435 lines
17 KiB
Python
435 lines
17 KiB
Python
"""
|
||
Frida Manager — 管理 Frida 与微信进程的连接生命周期
|
||
|
||
职责：
|
||
- 连接设备（USB / remote / gadget 三种模式）
|
||
- attach 到微信进程
|
||
- 加载 JS 脚本
|
||
- 维护 rpc.exports 代理
|
||
- 自动重连
|
||
|
||
连接模式：
|
||
- usb: 需要 Root，通过 frida-server 连接（传统方式）
|
||
- gadget: 无需 Root，通过注入到 APK 中的 frida-gadget 连接
|
||
- remote: 通过 TCP 连接远程 frida-server
|
||
|
||
技术栈：Frida 16.5.6（17.x 在 Android 11 上 Java 桥失效）
|
||
"""
|
||
|
||
import os
|
||
import re
|
||
import time
|
||
import logging
|
||
import threading
|
||
import subprocess
|
||
from typing import Optional, Callable, Dict, Any, Literal
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
|
||
DEFAULT_SCRIPT = os.path.join(SCRIPT_DIR, "wechat_hook_v2.js")
|
||
WECHAT_PACKAGE = "com.tencent.mm"
|
||
import random as _random
|
||
_ANTI_DETECT_PORT_RANGE = (10000, 60000)
|
||
GADGET_PORT = _random.randint(*_ANTI_DETECT_PORT_RANGE)
|
||
|
||
ConnectionMode = Literal["usb", "gadget", "remote"]
|
||
|
||
_SNAKE_RE = re.compile(r'(?<=[a-z0-9])([A-Z])')
|
||
|
||
|
||
def _random_port() -> int:
|
||
return _random.randint(*_ANTI_DETECT_PORT_RANGE)
|
||
|
||
|
||
class FridaManager:
|
||
"""Frida 会话管理器，支持 USB / Gadget / Remote 三种连接模式"""
|
||
|
||
def __init__(
|
||
self,
|
||
device_serial: Optional[str] = None,
|
||
script_path: str = DEFAULT_SCRIPT,
|
||
on_event: Optional[Callable[[Dict[str, Any]], None]] = None,
|
||
on_detach: Optional[Callable[[str], None]] = None,
|
||
auto_reconnect: bool = True,
|
||
reconnect_interval: float = 5.0,
|
||
mode: ConnectionMode = "gadget",
|
||
gadget_host: str = "127.0.0.1",
|
||
gadget_port: int = 0,
|
||
use_adb_forward: bool = True,
|
||
):
|
||
if gadget_port == 0:
|
||
gadget_port = _random_port()
|
||
self.device_serial = device_serial
|
||
self.script_path = script_path
|
||
self.on_event = on_event
|
||
self.on_detach = on_detach
|
||
self.auto_reconnect = auto_reconnect
|
||
self.reconnect_interval = reconnect_interval
|
||
self.mode = mode
|
||
self.gadget_host = gadget_host
|
||
self.gadget_port = gadget_port
|
||
self.use_adb_forward = use_adb_forward
|
||
|
||
self._device = None
|
||
self._session = None
|
||
self._script = None
|
||
self._rpc = None
|
||
self._running = False
|
||
self._detaching = False
|
||
self._lock = threading.Lock()
|
||
|
||
@property
|
||
def connected(self) -> bool:
|
||
return self._session is not None and self._script is not None
|
||
|
||
@property
|
||
def rpc(self):
|
||
return self._rpc
|
||
|
||
def start(self) -> bool:
|
||
try:
|
||
import frida
|
||
except ImportError:
|
||
logger.error("frida 未安装，请执行: pip install frida-tools")
|
||
return False
|
||
|
||
with self._lock:
|
||
if self.connected:
|
||
return True
|
||
return self._do_attach()
|
||
|
||
def _setup_gadget_forward(self):
|
||
"""为 Gadget/Remote 模式设置 ADB 端口转发（手机本机 Agent 连 127.0.0.1 时跳过）"""
|
||
if not self.use_adb_forward:
|
||
logger.info("跳过 ADB forward（设备本机 Frida remote）")
|
||
return
|
||
try:
|
||
cmd = ["adb"]
|
||
if self.device_serial:
|
||
cmd += ["-s", self.device_serial]
|
||
cmd += ["forward", f"tcp:{self.gadget_port}", f"tcp:{self.gadget_port}"]
|
||
subprocess.run(cmd, capture_output=True, timeout=5)
|
||
logger.info(f"ADB 端口转发已设置: tcp:{self.gadget_port}")
|
||
except Exception as e:
|
||
logger.warning(f"端口转发设置失败: {e}")
|
||
|
||
def _do_attach(self) -> bool:
|
||
import frida
|
||
|
||
try:
|
||
if self.mode == "gadget":
|
||
self._setup_gadget_forward()
|
||
addr = f"{self.gadget_host}:{self.gadget_port}"
|
||
mgr = frida.get_device_manager()
|
||
self._device = mgr.add_remote_device(addr)
|
||
logger.info(f"Frida Gadget 已连接: {addr}")
|
||
|
||
self._session = self._device.attach("Gadget")
|
||
self._session.on("detached", self._on_session_detached)
|
||
logger.info("已 attach 到 Gadget 进程（无 Root 模式）")
|
||
|
||
elif self.mode == "remote":
|
||
self._setup_gadget_forward()
|
||
addr = f"{self.gadget_host}:{self.gadget_port}"
|
||
mgr = frida.get_device_manager()
|
||
self._device = mgr.add_remote_device(addr)
|
||
logger.info(f"Frida Remote 已连接: {addr}")
|
||
|
||
pid = self._find_wechat_pid()
|
||
if pid is None:
|
||
# WX-11 修复：禁用 frida spawn（spawn 失败会在 ActivityManager 留下
|
||
# (null)pid 幽灵进程记录，阻塞微信后续启动需 reboot）。改为 am start
|
||
# 温和拉起 + 轮询 attach；仍失败则本轮放弃，交重连循环稍后重试。
|
||
logger.warning("微信未运行，am start 温和拉起（禁用 frida spawn 防 AM 幽灵进程 WX-11）")
|
||
pid = self._launch_wechat_gently()
|
||
if pid is None:
|
||
logger.warning("微信仍未运行，本轮放弃 attach（交重连循环重试 am start，不 frida-spawn）")
|
||
return False
|
||
self._session = self._device.attach(pid)
|
||
self._session.on("detached", self._on_session_detached)
|
||
logger.info(f"已 attach 到微信进程 pid={pid}")
|
||
|
||
else: # usb (需要 Root)
|
||
if self.device_serial:
|
||
self._device = frida.get_device(self.device_serial)
|
||
else:
|
||
self._device = frida.get_usb_device(timeout=10)
|
||
logger.info(f"Frida USB 已连接设备: {self._device.name}")
|
||
|
||
pid = self._find_wechat_pid()
|
||
if pid is None:
|
||
# WX-11 修复：USB 模式同样禁用 frida spawn，改 am start 温和拉起。
|
||
logger.warning("微信未运行，am start 温和拉起（禁用 frida spawn 防 AM 幽灵进程 WX-11）")
|
||
pid = self._launch_wechat_gently()
|
||
if pid is None:
|
||
logger.warning("微信仍未运行，本轮放弃 attach（不 frida-spawn）")
|
||
return False
|
||
self._session = self._device.attach(pid)
|
||
self._session.on("detached", self._on_session_detached)
|
||
logger.info(f"已 attach 到微信进程 pid={pid}")
|
||
|
||
self._load_script()
|
||
self._running = True
|
||
return True
|
||
|
||
except Exception as e:
|
||
logger.error(f"Frida attach 失败 [{self.mode}]: {e}")
|
||
self._do_cleanup()
|
||
return False
|
||
|
||
def _find_wechat_pid(self) -> Optional[int]:
|
||
# 手机本机：shell pidof，无需 adb
|
||
if not self.use_adb_forward:
|
||
try:
|
||
result = subprocess.run(
|
||
["pidof", WECHAT_PACKAGE],
|
||
capture_output=True, text=True, timeout=5,
|
||
)
|
||
out = (result.stdout or "").strip()
|
||
if out:
|
||
return int(out.split()[0])
|
||
except Exception:
|
||
pass
|
||
try:
|
||
result = subprocess.run(
|
||
["sh", "-c", f"pidof {WECHAT_PACKAGE}"],
|
||
capture_output=True, text=True, timeout=5,
|
||
)
|
||
out = (result.stdout or "").strip()
|
||
if out:
|
||
return int(out.split()[0])
|
||
except Exception:
|
||
pass
|
||
# 主机 ADB pidof（Remote/Gadget 经端口转发时 enumerate 常漏进程）
|
||
if self.device_serial and self.use_adb_forward:
|
||
for attempt in range(3):
|
||
try:
|
||
result = subprocess.run(
|
||
["adb", "-s", self.device_serial, "shell", "pidof", WECHAT_PACKAGE],
|
||
capture_output=True, text=True, timeout=8,
|
||
)
|
||
out = (result.stdout or "").strip()
|
||
if out:
|
||
return int(out.split()[0])
|
||
except Exception:
|
||
pass
|
||
if attempt < 2:
|
||
time.sleep(2)
|
||
try:
|
||
for proc in self._device.enumerate_processes():
|
||
if proc.name in (WECHAT_PACKAGE, "WeChat") or getattr(proc, 'identifier', '') == WECHAT_PACKAGE:
|
||
return proc.pid
|
||
except Exception:
|
||
pass
|
||
try:
|
||
for app in self._device.enumerate_applications():
|
||
if app.identifier == WECHAT_PACKAGE and app.pid > 0:
|
||
return app.pid
|
||
except Exception:
|
||
pass
|
||
try:
|
||
result = subprocess.run(
|
||
["adb", "-s", self.device_serial or "", "shell", "pidof", WECHAT_PACKAGE],
|
||
capture_output=True, text=True, timeout=5,
|
||
)
|
||
if result.stdout.strip():
|
||
return int(result.stdout.strip().split()[0])
|
||
except Exception:
|
||
pass
|
||
return None
|
||
|
||
def _launch_wechat_gently(self, max_wait: int = 18) -> Optional[int]:
|
||
"""温和拉起微信：仅 am start + 轮询 pid；绝不用 frida spawn。
|
||
|
||
WX-11：frida spawn 失败会在 ActivityManager 留下 (null)pid 幽灵进程记录，
|
||
使微信被视为"正在启动"而拒绝后续 am start，最终需 reboot 才能恢复。
|
||
故统一改用 am start 温和拉起并轮询，失败返回 None 交重连循环稍后重试。
|
||
"""
|
||
try:
|
||
cmd = ["am", "start", "-n", f"{WECHAT_PACKAGE}/.ui.LauncherUI"]
|
||
if self.device_serial:
|
||
cmd = ["adb", "-s", self.device_serial, "shell"] + cmd
|
||
subprocess.run(cmd, capture_output=True, timeout=15)
|
||
except Exception as e:
|
||
logger.warning(f"am start 拉起微信失败: {e}")
|
||
deadline = time.time() + max_wait
|
||
while time.time() < deadline:
|
||
pid = self._find_wechat_pid()
|
||
if pid:
|
||
logger.info(f"微信已温和拉起 pid={pid}")
|
||
return pid
|
||
time.sleep(2)
|
||
return None
|
||
|
||
def _load_script(self):
|
||
path = self.script_path
|
||
if not os.path.exists(path):
|
||
fallback = os.path.join(SCRIPT_DIR, "wechat_hook_v1.js")
|
||
if os.path.exists(fallback):
|
||
path = fallback
|
||
else:
|
||
raise FileNotFoundError(f"Hook 脚本不存在: {path}")
|
||
|
||
with open(path, "r", encoding="utf-8") as f:
|
||
source = f.read()
|
||
|
||
self._script = self._session.create_script(source)
|
||
self._script.on("message", self._on_message)
|
||
self._script.load()
|
||
# 注意：禁止调用 script.eternalize()。Frida 语义为「eternalize 后即与脚本断开交互」，
|
||
# 调用后 exports_sync 失效，所有 RPC 报 "script has been destroyed"。
|
||
# 保活改由 _on_session_detached → _reconnect_loop（FS-3 detach 重连守护）实现。
|
||
self._rpc = self._script.exports_sync
|
||
logger.info(f"Hook 脚本已加载: {os.path.basename(path)}")
|
||
|
||
try:
|
||
pong = self._rpc.ping()
|
||
logger.info(f"RPC ping: {pong}")
|
||
except Exception as e:
|
||
logger.warning(f"RPC ping 失败: {e}")
|
||
|
||
def _on_message(self, message: dict, data):
|
||
if message.get("type") == "send":
|
||
payload = message.get("payload", {})
|
||
msg_type = payload.get("type", "")
|
||
|
||
if msg_type == "hook_event" and self.on_event:
|
||
self.on_event(payload)
|
||
elif msg_type == "log":
|
||
level = payload.get("level", "info")
|
||
tag = payload.get("tag", "hook")
|
||
text = payload.get("message", "")
|
||
getattr(logger, level, logger.info)(f"[{tag}] {text}")
|
||
elif message.get("type") == "error":
|
||
logger.error(f"Frida 脚本错误: {message.get('description', '')}")
|
||
|
||
def _on_session_detached(self, reason: str):
|
||
"""Frida 内部线程回调 — 只清理引用，不重复 detach/unload，不获取 _lock（避免死锁）"""
|
||
logger.warning(f"Frida 会话断开: {reason}")
|
||
self._detaching = True
|
||
self._nullify_refs()
|
||
self._detaching = False
|
||
|
||
if self.on_detach:
|
||
try:
|
||
self.on_detach(reason)
|
||
except Exception as e:
|
||
logger.warning(f"on_detach 回调异常: {e}")
|
||
|
||
if self.auto_reconnect and self._running and reason != "application-requested":
|
||
threading.Thread(target=self._reconnect_loop, daemon=True).start()
|
||
|
||
def _reconnect_loop(self):
|
||
while self._running and not self.connected:
|
||
logger.info(f"尝试重连 Frida（{self.reconnect_interval}s 后）...")
|
||
time.sleep(self.reconnect_interval)
|
||
with self._lock:
|
||
if self.connected:
|
||
break
|
||
try:
|
||
if self._do_attach():
|
||
logger.info("Frida 重连成功")
|
||
break
|
||
except Exception as e:
|
||
logger.warning(f"重连失败: {e}")
|
||
|
||
@staticmethod
|
||
def _to_snake(name: str) -> str:
|
||
return _SNAKE_RE.sub(r'_\1', name).lower()
|
||
|
||
def call_rpc(self, method: str, params: dict = None) -> Dict[str, Any]:
|
||
with self._lock:
|
||
if not self.connected or not self._rpc:
|
||
return {"success": False, "error": "Frida 未连接"}
|
||
rpc = self._rpc
|
||
try:
|
||
snake = self._to_snake(method)
|
||
fn = getattr(rpc, snake, None) or getattr(rpc, method, None)
|
||
if fn is None:
|
||
return {"success": False, "error": f"RPC 方法不存在: {method} ({snake})"}
|
||
result = fn(params) if params else fn({})
|
||
if isinstance(result, dict):
|
||
result.setdefault("success", True)
|
||
return result
|
||
return {"success": True, "data": result}
|
||
except Exception as e:
|
||
logger.error(f"RPC 调用失败 [{method}]: {e}")
|
||
return {"success": False, "error": str(e)}
|
||
|
||
def reload_script(self) -> Dict[str, Any]:
|
||
"""重新加载当前 Hook 脚本，不重启微信进程。"""
|
||
with self._lock:
|
||
try:
|
||
if not self._session:
|
||
ok = self._do_attach()
|
||
return {
|
||
"success": ok,
|
||
"reloaded": ok,
|
||
"script_path": self.script_path,
|
||
"method": "attach_and_load",
|
||
}
|
||
if self._script:
|
||
try:
|
||
self._script.unload()
|
||
except Exception as e:
|
||
logger.warning(f"Hook 脚本卸载失败，继续重载: {e}")
|
||
self._script = None
|
||
self._rpc = None
|
||
self._load_script()
|
||
return {
|
||
"success": True,
|
||
"reloaded": True,
|
||
"script_path": self.script_path,
|
||
"method": "reload_script",
|
||
}
|
||
except Exception as e:
|
||
self._script = None
|
||
self._rpc = None
|
||
logger.error(f"Hook 脚本重载失败: {e}")
|
||
return {
|
||
"success": False,
|
||
"reloaded": False,
|
||
"script_path": self.script_path,
|
||
"error": str(e),
|
||
}
|
||
|
||
def stop(self):
|
||
self._running = False
|
||
with self._lock:
|
||
self._do_cleanup()
|
||
logger.info("FridaManager 已停止")
|
||
|
||
def _nullify_refs(self):
|
||
"""清空引用（不执行 unload/detach），用于 detach 回调内"""
|
||
self._script = None
|
||
self._session = None
|
||
self._rpc = None
|
||
|
||
def _do_cleanup(self):
|
||
"""主动断开时完整清理（unload 脚本 + detach 会话）"""
|
||
if self._detaching:
|
||
return
|
||
try:
|
||
if self._script:
|
||
self._script.unload()
|
||
except Exception:
|
||
pass
|
||
try:
|
||
if self._session:
|
||
self._session.detach()
|
||
except Exception:
|
||
pass
|
||
self._nullify_refs()
|
||
|
||
def get_status(self) -> Dict[str, Any]:
|
||
return {
|
||
"connected": self.connected,
|
||
"mode": self.mode,
|
||
"device": self._device.name if self._device else None,
|
||
"device_serial": self.device_serial,
|
||
"script": os.path.basename(self.script_path),
|
||
"running": self._running,
|
||
"gadget_endpoint": f"{self.gadget_host}:{self.gadget_port}" if self.mode == "gadget" else None,
|
||
}
|