat(offsprings);
+ } else {
+ var clzReg = eval("/" + scanTargetName + "/");
+ var index = 0;
+ Java.enumerateLoadedClasses({
+ onMatch: function(className) {
+ if (!className) {
+ console.log(" invalid:" + className);
+ return;
+ }
+ if (clzReg.test(className)) {
+ var resultItem = discoverClass(className);
+ if (resultItem && resultItem.containsMethod(containMethodName)) {
+ radarResults[index] = resultItem;
+ index++;
+ }
+ }
+ },
+ onComplete: function() {}
+ });
+ }
+ });
+ console.log("Discovering done");
+ return radarResults;
+}
+
+function generateFridaMethodOverload(clzVarName, radarMethod) {
+ var overloadJs = "";
+ if (!radarMethod.isLocal.value || radarMethod.methodName.value.indexOf("-") > -1) {
+ return overloadJs;
+ }
+ var methodVarName = clzVarName + "_method_" + radarMethod.methodName.value + "_" + Math.random().toString(36).slice( - 4);
+ overloadJs += "var " + methodVarName + "=" + clzVarName + "." + radarMethod.methodName.value + ".overload(";
+ if (radarMethod.paramsNum.value > 0) {
+ for (var j = 0; j < radarMethod.paramsNum.value; j++) {
+ overloadJs += "'";
+ overloadJs += radarMethod.paramsClasses.value[j];
+ overloadJs += "'";
+ if (j < (radarMethod.paramsNum.value - 1)) {
+ overloadJs += ",";
+ }
+ }
+ }
+ overloadJs += ");";
+ overloadJs += methodVarName;
+ overloadJs += ".implementation = function(";
+ var paramsJs = "";
+ for (var j = 0; j < radarMethod.paramsNum.value; j++) {
+ paramsJs += "v" + j;
+ if (j < (radarMethod.paramsNum.value - 1)) {
+ paramsJs += ",";
+ }
+ }
+ overloadJs += paramsJs;
+ overloadJs += ") {";
+ if (radarMethod.returnClass.value != "void") {
+ overloadJs += "var ret = ";
+ }
+ var handle = "this";
+ if (radarMethod.isStatic.value) {
+ handle = clzVarName;
+
+ }
+ overloadJs += methodVarName + ".call(" + handle;
+ if (radarMethod.paramsNum.value > 0) {
+ overloadJs += "," + paramsJs + ");";
+ } else {
+ overloadJs += ");";
+ }
+ overloadJs += "var invokeId = Math.random().toString(36).slice( - 8);";
+ overloadJs += "var startTime = new Date().getTime();";
+ if (handle == "this") {
+ overloadJs += "var executor = this.hashCode();";
+ } else {
+ overloadJs += "var executor = '" + clzVarName + "';";
+ }
+ overloadJs += "methodInBeat(invokeId, startTime, '" + radarMethod.describe.value + "', executor);";
+ overloadJs += "methodOutBeat(invokeId, startTime);";
+ if (radarMethod.returnClass.value != "void") {
+ overloadJs += "return ret;";
+ }
+ overloadJs += "};";
+ return overloadJs;
+}
+
+//生成构造方法的overload
+function generateFridaConstructorMethodOverload(clzVarName, constructorMethod) {
+ var overloadJs = "";
+ if (!constructorMethod.isLocal.value) {
+ return overloadJs;
+ }
+ var constructorMethodVarName = clzVarName + "_init_" + Math.random().toString(36).slice( - 4);
+ var hookConstructorMethodJs = clzVarName + ".$init.overload(";
+ if (constructorMethod.paramsNum.value > 0) {
+ for (var j = 0; j < constructorMethod.paramsNum.value; j++) {
+ hookConstructorMethodJs += "'";
+ hookConstructorMethodJs += constructorMethod.paramsClasses.value[j];
+ hookConstructorMethodJs += "'";
+ if (j < (constructorMethod.paramsNum.value - 1)) {
+ hookConstructorMethodJs += ",";
+ }
+ }
+ }
+ hookConstructorMethodJs += ");";
+ overloadJs += "var " + constructorMethodVarName + " = " + hookConstructorMethodJs;
+ overloadJs += constructorMethodVarName + ".implementation = function(";
+ var paramsJs = "";
+ for (var j = 0; j < constructorMethod.paramsNum.value; j++) {
+ paramsJs += "v" + j;
+ if (j < (constructorMethod.paramsNum.value - 1)) {
+ paramsJs += ",";
+ }
+ }
+ overloadJs += paramsJs;
+ overloadJs += ") {";
+ overloadJs += "var obj = ";
+ overloadJs += constructorMethodVarName + ".call(this";
+ if (constructorMethod.paramsNum.value > 0) {
+ overloadJs += "," + paramsJs + ");";
+ } else {
+ overloadJs += ");";
+ }
+ overloadJs += "var invokeId = Math.random().toString(36).slice( - 8);";
+ overloadJs += "var startTime = new Date().getTime();";
+ overloadJs += "var executor = this.hashCode();";
+ overloadJs += "methodInBeat(invokeId, startTime, '" + constructorMethod.describe.value + "', executor);";
+ overloadJs += "methodOutBeat(invokeId, startTime);";
+ overloadJs += "return obj;};";
+ return overloadJs;
+}
+
+//RadarClassResult string
+function generateMethodHookJs(radarClassResult, methodName) {
+ if (radarClassResult.isEnum.value || radarClassResult.isInterface.value) {
+ return "";
+ }
+ var hookJs = "";
+ var hasHook = false;
+ var clzHookJs = "";
+
+ var clzVarName = radarClassResult.className.value.replace(/[\.$;]/g, "_") + "_clz";
+ clzHookJs += "var " + clzVarName + " = Java.use('" + radarClassResult.className.value + "');";
+ var methods = radarClassResult.methods.value;
+ var hookAllMethod = methodName == "?";
+ var hookAllConstructorMethod = methodName == "_";
+ for (var i = 0; i < methods.length; i++) {
+ var radarMethod = methods[i];
+ if (hookAllMethod || radarMethod.matchName(methodName)) {
+ hasHook = true;
+ clzHookJs += generateFridaMethodOverload(clzVarName, radarMethod);
+ }
+ }
+
+ //是否需要hook构造方法
+ if (hookAllConstructorMethod) {
+ hasHook = true;
+ var constructorMethods = radarClassResult.constructorMethods.value;
+ for (var i = 0; i < constructorMethods.length; i++) {
+ clzHookJs += generateFridaConstructorMethodOverload(clzVarName, constructorMethods[i]);
+ }
+ }
+
+ if (hasHook) {
+ hookJs += clzHookJs;
+ console.log("generating hook js for class" + radarClassResult.className.value);
+ }
+ return hookJs;
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while (new Date().getTime() < startTime) {}
+};
+
+Java.perform(function() {
+ var java_security_SecureRandom_clz = Java.use('java.security.SecureRandom');
+ var java_security_SecureRandom_clz_method_setSeed_tsea = java_security_SecureRandom_clz.setSeed.overload('long');
+ java_security_SecureRandom_clz_method_setSeed_tsea.implementation = function(v0) {
+ java_security_SecureRandom_clz_method_setSeed_tsea.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public void java.security.SecureRandom.setSeed(long)', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var java_security_SecureRandom_clz_method_setSeed_c9w7 = java_security_SecureRandom_clz.setSeed.overload('[B');
+ java_security_SecureRandom_clz_method_setSeed_c9w7.implementation = function(v0) {
+ java_security_SecureRandom_clz_method_setSeed_c9w7.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public synchronized void java.security.SecureRandom.setSeed(byte[])', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz = Java.use('javax.crypto.Cipher');
+ var javax_crypto_Cipher_clz_method_doFinal_std2 = javax_crypto_Cipher_clz.doFinal.overload('java.nio.ByteBuffer', 'java.nio.ByteBuffer');
+ javax_crypto_Cipher_clz_method_doFinal_std2.implementation = function(v0, v1) {
+ var ret = javax_crypto_Cipher_clz_method_doFinal_std2.call(this, v0, v1);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final int javax.crypto.Cipher.doFinal(java.nio.ByteBuffer,java.nio.ByteBuffer) throws javax.crypto.ShortBufferException,javax.crypto.IllegalBlockSizeException,javax.crypto.BadPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_init_chy9 = javax_crypto_Cipher_clz.init.overload('int', 'java.security.Key', 'java.security.spec.AlgorithmParameterSpec');
+ javax_crypto_Cipher_clz_method_init_chy9.implementation = function(v0, v1, v2) {
+ javax_crypto_Cipher_clz_method_init_chy9.call(this, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.init(int,java.security.Key,java.security.spec.AlgorithmParameterSpec) throws java.security.InvalidKeyException,java.security.InvalidAlgorithmParameterException', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_tryTransform_s2x4 = javax_crypto_Cipher_clz.tryTransform.overload('java.security.Key', 'java.security.Provider', 'java.lang.String', '[Ljava.lang.String;', 'javax.crypto.Cipher$NeedToSet');
+ javax_crypto_Cipher_clz_method_tryTransform_s2x4.implementation = function(v0, v1, v2, v3, v4) {
+ var ret = javax_crypto_Cipher_clz_method_tryTransform_s2x4.call(javax_crypto_Cipher_clz, v0, v1, v2, v3, v4);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'private static org.apache.harmony.security.fortress.Engine$SpiAndProvider javax.crypto.Cipher.tryTransform(java.security.Key,java.security.Provider,java.lang.String,java.lang.String[],javax.crypto.Cipher$NeedToSet)', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_init_da7l = javax_crypto_Cipher_clz.init.overload('int', 'java.security.cert.Certificate', 'java.security.SecureRandom');
+ javax_crypto_Cipher_clz_method_init_da7l.implementation = function(v0, v1, v2) {
+ javax_crypto_Cipher_clz_method_init_da7l.call(this, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.init(int,java.security.cert.Certificate,java.security.SecureRandom) throws java.security.InvalidKeyException', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_update_ok86 = javax_crypto_Cipher_clz.update.overload('[B', 'int', 'int');
+ javax_crypto_Cipher_clz_method_update_ok86.implementation = function(v0, v1, v2) {
+ var ret = javax_crypto_Cipher_clz_method_update_ok86.call(this, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final [B javax.crypto.Cipher.update(byte[],int,int)', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getExemptionMechanism_lyot = javax_crypto_Cipher_clz.getExemptionMechanism.overload();
+ javax_crypto_Cipher_clz_method_getExemptionMechanism_lyot.implementation = function() {
+ var ret = javax_crypto_Cipher_clz_method_getExemptionMechanism_lyot.call(this);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final javax.crypto.ExemptionMechanism javax.crypto.Cipher.getExemptionMechanism()', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_tryCombinations_cyp9 = javax_crypto_Cipher_clz.tryCombinations.overload('java.security.Key', 'java.security.Provider', '[Ljava.lang.String;');
+ javax_crypto_Cipher_clz_method_tryCombinations_cyp9.implementation = function(v0, v1, v2) {
+ var ret = javax_crypto_Cipher_clz_method_tryCombinations_cyp9.call(javax_crypto_Cipher_clz, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'private static org.apache.harmony.security.fortress.Engine$SpiAndProvider javax.crypto.Cipher.tryCombinations(java.security.Key,java.security.Provider,java.lang.String[])', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_init_uuhl = javax_crypto_Cipher_clz.init.overload('int', 'java.security.cert.Certificate');
+ javax_crypto_Cipher_clz_method_init_uuhl.implementation = function(v0, v1) {
+ javax_crypto_Cipher_clz_method_init_uuhl.call(this, v0, v1);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.init(int,java.security.cert.Certificate) throws java.security.InvalidKeyException', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_getInstance_ot5d = javax_crypto_Cipher_clz.getInstance.overload('java.lang.String', 'java.lang.String');
+ javax_crypto_Cipher_clz_method_getInstance_ot5d.implementation = function(v0, v1) {
+ var ret = javax_crypto_Cipher_clz_method_getInstance_ot5d.call(javax_crypto_Cipher_clz, v0, v1);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'public static final javax.crypto.Cipher javax.crypto.Cipher.getInstance(java.lang.String,java.lang.String) throws java.security.NoSuchAlgorithmException,java.security.NoSuchProviderException,javax.crypto.NoSuchPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getOutputSize_f23n = javax_crypto_Cipher_clz.getOutputSize.overload('int');
+ javax_crypto_Cipher_clz_method_getOutputSize_f23n.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_getOutputSize_f23n.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final int javax.crypto.Cipher.getOutputSize(int)', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_update_tx68 = javax_crypto_Cipher_clz.update.overload('[B', 'int', 'int', '[B', 'int');
+ javax_crypto_Cipher_clz_method_update_tx68.implementation = function(v0, v1, v2, v3, v4) {
+ var ret = javax_crypto_Cipher_clz_method_update_tx68.call(this, v0, v1, v2, v3, v4);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final int javax.crypto.Cipher.update(byte[],int,int,byte[],int) throws javax.crypto.ShortBufferException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_doFinal_ihw9 = javax_crypto_Cipher_clz.doFinal.overload('[B', 'int', 'int', '[B', 'int');
+ javax_crypto_Cipher_clz_method_doFinal_ihw9.implementation = function(v0, v1, v2, v3, v4) {
+ var ret = javax_crypto_Cipher_clz_method_doFinal_ihw9.call(this, v0, v1, v2, v3, v4);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final int javax.crypto.Cipher.doFinal(byte[],int,int,byte[],int) throws javax.crypto.ShortBufferException,javax.crypto.IllegalBlockSizeException,javax.crypto.BadPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_init_34ei = javax_crypto_Cipher_clz.init.overload('int', 'java.security.Key', 'java.security.AlgorithmParameters', 'java.security.SecureRandom');
+ javax_crypto_Cipher_clz_method_init_34ei.implementation = function(v0, v1, v2, v3) {
+ javax_crypto_Cipher_clz_method_init_34ei.call(this, v0, v1, v2, v3);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.init(int,java.security.Key,java.security.AlgorithmParameters,java.security.SecureRandom) throws java.security.InvalidKeyException,java.security.InvalidAlgorithmParameterException', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_getAlgorithm_lyxb = javax_crypto_Cipher_clz.getAlgorithm.overload();
+ javax_crypto_Cipher_clz_method_getAlgorithm_lyxb.implementation = function() {
+ var ret = javax_crypto_Cipher_clz_method_getAlgorithm_lyxb.call(this);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final java.lang.String javax.crypto.Cipher.getAlgorithm()', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_invalidTransformation_ntcg = javax_crypto_Cipher_clz.invalidTransformation.overload('java.lang.String');
+ javax_crypto_Cipher_clz_method_invalidTransformation_ntcg.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_invalidTransformation_ntcg.call(javax_crypto_Cipher_clz, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'private static java.security.NoSuchAlgorithmException javax.crypto.Cipher.invalidTransformation(java.lang.String) throws java.security.NoSuchAlgorithmException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getInstance_oj4j = javax_crypto_Cipher_clz.getInstance.overload('java.lang.String', 'java.security.Provider');
+ javax_crypto_Cipher_clz_method_getInstance_oj4j.implementation = function(v0, v1) {
+ var ret = javax_crypto_Cipher_clz_method_getInstance_oj4j.call(javax_crypto_Cipher_clz, v0, v1);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'public static final javax.crypto.Cipher javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) throws java.security.NoSuchAlgorithmException,javax.crypto.NoSuchPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getCipher_2lau = javax_crypto_Cipher_clz.getCipher.overload('java.lang.String', 'java.security.Provider');
+ javax_crypto_Cipher_clz_method_getCipher_2lau.implementation = function(v0, v1) {
+ var ret = javax_crypto_Cipher_clz_method_getCipher_2lau.call(javax_crypto_Cipher_clz, v0, v1);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'private static javax.crypto.Cipher javax.crypto.Cipher.getCipher(java.lang.String,java.security.Provider) throws java.security.NoSuchAlgorithmException,javax.crypto.NoSuchPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_checkInputOffsetAndCount_q4ed = javax_crypto_Cipher_clz.checkInputOffsetAndCount.overload('int', 'int', 'int');
+ javax_crypto_Cipher_clz_method_checkInputOffsetAndCount_q4ed.implementation = function(v0, v1, v2) {
+ javax_crypto_Cipher_clz_method_checkInputOffsetAndCount_q4ed.call(javax_crypto_Cipher_clz, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'private static void javax.crypto.Cipher.checkInputOffsetAndCount(int,int,int)', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_update_mmvk = javax_crypto_Cipher_clz.update.overload('java.nio.ByteBuffer', 'java.nio.ByteBuffer');
+ javax_crypto_Cipher_clz_method_update_mmvk.implementation = function(v0, v1) {
+ var ret = javax_crypto_Cipher_clz_method_update_mmvk.call(this, v0, v1);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final int javax.crypto.Cipher.update(java.nio.ByteBuffer,java.nio.ByteBuffer) throws javax.crypto.ShortBufferException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getProvider_u7pr = javax_crypto_Cipher_clz.getProvider.overload();
+ javax_crypto_Cipher_clz_method_getProvider_u7pr.implementation = function() {
+ var ret = javax_crypto_Cipher_clz_method_getProvider_u7pr.call(this);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final java.security.Provider javax.crypto.Cipher.getProvider()', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_updateAAD_alep = javax_crypto_Cipher_clz.updateAAD.overload('[B', 'int', 'int');
+ javax_crypto_Cipher_clz_method_updateAAD_alep.implementation = function(v0, v1, v2) {
+ javax_crypto_Cipher_clz_method_updateAAD_alep.call(this, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.updateAAD(byte[],int,int)', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_getMaxAllowedKeyLength_4cvh = javax_crypto_Cipher_clz.getMaxAllowedKeyLength.overload('java.lang.String');
+ javax_crypto_Cipher_clz_method_getMaxAllowedKeyLength_4cvh.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_getMaxAllowedKeyLength_4cvh.call(javax_crypto_Cipher_clz, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'public static final int javax.crypto.Cipher.getMaxAllowedKeyLength(java.lang.String) throws java.security.NoSuchAlgorithmException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_update_bto4 = javax_crypto_Cipher_clz.update.overload('[B');
+ javax_crypto_Cipher_clz_method_update_bto4.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_update_bto4.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final [B javax.crypto.Cipher.update(byte[])', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_doFinal_dxgo = javax_crypto_Cipher_clz.doFinal.overload('[B', 'int', 'int', '[B');
+ javax_crypto_Cipher_clz_method_doFinal_dxgo.implementation = function(v0, v1, v2, v3) {
+ var ret = javax_crypto_Cipher_clz_method_doFinal_dxgo.call(this, v0, v1, v2, v3);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final int javax.crypto.Cipher.doFinal(byte[],int,int,byte[]) throws javax.crypto.ShortBufferException,javax.crypto.IllegalBlockSizeException,javax.crypto.BadPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getInstance_03ug = javax_crypto_Cipher_clz.getInstance.overload('java.lang.String');
+ javax_crypto_Cipher_clz_method_getInstance_03ug.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_getInstance_03ug.call(javax_crypto_Cipher_clz, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'public static final javax.crypto.Cipher javax.crypto.Cipher.getInstance(java.lang.String) throws java.security.NoSuchAlgorithmException,javax.crypto.NoSuchPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_init_u19e = javax_crypto_Cipher_clz.init.overload('int', 'java.security.Key', 'java.security.AlgorithmParameters');
+ javax_crypto_Cipher_clz_method_init_u19e.implementation = function(v0, v1, v2) {
+ javax_crypto_Cipher_clz_method_init_u19e.call(this, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.init(int,java.security.Key,java.security.AlgorithmParameters) throws java.security.InvalidKeyException,java.security.InvalidAlgorithmParameterException', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_updateAAD_ojmm = javax_crypto_Cipher_clz.updateAAD.overload('java.nio.ByteBuffer');
+ javax_crypto_Cipher_clz_method_updateAAD_ojmm.implementation = function(v0) {
+ javax_crypto_Cipher_clz_method_updateAAD_ojmm.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.updateAAD(java.nio.ByteBuffer)', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_doFinal_ixw8 = javax_crypto_Cipher_clz.doFinal.overload('[B', 'int', 'int');
+ javax_crypto_Cipher_clz_method_doFinal_ixw8.implementation = function(v0, v1, v2) {
+ var ret = javax_crypto_Cipher_clz_method_doFinal_ixw8.call(this, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final [B javax.crypto.Cipher.doFinal(byte[],int,int) throws javax.crypto.IllegalBlockSizeException,javax.crypto.BadPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getBlockSize_wjca = javax_crypto_Cipher_clz.getBlockSize.overload();
+ javax_crypto_Cipher_clz_method_getBlockSize_wjca.implementation = function() {
+ var ret = javax_crypto_Cipher_clz_method_getBlockSize_wjca.call(this);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final int javax.crypto.Cipher.getBlockSize()', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_wrap_05i9 = javax_crypto_Cipher_clz.wrap.overload('java.security.Key');
+ javax_crypto_Cipher_clz_method_wrap_05i9.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_wrap_05i9.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final [B javax.crypto.Cipher.wrap(java.security.Key) throws javax.crypto.IllegalBlockSizeException,java.security.InvalidKeyException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getMaxAllowedParameterSpec_cp3m = javax_crypto_Cipher_clz.getMaxAllowedParameterSpec.overload('java.lang.String');
+ javax_crypto_Cipher_clz_method_getMaxAllowedParameterSpec_cp3m.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_getMaxAllowedParameterSpec_cp3m.call(javax_crypto_Cipher_clz, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'public static final java.security.spec.AlgorithmParameterSpec javax.crypto.Cipher.getMaxAllowedParameterSpec(java.lang.String) throws java.security.NoSuchAlgorithmException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_checkTransformation_qoag = javax_crypto_Cipher_clz.checkTransformation.overload('java.lang.String');
+ javax_crypto_Cipher_clz_method_checkTransformation_qoag.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_checkTransformation_qoag.call(javax_crypto_Cipher_clz, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'private static [Ljava.lang.String; javax.crypto.Cipher.checkTransformation(java.lang.String) throws java.security.NoSuchAlgorithmException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getParameters_6auy = javax_crypto_Cipher_clz.getParameters.overload();
+ javax_crypto_Cipher_clz_method_getParameters_6auy.implementation = function() {
+ var ret = javax_crypto_Cipher_clz_method_getParameters_6auy.call(this);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final java.security.AlgorithmParameters javax.crypto.Cipher.getParameters()', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getSpi_963r = javax_crypto_Cipher_clz.getSpi.overload('java.security.Key');
+ javax_crypto_Cipher_clz_method_getSpi_963r.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_getSpi_963r.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'private javax.crypto.CipherSpi javax.crypto.Cipher.getSpi(java.security.Key)', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_doFinal_k1n2 = javax_crypto_Cipher_clz.doFinal.overload('[B');
+ javax_crypto_Cipher_clz_method_doFinal_k1n2.implementation = function(v0) {
+ var ret = javax_crypto_Cipher_clz_method_doFinal_k1n2.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final [B javax.crypto.Cipher.doFinal(byte[]) throws javax.crypto.IllegalBlockSizeException,javax.crypto.BadPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getSpi_vlc2 = javax_crypto_Cipher_clz.getSpi.overload();
+ javax_crypto_Cipher_clz_method_getSpi_vlc2.implementation = function() {
+ var ret = javax_crypto_Cipher_clz_method_getSpi_vlc2.call(this);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'private javax.crypto.CipherSpi javax.crypto.Cipher.getSpi()', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_getIV_2b1b = javax_crypto_Cipher_clz.getIV.overload();
+ javax_crypto_Cipher_clz_method_getIV_2b1b.implementation = function() {
+ var ret = javax_crypto_Cipher_clz_method_getIV_2b1b.call(this);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final [B javax.crypto.Cipher.getIV()', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_unwrap_azqe = javax_crypto_Cipher_clz.unwrap.overload('[B', 'java.lang.String', 'int');
+ javax_crypto_Cipher_clz_method_unwrap_azqe.implementation = function(v0, v1, v2) {
+ var ret = javax_crypto_Cipher_clz_method_unwrap_azqe.call(this, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final java.security.Key javax.crypto.Cipher.unwrap(byte[],java.lang.String,int) throws java.security.InvalidKeyException,java.security.NoSuchAlgorithmException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_init_l66q = javax_crypto_Cipher_clz.init.overload('int', 'java.security.Key');
+ javax_crypto_Cipher_clz_method_init_l66q.implementation = function(v0, v1) {
+ javax_crypto_Cipher_clz_method_init_l66q.call(this, v0, v1);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.init(int,java.security.Key) throws java.security.InvalidKeyException', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_init_w1fs = javax_crypto_Cipher_clz.init.overload('int', 'java.security.Key', 'java.security.spec.AlgorithmParameterSpec', 'java.security.SecureRandom');
+ javax_crypto_Cipher_clz_method_init_w1fs.implementation = function(v0, v1, v2, v3) {
+ javax_crypto_Cipher_clz_method_init_w1fs.call(this, v0, v1, v2, v3);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.init(int,java.security.Key,java.security.spec.AlgorithmParameterSpec,java.security.SecureRandom) throws java.security.InvalidKeyException,java.security.InvalidAlgorithmParameterException', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_tryTransformWithProvider_an3a = javax_crypto_Cipher_clz.tryTransformWithProvider.overload('java.security.Key', '[Ljava.lang.String;', 'javax.crypto.Cipher$NeedToSet', 'java.security.Provider$Service');
+ javax_crypto_Cipher_clz_method_tryTransformWithProvider_an3a.implementation = function(v0, v1, v2, v3) {
+ var ret = javax_crypto_Cipher_clz_method_tryTransformWithProvider_an3a.call(javax_crypto_Cipher_clz, v0, v1, v2, v3);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'private static org.apache.harmony.security.fortress.Engine$SpiAndProvider javax.crypto.Cipher.tryTransformWithProvider(java.security.Key,java.lang.String[],javax.crypto.Cipher$NeedToSet,java.security.Provider$Service)', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_checkMode_8g2b = javax_crypto_Cipher_clz.checkMode.overload('int');
+ javax_crypto_Cipher_clz_method_checkMode_8g2b.implementation = function(v0) {
+ javax_crypto_Cipher_clz_method_checkMode_8g2b.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'private void javax.crypto.Cipher.checkMode(int)', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_update_ll68 = javax_crypto_Cipher_clz.update.overload('[B', 'int', 'int', '[B');
+ javax_crypto_Cipher_clz_method_update_ll68.implementation = function(v0, v1, v2, v3) {
+ var ret = javax_crypto_Cipher_clz_method_update_ll68.call(this, v0, v1, v2, v3);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final int javax.crypto.Cipher.update(byte[],int,int,byte[]) throws javax.crypto.ShortBufferException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_doFinal_62jl = javax_crypto_Cipher_clz.doFinal.overload();
+ javax_crypto_Cipher_clz_method_doFinal_62jl.implementation = function() {
+ var ret = javax_crypto_Cipher_clz_method_doFinal_62jl.call(this);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final [B javax.crypto.Cipher.doFinal() throws javax.crypto.IllegalBlockSizeException,javax.crypto.BadPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_init_c9qo = javax_crypto_Cipher_clz.init.overload('int', 'java.security.Key', 'java.security.SecureRandom');
+ javax_crypto_Cipher_clz_method_init_c9qo.implementation = function(v0, v1, v2) {
+ javax_crypto_Cipher_clz_method_init_c9qo.call(this, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.init(int,java.security.Key,java.security.SecureRandom) throws java.security.InvalidKeyException', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_doFinal_rso8 = javax_crypto_Cipher_clz.doFinal.overload('[B', 'int');
+ javax_crypto_Cipher_clz_method_doFinal_rso8.implementation = function(v0, v1) {
+ var ret = javax_crypto_Cipher_clz_method_doFinal_rso8.call(this, v0, v1);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final int javax.crypto.Cipher.doFinal(byte[],int) throws javax.crypto.IllegalBlockSizeException,javax.crypto.ShortBufferException,javax.crypto.BadPaddingException', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+ var javax_crypto_Cipher_clz_method_updateAAD_ry91 = javax_crypto_Cipher_clz.updateAAD.overload('[B');
+ javax_crypto_Cipher_clz_method_updateAAD_ry91.implementation = function(v0) {
+ javax_crypto_Cipher_clz_method_updateAAD_ry91.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'public final void javax.crypto.Cipher.updateAAD(byte[])', executor);
+ methodOutBeat(invokeId, startTime);
+ };
+ var javax_crypto_Cipher_clz_method_matchAttribute_mv6j = javax_crypto_Cipher_clz.matchAttribute.overload('java.security.Provider$Service', 'java.lang.String', 'java.lang.String');
+ javax_crypto_Cipher_clz_method_matchAttribute_mv6j.implementation = function(v0, v1, v2) {
+ var ret = javax_crypto_Cipher_clz_method_matchAttribute_mv6j.call(javax_crypto_Cipher_clz, v0, v1, v2);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'javax_crypto_Cipher_clz';
+ methodInBeat(invokeId, startTime, 'private static boolean javax.crypto.Cipher.matchAttribute(java.security.Provider$Service,java.lang.String,java.lang.String)', executor);
+ methodOutBeat(invokeId, startTime);
+ return ret;
+ };
+
+});
\ No newline at end of file
diff --git a/com.google.android.youtube/click.js b/com.google.android.youtube/click.js
new file mode 100644
index 0000000..70442e9
--- /dev/null
+++ b/com.google.android.youtube/click.js
@@ -0,0 +1,48 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ console.log("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id,name:" + currentThread.getId() +"," + currentThread.getName() + "),timestamp:" + startTime+"---------------");
+ console.log(methodName);
+ console.log(stackInfo.substring(20));
+ console.log("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+};
+
+function sleep(time) {
+ var startTime = new Date().getTime() + parseInt(time, 10);
+ while (new Date().getTime() < startTime) {}
+};
+
+function makeClass(className) {
+ var classClz = Java.use("java.lang.Class");
+ var forNameFunc = classClz.forName.overload("java.lang.String");
+ return forNameFunc.call(classClz, className);
+};
+
+function isClass(obj, superClzName) {
+ var objClz = obj.getClass();
+ var superClz = makeClass(superClzName);
+ return superClz.isAssignableFrom(objClz);
+};
+
+Java.perform(function() {
+ var textViewClz = Java.use("android.widget.TextView");
+ var android_view_View_clz = Java.use('android.view.View');
+ var android_view_View_clz_method_performClick_u6ef = android_view_View_clz.performClick.overload();
+ android_view_View_clz_method_performClick_u6ef.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'obj:' + this.hashCode();
+ var ret = android_view_View_clz_method_performClick_u6ef.call(this);
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ //console.log("ViewText: " + Java.cast(this, textViewClz).getText());
+ console.log("ViewClz: " + clz);
+ console.log("ViewId: " + viewId);
+ methodInBeat(invokeId, startTime, 'public boolean android.view.View.performClick()', executor);
+ return ret;
+ };
+});
\ No newline at end of file
diff --git a/com.google.android.youtube/edit_text.js b/com.google.android.youtube/edit_text.js
new file mode 100644
index 0000000..e6b8053
--- /dev/null
+++ b/com.google.android.youtube/edit_text.js
@@ -0,0 +1,96 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ console.log("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id,name:" + currentThread.getId() +"," + currentThread.getName() + "),timestamp:" + startTime+"---------------");
+ console.log(methodName);
+ console.log(stackInfo.substring(20));
+ console.log("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+};
+
+function makeClass(className) {
+ var classClz = Java.use("java.lang.Class");
+ var forNameFunc = classClz.forName.overload("java.lang.String");
+ return forNameFunc.call(classClz, className);
+};
+
+function isClass(obj, superClzName) {
+ var objClz = obj.getClass();
+ var superClz = makeClass(superClzName);
+ return superClz.isAssignableFrom(objClz);
+};
+
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+Java.perform(function() {
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var textViewClz = Java.use("android.widget.TextView");
+ var charSequenceClz = Java.use("java.lang.CharSequence");
+ if (textViewClz.setText) {
+ var setTextFunc = textViewClz.setText.overload("java.lang.CharSequence");
+ setTextFunc.implementation = function(v0) {
+ var startTime = new Date().getTime();
+ setTextFunc.call(this, v0);
+ if (isClass(this, "android.widget.EditText")) {
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("EditTextClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("text: " + v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'android.widget.EditText.setText()', executor);
+ }
+ };
+ }
+ //EditText的getText继承自TextView
+ if (textViewClz.getText) {
+ var getTextFunc = textViewClz.getText.overload();
+ getTextFunc.implementation = function() {
+ var startTime = new Date().getTime();
+ var editable = getTextFunc.call(this);
+ if (isClass(this, "android.widget.EditText")) {
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("EditTextClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text: " + Java.cast(editable, charSequenceClz));
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'android.widget.EditText.getText()', executor);
+ }
+ return editable;
+ };
+ }
+ //AppCompatEditText 有自定义的getText所以单独hook
+ if (classExists("androidx.appcompat.widget.AppCompatEditText")) {
+ var appCompatEditTextClz = Java.use("androidx.appcompat.widget.AppCompatEditText");
+ var appCompatEditTextClzGetTextFunc = appCompatEditTextClz.getText.overload();
+ appCompatEditTextClzGetTextFunc.implementation = function() {
+ var startTime = new Date().getTime();
+ var editable = appCompatEditTextClzGetTextFunc.call(this);
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("EditTextClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text: " + Java.cast(editable, charSequenceClz));
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, 'androidx.appcompat.widget.AppCompatEditText.getText()', executor);
+ return editable;
+ };
+ }
+});
\ No newline at end of file
diff --git a/com.google.android.youtube/hooking b/com.google.android.youtube/hooking
new file mode 100755
index 0000000..5beeea7
--- /dev/null
+++ b/com.google.android.youtube/hooking
@@ -0,0 +1,4 @@
+#!/bin/bash
+echo "hooking $1" > log
+date | tee -ai log
+frida -U -l $1 com.google.android.youtube | tee -ai log
\ No newline at end of file
diff --git a/com.google.android.youtube/interacting b/com.google.android.youtube/interacting
new file mode 100755
index 0000000..23443d8
--- /dev/null
+++ b/com.google.android.youtube/interacting
@@ -0,0 +1,2 @@
+#!/bin/bash
+frida -U -l $1 com.google.android.youtube
\ No newline at end of file
diff --git a/com.google.android.youtube/ipc.js b/com.google.android.youtube/ipc.js
new file mode 100644
index 0000000..245bd6b
--- /dev/null
+++ b/com.google.android.youtube/ipc.js
@@ -0,0 +1,92 @@
+function printStacks(androidLogClz, exceptionClz, methodName) {
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ console.log(new Date().getTime()+":"+methodName);
+ console.log(stackInfo.substring(20));
+};
+
+Java.perform(function() {
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var ContextWrapper = Java.use("android.content.ContextWrapper");
+
+ if (ContextWrapper.sendBroadcast) {
+ // Ref: https://developer.android.com/reference/android/content/ContextWrapper.html#sendBroadcast(android.content.Intent)
+ ContextWrapper.sendBroadcast.overload("android.content.Intent").implementation = function(intent) {
+ console.log("Intent toString: " + intent.toString());
+ console.log("Intent getExtras: " + intent.getExtras());
+ console.log("Intent getFlags: " + intent.getFlags());
+ printStacks(androidLogClz, exceptionClz, 'android.content.ContextWrapper.sendBroadcast(android.content.Intent)');
+ return this.sendBroadcast.overload("android.content.Intent").apply(this, arguments);
+ };
+
+ // Ref: https://developer.android.com/reference/android/content/ContextWrapper.html#sendBroadcast(android.content.Intent, java.lang.String)
+ ContextWrapper.sendBroadcast.overload("android.content.Intent", "java.lang.String").implementation = function(intent, receiverPermission) {
+ console.log("Intent toString: " + intent.toString());
+ console.log("Intent getExtras: " + intent.getExtras());
+ console.log("Intent getFlags: " + intent.getFlags());
+ console.log("Intent receiverPermission: " + receiverPermission);
+ printStacks(androidLogClz, exceptionClz, 'android.content.ContextWrapper.sendBroadcast(android.content.Intent, java.lang.String)');
+ return this.sendBroadcast.overload("android.content.Intent", "java.lang.String").apply(this, arguments);
+ };
+ }
+
+ if (ContextWrapper.sendStickyBroadcast) {
+ // Ref: https://developer.android.com/reference/android/content/ContextWrapper.html#sendStickyBroadcast(android.content.Intent)
+ ContextWrapper.sendStickyBroadcast.overload("android.content.Intent").implementation = function(intent) {
+ console.log("Intent toString: " + intent.toString());
+ console.log("Intent getExtras: " + intent.getExtras());
+ console.log("Intent getFlags: " + intent.getFlags());
+ printStacks(androidLogClz, exceptionClz, 'android.content.ContextWrapper.sendStickyBroadcast(android.content.Intent)');
+ return this.sendStickyBroadcast.overload("android.content.Intent").apply(this, arguments);
+ };
+ }
+
+ if (ContextWrapper.startActivity) {
+ //Ref: https://developer.android.com/reference/android/content/ContextWrapper.html#startActivity(android.content.Intent)
+ ContextWrapper.startActivity.overload("android.content.Intent").implementation = function(intent) {
+ console.log("Intent: " + intent);
+ printStacks(androidLogClz, exceptionClz, 'android.content.ContextWrapper.startActivity(android.content.Intent)');
+ return this.startActivity.overload("android.content.Intent").apply(this, arguments);
+ };
+
+ //Ref: https://developer.android.com/reference/android/content/ContextWrapper.html#startActivity(android.content.Intent, android.os.Bundle)
+ ContextWrapper.startActivity.overload("android.content.Intent", "android.os.Bundle").implementation = function(intent, bundle) {
+ console.log("Intent: " + intent);
+ console.log("Bundle: " + bundle);
+ printStacks(androidLogClz, exceptionClz, 'android.content.ContextWrapper.startActivity(android.content.Intent, android.os.Bundle)');
+ return this.startActivity.overload("android.content.Intent", "android.os.Bundle").apply(this, arguments);
+ };
+ }
+
+ if (ContextWrapper.startService) {
+ //Ref: https://developer.android.com/reference/android/content/ContextWrapper.html#startService(android.content.Intent)
+ ContextWrapper.startService.implementation = function(service) {
+ console.log("startService: " + service);
+ printStacks(androidLogClz, exceptionClz, 'android.content.ContextWrapper.startService(android.content.Intent)');
+ return this.startService.apply(this, arguments);
+ };
+ }
+
+ if (ContextWrapper.stopService) {
+ //Ref: https://developer.android.com/reference/android/content/ContextWrapper.html#stopService(android.content.Intent)
+ ContextWrapper.stopService.implementation = function(name) {
+ console.log("stopService: " + name);
+ printStacks(androidLogClz, exceptionClz, 'android.content.ContextWrapper.stopService(android.content.Intent)');
+ return this.stopService.apply(this, arguments);
+ };
+ }
+
+ if (ContextWrapper.registerReceiver) {
+ //Ref: https://developer.android.com/reference/android/content/ContextWrapper.html#registerReceiver(android.content.BroadcastReceiver, android.content.IntentFilter)
+ ContextWrapper.registerReceiver.overload("android.content.BroadcastReceiver", "android.content.IntentFilter").implementation = function(receiver, filter) {
+ printStacks(androidLogClz, exceptionClz, 'android.content.ContextWrapper.registerReceiver(android.content.BroadcastReceiver, android.content.IntentFilter)');
+ return this.registerReceiver.apply(this, arguments);
+ };
+
+ //Ref: https://developer.android.com/reference/android/content/ContextWrapper.html#registerReceiver(android.content.BroadcastReceiver, android.content.IntentFilter, java.lang.String, android.os.Handler)
+ ContextWrapper.registerReceiver.overload("android.content.BroadcastReceiver", "android.content.IntentFilter", "java.lang.String", "android.os.Handler").implementation = function(receiver, filter, broadcastPermission, scheduler) {
+ printStacks(androidLogClz, exceptionClz, 'android.content.ContextWrapper.registerReceiver(android.content.BroadcastReceiver, android.content.IntentFilter, java.lang.String, android.os.Handler)');
+ return this.registerReceiver.apply(this, arguments);
+ };
+ }
+});
\ No newline at end of file
diff --git a/com.google.android.youtube/kill b/com.google.android.youtube/kill
new file mode 100755
index 0000000..b8c456d
--- /dev/null
+++ b/com.google.android.youtube/kill
@@ -0,0 +1 @@
+frida-kill -U com.google.android.youtube
\ No newline at end of file
diff --git a/com.google.android.youtube/log.js b/com.google.android.youtube/log.js
new file mode 100644
index 0000000..7d20aef
--- /dev/null
+++ b/com.google.android.youtube/log.js
@@ -0,0 +1,9 @@
+Java.perform(function() {
+ var androidLog = Java.use("android.util.Log");
+ var dMethod = androidLog.d.overload("java.lang.String", "java.lang.String");
+ dMethod.implementation = function(tag, message) {
+ var ret = dMethod.call(androidLog, tag, message);
+ console.log("androidLog.d:"+tag+" message:"+message);
+ return ret;
+ };
+});
\ No newline at end of file
diff --git a/com.google.android.youtube/text_view.js b/com.google.android.youtube/text_view.js
new file mode 100644
index 0000000..55287c4
--- /dev/null
+++ b/com.google.android.youtube/text_view.js
@@ -0,0 +1,49 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ console.log("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id,name:" + currentThread.getId() +"," + currentThread.getName() + "),timestamp:" + startTime+"---------------");
+ console.log(methodName);
+ console.log(stackInfo.substring(20));
+ console.log("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+};
+
+Java.perform(function() {
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var textViewClz = Java.use("android.widget.TextView");
+
+ if (textViewClz.setText) {
+ var setTextFunc = textViewClz.setText.overload("java.lang.CharSequence");
+ setTextFunc.implementation = function(v0) {
+ var startTime = new Date().getTime();
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ console.log("TextViewClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text:" + v0);
+ setTextFunc.call(this, v0);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, "android.widget.TextView.setText()", executor);
+ };
+ }
+ if (textViewClz.getText) {
+ var getTextFunc = textViewClz.getText.overload();
+ getTextFunc.implementation = function() {
+ var clz = this.getClass().getName();
+ var viewId = this.getId();
+ var editable = getTextFunc.call(this);
+ console.log("TextViewClz: " + clz);
+ console.log("ViewId: " + viewId);
+ console.log("Text: " + editable.toString());
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, "android.widget.TextView.getText()", executor);
+ return editable;
+ };
+ }
+});
\ No newline at end of file
diff --git a/com.google.android.youtube/url.js b/com.google.android.youtube/url.js
new file mode 100644
index 0000000..60dbcf3
--- /dev/null
+++ b/com.google.android.youtube/url.js
@@ -0,0 +1,98 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ console.log("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id,name:" + currentThread.getId() +"," + currentThread.getName() + "),timestamp:" + startTime+"---------------");
+ console.log(methodName);
+ console.log(stackInfo.substring(20));
+ console.log("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+};
+
+function tryGetClass(className) {
+ var clz = undefined;
+ try {
+ clz = Java.use(className);
+ } catch(e) {}
+ return clz;
+}
+
+var containRegExps = new Array()
+
+var notContainRegExps = new Array(RegExp(/\.jpg/))
+
+function check(str) {
+ str = str.toString();
+ if (! (str && str.match)) {
+ return false;
+ }
+ for (var i = 0; i < containRegExps.length; i++) {
+ if (!str.match(containRegExps[i])) {
+ return false;
+ }
+ }
+ for (var i = 0; i < notContainRegExps.length; i++) {
+ if (str.match(notContainRegExps[i])) {
+ return false;
+ }
+ }
+ return true;
+}
+
+Java.perform(function() {
+ // URL
+ var clz = Java.use('java.net.URL');
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var urlConstruct = clz.$init.overload("java.lang.String");
+ urlConstruct.implementation = function(url) {
+ var startTime = new Date().getTime();
+ var result = urlConstruct.call(this, url);
+ if (check(url)) {
+ console.log("url:" + url);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, "java.net.URL.$new()", executor);
+ }
+ return result;
+ };
+
+ //ok系统原生支持
+ var sysBuilderClz = tryGetClass('com.android.okhttp.Request$Builder');
+ if (sysBuilderClz) {
+ sysBuilderClz.build.implementation = function() {
+ var startTime = new Date().getTime();
+ var okRequestResult = this.build();
+ var httpUrl = okRequestResult.url();
+ var url = httpUrl.toString();
+ if (check(url)) {
+ console.log("url:" + url);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, "com.android.okhttp.Request.Builder.build()", executor);
+ }
+ return okRequestResult
+ };
+ }
+
+ //ok本地依赖
+ var builderClz = tryGetClass('okhttp3.Request$Builder');
+ if (builderClz) {
+ var buildFunc = builderClz.build.overload();
+ buildFunc.implementation = function() {
+ var startTime = new Date().getTime();
+ var okRequestResult = buildFunc.call(this);
+ var httpUrl = okRequestResult.url();
+ var url = httpUrl.toString();
+ if (check(url)) {
+ console.log("url:" + url);
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var executor = this.hashCode();
+ methodInBeat(invokeId, startTime, "okhttp3.Request.Builder.build()", executor);
+ }
+ return okRequestResult
+ };
+ }
+});
\ No newline at end of file
diff --git a/com.google.android.youtube/view_pager.js b/com.google.android.youtube/view_pager.js
new file mode 100644
index 0000000..a5d3999
--- /dev/null
+++ b/com.google.android.youtube/view_pager.js
@@ -0,0 +1,1626 @@
+function methodInBeat(invokeId, timestamp, methodName, executor) {
+ var startTime = timestamp;
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var threadClz = Java.use("java.lang.Thread");
+ var currentThread = threadClz.currentThread();
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ console.log("------------startFlag:" + invokeId + ",objectHash:"+executor+",thread(id,name:" + currentThread.getId() +"," + currentThread.getName() + "),timestamp:" + startTime+"---------------");
+ console.log(methodName);
+ console.log(stackInfo.substring(20));
+ console.log("------------endFlag:" + invokeId + ",usedtime:" + (new Date().getTime() - startTime) +"---------------\n");
+};
+
+function classExists(className) {
+ var exists = false;
+ try {
+ var clz = Java.use(className);
+ exists = true;
+ } catch(err) {
+ //console.log(err);
+ }
+ return exists;
+};
+
+function hookingAndroidV4ViewPager() {
+ if (!classExists("android.support.v4.view.ViewPager")) {
+ console.warn("Class android.support.v4.view.ViewPager not found.");
+ return;
+ }
+ var android_support_v4_view_ViewPager_clz = Java.use('android.support.v4.view.ViewPager');
+ var android_support_v4_view_ViewPager_clz_method_canScrollHorizontally_72ob = android_support_v4_view_ViewPager_clz.canScrollHorizontally.overload('int');
+ android_support_v4_view_ViewPager_clz_method_canScrollHorizontally_72ob.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_canScrollHorizontally_72ob.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean android.support.v4.view.ViewPager.canScrollHorizontally(int)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_onSaveInstanceState_95lm = android_support_v4_view_ViewPager_clz.onSaveInstanceState.overload();
+ android_support_v4_view_ViewPager_clz_method_onSaveInstanceState_95lm.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_onSaveInstanceState_95lm.call(this);
+ methodInBeat(invokeId, startTime, 'public android.os.Parcelable android.support.v4.view.ViewPager.onSaveInstanceState()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_onSizeChanged_oomc = android_support_v4_view_ViewPager_clz.onSizeChanged.overload('int', 'int', 'int', 'int');
+ android_support_v4_view_ViewPager_clz_method_onSizeChanged_oomc.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_onSizeChanged_oomc.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'protected void android.support.v4.view.ViewPager.onSizeChanged(int,int,int,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_pageRight_e3ai = android_support_v4_view_ViewPager_clz.pageRight.overload();
+ android_support_v4_view_ViewPager_clz_method_pageRight_e3ai.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_pageRight_e3ai.call(this);
+ methodInBeat(invokeId, startTime, 'boolean android.support.v4.view.ViewPager.pageRight()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_dispatchKeyEvent_u5sq = android_support_v4_view_ViewPager_clz.dispatchKeyEvent.overload('android.view.KeyEvent');
+ android_support_v4_view_ViewPager_clz_method_dispatchKeyEvent_u5sq.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_dispatchKeyEvent_u5sq.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean android.support.v4.view.ViewPager.dispatchKeyEvent(android.view.KeyEvent)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_getAdapter_72hx = android_support_v4_view_ViewPager_clz.getAdapter.overload();
+ android_support_v4_view_ViewPager_clz_method_getAdapter_72hx.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_getAdapter_72hx.call(this);
+ methodInBeat(invokeId, startTime, 'public android.support.v4.view.PagerAdapter android.support.v4.view.ViewPager.getAdapter()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_clearOnPageChangeListeners_aa1d = android_support_v4_view_ViewPager_clz.clearOnPageChangeListeners.overload();
+ android_support_v4_view_ViewPager_clz_method_clearOnPageChangeListeners_aa1d.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_clearOnPageChangeListeners_aa1d.call(this);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.clearOnPageChangeListeners()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_getChildRectInPagerCoordinates_day6 = android_support_v4_view_ViewPager_clz.getChildRectInPagerCoordinates.overload('android.graphics.Rect', 'android.view.View');
+ android_support_v4_view_ViewPager_clz_method_getChildRectInPagerCoordinates_day6.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_getChildRectInPagerCoordinates_day6.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'private android.graphics.Rect android.support.v4.view.ViewPager.getChildRectInPagerCoordinates(android.graphics.Rect,android.view.View)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_fakeDragBy_1srx = android_support_v4_view_ViewPager_clz.fakeDragBy.overload('float');
+ android_support_v4_view_ViewPager_clz_method_fakeDragBy_1srx.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_fakeDragBy_1srx.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.fakeDragBy(float)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_dataSetChanged_rqbg = android_support_v4_view_ViewPager_clz.dataSetChanged.overload();
+ android_support_v4_view_ViewPager_clz_method_dataSetChanged_rqbg.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_dataSetChanged_rqbg.call(this);
+ methodInBeat(invokeId, startTime, 'void android.support.v4.view.ViewPager.dataSetChanged()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_onLayout_cie4 = android_support_v4_view_ViewPager_clz.onLayout.overload('boolean', 'int', 'int', 'int', 'int');
+ android_support_v4_view_ViewPager_clz_method_onLayout_cie4.implementation = function(v0, v1, v2, v3, v4) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_onLayout_cie4.call(this, v0, v1, v2, v3, v4);
+ methodInBeat(invokeId, startTime, 'protected void android.support.v4.view.ViewPager.onLayout(boolean,int,int,int,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setCurrentItemInternal_1tkm = android_support_v4_view_ViewPager_clz.setCurrentItemInternal.overload('int', 'boolean', 'boolean', 'int');
+ android_support_v4_view_ViewPager_clz_method_setCurrentItemInternal_1tkm.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setCurrentItemInternal_1tkm.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'void android.support.v4.view.ViewPager.setCurrentItemInternal(int,boolean,boolean,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setCurrentItem_9toq = android_support_v4_view_ViewPager_clz.setCurrentItem.overload('int');
+ android_support_v4_view_ViewPager_clz_method_setCurrentItem_9toq.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setCurrentItem_9toq.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setCurrentItem(int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_pageScrolled_dj79 = android_support_v4_view_ViewPager_clz.pageScrolled.overload('int');
+ android_support_v4_view_ViewPager_clz_method_pageScrolled_dj79.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_pageScrolled_dj79.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private boolean android.support.v4.view.ViewPager.pageScrolled(int)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_addOnPageChangeListener_hfn8 = android_support_v4_view_ViewPager_clz.addOnPageChangeListener.overload('android.support.v4.view.ViewPager$OnPageChangeListener');
+ android_support_v4_view_ViewPager_clz_method_addOnPageChangeListener_hfn8.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_addOnPageChangeListener_hfn8.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.addOnPageChangeListener(android.support.v4.view.ViewPager$OnPageChangeListener)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_dispatchPopulateAccessibilityEvent_3afb = android_support_v4_view_ViewPager_clz.dispatchPopulateAccessibilityEvent.overload('android.view.accessibility.AccessibilityEvent');
+ android_support_v4_view_ViewPager_clz_method_dispatchPopulateAccessibilityEvent_3afb.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_dispatchPopulateAccessibilityEvent_3afb.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean android.support.v4.view.ViewPager.dispatchPopulateAccessibilityEvent(android.view.accessibility.AccessibilityEvent)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_setScrollingCacheEnabled_f7e9 = android_support_v4_view_ViewPager_clz.setScrollingCacheEnabled.overload('boolean');
+ android_support_v4_view_ViewPager_clz_method_setScrollingCacheEnabled_f7e9.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setScrollingCacheEnabled_f7e9.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.setScrollingCacheEnabled(boolean)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_infoForAnyChild_6efq = android_support_v4_view_ViewPager_clz.infoForAnyChild.overload('android.view.View');
+ android_support_v4_view_ViewPager_clz_method_infoForAnyChild_6efq.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_infoForAnyChild_6efq.call(this, v0);
+ methodInBeat(invokeId, startTime, 'android.support.v4.view.ViewPager$ItemInfo android.support.v4.view.ViewPager.infoForAnyChild(android.view.View)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_pageLeft_38se = android_support_v4_view_ViewPager_clz.pageLeft.overload();
+ android_support_v4_view_ViewPager_clz_method_pageLeft_38se.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_pageLeft_38se.call(this);
+ methodInBeat(invokeId, startTime, 'boolean android.support.v4.view.ViewPager.pageLeft()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_setScrollState_2p3f = android_support_v4_view_ViewPager_clz.setScrollState.overload('int');
+ android_support_v4_view_ViewPager_clz_method_setScrollState_2p3f.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setScrollState_2p3f.call(this, v0);
+ methodInBeat(invokeId, startTime, 'void android.support.v4.view.ViewPager.setScrollState(int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_isGutterDrag_f7ru = android_support_v4_view_ViewPager_clz.isGutterDrag.overload('float', 'float');
+ android_support_v4_view_ViewPager_clz_method_isGutterDrag_f7ru.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_isGutterDrag_f7ru.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'private boolean android.support.v4.view.ViewPager.isGutterDrag(float,float)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_completeScroll_ec01 = android_support_v4_view_ViewPager_clz.completeScroll.overload('boolean');
+ android_support_v4_view_ViewPager_clz_method_completeScroll_ec01.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_completeScroll_ec01.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.completeScroll(boolean)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_onRequestFocusInDescendants_fhrj = android_support_v4_view_ViewPager_clz.onRequestFocusInDescendants.overload('int', 'android.graphics.Rect');
+ android_support_v4_view_ViewPager_clz_method_onRequestFocusInDescendants_fhrj.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_onRequestFocusInDescendants_fhrj.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'protected boolean android.support.v4.view.ViewPager.onRequestFocusInDescendants(int,android.graphics.Rect)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_getPageMargin_wpn8 = android_support_v4_view_ViewPager_clz.getPageMargin.overload();
+ android_support_v4_view_ViewPager_clz_method_getPageMargin_wpn8.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_getPageMargin_wpn8.call(this);
+ methodInBeat(invokeId, startTime, 'public int android.support.v4.view.ViewPager.getPageMargin()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_removeOnAdapterChangeListener_n3hk = android_support_v4_view_ViewPager_clz.removeOnAdapterChangeListener.overload('android.support.v4.view.ViewPager$OnAdapterChangeListener');
+ android_support_v4_view_ViewPager_clz_method_removeOnAdapterChangeListener_n3hk.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_removeOnAdapterChangeListener_n3hk.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.removeOnAdapterChangeListener(android.support.v4.view.ViewPager$OnAdapterChangeListener)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_isFakeDragging_fdzo = android_support_v4_view_ViewPager_clz.isFakeDragging.overload();
+ android_support_v4_view_ViewPager_clz_method_isFakeDragging_fdzo.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_isFakeDragging_fdzo.call(this);
+ methodInBeat(invokeId, startTime, 'public boolean android.support.v4.view.ViewPager.isFakeDragging()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_removeNonDecorViews_svg1 = android_support_v4_view_ViewPager_clz.removeNonDecorViews.overload();
+ android_support_v4_view_ViewPager_clz_method_removeNonDecorViews_svg1.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_removeNonDecorViews_svg1.call(this);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.removeNonDecorViews()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_requestParentDisallowInterceptTouchEvent_194a = android_support_v4_view_ViewPager_clz.requestParentDisallowInterceptTouchEvent.overload('boolean');
+ android_support_v4_view_ViewPager_clz_method_requestParentDisallowInterceptTouchEvent_194a.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_requestParentDisallowInterceptTouchEvent_194a.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.requestParentDisallowInterceptTouchEvent(boolean)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_getOffscreenPageLimit_mqks = android_support_v4_view_ViewPager_clz.getOffscreenPageLimit.overload();
+ android_support_v4_view_ViewPager_clz_method_getOffscreenPageLimit_mqks.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_getOffscreenPageLimit_mqks.call(this);
+ methodInBeat(invokeId, startTime, 'public int android.support.v4.view.ViewPager.getOffscreenPageLimit()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_addTouchables_imkl = android_support_v4_view_ViewPager_clz.addTouchables.overload('java.util.ArrayList');
+ android_support_v4_view_ViewPager_clz_method_addTouchables_imkl.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_addTouchables_imkl.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.addTouchables(java.util.ArrayList)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_getClientWidth_b7kq = android_support_v4_view_ViewPager_clz.getClientWidth.overload();
+ android_support_v4_view_ViewPager_clz_method_getClientWidth_b7kq.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_getClientWidth_b7kq.call(this);
+ methodInBeat(invokeId, startTime, 'private int android.support.v4.view.ViewPager.getClientWidth()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_generateLayoutParams_bgb5 = android_support_v4_view_ViewPager_clz.generateLayoutParams.overload('android.view.ViewGroup$LayoutParams');
+ android_support_v4_view_ViewPager_clz_method_generateLayoutParams_bgb5.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_generateLayoutParams_bgb5.call(this, v0);
+ methodInBeat(invokeId, startTime, 'protected android.view.ViewGroup$LayoutParams android.support.v4.view.ViewPager.generateLayoutParams(android.view.ViewGroup$LayoutParams)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_drawableStateChanged_4uae = android_support_v4_view_ViewPager_clz.drawableStateChanged.overload();
+ android_support_v4_view_ViewPager_clz_method_drawableStateChanged_4uae.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_drawableStateChanged_4uae.call(this);
+ methodInBeat(invokeId, startTime, 'protected void android.support.v4.view.ViewPager.drawableStateChanged()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_infoForPosition_xej7 = android_support_v4_view_ViewPager_clz.infoForPosition.overload('int');
+ android_support_v4_view_ViewPager_clz_method_infoForPosition_xej7.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_infoForPosition_xej7.call(this, v0);
+ methodInBeat(invokeId, startTime, 'android.support.v4.view.ViewPager$ItemInfo android.support.v4.view.ViewPager.infoForPosition(int)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_scrollToItem_ooah = android_support_v4_view_ViewPager_clz.scrollToItem.overload('int', 'boolean', 'int', 'boolean');
+ android_support_v4_view_ViewPager_clz_method_scrollToItem_ooah.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_scrollToItem_ooah.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.scrollToItem(int,boolean,int,boolean)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_onTouchEvent_qhgu = android_support_v4_view_ViewPager_clz.onTouchEvent.overload('android.view.MotionEvent');
+ android_support_v4_view_ViewPager_clz_method_onTouchEvent_qhgu.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_onTouchEvent_qhgu.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean android.support.v4.view.ViewPager.onTouchEvent(android.view.MotionEvent)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_generateLayoutParams_ftfu = android_support_v4_view_ViewPager_clz.generateLayoutParams.overload('android.util.AttributeSet');
+ android_support_v4_view_ViewPager_clz_method_generateLayoutParams_ftfu.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_generateLayoutParams_ftfu.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public android.view.ViewGroup$LayoutParams android.support.v4.view.ViewPager.generateLayoutParams(android.util.AttributeSet)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_setPageMarginDrawable_9t8s = android_support_v4_view_ViewPager_clz.setPageMarginDrawable.overload('android.graphics.drawable.Drawable');
+ android_support_v4_view_ViewPager_clz_method_setPageMarginDrawable_9t8s.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setPageMarginDrawable_9t8s.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setPageMarginDrawable(android.graphics.drawable.Drawable)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_determineTargetPage_oalp = android_support_v4_view_ViewPager_clz.determineTargetPage.overload('int', 'float', 'int', 'int');
+ android_support_v4_view_ViewPager_clz_method_determineTargetPage_oalp.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_determineTargetPage_oalp.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'private int android.support.v4.view.ViewPager.determineTargetPage(int,float,int,int)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_resetTouch_moyn = android_support_v4_view_ViewPager_clz.resetTouch.overload();
+ android_support_v4_view_ViewPager_clz_method_resetTouch_moyn.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_resetTouch_moyn.call(this);
+ methodInBeat(invokeId, startTime, 'private boolean android.support.v4.view.ViewPager.resetTouch()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_endFakeDrag_y9y4 = android_support_v4_view_ViewPager_clz.endFakeDrag.overload();
+ android_support_v4_view_ViewPager_clz_method_endFakeDrag_y9y4.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_endFakeDrag_y9y4.call(this);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.endFakeDrag()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_populate_0445 = android_support_v4_view_ViewPager_clz.populate.overload();
+ android_support_v4_view_ViewPager_clz_method_populate_0445.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_populate_0445.call(this);
+ methodInBeat(invokeId, startTime, 'void android.support.v4.view.ViewPager.populate()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setOffscreenPageLimit_nmyt = android_support_v4_view_ViewPager_clz.setOffscreenPageLimit.overload('int');
+ android_support_v4_view_ViewPager_clz_method_setOffscreenPageLimit_nmyt.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setOffscreenPageLimit_nmyt.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setOffscreenPageLimit(int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_getCurrentItem_98is = android_support_v4_view_ViewPager_clz.getCurrentItem.overload();
+ android_support_v4_view_ViewPager_clz_method_getCurrentItem_98is.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_getCurrentItem_98is.call(this);
+ methodInBeat(invokeId, startTime, 'public int android.support.v4.view.ViewPager.getCurrentItem()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_onAttachedToWindow_kwdd = android_support_v4_view_ViewPager_clz.onAttachedToWindow.overload();
+ android_support_v4_view_ViewPager_clz_method_onAttachedToWindow_kwdd.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_onAttachedToWindow_kwdd.call(this);
+ methodInBeat(invokeId, startTime, 'protected void android.support.v4.view.ViewPager.onAttachedToWindow()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setAdapter_xkla = android_support_v4_view_ViewPager_clz.setAdapter.overload('android.support.v4.view.PagerAdapter');
+ android_support_v4_view_ViewPager_clz_method_setAdapter_xkla.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setAdapter_xkla.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setAdapter(android.support.v4.view.PagerAdapter)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_performDrag_59d7 = android_support_v4_view_ViewPager_clz.performDrag.overload('float');
+ android_support_v4_view_ViewPager_clz_method_performDrag_59d7.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_performDrag_59d7.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private boolean android.support.v4.view.ViewPager.performDrag(float)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_isDecorView_n7k5 = android_support_v4_view_ViewPager_clz.isDecorView.overload('android.view.View');
+ android_support_v4_view_ViewPager_clz_method_isDecorView_n7k5.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'Class';
+ var ret = android_support_v4_view_ViewPager_clz_method_isDecorView_n7k5.call(android_support_v4_view_ViewPager_clz, v0);
+ methodInBeat(invokeId, startTime, 'private static boolean android.support.v4.view.ViewPager.isDecorView(android.view.View)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_setPageMargin_fwzk = android_support_v4_view_ViewPager_clz.setPageMargin.overload('int');
+ android_support_v4_view_ViewPager_clz_method_setPageMargin_fwzk.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setPageMargin_fwzk.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setPageMargin(int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_removeView_bj1a = android_support_v4_view_ViewPager_clz.removeView.overload('android.view.View');
+ android_support_v4_view_ViewPager_clz_method_removeView_bj1a.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_removeView_bj1a.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.removeView(android.view.View)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_verifyDrawable_k5us = android_support_v4_view_ViewPager_clz.verifyDrawable.overload('android.graphics.drawable.Drawable');
+ android_support_v4_view_ViewPager_clz_method_verifyDrawable_k5us.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_verifyDrawable_k5us.call(this, v0);
+ methodInBeat(invokeId, startTime, 'protected boolean android.support.v4.view.ViewPager.verifyDrawable(android.graphics.drawable.Drawable)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_onDetachedFromWindow_dkyj = android_support_v4_view_ViewPager_clz.onDetachedFromWindow.overload();
+ android_support_v4_view_ViewPager_clz_method_onDetachedFromWindow_dkyj.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_onDetachedFromWindow_dkyj.call(this);
+ methodInBeat(invokeId, startTime, 'protected void android.support.v4.view.ViewPager.onDetachedFromWindow()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_populate_h8aj = android_support_v4_view_ViewPager_clz.populate.overload('int');
+ android_support_v4_view_ViewPager_clz_method_populate_h8aj.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_populate_h8aj.call(this, v0);
+ methodInBeat(invokeId, startTime, 'void android.support.v4.view.ViewPager.populate(int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_addFocusables_sglh = android_support_v4_view_ViewPager_clz.addFocusables.overload('java.util.ArrayList', 'int', 'int');
+ android_support_v4_view_ViewPager_clz_method_addFocusables_sglh.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_addFocusables_sglh.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.addFocusables(java.util.ArrayList,int,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_infoForChild_1lp9 = android_support_v4_view_ViewPager_clz.infoForChild.overload('android.view.View');
+ android_support_v4_view_ViewPager_clz_method_infoForChild_1lp9.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_infoForChild_1lp9.call(this, v0);
+ methodInBeat(invokeId, startTime, 'android.support.v4.view.ViewPager$ItemInfo android.support.v4.view.ViewPager.infoForChild(android.view.View)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_smoothScrollTo_b5qt = android_support_v4_view_ViewPager_clz.smoothScrollTo.overload('int', 'int', 'int');
+ android_support_v4_view_ViewPager_clz_method_smoothScrollTo_b5qt.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_smoothScrollTo_b5qt.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'void android.support.v4.view.ViewPager.smoothScrollTo(int,int,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_onMeasure_z925 = android_support_v4_view_ViewPager_clz.onMeasure.overload('int', 'int');
+ android_support_v4_view_ViewPager_clz_method_onMeasure_z925.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_onMeasure_z925.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'protected void android.support.v4.view.ViewPager.onMeasure(int,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_sortChildDrawingOrder_k87f = android_support_v4_view_ViewPager_clz.sortChildDrawingOrder.overload();
+ android_support_v4_view_ViewPager_clz_method_sortChildDrawingOrder_k87f.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_sortChildDrawingOrder_k87f.call(this);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.sortChildDrawingOrder()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_getChildDrawingOrder_0hcs = android_support_v4_view_ViewPager_clz.getChildDrawingOrder.overload('int', 'int');
+ android_support_v4_view_ViewPager_clz_method_getChildDrawingOrder_0hcs.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_getChildDrawingOrder_0hcs.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'protected int android.support.v4.view.ViewPager.getChildDrawingOrder(int,int)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_executeKeyEvent_jvie = android_support_v4_view_ViewPager_clz.executeKeyEvent.overload('android.view.KeyEvent');
+ android_support_v4_view_ViewPager_clz_method_executeKeyEvent_jvie.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_executeKeyEvent_jvie.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean android.support.v4.view.ViewPager.executeKeyEvent(android.view.KeyEvent)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_beginFakeDrag_d1ph = android_support_v4_view_ViewPager_clz.beginFakeDrag.overload();
+ android_support_v4_view_ViewPager_clz_method_beginFakeDrag_d1ph.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_beginFakeDrag_d1ph.call(this);
+ methodInBeat(invokeId, startTime, 'public boolean android.support.v4.view.ViewPager.beginFakeDrag()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_endDrag_vk1u = android_support_v4_view_ViewPager_clz.endDrag.overload();
+ android_support_v4_view_ViewPager_clz_method_endDrag_vk1u.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_endDrag_vk1u.call(this);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.endDrag()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_onDraw_4ser = android_support_v4_view_ViewPager_clz.onDraw.overload('android.graphics.Canvas');
+ android_support_v4_view_ViewPager_clz_method_onDraw_4ser.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_onDraw_4ser.call(this, v0);
+ methodInBeat(invokeId, startTime, 'protected void android.support.v4.view.ViewPager.onDraw(android.graphics.Canvas)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setPageTransformer_zkfn = android_support_v4_view_ViewPager_clz.setPageTransformer.overload('boolean', 'android.support.v4.view.ViewPager$PageTransformer');
+ android_support_v4_view_ViewPager_clz_method_setPageTransformer_zkfn.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setPageTransformer_zkfn.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setPageTransformer(boolean,android.support.v4.view.ViewPager$PageTransformer)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_recomputeScrollPosition_fqyb = android_support_v4_view_ViewPager_clz.recomputeScrollPosition.overload('int', 'int', 'int', 'int');
+ android_support_v4_view_ViewPager_clz_method_recomputeScrollPosition_fqyb.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_recomputeScrollPosition_fqyb.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.recomputeScrollPosition(int,int,int,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_computeScroll_fcwk = android_support_v4_view_ViewPager_clz.computeScroll.overload();
+ android_support_v4_view_ViewPager_clz_method_computeScroll_fcwk.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_computeScroll_fcwk.call(this);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.computeScroll()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_canScroll_0jjk = android_support_v4_view_ViewPager_clz.canScroll.overload('android.view.View', 'boolean', 'int', 'int', 'int');
+ android_support_v4_view_ViewPager_clz_method_canScroll_0jjk.implementation = function(v0, v1, v2, v3, v4) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_canScroll_0jjk.call(this, v0, v1, v2, v3, v4);
+ methodInBeat(invokeId, startTime, 'protected boolean android.support.v4.view.ViewPager.canScroll(android.view.View,boolean,int,int,int)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_setOnPageChangeListener_o8n7 = android_support_v4_view_ViewPager_clz.setOnPageChangeListener.overload('android.support.v4.view.ViewPager$OnPageChangeListener');
+ android_support_v4_view_ViewPager_clz_method_setOnPageChangeListener_o8n7.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setOnPageChangeListener_o8n7.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setOnPageChangeListener(android.support.v4.view.ViewPager$OnPageChangeListener)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setPageTransformer_x9od = android_support_v4_view_ViewPager_clz.setPageTransformer.overload('boolean', 'android.support.v4.view.ViewPager$PageTransformer', 'int');
+ android_support_v4_view_ViewPager_clz_method_setPageTransformer_x9od.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setPageTransformer_x9od.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setPageTransformer(boolean,android.support.v4.view.ViewPager$PageTransformer,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_removeOnPageChangeListener_y6ad = android_support_v4_view_ViewPager_clz.removeOnPageChangeListener.overload('android.support.v4.view.ViewPager$OnPageChangeListener');
+ android_support_v4_view_ViewPager_clz_method_removeOnPageChangeListener_y6ad.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_removeOnPageChangeListener_y6ad.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.removeOnPageChangeListener(android.support.v4.view.ViewPager$OnPageChangeListener)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setPageMarginDrawable_8ifn = android_support_v4_view_ViewPager_clz.setPageMarginDrawable.overload('int');
+ android_support_v4_view_ViewPager_clz_method_setPageMarginDrawable_8ifn.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setPageMarginDrawable_8ifn.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setPageMarginDrawable(int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_distanceInfluenceForSnapDuration_9iyg = android_support_v4_view_ViewPager_clz.distanceInfluenceForSnapDuration.overload('float');
+ android_support_v4_view_ViewPager_clz_method_distanceInfluenceForSnapDuration_9iyg.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_distanceInfluenceForSnapDuration_9iyg.call(this, v0);
+ methodInBeat(invokeId, startTime, 'float android.support.v4.view.ViewPager.distanceInfluenceForSnapDuration(float)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_initViewPager_sd08 = android_support_v4_view_ViewPager_clz.initViewPager.overload();
+ android_support_v4_view_ViewPager_clz_method_initViewPager_sd08.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_initViewPager_sd08.call(this);
+ methodInBeat(invokeId, startTime, 'void android.support.v4.view.ViewPager.initViewPager()', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setInternalPageChangeListener_pj5b = android_support_v4_view_ViewPager_clz.setInternalPageChangeListener.overload('android.support.v4.view.ViewPager$OnPageChangeListener');
+ android_support_v4_view_ViewPager_clz_method_setInternalPageChangeListener_pj5b.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_setInternalPageChangeListener_pj5b.call(this, v0);
+ methodInBeat(invokeId, startTime, 'android.support.v4.view.ViewPager$OnPageChangeListener android.support.v4.view.ViewPager.setInternalPageChangeListener(android.support.v4.view.ViewPager$OnPageChangeListener)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_onInterceptTouchEvent_vlt5 = android_support_v4_view_ViewPager_clz.onInterceptTouchEvent.overload('android.view.MotionEvent');
+ android_support_v4_view_ViewPager_clz_method_onInterceptTouchEvent_vlt5.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_onInterceptTouchEvent_vlt5.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean android.support.v4.view.ViewPager.onInterceptTouchEvent(android.view.MotionEvent)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_arrowScroll_8ntk = android_support_v4_view_ViewPager_clz.arrowScroll.overload('int');
+ android_support_v4_view_ViewPager_clz_method_arrowScroll_8ntk.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_arrowScroll_8ntk.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean android.support.v4.view.ViewPager.arrowScroll(int)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_addNewItem_5uui = android_support_v4_view_ViewPager_clz.addNewItem.overload('int', 'int');
+ android_support_v4_view_ViewPager_clz_method_addNewItem_5uui.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_addNewItem_5uui.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'android.support.v4.view.ViewPager$ItemInfo android.support.v4.view.ViewPager.addNewItem(int,int)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_checkLayoutParams_3hwh = android_support_v4_view_ViewPager_clz.checkLayoutParams.overload('android.view.ViewGroup$LayoutParams');
+ android_support_v4_view_ViewPager_clz_method_checkLayoutParams_3hwh.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_checkLayoutParams_3hwh.call(this, v0);
+ methodInBeat(invokeId, startTime, 'protected boolean android.support.v4.view.ViewPager.checkLayoutParams(android.view.ViewGroup$LayoutParams)', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_dispatchOnScrollStateChanged_29vq = android_support_v4_view_ViewPager_clz.dispatchOnScrollStateChanged.overload('int');
+ android_support_v4_view_ViewPager_clz_method_dispatchOnScrollStateChanged_29vq.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_dispatchOnScrollStateChanged_29vq.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.dispatchOnScrollStateChanged(int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_enableLayers_rtjj = android_support_v4_view_ViewPager_clz.enableLayers.overload('boolean');
+ android_support_v4_view_ViewPager_clz_method_enableLayers_rtjj.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_enableLayers_rtjj.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.enableLayers(boolean)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_draw_luki = android_support_v4_view_ViewPager_clz.draw.overload('android.graphics.Canvas');
+ android_support_v4_view_ViewPager_clz_method_draw_luki.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_draw_luki.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.draw(android.graphics.Canvas)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setCurrentItemInternal_4la7 = android_support_v4_view_ViewPager_clz.setCurrentItemInternal.overload('int', 'boolean', 'boolean');
+ android_support_v4_view_ViewPager_clz_method_setCurrentItemInternal_4la7.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setCurrentItemInternal_4la7.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'void android.support.v4.view.ViewPager.setCurrentItemInternal(int,boolean,boolean)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_dispatchOnPageSelected_47co = android_support_v4_view_ViewPager_clz.dispatchOnPageSelected.overload('int');
+ android_support_v4_view_ViewPager_clz_method_dispatchOnPageSelected_47co.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_dispatchOnPageSelected_47co.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.dispatchOnPageSelected(int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_onPageScrolled_ltek = android_support_v4_view_ViewPager_clz.onPageScrolled.overload('int', 'float', 'int');
+ android_support_v4_view_ViewPager_clz_method_onPageScrolled_ltek.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_onPageScrolled_ltek.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'protected void android.support.v4.view.ViewPager.onPageScrolled(int,float,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_onSecondaryPointerUp_6pow = android_support_v4_view_ViewPager_clz.onSecondaryPointerUp.overload('android.view.MotionEvent');
+ android_support_v4_view_ViewPager_clz_method_onSecondaryPointerUp_6pow.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_onSecondaryPointerUp_6pow.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.onSecondaryPointerUp(android.view.MotionEvent)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_calculatePageOffsets_zxrk = android_support_v4_view_ViewPager_clz.calculatePageOffsets.overload('android.support.v4.view.ViewPager$ItemInfo', 'int', 'android.support.v4.view.ViewPager$ItemInfo');
+ android_support_v4_view_ViewPager_clz_method_calculatePageOffsets_zxrk.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_calculatePageOffsets_zxrk.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.calculatePageOffsets(android.support.v4.view.ViewPager$ItemInfo,int,android.support.v4.view.ViewPager$ItemInfo)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_setCurrentItem_uef6 = android_support_v4_view_ViewPager_clz.setCurrentItem.overload('int', 'boolean');
+ android_support_v4_view_ViewPager_clz_method_setCurrentItem_uef6.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_setCurrentItem_uef6.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.setCurrentItem(int,boolean)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_generateDefaultLayoutParams_f0n9 = android_support_v4_view_ViewPager_clz.generateDefaultLayoutParams.overload();
+ android_support_v4_view_ViewPager_clz_method_generateDefaultLayoutParams_f0n9.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_generateDefaultLayoutParams_f0n9.call(this);
+ methodInBeat(invokeId, startTime, 'protected android.view.ViewGroup$LayoutParams android.support.v4.view.ViewPager.generateDefaultLayoutParams()', executor);
+ return ret;
+ };
+ var android_support_v4_view_ViewPager_clz_method_dispatchOnPageScrolled_ep1v = android_support_v4_view_ViewPager_clz.dispatchOnPageScrolled.overload('int', 'float', 'int');
+ android_support_v4_view_ViewPager_clz_method_dispatchOnPageScrolled_ep1v.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_dispatchOnPageScrolled_ep1v.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'private void android.support.v4.view.ViewPager.dispatchOnPageScrolled(int,float,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_addView_eexv = android_support_v4_view_ViewPager_clz.addView.overload('android.view.View', 'int', 'android.view.ViewGroup$LayoutParams');
+ android_support_v4_view_ViewPager_clz_method_addView_eexv.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_addView_eexv.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.addView(android.view.View,int,android.view.ViewGroup$LayoutParams)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_addOnAdapterChangeListener_xo79 = android_support_v4_view_ViewPager_clz.addOnAdapterChangeListener.overload('android.support.v4.view.ViewPager$OnAdapterChangeListener');
+ android_support_v4_view_ViewPager_clz_method_addOnAdapterChangeListener_xo79.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_addOnAdapterChangeListener_xo79.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.addOnAdapterChangeListener(android.support.v4.view.ViewPager$OnAdapterChangeListener)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_smoothScrollTo_9f5k = android_support_v4_view_ViewPager_clz.smoothScrollTo.overload('int', 'int');
+ android_support_v4_view_ViewPager_clz_method_smoothScrollTo_9f5k.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_smoothScrollTo_9f5k.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'void android.support.v4.view.ViewPager.smoothScrollTo(int,int)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_onRestoreInstanceState_yhba = android_support_v4_view_ViewPager_clz.onRestoreInstanceState.overload('android.os.Parcelable');
+ android_support_v4_view_ViewPager_clz_method_onRestoreInstanceState_yhba.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ android_support_v4_view_ViewPager_clz_method_onRestoreInstanceState_yhba.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void android.support.v4.view.ViewPager.onRestoreInstanceState(android.os.Parcelable)', executor);
+ };
+ var android_support_v4_view_ViewPager_clz_method_infoForCurrentScrollPosition_lyv3 = android_support_v4_view_ViewPager_clz.infoForCurrentScrollPosition.overload();
+ android_support_v4_view_ViewPager_clz_method_infoForCurrentScrollPosition_lyv3.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = android_support_v4_view_ViewPager_clz_method_infoForCurrentScrollPosition_lyv3.call(this);
+ methodInBeat(invokeId, startTime, 'private android.support.v4.view.ViewPager$ItemInfo android.support.v4.view.ViewPager.infoForCurrentScrollPosition()', executor);
+ return ret;
+ };
+}
+
+function hookingAndroidxViewPager() {
+ if (!classExists("androidx.viewpager.widget.ViewPager")) {
+ console.warn("Class androidx.viewpager.widget.ViewPager not found.");
+ return;
+ }
+ var androidx_viewpager_widget_ViewPager_clz = Java.use('androidx.viewpager.widget.ViewPager');
+ var androidx_viewpager_widget_ViewPager_clz_method_removeOnAdapterChangeListener_346p = androidx_viewpager_widget_ViewPager_clz.removeOnAdapterChangeListener.overload('androidx.viewpager.widget.ViewPager$OnAdapterChangeListener');
+ androidx_viewpager_widget_ViewPager_clz_method_removeOnAdapterChangeListener_346p.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_removeOnAdapterChangeListener_346p.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.removeOnAdapterChangeListener(androidx.viewpager.widget.ViewPager$OnAdapterChangeListener)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_canScrollHorizontally_tvve = androidx_viewpager_widget_ViewPager_clz.canScrollHorizontally.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_canScrollHorizontally_tvve.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_canScrollHorizontally_tvve.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean androidx.viewpager.widget.ViewPager.canScrollHorizontally(int)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onSaveInstanceState_70eb = androidx_viewpager_widget_ViewPager_clz.onSaveInstanceState.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_onSaveInstanceState_70eb.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_onSaveInstanceState_70eb.call(this);
+ methodInBeat(invokeId, startTime, 'public android.os.Parcelable androidx.viewpager.widget.ViewPager.onSaveInstanceState()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onSizeChanged_ca5z = androidx_viewpager_widget_ViewPager_clz.onSizeChanged.overload('int', 'int', 'int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_onSizeChanged_ca5z.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_onSizeChanged_ca5z.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'protected void androidx.viewpager.widget.ViewPager.onSizeChanged(int,int,int,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_pageRight_6eur = androidx_viewpager_widget_ViewPager_clz.pageRight.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_pageRight_6eur.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_pageRight_6eur.call(this);
+ methodInBeat(invokeId, startTime, 'boolean androidx.viewpager.widget.ViewPager.pageRight()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_dispatchKeyEvent_v3ew = androidx_viewpager_widget_ViewPager_clz.dispatchKeyEvent.overload('android.view.KeyEvent');
+ androidx_viewpager_widget_ViewPager_clz_method_dispatchKeyEvent_v3ew.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_dispatchKeyEvent_v3ew.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean androidx.viewpager.widget.ViewPager.dispatchKeyEvent(android.view.KeyEvent)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_getAdapter_pu8g = androidx_viewpager_widget_ViewPager_clz.getAdapter.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_getAdapter_pu8g.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_getAdapter_pu8g.call(this);
+ methodInBeat(invokeId, startTime, 'public androidx.viewpager.widget.PagerAdapter androidx.viewpager.widget.ViewPager.getAdapter()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_clearOnPageChangeListeners_o8up = androidx_viewpager_widget_ViewPager_clz.clearOnPageChangeListeners.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_clearOnPageChangeListeners_o8up.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_clearOnPageChangeListeners_o8up.call(this);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.clearOnPageChangeListeners()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_getChildRectInPagerCoordinates_e92s = androidx_viewpager_widget_ViewPager_clz.getChildRectInPagerCoordinates.overload('android.graphics.Rect', 'android.view.View');
+ androidx_viewpager_widget_ViewPager_clz_method_getChildRectInPagerCoordinates_e92s.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_getChildRectInPagerCoordinates_e92s.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'private android.graphics.Rect androidx.viewpager.widget.ViewPager.getChildRectInPagerCoordinates(android.graphics.Rect,android.view.View)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_fakeDragBy_hq23 = androidx_viewpager_widget_ViewPager_clz.fakeDragBy.overload('float');
+ androidx_viewpager_widget_ViewPager_clz_method_fakeDragBy_hq23.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_fakeDragBy_hq23.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.fakeDragBy(float)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_dataSetChanged_6t85 = androidx_viewpager_widget_ViewPager_clz.dataSetChanged.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_dataSetChanged_6t85.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_dataSetChanged_6t85.call(this);
+ methodInBeat(invokeId, startTime, 'void androidx.viewpager.widget.ViewPager.dataSetChanged()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onLayout_bdel = androidx_viewpager_widget_ViewPager_clz.onLayout.overload('boolean', 'int', 'int', 'int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_onLayout_bdel.implementation = function(v0, v1, v2, v3, v4) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_onLayout_bdel.call(this, v0, v1, v2, v3, v4);
+ methodInBeat(invokeId, startTime, 'protected void androidx.viewpager.widget.ViewPager.onLayout(boolean,int,int,int,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setCurrentItemInternal_ac9m = androidx_viewpager_widget_ViewPager_clz.setCurrentItemInternal.overload('int', 'boolean', 'boolean', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_setCurrentItemInternal_ac9m.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setCurrentItemInternal_ac9m.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'void androidx.viewpager.widget.ViewPager.setCurrentItemInternal(int,boolean,boolean,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setCurrentItem_g5xa = androidx_viewpager_widget_ViewPager_clz.setCurrentItem.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_setCurrentItem_g5xa.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setCurrentItem_g5xa.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setCurrentItem(int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_pageScrolled_rxhe = androidx_viewpager_widget_ViewPager_clz.pageScrolled.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_pageScrolled_rxhe.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_pageScrolled_rxhe.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private boolean androidx.viewpager.widget.ViewPager.pageScrolled(int)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_dispatchPopulateAccessibilityEvent_fhgv = androidx_viewpager_widget_ViewPager_clz.dispatchPopulateAccessibilityEvent.overload('android.view.accessibility.AccessibilityEvent');
+ androidx_viewpager_widget_ViewPager_clz_method_dispatchPopulateAccessibilityEvent_fhgv.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_dispatchPopulateAccessibilityEvent_fhgv.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean androidx.viewpager.widget.ViewPager.dispatchPopulateAccessibilityEvent(android.view.accessibility.AccessibilityEvent)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setScrollingCacheEnabled_0y68 = androidx_viewpager_widget_ViewPager_clz.setScrollingCacheEnabled.overload('boolean');
+ androidx_viewpager_widget_ViewPager_clz_method_setScrollingCacheEnabled_0y68.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setScrollingCacheEnabled_0y68.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.setScrollingCacheEnabled(boolean)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_infoForAnyChild_3eru = androidx_viewpager_widget_ViewPager_clz.infoForAnyChild.overload('android.view.View');
+ androidx_viewpager_widget_ViewPager_clz_method_infoForAnyChild_3eru.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_infoForAnyChild_3eru.call(this, v0);
+ methodInBeat(invokeId, startTime, 'androidx.viewpager.widget.ViewPager$ItemInfo androidx.viewpager.widget.ViewPager.infoForAnyChild(android.view.View)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_pageLeft_h7dx = androidx_viewpager_widget_ViewPager_clz.pageLeft.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_pageLeft_h7dx.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_pageLeft_h7dx.call(this);
+ methodInBeat(invokeId, startTime, 'boolean androidx.viewpager.widget.ViewPager.pageLeft()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setScrollState_n3qa = androidx_viewpager_widget_ViewPager_clz.setScrollState.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_setScrollState_n3qa.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setScrollState_n3qa.call(this, v0);
+ methodInBeat(invokeId, startTime, 'void androidx.viewpager.widget.ViewPager.setScrollState(int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_isGutterDrag_fyut = androidx_viewpager_widget_ViewPager_clz.isGutterDrag.overload('float', 'float');
+ androidx_viewpager_widget_ViewPager_clz_method_isGutterDrag_fyut.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_isGutterDrag_fyut.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'private boolean androidx.viewpager.widget.ViewPager.isGutterDrag(float,float)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_completeScroll_gfqf = androidx_viewpager_widget_ViewPager_clz.completeScroll.overload('boolean');
+ androidx_viewpager_widget_ViewPager_clz_method_completeScroll_gfqf.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_completeScroll_gfqf.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.completeScroll(boolean)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onRequestFocusInDescendants_0ydq = androidx_viewpager_widget_ViewPager_clz.onRequestFocusInDescendants.overload('int', 'android.graphics.Rect');
+ androidx_viewpager_widget_ViewPager_clz_method_onRequestFocusInDescendants_0ydq.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_onRequestFocusInDescendants_0ydq.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'protected boolean androidx.viewpager.widget.ViewPager.onRequestFocusInDescendants(int,android.graphics.Rect)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_getPageMargin_80nr = androidx_viewpager_widget_ViewPager_clz.getPageMargin.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_getPageMargin_80nr.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_getPageMargin_80nr.call(this);
+ methodInBeat(invokeId, startTime, 'public int androidx.viewpager.widget.ViewPager.getPageMargin()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_calculatePageOffsets_9dlg = androidx_viewpager_widget_ViewPager_clz.calculatePageOffsets.overload('androidx.viewpager.widget.ViewPager$ItemInfo', 'int', 'androidx.viewpager.widget.ViewPager$ItemInfo');
+ androidx_viewpager_widget_ViewPager_clz_method_calculatePageOffsets_9dlg.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_calculatePageOffsets_9dlg.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.calculatePageOffsets(androidx.viewpager.widget.ViewPager$ItemInfo,int,androidx.viewpager.widget.ViewPager$ItemInfo)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_isFakeDragging_w9il = androidx_viewpager_widget_ViewPager_clz.isFakeDragging.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_isFakeDragging_w9il.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_isFakeDragging_w9il.call(this);
+ methodInBeat(invokeId, startTime, 'public boolean androidx.viewpager.widget.ViewPager.isFakeDragging()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_removeNonDecorViews_71ul = androidx_viewpager_widget_ViewPager_clz.removeNonDecorViews.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_removeNonDecorViews_71ul.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_removeNonDecorViews_71ul.call(this);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.removeNonDecorViews()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_addOnAdapterChangeListener_ucgf = androidx_viewpager_widget_ViewPager_clz.addOnAdapterChangeListener.overload('androidx.viewpager.widget.ViewPager$OnAdapterChangeListener');
+ androidx_viewpager_widget_ViewPager_clz_method_addOnAdapterChangeListener_ucgf.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_addOnAdapterChangeListener_ucgf.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.addOnAdapterChangeListener(androidx.viewpager.widget.ViewPager$OnAdapterChangeListener)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_requestParentDisallowInterceptTouchEvent_5p2g = androidx_viewpager_widget_ViewPager_clz.requestParentDisallowInterceptTouchEvent.overload('boolean');
+ androidx_viewpager_widget_ViewPager_clz_method_requestParentDisallowInterceptTouchEvent_5p2g.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_requestParentDisallowInterceptTouchEvent_5p2g.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.requestParentDisallowInterceptTouchEvent(boolean)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_getOffscreenPageLimit_5d7d = androidx_viewpager_widget_ViewPager_clz.getOffscreenPageLimit.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_getOffscreenPageLimit_5d7d.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_getOffscreenPageLimit_5d7d.call(this);
+ methodInBeat(invokeId, startTime, 'public int androidx.viewpager.widget.ViewPager.getOffscreenPageLimit()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_addTouchables_ay2s = androidx_viewpager_widget_ViewPager_clz.addTouchables.overload('java.util.ArrayList');
+ androidx_viewpager_widget_ViewPager_clz_method_addTouchables_ay2s.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_addTouchables_ay2s.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.addTouchables(java.util.ArrayList)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_getClientWidth_g33r = androidx_viewpager_widget_ViewPager_clz.getClientWidth.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_getClientWidth_g33r.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_getClientWidth_g33r.call(this);
+ methodInBeat(invokeId, startTime, 'private int androidx.viewpager.widget.ViewPager.getClientWidth()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_generateLayoutParams_m21m = androidx_viewpager_widget_ViewPager_clz.generateLayoutParams.overload('android.view.ViewGroup$LayoutParams');
+ androidx_viewpager_widget_ViewPager_clz_method_generateLayoutParams_m21m.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_generateLayoutParams_m21m.call(this, v0);
+ methodInBeat(invokeId, startTime, 'protected android.view.ViewGroup$LayoutParams androidx.viewpager.widget.ViewPager.generateLayoutParams(android.view.ViewGroup$LayoutParams)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setPageTransformer_46rm = androidx_viewpager_widget_ViewPager_clz.setPageTransformer.overload('boolean', 'androidx.viewpager.widget.ViewPager$PageTransformer');
+ androidx_viewpager_widget_ViewPager_clz_method_setPageTransformer_46rm.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setPageTransformer_46rm.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setPageTransformer(boolean,androidx.viewpager.widget.ViewPager$PageTransformer)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_drawableStateChanged_tacc = androidx_viewpager_widget_ViewPager_clz.drawableStateChanged.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_drawableStateChanged_tacc.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_drawableStateChanged_tacc.call(this);
+ methodInBeat(invokeId, startTime, 'protected void androidx.viewpager.widget.ViewPager.drawableStateChanged()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_infoForPosition_uo31 = androidx_viewpager_widget_ViewPager_clz.infoForPosition.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_infoForPosition_uo31.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_infoForPosition_uo31.call(this, v0);
+ methodInBeat(invokeId, startTime, 'androidx.viewpager.widget.ViewPager$ItemInfo androidx.viewpager.widget.ViewPager.infoForPosition(int)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_scrollToItem_7u5u = androidx_viewpager_widget_ViewPager_clz.scrollToItem.overload('int', 'boolean', 'int', 'boolean');
+ androidx_viewpager_widget_ViewPager_clz_method_scrollToItem_7u5u.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_scrollToItem_7u5u.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.scrollToItem(int,boolean,int,boolean)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onTouchEvent_ml2d = androidx_viewpager_widget_ViewPager_clz.onTouchEvent.overload('android.view.MotionEvent');
+ androidx_viewpager_widget_ViewPager_clz_method_onTouchEvent_ml2d.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_onTouchEvent_ml2d.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean androidx.viewpager.widget.ViewPager.onTouchEvent(android.view.MotionEvent)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_generateLayoutParams_o5br = androidx_viewpager_widget_ViewPager_clz.generateLayoutParams.overload('android.util.AttributeSet');
+ androidx_viewpager_widget_ViewPager_clz_method_generateLayoutParams_o5br.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_generateLayoutParams_o5br.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public android.view.ViewGroup$LayoutParams androidx.viewpager.widget.ViewPager.generateLayoutParams(android.util.AttributeSet)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setPageMarginDrawable_0s8r = androidx_viewpager_widget_ViewPager_clz.setPageMarginDrawable.overload('android.graphics.drawable.Drawable');
+ androidx_viewpager_widget_ViewPager_clz_method_setPageMarginDrawable_0s8r.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setPageMarginDrawable_0s8r.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setPageMarginDrawable(android.graphics.drawable.Drawable)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_determineTargetPage_efu8 = androidx_viewpager_widget_ViewPager_clz.determineTargetPage.overload('int', 'float', 'int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_determineTargetPage_efu8.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_determineTargetPage_efu8.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'private int androidx.viewpager.widget.ViewPager.determineTargetPage(int,float,int,int)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_resetTouch_r3gx = androidx_viewpager_widget_ViewPager_clz.resetTouch.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_resetTouch_r3gx.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_resetTouch_r3gx.call(this);
+ methodInBeat(invokeId, startTime, 'private boolean androidx.viewpager.widget.ViewPager.resetTouch()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_endFakeDrag_3we9 = androidx_viewpager_widget_ViewPager_clz.endFakeDrag.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_endFakeDrag_3we9.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_endFakeDrag_3we9.call(this);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.endFakeDrag()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_populate_kzwg = androidx_viewpager_widget_ViewPager_clz.populate.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_populate_kzwg.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_populate_kzwg.call(this);
+ methodInBeat(invokeId, startTime, 'void androidx.viewpager.widget.ViewPager.populate()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setOffscreenPageLimit_ntao = androidx_viewpager_widget_ViewPager_clz.setOffscreenPageLimit.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_setOffscreenPageLimit_ntao.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setOffscreenPageLimit_ntao.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setOffscreenPageLimit(int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_getCurrentItem_848m = androidx_viewpager_widget_ViewPager_clz.getCurrentItem.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_getCurrentItem_848m.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_getCurrentItem_848m.call(this);
+ methodInBeat(invokeId, startTime, 'public int androidx.viewpager.widget.ViewPager.getCurrentItem()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onAttachedToWindow_53bs = androidx_viewpager_widget_ViewPager_clz.onAttachedToWindow.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_onAttachedToWindow_53bs.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_onAttachedToWindow_53bs.call(this);
+ methodInBeat(invokeId, startTime, 'protected void androidx.viewpager.widget.ViewPager.onAttachedToWindow()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_performDrag_exui = androidx_viewpager_widget_ViewPager_clz.performDrag.overload('float');
+ androidx_viewpager_widget_ViewPager_clz_method_performDrag_exui.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_performDrag_exui.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private boolean androidx.viewpager.widget.ViewPager.performDrag(float)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_isDecorView_nzl4 = androidx_viewpager_widget_ViewPager_clz.isDecorView.overload('android.view.View');
+ androidx_viewpager_widget_ViewPager_clz_method_isDecorView_nzl4.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = 'Class';
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_isDecorView_nzl4.call(androidx_viewpager_widget_ViewPager_clz, v0);
+ methodInBeat(invokeId, startTime, 'private static boolean androidx.viewpager.widget.ViewPager.isDecorView(android.view.View)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setPageMargin_w0hl = androidx_viewpager_widget_ViewPager_clz.setPageMargin.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_setPageMargin_w0hl.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setPageMargin_w0hl.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setPageMargin(int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_removeView_c32h = androidx_viewpager_widget_ViewPager_clz.removeView.overload('android.view.View');
+ androidx_viewpager_widget_ViewPager_clz_method_removeView_c32h.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_removeView_c32h.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.removeView(android.view.View)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_verifyDrawable_y0h9 = androidx_viewpager_widget_ViewPager_clz.verifyDrawable.overload('android.graphics.drawable.Drawable');
+ androidx_viewpager_widget_ViewPager_clz_method_verifyDrawable_y0h9.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_verifyDrawable_y0h9.call(this, v0);
+ methodInBeat(invokeId, startTime, 'protected boolean androidx.viewpager.widget.ViewPager.verifyDrawable(android.graphics.drawable.Drawable)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onDetachedFromWindow_k5n2 = androidx_viewpager_widget_ViewPager_clz.onDetachedFromWindow.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_onDetachedFromWindow_k5n2.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_onDetachedFromWindow_k5n2.call(this);
+ methodInBeat(invokeId, startTime, 'protected void androidx.viewpager.widget.ViewPager.onDetachedFromWindow()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_removeOnPageChangeListener_5ovh = androidx_viewpager_widget_ViewPager_clz.removeOnPageChangeListener.overload('androidx.viewpager.widget.ViewPager$OnPageChangeListener');
+ androidx_viewpager_widget_ViewPager_clz_method_removeOnPageChangeListener_5ovh.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_removeOnPageChangeListener_5ovh.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.removeOnPageChangeListener(androidx.viewpager.widget.ViewPager$OnPageChangeListener)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_populate_dtw5 = androidx_viewpager_widget_ViewPager_clz.populate.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_populate_dtw5.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_populate_dtw5.call(this, v0);
+ methodInBeat(invokeId, startTime, 'void androidx.viewpager.widget.ViewPager.populate(int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_addFocusables_w84t = androidx_viewpager_widget_ViewPager_clz.addFocusables.overload('java.util.ArrayList', 'int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_addFocusables_w84t.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_addFocusables_w84t.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.addFocusables(java.util.ArrayList,int,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_infoForChild_w2zx = androidx_viewpager_widget_ViewPager_clz.infoForChild.overload('android.view.View');
+ androidx_viewpager_widget_ViewPager_clz_method_infoForChild_w2zx.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_infoForChild_w2zx.call(this, v0);
+ methodInBeat(invokeId, startTime, 'androidx.viewpager.widget.ViewPager$ItemInfo androidx.viewpager.widget.ViewPager.infoForChild(android.view.View)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_smoothScrollTo_zitg = androidx_viewpager_widget_ViewPager_clz.smoothScrollTo.overload('int', 'int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_smoothScrollTo_zitg.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_smoothScrollTo_zitg.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'void androidx.viewpager.widget.ViewPager.smoothScrollTo(int,int,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onMeasure_ujt8 = androidx_viewpager_widget_ViewPager_clz.onMeasure.overload('int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_onMeasure_ujt8.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_onMeasure_ujt8.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'protected void androidx.viewpager.widget.ViewPager.onMeasure(int,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_sortChildDrawingOrder_no78 = androidx_viewpager_widget_ViewPager_clz.sortChildDrawingOrder.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_sortChildDrawingOrder_no78.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_sortChildDrawingOrder_no78.call(this);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.sortChildDrawingOrder()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_getChildDrawingOrder_xmoc = androidx_viewpager_widget_ViewPager_clz.getChildDrawingOrder.overload('int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_getChildDrawingOrder_xmoc.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_getChildDrawingOrder_xmoc.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'protected int androidx.viewpager.widget.ViewPager.getChildDrawingOrder(int,int)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_executeKeyEvent_3toa = androidx_viewpager_widget_ViewPager_clz.executeKeyEvent.overload('android.view.KeyEvent');
+ androidx_viewpager_widget_ViewPager_clz_method_executeKeyEvent_3toa.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_executeKeyEvent_3toa.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean androidx.viewpager.widget.ViewPager.executeKeyEvent(android.view.KeyEvent)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_beginFakeDrag_e8qj = androidx_viewpager_widget_ViewPager_clz.beginFakeDrag.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_beginFakeDrag_e8qj.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_beginFakeDrag_e8qj.call(this);
+ methodInBeat(invokeId, startTime, 'public boolean androidx.viewpager.widget.ViewPager.beginFakeDrag()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_endDrag_a3zk = androidx_viewpager_widget_ViewPager_clz.endDrag.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_endDrag_a3zk.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_endDrag_a3zk.call(this);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.endDrag()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onDraw_2ec1 = androidx_viewpager_widget_ViewPager_clz.onDraw.overload('android.graphics.Canvas');
+ androidx_viewpager_widget_ViewPager_clz_method_onDraw_2ec1.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_onDraw_2ec1.call(this, v0);
+ methodInBeat(invokeId, startTime, 'protected void androidx.viewpager.widget.ViewPager.onDraw(android.graphics.Canvas)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_recomputeScrollPosition_vgfe = androidx_viewpager_widget_ViewPager_clz.recomputeScrollPosition.overload('int', 'int', 'int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_recomputeScrollPosition_vgfe.implementation = function(v0, v1, v2, v3) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_recomputeScrollPosition_vgfe.call(this, v0, v1, v2, v3);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.recomputeScrollPosition(int,int,int,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_computeScroll_439p = androidx_viewpager_widget_ViewPager_clz.computeScroll.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_computeScroll_439p.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_computeScroll_439p.call(this);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.computeScroll()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_canScroll_x6gp = androidx_viewpager_widget_ViewPager_clz.canScroll.overload('android.view.View', 'boolean', 'int', 'int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_canScroll_x6gp.implementation = function(v0, v1, v2, v3, v4) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_canScroll_x6gp.call(this, v0, v1, v2, v3, v4);
+ methodInBeat(invokeId, startTime, 'protected boolean androidx.viewpager.widget.ViewPager.canScroll(android.view.View,boolean,int,int,int)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setPageMarginDrawable_b4aj = androidx_viewpager_widget_ViewPager_clz.setPageMarginDrawable.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_setPageMarginDrawable_b4aj.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setPageMarginDrawable_b4aj.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setPageMarginDrawable(int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setOnPageChangeListener_41ur = androidx_viewpager_widget_ViewPager_clz.setOnPageChangeListener.overload('androidx.viewpager.widget.ViewPager$OnPageChangeListener');
+ androidx_viewpager_widget_ViewPager_clz_method_setOnPageChangeListener_41ur.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setOnPageChangeListener_41ur.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setOnPageChangeListener(androidx.viewpager.widget.ViewPager$OnPageChangeListener)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_distanceInfluenceForSnapDuration_pguu = androidx_viewpager_widget_ViewPager_clz.distanceInfluenceForSnapDuration.overload('float');
+ androidx_viewpager_widget_ViewPager_clz_method_distanceInfluenceForSnapDuration_pguu.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_distanceInfluenceForSnapDuration_pguu.call(this, v0);
+ methodInBeat(invokeId, startTime, 'float androidx.viewpager.widget.ViewPager.distanceInfluenceForSnapDuration(float)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_initViewPager_qtxg = androidx_viewpager_widget_ViewPager_clz.initViewPager.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_initViewPager_qtxg.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_initViewPager_qtxg.call(this);
+ methodInBeat(invokeId, startTime, 'void androidx.viewpager.widget.ViewPager.initViewPager()', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_addOnPageChangeListener_34lc = androidx_viewpager_widget_ViewPager_clz.addOnPageChangeListener.overload('androidx.viewpager.widget.ViewPager$OnPageChangeListener');
+ androidx_viewpager_widget_ViewPager_clz_method_addOnPageChangeListener_34lc.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_addOnPageChangeListener_34lc.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.addOnPageChangeListener(androidx.viewpager.widget.ViewPager$OnPageChangeListener)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onInterceptTouchEvent_ysyr = androidx_viewpager_widget_ViewPager_clz.onInterceptTouchEvent.overload('android.view.MotionEvent');
+ androidx_viewpager_widget_ViewPager_clz_method_onInterceptTouchEvent_ysyr.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_onInterceptTouchEvent_ysyr.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean androidx.viewpager.widget.ViewPager.onInterceptTouchEvent(android.view.MotionEvent)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_arrowScroll_5ub1 = androidx_viewpager_widget_ViewPager_clz.arrowScroll.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_arrowScroll_5ub1.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_arrowScroll_5ub1.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public boolean androidx.viewpager.widget.ViewPager.arrowScroll(int)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_addNewItem_met3 = androidx_viewpager_widget_ViewPager_clz.addNewItem.overload('int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_addNewItem_met3.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_addNewItem_met3.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'androidx.viewpager.widget.ViewPager$ItemInfo androidx.viewpager.widget.ViewPager.addNewItem(int,int)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_checkLayoutParams_4fqh = androidx_viewpager_widget_ViewPager_clz.checkLayoutParams.overload('android.view.ViewGroup$LayoutParams');
+ androidx_viewpager_widget_ViewPager_clz_method_checkLayoutParams_4fqh.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_checkLayoutParams_4fqh.call(this, v0);
+ methodInBeat(invokeId, startTime, 'protected boolean androidx.viewpager.widget.ViewPager.checkLayoutParams(android.view.ViewGroup$LayoutParams)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setAdapter_ay3i = androidx_viewpager_widget_ViewPager_clz.setAdapter.overload('androidx.viewpager.widget.PagerAdapter');
+ androidx_viewpager_widget_ViewPager_clz_method_setAdapter_ay3i.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setAdapter_ay3i.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setAdapter(androidx.viewpager.widget.PagerAdapter)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_dispatchOnScrollStateChanged_ullc = androidx_viewpager_widget_ViewPager_clz.dispatchOnScrollStateChanged.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_dispatchOnScrollStateChanged_ullc.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_dispatchOnScrollStateChanged_ullc.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.dispatchOnScrollStateChanged(int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_enableLayers_df5g = androidx_viewpager_widget_ViewPager_clz.enableLayers.overload('boolean');
+ androidx_viewpager_widget_ViewPager_clz_method_enableLayers_df5g.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_enableLayers_df5g.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.enableLayers(boolean)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_draw_zkah = androidx_viewpager_widget_ViewPager_clz.draw.overload('android.graphics.Canvas');
+ androidx_viewpager_widget_ViewPager_clz_method_draw_zkah.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_draw_zkah.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.draw(android.graphics.Canvas)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setCurrentItemInternal_f0v6 = androidx_viewpager_widget_ViewPager_clz.setCurrentItemInternal.overload('int', 'boolean', 'boolean');
+ androidx_viewpager_widget_ViewPager_clz_method_setCurrentItemInternal_f0v6.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setCurrentItemInternal_f0v6.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'void androidx.viewpager.widget.ViewPager.setCurrentItemInternal(int,boolean,boolean)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_dispatchOnPageSelected_41oa = androidx_viewpager_widget_ViewPager_clz.dispatchOnPageSelected.overload('int');
+ androidx_viewpager_widget_ViewPager_clz_method_dispatchOnPageSelected_41oa.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_dispatchOnPageSelected_41oa.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.dispatchOnPageSelected(int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setPageTransformer_3q2o = androidx_viewpager_widget_ViewPager_clz.setPageTransformer.overload('boolean', 'androidx.viewpager.widget.ViewPager$PageTransformer', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_setPageTransformer_3q2o.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setPageTransformer_3q2o.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setPageTransformer(boolean,androidx.viewpager.widget.ViewPager$PageTransformer,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onPageScrolled_qoey = androidx_viewpager_widget_ViewPager_clz.onPageScrolled.overload('int', 'float', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_onPageScrolled_qoey.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_onPageScrolled_qoey.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'protected void androidx.viewpager.widget.ViewPager.onPageScrolled(int,float,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onSecondaryPointerUp_85g8 = androidx_viewpager_widget_ViewPager_clz.onSecondaryPointerUp.overload('android.view.MotionEvent');
+ androidx_viewpager_widget_ViewPager_clz_method_onSecondaryPointerUp_85g8.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_onSecondaryPointerUp_85g8.call(this, v0);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.onSecondaryPointerUp(android.view.MotionEvent)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setCurrentItem_m7z9 = androidx_viewpager_widget_ViewPager_clz.setCurrentItem.overload('int', 'boolean');
+ androidx_viewpager_widget_ViewPager_clz_method_setCurrentItem_m7z9.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_setCurrentItem_m7z9.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.setCurrentItem(int,boolean)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_generateDefaultLayoutParams_h5km = androidx_viewpager_widget_ViewPager_clz.generateDefaultLayoutParams.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_generateDefaultLayoutParams_h5km.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_generateDefaultLayoutParams_h5km.call(this);
+ methodInBeat(invokeId, startTime, 'protected android.view.ViewGroup$LayoutParams androidx.viewpager.widget.ViewPager.generateDefaultLayoutParams()', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_dispatchOnPageScrolled_rkqf = androidx_viewpager_widget_ViewPager_clz.dispatchOnPageScrolled.overload('int', 'float', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_dispatchOnPageScrolled_rkqf.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_dispatchOnPageScrolled_rkqf.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'private void androidx.viewpager.widget.ViewPager.dispatchOnPageScrolled(int,float,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_setInternalPageChangeListener_9cdg = androidx_viewpager_widget_ViewPager_clz.setInternalPageChangeListener.overload('androidx.viewpager.widget.ViewPager$OnPageChangeListener');
+ androidx_viewpager_widget_ViewPager_clz_method_setInternalPageChangeListener_9cdg.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_setInternalPageChangeListener_9cdg.call(this, v0);
+ methodInBeat(invokeId, startTime, 'androidx.viewpager.widget.ViewPager$OnPageChangeListener androidx.viewpager.widget.ViewPager.setInternalPageChangeListener(androidx.viewpager.widget.ViewPager$OnPageChangeListener)', executor);
+ return ret;
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_addView_aak3 = androidx_viewpager_widget_ViewPager_clz.addView.overload('android.view.View', 'int', 'android.view.ViewGroup$LayoutParams');
+ androidx_viewpager_widget_ViewPager_clz_method_addView_aak3.implementation = function(v0, v1, v2) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_addView_aak3.call(this, v0, v1, v2);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.addView(android.view.View,int,android.view.ViewGroup$LayoutParams)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_smoothScrollTo_hajo = androidx_viewpager_widget_ViewPager_clz.smoothScrollTo.overload('int', 'int');
+ androidx_viewpager_widget_ViewPager_clz_method_smoothScrollTo_hajo.implementation = function(v0, v1) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_smoothScrollTo_hajo.call(this, v0, v1);
+ methodInBeat(invokeId, startTime, 'void androidx.viewpager.widget.ViewPager.smoothScrollTo(int,int)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_onRestoreInstanceState_v7xe = androidx_viewpager_widget_ViewPager_clz.onRestoreInstanceState.overload('android.os.Parcelable');
+ androidx_viewpager_widget_ViewPager_clz_method_onRestoreInstanceState_v7xe.implementation = function(v0) {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ androidx_viewpager_widget_ViewPager_clz_method_onRestoreInstanceState_v7xe.call(this, v0);
+ methodInBeat(invokeId, startTime, 'public void androidx.viewpager.widget.ViewPager.onRestoreInstanceState(android.os.Parcelable)', executor);
+ };
+ var androidx_viewpager_widget_ViewPager_clz_method_infoForCurrentScrollPosition_zbog = androidx_viewpager_widget_ViewPager_clz.infoForCurrentScrollPosition.overload();
+ androidx_viewpager_widget_ViewPager_clz_method_infoForCurrentScrollPosition_zbog.implementation = function() {
+ var invokeId = Math.random().toString(36).slice( - 8);
+ var startTime = new Date().getTime();
+ var executor = this.hashCode();
+ var ret = androidx_viewpager_widget_ViewPager_clz_method_infoForCurrentScrollPosition_zbog.call(this);
+ methodInBeat(invokeId, startTime, 'private androidx.viewpager.widget.ViewPager$ItemInfo androidx.viewpager.widget.ViewPager.infoForCurrentScrollPosition()', executor);
+ return ret;
+ };
+}
+
+Java.perform(function() {
+ hookingAndroidV4ViewPager();
+ hookingAndroidxViewPager();
+});
\ No newline at end of file
diff --git a/com.google.android.youtube/web_view.js b/com.google.android.youtube/web_view.js
new file mode 100644
index 0000000..0a5ddb4
--- /dev/null
+++ b/com.google.android.youtube/web_view.js
@@ -0,0 +1,131 @@
+function printStacks(androidLogClz, exceptionClz, methodName) {
+ var stackInfo = androidLogClz.getStackTraceString(exceptionClz.$new());
+ console.log(new Date().getTime()+":"+methodName);
+ console.log(stackInfo.substring(20));
+};
+
+Java.perform(function() {
+ var androidLogClz = Java.use("android.util.Log");
+ var exceptionClz = Java.use("java.lang.Exception");
+ var WebView = Java.use("android.webkit.WebView");
+ var WebSettings = Java.use("android.webkit.WebSettings");
+
+ if (WebView.loadUrl) {
+ //Ref: https://developer.android.com/reference/android/webkit/WebView.html#loadUrl(java.lang.String)
+ WebView.loadUrl.overloads[0].implementation = function(url) {
+ //checkSettings(this);
+ printStacks(androidLogClz, exceptionClz, 'android.webkit.WebView.loadUrl(java.lang.String:' + url + ')');
+ return this.loadUrl.overloads[0].apply(this, arguments);
+ };
+
+ //Ref: https://developer.android.com/reference/android/webkit/WebView.html#loadUrl(java.lang.String, java.util.Map