132 lines
5.8 KiB
Bash
Executable File
132 lines
5.8 KiB
Bash
Executable File
#!/data/data/com.termux/files/usr/bin/bash
|
||
# ==============================================================================
|
||
# termux_frida_up_onphone.sh — 手机 Termux 内一键拉起 Phantom frida-server + 验证
|
||
#
|
||
# 场景：无线主控（无 USB/ADB）。在【手机 Termux】里执行，不在 Mac 跑。
|
||
# 作用：
|
||
# 1. 读 phantom_frida_config.json（端口/二进制名，反检测随机化）
|
||
# 2. su 起 frida-server（默认端口来自配置，避开微信扫的 27042）
|
||
# 3. 可选 setenforce 0（SELinux 拦端口时）
|
||
# 4. 验证 frida-server 进程 + 微信 com.tencent.mm pid
|
||
# 5. 重启 Termux Agent 触发 attach
|
||
#
|
||
# 用法（手机 Termux）：
|
||
# bash ~/workphone/sdk/scripts/termux_frida_up_onphone.sh
|
||
# bash termux_frida_up_onphone.sh --port 33891 --no-agent
|
||
#
|
||
# 参考：frida.re/docs/android · WeChat 8.0+ 扫 27042，须换端口 + Zygisk DenyList
|
||
# ==============================================================================
|
||
set -uo pipefail
|
||
|
||
DEVICE_ID="${WP_DEVICE_ID:-xgfe65eimrrofyws}"
|
||
WECHAT_PKG="com.tencent.mm"
|
||
NO_AGENT=0
|
||
FORCE_PORT=""
|
||
SETENFORCE=0
|
||
|
||
while [[ $# -gt 0 ]]; do
|
||
case "$1" in
|
||
-d) DEVICE_ID="$2"; shift 2 ;;
|
||
--port) FORCE_PORT="$2"; shift 2 ;;
|
||
--no-agent) NO_AGENT=1; shift ;;
|
||
--setenforce) SETENFORCE=1; shift ;;
|
||
*) echo "[!] 未知参数: $1"; shift ;;
|
||
esac
|
||
done
|
||
|
||
# ── 定位 phantom 配置 ─────────────────────────────────────────────
|
||
CONFIG=""
|
||
for p in \
|
||
"$HOME/workphone/sdk/scripts/anti_detect/phantom_frida_config.json" \
|
||
"$HOME/workphone/phantom_frida_config.json" \
|
||
"/sdcard/workphone/phantom_frida_config.json" \
|
||
"$(dirname "$0")/anti_detect/phantom_frida_config.json"; do
|
||
[ -f "$p" ] && CONFIG="$p" && break
|
||
done
|
||
|
||
BIN_PATH="/data/local/tmp/frida-server"
|
||
PORT="27042"
|
||
if [ -n "$CONFIG" ]; then
|
||
echo "[*] 读取配置: $CONFIG"
|
||
BIN_PATH=$(python3 -c "import json;print(json.load(open('$CONFIG')).get('binary_path','/data/local/tmp/frida-server'))" 2>/dev/null || echo "/data/local/tmp/frida-server")
|
||
PORT=$(python3 -c "import json;print(json.load(open('$CONFIG')).get('listen_port',27042))" 2>/dev/null || echo 27042)
|
||
else
|
||
echo "[!] 未找到 phantom 配置，用默认 $BIN_PATH:$PORT"
|
||
fi
|
||
[ -n "$FORCE_PORT" ] && PORT="$FORCE_PORT"
|
||
|
||
echo "=== 手机端 Frida 起服 ==="
|
||
echo " 设备: $DEVICE_ID"
|
||
echo " 二进制: $BIN_PATH"
|
||
echo " 端口: $PORT"
|
||
|
||
# ── 检查 su ──────────────────────────────────────────────────────
|
||
if ! su -c 'id' >/dev/null 2>&1; then
|
||
echo "[✗] su 不可用，需 Root（Magisk）。无法启动 frida-server。"
|
||
exit 2
|
||
fi
|
||
|
||
# ── 检查二进制 ────────────────────────────────────────────────────
|
||
if ! su -c "[ -f $BIN_PATH ]" 2>/dev/null; then
|
||
echo "[✗] frida-server 二进制不存在: $BIN_PATH"
|
||
echo " 请先用 Mac+USB 跑: bash sdk/scripts/anti_detect/setup_phantom_frida.sh $DEVICE_ID"
|
||
exit 3
|
||
fi
|
||
|
||
# ── 可选关 SELinux ────────────────────────────────────────────────
|
||
if [ "$SETENFORCE" = "1" ]; then
|
||
echo "[*] setenforce 0（临时，重启恢复）"
|
||
su -c 'setenforce 0' 2>/dev/null || true
|
||
fi
|
||
|
||
# ── 重启 frida-server ─────────────────────────────────────────────
|
||
echo "[*] 停止旧进程..."
|
||
su -c "pkill -f $(basename "$BIN_PATH")" 2>/dev/null || true
|
||
su -c 'pkill -f frida-server' 2>/dev/null || true
|
||
sleep 1
|
||
|
||
echo "[*] 启动 frida-server..."
|
||
su -c "chmod 755 $BIN_PATH; nohup $BIN_PATH -l 0.0.0.0:$PORT >/dev/null 2>&1 &" 2>/dev/null
|
||
sleep 2
|
||
|
||
RUNNING=$(su -c "ps -A 2>/dev/null | grep -c $(basename "$BIN_PATH")" 2>/dev/null || echo 0)
|
||
if [ "${RUNNING:-0}" -lt 1 ]; then
|
||
echo "[✗] frida-server 未起。排查：ABI 不符 / SELinux（加 --setenforce）/ 端口占用。"
|
||
exit 4
|
||
fi
|
||
echo "[✓] frida-server 运行中（端口 $PORT）"
|
||
|
||
# ── 检查微信进程 ──────────────────────────────────────────────────
|
||
WX_PID=$(su -c "pidof $WECHAT_PKG" 2>/dev/null | tr -d '\r')
|
||
if [ -z "$WX_PID" ]; then
|
||
echo "[!] 微信未运行，尝试拉起前台..."
|
||
su -c "am start -n $WECHAT_PKG/.ui.LauncherUI" 2>/dev/null || \
|
||
monkey -p $WECHAT_PKG -c android.intent.category.LAUNCHER 1 >/dev/null 2>&1 || true
|
||
sleep 4
|
||
WX_PID=$(su -c "pidof $WECHAT_PKG" 2>/dev/null | tr -d '\r')
|
||
fi
|
||
[ -n "$WX_PID" ] && echo "[✓] 微信 pid=$WX_PID" || echo "[!] 微信仍未检测到 pid，请手动打开微信并进入一次聊天"
|
||
|
||
# ── 重启 Agent 触发 attach ────────────────────────────────────────
|
||
if [ "$NO_AGENT" = "0" ]; then
|
||
echo "[*] 重启 Termux Agent..."
|
||
pkill -f "agent.py -d $DEVICE_ID" 2>/dev/null || true
|
||
sleep 1
|
||
AGENT_DIR="$HOME/workphone/agent"
|
||
[ -d "$AGENT_DIR" ] || AGENT_DIR="$HOME/workphone/sdk/agent"
|
||
if [ -d "$AGENT_DIR" ]; then
|
||
cd "$AGENT_DIR"
|
||
export WP_AGENT_ON_DEVICE=1 WP_FRIDA_MODE=remote WP_FRIDA_PORT="$PORT" WP_AUTO_DISCOVER=1
|
||
nohup python agent.py -d "$DEVICE_ID" --heartbeat 10 >/tmp/wp_agent.log 2>&1 &
|
||
sleep 3
|
||
echo "[✓] Agent 已重启（日志 /tmp/wp_agent.log）"
|
||
else
|
||
echo "[!] 未找到 agent 目录，请手动启动 Agent"
|
||
fi
|
||
fi
|
||
|
||
echo ""
|
||
echo "=== 完成 ==="
|
||
echo "Mac 侧验证: curl http://<SDK_IP>:8899/api/v3/hook/probe/$DEVICE_ID"
|
||
echo "期望 supports_hook=true 后回复「继续」自动跑三项真机验收。"
|