admin/Florida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial Commit

Browse Source
This commit is contained in:
Ylarod
2023-07-18 16:29:24 +08:00
commit 5ba1373c87
17 changed files with 1101 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
patches/frida-core-hluwa/0001-strongR-frida-string_frida_rpc.patch Normal file
View File

@@ -0,0 +1,43 @@
From 0874adb5e0e53d90da56e542053b9f14adccfb1a Mon Sep 17 00:00:00 2001
From: hluwa <hluwa888@gmail.com>
Date: Mon, 16 Aug 2021 10:55:11 +0800
Subject: [PATCH 1/8] strongR-frida: string_frida_rpc
---
lib/base/rpc.vala | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/base/rpc.vala b/lib/base/rpc.vala
index 3695ba8c..02602abf 100644
--- a/lib/base/rpc.vala
+++ b/lib/base/rpc.vala
@@ -17,7 +17,7 @@ namespace Frida {
var request = new Json.Builder ();
request
.begin_array ()
- .add_string_value ("frida:rpc")
+ .add_string_value ((string) GLib.Base64.decode("ZnJpZGE6cnBj="))
.add_string_value (request_id)
.add_string_value ("call")
.add_string_value (method)
@@ -70,7 +70,7 @@ namespace Frida {
}
public bool try_handle_message (string json) {
- if (json.index_of ("\"frida:rpc\"") == -1)
+ if (json.index_of ((string) GLib.Base64.decode("ImZyaWRhOnJwYyI=")) == -1)
return false;
var parser = new Json.Parser ();
@@ -99,7 +99,7 @@ namespace Frida {
return false;
string? type = rpc_message.get_element (0).get_string ();
- if (type == null || type != "frida:rpc")
+ if (type == null || type != (string) GLib.Base64.decode("ZnJpZGE6cnBj="))
return false;
var request_id_value = rpc_message.get_element (1);
--
2.30.2

33
patches/frida-core-hluwa/0002-strongR-frida-io_re_frida_server.patch Normal file
View File

@@ -0,0 +1,33 @@
From aafd3e9f938e6e94d6b181718b0c2d85192168b4 Mon Sep 17 00:00:00 2001
From: hluwa <hluwa888@gmail.com>
Date: Mon, 16 Aug 2021 10:55:11 +0800
Subject: [PATCH 2/8] strongR-frida: io_re_frida_server
---
server/server.vala | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/server/server.vala b/server/server.vala
index e2d1b66d..42c86739 100644
--- a/server/server.vala
+++ b/server/server.vala
@@ -1,7 +1,7 @@
namespace Frida.Server {
private static Application application;
- private const string DEFAULT_DIRECTORY = "re.frida.server";
+ private static string DEFAULT_DIRECTORY = null;
private static bool output_version = false;
private static string? listen_address = null;
private static string? certpath = null;
@@ -50,6 +50,7 @@ namespace Frida.Server {
};
private static int main (string[] args) {
+ DEFAULT_DIRECTORY = GLib.Uuid.string_random();
Environment.init ();
#if DARWIN
--
2.30.2

25
patches/frida-core-hluwa/0003-strongR-frida-pipe_linjector.patch Normal file
View File

@@ -0,0 +1,25 @@
From 7a036bdfb159ad73bb208647555e2c632760e743 Mon Sep 17 00:00:00 2001
From: hluwa <hluwa888@gmail.com>
Date: Mon, 16 Aug 2021 10:55:11 +0800
Subject: [PATCH 3/8] strongR-frida: pipe_linjector
---
src/linux/frida-helper-backend-glue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/linux/frida-helper-backend-glue.c b/src/linux/frida-helper-backend-glue.c
index b99963a1..3a8dbfa2 100644
--- a/src/linux/frida-helper-backend-glue.c
+++ b/src/linux/frida-helper-backend-glue.c
@@ -947,7 +947,7 @@ frida_inject_instance_init_fifo (FridaInjectInstance * self)
{
const int mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH;
- self->fifo_path = g_strdup_printf ("%s/linjector-%u", self->temp_path, self->id);
+ self->fifo_path = g_strdup_printf ("%s/%p%u", self->temp_path, self ,self->id);
mkfifo (self->fifo_path, mode);
chmod (self->fifo_path, mode);
--
2.30.2

33
patches/frida-core-hluwa/0004-strongR-frida-io_frida_agent_so.patch Normal file
View File

@@ -0,0 +1,33 @@
From 6fdcb5ae0b7f398e0eb2b23f22f9ab01ae2e09bf Mon Sep 17 00:00:00 2001
From: hluwa <hluwa888@gmail.com>
Date: Mon, 16 Aug 2021 10:55:11 +0800
Subject: [PATCH 4/8] strongR-frida: io_frida_agent_so
---
src/linux/linux-host-session.vala | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/linux/linux-host-session.vala b/src/linux/linux-host-session.vala
index 301799ed..059e75a9 100644
--- a/src/linux/linux-host-session.vala
+++ b/src/linux/linux-host-session.vala
@@ -128,12 +128,13 @@ namespace Frida {
var blob64 = Frida.Data.Agent.get_frida_agent_64_so_blob ();
var emulated_arm = Frida.Data.Agent.get_frida_agent_arm_so_blob ();
var emulated_arm64 = Frida.Data.Agent.get_frida_agent_arm64_so_blob ();
- agent = new AgentDescriptor (PathTemplate ("frida-agent-<arch>.so"),
+ var random_prefix = GLib.Uuid.string_random();
+ agent = new AgentDescriptor (PathTemplate (random_prefix + "-<arch>.so"),
new Bytes.static (blob32.data),
new Bytes.static (blob64.data),
new AgentResource[] {
- new AgentResource ("frida-agent-arm.so", new Bytes.static (emulated_arm.data), tempdir),
- new AgentResource ("frida-agent-arm64.so", new Bytes.static (emulated_arm64.data), tempdir),
+ new AgentResource (random_prefix + "-arm.so", new Bytes.static (emulated_arm.data), tempdir),
+ new AgentResource (random_prefix + "-arm64.so", new Bytes.static (emulated_arm64.data), tempdir),
},
AgentMode.INSTANCED,
tempdir);
--
2.30.2

179
patches/frida-core-hluwa/0005-strongR-frida-symbol_frida_agent_main.patch Normal file
View File

@@ -0,0 +1,179 @@
From 2ca848b58ebcf36fda34c5eaba4fa85d2ad438c6 Mon Sep 17 00:00:00 2001
From: hluwa <hluwa888@gmail.com>
Date: Mon, 16 Aug 2021 10:55:11 +0800
Subject: [PATCH 5/8] strongR-frida: symbol_frida_agent_main
---
src/agent-container.vala | 2 +-
src/anti-anti-frida.py | 27 +++++++++++++++++++++++++++
src/darwin/darwin-host-session.vala | 2 +-
src/embed-agent.sh | 9 +++++++++
src/linux/linux-host-session.vala | 2 +-
src/qnx/qnx-host-session.vala | 2 +-
src/windows/windows-host-session.vala | 2 +-
tests/test-agent.vala | 2 +-
tests/test-injector.vala | 2 +-
9 files changed, 43 insertions(+), 7 deletions(-)
create mode 100644 src/anti-anti-frida.py
diff --git a/src/agent-container.vala b/src/agent-container.vala
index 256e5ed7..83f6a3e8 100644
--- a/src/agent-container.vala
+++ b/src/agent-container.vala
@@ -20,7 +20,7 @@ namespace Frida {
assert (container.module != null);
void * main_func_symbol;
- var main_func_found = container.module.symbol ("frida_agent_main", out main_func_symbol);
+ var main_func_found = container.module.symbol ("main", out main_func_symbol);
assert (main_func_found);
container.main_impl = (AgentMainFunc) main_func_symbol;
diff --git a/src/anti-anti-frida.py b/src/anti-anti-frida.py
new file mode 100644
index 00000000..d30168d6
--- /dev/null
+++ b/src/anti-anti-frida.py
@@ -0,0 +1,27 @@
+import lief
+import sys
+import random
+import os
+
+if __name__ == "__main__":
+ input_file = sys.arantigv[1]
+ print(f"[*] Patch frida-agent: {input_file}")
+ random_name = "".join(random.sample("ABCDEFGHIJKLMNO", 5))
+ print(f"[*] Patch `frida` to `{random_name}``")
+
+ binary = lief.parse(input_file)
+
+ if not binary:
+ exit()
+
+ for symbol in binary.symbols:
+ if symbol.name == "frida_agent_main":
+ symbol.name = "main"
+
+ if "frida" in symbol.name:
+ symbol.name = symbol.name.replace("frida", random_name)
+
+ if "FRIDA" in symbol.name:
+ symbol.name = symbol.name.replace("FRIDA", random_name)
+
+ binary.write(input_file)
diff --git a/src/darwin/darwin-host-session.vala b/src/darwin/darwin-host-session.vala
index 8f1336c5..0f6fae59 100644
--- a/src/darwin/darwin-host-session.vala
+++ b/src/darwin/darwin-host-session.vala
@@ -332,7 +332,7 @@ namespace Frida {
private async uint inject_agent (uint pid, string agent_parameters, Cancellable? cancellable) throws Error, IOError {
uint id;
- unowned string entrypoint = "frida_agent_main";
+ unowned string entrypoint = "main";
#if HAVE_EMBEDDED_ASSETS
id = yield fruitjector.inject_library_resource (pid, agent, entrypoint, agent_parameters, cancellable);
#else
diff --git a/src/embed-agent.sh b/src/embed-agent.sh
index 380e8a32..d07f4588 100755
--- a/src/embed-agent.sh
+++ b/src/embed-agent.sh
@@ -9,6 +9,7 @@ host_os="$6"
resource_compiler="$7"
resource_config="$8"
+custom_script="$output_dir/../../../../frida-core/src/anti-anti-frida.py"
priv_dir="$output_dir/frida-agent@emb"
case $host_os in
@@ -30,6 +31,10 @@ collect_generic_agent ()
else
touch "$embedded_agent"
fi
+ if [ -f "$custom_script" ]; then
+ python3 "$custom_script" "$embedded_agent"
+ fi
+
embedded_agents+=("$embedded_agent")
}
@@ -62,6 +67,10 @@ case $host_os in
exit 1
fi
+ if [ -f "$custom_script" ]; then
+ python3 "$custom_script" "$embedded_agent"
+ fi
+
exec "$resource_compiler" --toolchain=gnu -c "$resource_config" -o "$output_dir/frida-data-agent" "$embedded_agent"
;;
*)
diff --git a/src/linux/linux-host-session.vala b/src/linux/linux-host-session.vala
index 059e75a9..1221de64 100644
--- a/src/linux/linux-host-session.vala
+++ b/src/linux/linux-host-session.vala
@@ -422,7 +422,7 @@ namespace Frida {
var stream_request = Pipe.open (t.local_address, cancellable);
uint id;
- string entrypoint = "frida_agent_main";
+ string entrypoint = "main";
string agent_parameters = make_agent_parameters (t.remote_address, options);
var linjector = injector as Linjector;
#if HAVE_EMBEDDED_ASSETS
diff --git a/src/qnx/qnx-host-session.vala b/src/qnx/qnx-host-session.vala
index a7e5f51d..24b1f518 100644
--- a/src/qnx/qnx-host-session.vala
+++ b/src/qnx/qnx-host-session.vala
@@ -182,7 +182,7 @@ namespace Frida {
var stream_request = Pipe.open (t.local_address, cancellable);
- var id = yield qinjector.inject_library_resource (pid, agent_desc, "frida_agent_main",
+ var id = yield qinjector.inject_library_resource (pid, agent_desc, "main",
make_agent_parameters (t.remote_address, options), cancellable);
injectee_by_pid[pid] = id;
diff --git a/src/windows/windows-host-session.vala b/src/windows/windows-host-session.vala
index bae0f6be..630d0bb0 100644
--- a/src/windows/windows-host-session.vala
+++ b/src/windows/windows-host-session.vala
@@ -274,7 +274,7 @@ namespace Frida {
var stream_request = Pipe.open (t.local_address, cancellable);
var winjector = injector as Winjector;
- var id = yield winjector.inject_library_resource (pid, agent, "frida_agent_main",
+ var id = yield winjector.inject_library_resource (pid, agent, "main",
make_agent_parameters (t.remote_address, options), cancellable);
injectee_by_pid[pid] = id;
diff --git a/tests/test-agent.vala b/tests/test-agent.vala
index cb666dbb..66c407f8 100644
--- a/tests/test-agent.vala
+++ b/tests/test-agent.vala
@@ -444,7 +444,7 @@ Interceptor.attach(Module.getExportByName('libsystem_kernel.dylib', 'open'), ()
assert_nonnull (module);
void * main_func_symbol;
- var main_func_found = module.symbol ("frida_agent_main", out main_func_symbol);
+ var main_func_found = module.symbol ("main", out main_func_symbol);
assert_true (main_func_found);
main_impl = (AgentMainFunc) main_func_symbol;
diff --git a/tests/test-injector.vala b/tests/test-injector.vala
index 81df3e16..e4fb6730 100644
--- a/tests/test-injector.vala
+++ b/tests/test-injector.vala
@@ -250,7 +250,7 @@ namespace Frida.InjectorTest {
var path = Frida.Test.Labrats.path_to_library (name, arch);
assert_true (FileUtils.test (path, FileTest.EXISTS));
- yield injector.inject_library_file (process.id, path, "frida_agent_main", data);
+ yield injector.inject_library_file (process.id, path, "main", data);
} catch (GLib.Error e) {
printerr ("\nFAIL: %s\n\n", e.message);
assert_not_reached ();
--
2.30.2

25
patches/frida-core-hluwa/0006-strongR-frida-thread_gum_js_loop.patch Normal file
View File

@@ -0,0 +1,25 @@
From 3f729d795063022a7136139c78fc3788d091c158 Mon Sep 17 00:00:00 2001
From: hluwa <hluwa888@gmail.com>
Date: Mon, 16 Aug 2021 10:55:11 +0800
Subject: [PATCH 6/8] strongR-frida: thread_gum_js_loop
---
src/anti-anti-frida.py | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/anti-anti-frida.py b/src/anti-anti-frida.py
index d30168d6..b6a8e1aa 100644
--- a/src/anti-anti-frida.py
+++ b/src/anti-anti-frida.py
@@ -25,3 +25,8 @@ if __name__ == "__main__":
symbol.name = symbol.name.replace("FRIDA", random_name)
binary.write(input_file)
+
+ # gum-js-loop thread
+ random_name = "".join(random.sample("abcdefghijklmn", 11))
+ print(f"[*] Patch `gum-js-loop` to `{random_name}`")
+ os.system(f"sed -b -i s/gum-js-loop/{random_name}/g {input_file}")
--
2.30.2

26
patches/frida-core-hluwa/0007-strongR-frida-thread_gmain.patch Normal file
View File

@@ -0,0 +1,26 @@
From 2d63299647f698b0c8d5c165c08edf1edf57b9dc Mon Sep 17 00:00:00 2001
From: hluwa <hluwa888@gmail.com>
Date: Mon, 16 Aug 2021 10:55:11 +0800
Subject: [PATCH 7/8] strongR-frida: thread_gmain
---
src/anti-anti-frida.py | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/anti-anti-frida.py b/src/anti-anti-frida.py
index b6a8e1aa..bd67c606 100644
--- a/src/anti-anti-frida.py
+++ b/src/anti-anti-frida.py
@@ -30,3 +30,9 @@ if __name__ == "__main__":
random_name = "".join(random.sample("abcdefghijklmn", 11))
print(f"[*] Patch `gum-js-loop` to `{random_name}`")
os.system(f"sed -b -i s/gum-js-loop/{random_name}/g {input_file}")
+
+
+ # gmain thread
+ random_name = "".join(random.sample("abcdefghijklmn", 5))
+ print(f"[*] Patch `gmain` to `{random_name}`")
+ os.system(f"sed -b -i s/gmain/{random_name}/g {input_file}")
--
2.30.2

25
patches/frida-core-hluwa/0008-strongR-frida-protocol_unexpected_command.patch Normal file
View File

@@ -0,0 +1,25 @@
From 1c19492c453426c6b9f7af868e9b24b0734d9617 Mon Sep 17 00:00:00 2001
From: hluwa <hluwa888@gmail.com>
Date: Mon, 16 Aug 2021 10:55:11 +0800
Subject: [PATCH 8/8] strongR-frida: protocol_unexpected_command
---
src/droidy/droidy-client.vala | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/droidy/droidy-client.vala b/src/droidy/droidy-client.vala
index e784e0d1..95ca0deb 100644
--- a/src/droidy/droidy-client.vala
+++ b/src/droidy/droidy-client.vala
@@ -974,7 +974,7 @@ namespace Frida.Droidy {
case "OPEN":
case "CLSE":
case "WRTE":
- throw new Error.PROTOCOL ("Unexpected command");
+ break; //throw new Error.PROTOCOL ("Unexpected command");
default:
var length = parse_length (command_or_length);
--
2.30.2

63
patches/frida-core/0001-Florida-string_frida_rpc.patch Normal file
View File

@@ -0,0 +1,63 @@
From 595cb1bebc6954207ddf56ca1e21b49d8b01f427 Mon Sep 17 00:00:00 2001
From: Ylarod <me@ylarod.cn>
Date: Tue, 18 Jul 2023 15:51:29 +0800
Subject: [PATCH 1/7] Florida: string_frida_rpc
---
lib/base/rpc.vala | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
diff --git a/lib/base/rpc.vala b/lib/base/rpc.vala
index 3695ba8c..e5eddf0d 100644
--- a/lib/base/rpc.vala
+++ b/lib/base/rpc.vala
@@ -11,13 +11,27 @@ namespace Frida {
Object (peer: peer);
}
+ public string getRpcStr(bool quote){
+ char[] encryptedString = {0x6f, 0x7b, 0x60, 0x6d, 0x68, 0x33, 0x7b, 0x79, 0x6a};
+ string result = "";
+ for (int i = 0; i < encryptedString.length; i++) {
+ char decryptedChar = encryptedString[i] ^ 9;
+ result += decryptedChar;
+ }
+ if(quote){
+ return "\"" + result + "\""
+ }else{
+ return result;
+ }
+ }
+
public async Json.Node call (string method, Json.Node[] args, Cancellable? cancellable) throws Error, IOError {
string request_id = Uuid.string_random ();
var request = new Json.Builder ();
request
.begin_array ()
- .add_string_value ("frida:rpc")
+ .add_string_value (getRpcStr(false))
.add_string_value (request_id)
.add_string_value ("call")
.add_string_value (method)
@@ -70,7 +84,7 @@ namespace Frida {
}
public bool try_handle_message (string json) {
- if (json.index_of ("\"frida:rpc\"") == -1)
+ if (json.index_of (getRpcStr(true)) == -1)
return false;
var parser = new Json.Parser ();
@@ -99,7 +113,7 @@ namespace Frida {
return false;
string? type = rpc_message.get_element (0).get_string ();
- if (type == null || type != "frida:rpc")
+ if (type == null || type != getRpcStr(false))
return false;
var request_id_value = rpc_message.get_element (1);
--
2.34.1

33
patches/frida-core/0002-Florida-re_frida_server.patch Normal file
View File

@@ -0,0 +1,33 @@
From c4dadb40b9b0aedebd0db9a7d6ea00eb76e6c43b Mon Sep 17 00:00:00 2001
From: Ylarod <me@ylarod.cn>
Date: Tue, 18 Jul 2023 15:52:56 +0800
Subject: [PATCH 2/7] Florida: re_frida_server
---
server/server.vala | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/server/server.vala b/server/server.vala
index f96c7ca5..2658d24f 100644
--- a/server/server.vala
+++ b/server/server.vala
@@ -1,7 +1,7 @@
namespace Frida.Server {
private static Application application;
- private const string DEFAULT_DIRECTORY = "re.frida.server";
+ private const string DEFAULT_DIRECTORY = null;
private static bool output_version = false;
private static string? listen_address = null;
private static string? certpath = null;
@@ -50,6 +50,7 @@ namespace Frida.Server {
};
private static int main (string[] args) {
+ DEFAULT_DIRECTORY = GLib.Uuid.string_random();
Environment.init ();
#if DARWIN
--
2.34.1

33
patches/frida-core/0003-Florida-frida_agent_so.patch Normal file
View File

@@ -0,0 +1,33 @@
From 3a2edaf762e3af9cd3eba444c02cffdfd9c647cb Mon Sep 17 00:00:00 2001
From: Ylarod <me@ylarod.cn>
Date: Tue, 18 Jul 2023 15:57:19 +0800
Subject: [PATCH 3/7] Florida: frida_agent_so
---
src/linux/linux-host-session.vala | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/linux/linux-host-session.vala b/src/linux/linux-host-session.vala
index 50470ac8..64245792 100644
--- a/src/linux/linux-host-session.vala
+++ b/src/linux/linux-host-session.vala
@@ -128,12 +128,13 @@ namespace Frida {
var blob64 = Frida.Data.Agent.get_frida_agent_64_so_blob ();
var emulated_arm = Frida.Data.Agent.get_frida_agent_arm_so_blob ();
var emulated_arm64 = Frida.Data.Agent.get_frida_agent_arm64_so_blob ();
- agent = new AgentDescriptor (PathTemplate ("frida-agent-<arch>.so"),
+ var random_prefix = GLib.Uuid.string_random();
+ agent = new AgentDescriptor (PathTemplate (random_prefix + "-<arch>.so"),
new Bytes.static (blob32.data),
new Bytes.static (blob64.data),
new AgentResource[] {
- new AgentResource ("frida-agent-arm.so", new Bytes.static (emulated_arm.data), tempdir),
- new AgentResource ("frida-agent-arm64.so", new Bytes.static (emulated_arm64.data), tempdir),
+ new AgentResource (random_prefix + "-arm.so", new Bytes.static (emulated_arm.data), tempdir),
+ new AgentResource (random_prefix + "-arm64.so", new Bytes.static (emulated_arm64.data), tempdir),
},
AgentMode.INSTANCED,
tempdir);
--
2.34.1

195
patches/frida-core/0004-Florida-symbol_frida_agent_main.patch Normal file
View File

@@ -0,0 +1,195 @@
From bb75966aaa2943a7adc4b41aa029d86d61a7f847 Mon Sep 17 00:00:00 2001
From: Ylarod <me@ylarod.cn>
Date: Tue, 18 Jul 2023 16:02:50 +0800
Subject: [PATCH 4/7] Florida: symbol_frida_agent_main
---
src/agent-container.vala | 2 +-
src/anti-anti-frida.py | 27 +++++++++++++++++++++++++++
src/darwin/darwin-host-session.vala | 2 +-
src/embed-agent.sh | 10 ++++++++++
src/freebsd/freebsd-host-session.vala | 2 +-
src/linux/linux-host-session.vala | 2 +-
src/qnx/qnx-host-session.vala | 2 +-
src/windows/windows-host-session.vala | 2 +-
tests/test-agent.vala | 2 +-
tests/test-injector.vala | 2 +-
10 files changed, 45 insertions(+), 8 deletions(-)
create mode 100644 src/anti-anti-frida.py
diff --git a/src/agent-container.vala b/src/agent-container.vala
index a8db6b29..afe514cb 100644
--- a/src/agent-container.vala
+++ b/src/agent-container.vala
@@ -25,7 +25,7 @@ namespace Frida {
assert (container.module != null);
void * main_func_symbol;
- var main_func_found = container.module.symbol ("frida_agent_main", out main_func_symbol);
+ var main_func_found = container.module.symbol ("main", out main_func_symbol);
assert (main_func_found);
container.main_impl = (AgentMainFunc) main_func_symbol;
diff --git a/src/anti-anti-frida.py b/src/anti-anti-frida.py
new file mode 100644
index 00000000..1b82fb03
--- /dev/null
+++ b/src/anti-anti-frida.py
@@ -0,0 +1,27 @@
+import lief
+import sys
+import random
+import os
+
+if __name__ == "__main__":
+ input_file = sys.arantigv[1]
+ print(f"[*] Patch frida-agent: {input_file}")
+ random_name = "".join(random.sample("ABCDEFGHIJKLMNO", 5))
+ print(f"[*] Patch `frida` to `{random_name}``")
+
+ binary = lief.parse(input_file)
+
+ if not binary:
+ exit()
+
+ for symbol in binary.symbols:
+ if symbol.name == "frida_agent_main":
+ symbol.name = "main"
+
+ if "frida" in symbol.name:
+ symbol.name = symbol.name.replace("frida", random_name)
+
+ if "FRIDA" in symbol.name:
+ symbol.name = symbol.name.replace("FRIDA", random_name)
+
+ binary.write(input_file)
\ No newline at end of file
diff --git a/src/darwin/darwin-host-session.vala b/src/darwin/darwin-host-session.vala
index 06e7065b..d215b75a 100644
--- a/src/darwin/darwin-host-session.vala
+++ b/src/darwin/darwin-host-session.vala
@@ -354,7 +354,7 @@ namespace Frida {
private async uint inject_agent (uint pid, string agent_parameters, Cancellable? cancellable) throws Error, IOError {
uint id;
- unowned string entrypoint = "frida_agent_main";
+ unowned string entrypoint = "main";
#if HAVE_EMBEDDED_ASSETS
id = yield fruitjector.inject_library_resource (pid, agent, entrypoint, agent_parameters, cancellable);
#else
diff --git a/src/embed-agent.sh b/src/embed-agent.sh
index 6119b5e1..1e8d04ca 100755
--- a/src/embed-agent.sh
+++ b/src/embed-agent.sh
@@ -10,6 +10,7 @@ resource_compiler=$7
resource_config=$8
lipo=$9
+custom_script="$output_dir/../../../../frida-core/src/anti-anti-frida.py"
priv_dir="$output_dir/frida-agent@emb"
mkdir -p "$priv_dir"
@@ -22,6 +23,11 @@ collect_generic_agent ()
else
touch "$embedded_agent"
fi
+
+ if [ -f "$custom_script" ]; then
+ python3 "$custom_script" "$embedded_agent"
+ fi
+
embedded_agents+=("$embedded_agent")
}
@@ -40,6 +46,10 @@ case $host_os in
exit 1
fi
+ if [ -f "$custom_script" ]; then
+ python3 "$custom_script" "$embedded_agent"
+ fi
+
exec "$resource_compiler" --toolchain=apple -c "$resource_config" -o "$output_dir/frida-data-agent" "$embedded_agent"
;;
freebsd|qnx)
diff --git a/src/freebsd/freebsd-host-session.vala b/src/freebsd/freebsd-host-session.vala
index a2204a4e..eac16116 100644
--- a/src/freebsd/freebsd-host-session.vala
+++ b/src/freebsd/freebsd-host-session.vala
@@ -197,7 +197,7 @@ namespace Frida {
var stream_request = Pipe.open (t.local_address, cancellable);
- var id = yield binjector.inject_library_resource (pid, agent_desc, "frida_agent_main",
+ var id = yield binjector.inject_library_resource (pid, agent_desc, "main",
make_agent_parameters (pid, t.remote_address, options), cancellable);
injectee_by_pid[pid] = id;
diff --git a/src/linux/linux-host-session.vala b/src/linux/linux-host-session.vala
index 64245792..086d0b96 100644
--- a/src/linux/linux-host-session.vala
+++ b/src/linux/linux-host-session.vala
@@ -427,7 +427,7 @@ namespace Frida {
protected override async Future<IOStream> perform_attach_to (uint pid, HashTable<string, Variant> options,
Cancellable? cancellable, out Object? transport) throws Error, IOError {
uint id;
- string entrypoint = "frida_agent_main";
+ string entrypoint = "main";
string parameters = make_agent_parameters (pid, "", options);
AgentFeatures features = CONTROL_CHANNEL;
var linjector = (Linjector) injector;
diff --git a/src/qnx/qnx-host-session.vala b/src/qnx/qnx-host-session.vala
index 69f2995f..a4e59ab2 100644
--- a/src/qnx/qnx-host-session.vala
+++ b/src/qnx/qnx-host-session.vala
@@ -182,7 +182,7 @@ namespace Frida {
var stream_request = Pipe.open (t.local_address, cancellable);
- var id = yield qinjector.inject_library_resource (pid, agent_desc, "frida_agent_main",
+ var id = yield qinjector.inject_library_resource (pid, agent_desc, "main",
make_agent_parameters (pid, t.remote_address, options), cancellable);
injectee_by_pid[pid] = id;
diff --git a/src/windows/windows-host-session.vala b/src/windows/windows-host-session.vala
index 67f1f3ef..518cd256 100644
--- a/src/windows/windows-host-session.vala
+++ b/src/windows/windows-host-session.vala
@@ -274,7 +274,7 @@ namespace Frida {
var stream_request = Pipe.open (t.local_address, cancellable);
var winjector = injector as Winjector;
- var id = yield winjector.inject_library_resource (pid, agent, "frida_agent_main",
+ var id = yield winjector.inject_library_resource (pid, agent, "main",
make_agent_parameters (pid, t.remote_address, options), cancellable);
injectee_by_pid[pid] = id;
diff --git a/tests/test-agent.vala b/tests/test-agent.vala
index 62fb8260..6e5eba51 100644
--- a/tests/test-agent.vala
+++ b/tests/test-agent.vala
@@ -449,7 +449,7 @@ Interceptor.attach(Module.getExportByName('libsystem_kernel.dylib', 'open'), ()
assert_nonnull (module);
void * main_func_symbol;
- var main_func_found = module.symbol ("frida_agent_main", out main_func_symbol);
+ var main_func_found = module.symbol ("main", out main_func_symbol);
assert_true (main_func_found);
main_impl = (AgentMainFunc) main_func_symbol;
diff --git a/tests/test-injector.vala b/tests/test-injector.vala
index f4a321c4..448bddf3 100644
--- a/tests/test-injector.vala
+++ b/tests/test-injector.vala
@@ -258,7 +258,7 @@ namespace Frida.InjectorTest {
var path = Frida.Test.Labrats.path_to_library (name, arch);
assert_true (FileUtils.test (path, FileTest.EXISTS));
- yield injector.inject_library_file (process.id, path, "frida_agent_main", data);
+ yield injector.inject_library_file (process.id, path, "main", data);
} catch (GLib.Error e) {
printerr ("\nFAIL: %s\n\n", e.message);
assert_not_reached ();
--
2.34.1

29
patches/frida-core/0005-Florida-thread_gum_js_loop.patch Normal file
View File

@@ -0,0 +1,29 @@
From 42f9eb741966e1bd17fd1d88d4a5238019b10225 Mon Sep 17 00:00:00 2001
From: Ylarod <me@ylarod.cn>
Date: Tue, 18 Jul 2023 16:03:47 +0800
Subject: [PATCH 5/7] Florida: thread_gum_js_loop
---
src/anti-anti-frida.py | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/anti-anti-frida.py b/src/anti-anti-frida.py
index 1b82fb03..4317e802 100644
--- a/src/anti-anti-frida.py
+++ b/src/anti-anti-frida.py
@@ -24,4 +24,9 @@ if __name__ == "__main__":
if "FRIDA" in symbol.name:
symbol.name = symbol.name.replace("FRIDA", random_name)
- binary.write(input_file)
\ No newline at end of file
+ binary.write(input_file)
+
+ # gum-js-loop thread
+ random_name = "".join(random.sample("abcdefghijklmn", 11))
+ print(f"[*] Patch `gum-js-loop` to `{random_name}`")
+ os.system(f"sed -b -i s/gum-js-loop/{random_name}/g {input_file}")
\ No newline at end of file
--
2.34.1

29
patches/frida-core/0006-Florida-thread_gmain.patch Normal file
View File

@@ -0,0 +1,29 @@
From 8d04db531ec7e5ce45e783b75114b6f04f3c16a6 Mon Sep 17 00:00:00 2001
From: Ylarod <me@ylarod.cn>
Date: Tue, 18 Jul 2023 16:04:15 +0800
Subject: [PATCH 6/7] Florida: thread_gmain
---
src/anti-anti-frida.py | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/anti-anti-frida.py b/src/anti-anti-frida.py
index 4317e802..f040406b 100644
--- a/src/anti-anti-frida.py
+++ b/src/anti-anti-frida.py
@@ -29,4 +29,9 @@ if __name__ == "__main__":
# gum-js-loop thread
random_name = "".join(random.sample("abcdefghijklmn", 11))
print(f"[*] Patch `gum-js-loop` to `{random_name}`")
- os.system(f"sed -b -i s/gum-js-loop/{random_name}/g {input_file}")
\ No newline at end of file
+ os.system(f"sed -b -i s/gum-js-loop/{random_name}/g {input_file}")
+
+ # gmain thread
+ random_name = "".join(random.sample("abcdefghijklmn", 5))
+ print(f"[*] Patch `gmain` to `{random_name}`")
+ os.system(f"sed -b -i s/gmain/{random_name}/g {input_file}")
\ No newline at end of file
--
2.34.1

25
patches/frida-core/0007-Florida-protocol_unexpected_command.patch Normal file
View File

@@ -0,0 +1,25 @@
From 7fdbd1c5400af62d71902991b30388fe2b9a35e8 Mon Sep 17 00:00:00 2001
From: Ylarod <me@ylarod.cn>
Date: Tue, 18 Jul 2023 16:04:55 +0800
Subject: [PATCH 7/7] Florida: protocol_unexpected_command
---
src/droidy/droidy-client.vala | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/droidy/droidy-client.vala b/src/droidy/droidy-client.vala
index 0ed2edeb..9de04b54 100644
--- a/src/droidy/droidy-client.vala
+++ b/src/droidy/droidy-client.vala
@@ -1013,7 +1013,7 @@ namespace Frida.Droidy {
case "OPEN":
case "CLSE":
case "WRTE":
- throw new Error.PROTOCOL ("Unexpected command");
+ break; // throw new Error.PROTOCOL ("Unexpected command");
default:
var length = parse_length (command_or_length);
--
2.34.1