test: db choose

test_db_choose.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""测试Java.choose是否能找到微信DB实例"""
+import frida, time, json
+
+device = frida.get_device_manager().add_remote_device('127.0.0.1:27042')
+session = device.attach(25425)
+
+js = """
+Java.perform(function() {
+    var found = [];
+    try {
+        Java.choose('com.tencent.wcdb.database.SQLiteDatabase', {
+            onMatch: function(db) {
+                try {
+                    var p = db.getPath();
+                    if (!p) return;
+                    var item = {path: p};
+                    if (p.indexOf('EnMicroMsg') > -1) {
+                        try {
+                            var c = db.rawQuery('SELECT COUNT(*) FROM rcontact', null);
+                            c.moveToFirst();
+                            item.rcontact_count = c.getString(0);
+                            c.close();
+                        } catch(e) { item.query_err = e.toString(); }
+                    }
+                    found.push(item);
+                    send({type:'db', item:item});
+                } catch(e) { send({type:'err', msg:e.toString()}); }
+            },
+            onComplete: function() {
+                send({type:'done', total:found.length});
+            }
+        });
+    } catch(e) {
+        send({type:'fail', msg:e.toString()});
+    }
+});
+"""
+
+msgs = []
+def on_msg(msg, data):
+    if msg['type'] == 'send':
+        p = msg['payload']
+        msgs.append(p)
+        if p.get('type') == 'db':
+            item = p['item']
+            path = item['path'].split('/')[-1]
+            count = item.get('rcontact_count', '')
+            err = item.get('query_err', '')
+            print(f"  DB: {path} {('| rcontact: '+count) if count else ''} {err[:50] if err else ''}")
+        elif p.get('type') == 'done':
+            print(f"  完成！找到 {p['total']} 个DB实例")
+        elif p.get('type') in ('err', 'fail'):
+            print(f"  错误: {p.get('msg','')[:100]}")
+
+script = session.create_script(js)
+script.on('message', on_msg)
+script.load()
+time.sleep(15)
+print(f"总消息数: {len(msgs)}")