alex-frida/agent/HookDY.js

import {logColor, LogColor} from "./logger";

export let HOOK_DY = {
    printStackTrace: function () {
        Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()).split("\n").forEach(function (line) {
            console.log(line);
        });
    }, hookTextViewClick: function () {
        function hookTextView() {
            var View = Java.use("android.view.View"); // setOnClickListener 定义在 View 类中
            var TextView = Java.use("android.widget.TextView"); // 为了访问 getText 方法

            // 重写 setOnClickListener
            View.setOnClickListener.implementation = function (listener) {
                // 检查 this 是否是 TextView 的实例
                // console.log("type of this: " + this.getClass().getName());
                if (this.getClass().getName().includes("TextView")) {
                    try { // 安全地转换 this 为 TextView
                        var textView = Java.cast(this, TextView);
                        let text = textView.getText();
                        console.log("id: " + textView.getId(), "\t\t >>> \t\t" + text)
                        // if (text.toString().includes("***")) {
                        //     var stack = Java.use("java.lang.Thread").currentThread().getStackTrace();
                        //     for (var i = 0; i < stack.length; i++) {
                        //         console.log(stack[i].toString());
                        //     }
                        //     //打印堆栈信息
                        //     console.log("1111")
                        //     var jThrowable = Java.use("java.lang.Throwable");
                        //     console.log("2222")
                        //     var jStackTrace = jThrowable.$new().getStackTrace();
                        //     console.log("Stack trace:");
                        //     jStackTrace.forEach(function (stackTraceElement) {
                        //         console.log("\t" + stackTraceElement.toString());
                        //     });
                        //     console.log("33333")
                        // }
                    } catch (e) {
                        console.log("报错:", e);
                    }
                } else {
                    // console.log("Not a TextView");
                }

                // 调用原始的 setOnClickListener 方法
                this.setOnClickListener(listener);
            };
        }

        function hookSocket() {
            Java.perform(function () {
                // Hook Socket's OutputStream
                var SocketOutputStream = Java.use("java.net.SocketOutputStream");
                SocketOutputStream.write.overload('[B').implementation = function (b) {
                    console.log("SocketOutputStream.write:", Java.array('byte', b));
                    return this.write(b);
                };
                SocketOutputStream.write.overload('[B', 'int', 'int').implementation = function (b, off, len) {
                    console.log("SocketOutputStream.write with offset and length:", Java.array('byte', b).slice(off, off + len));
                    return this.write(b, off, len);
                };

                // Hook Socket's InputStream
                var SocketInputStream = Java.use("java.net.SocketInputStream");
                SocketInputStream.read.overload('[B').implementation = function (b) {
                    var result = this.read(b);
                    console.log("SocketInputStream.read:", Java.array('byte', b));
                    return result;
                };
                SocketInputStream.read.overload('[B', 'int', 'int').implementation = function (b, off, len) {
                    var result = this.read(b, off, len);
                    console.log("SocketInputStream.read with offset and length:", Java.array('byte', b).slice(off, off + len));
                    return result;
                };
            });


            let IMessageReceiveListener = Java.use("com.bytedance.frameworks.baselib.network.http.cronet.websocket.IMessageReceiveListener");
            IMessageReceiveListener["onConnection"].implementation = function (i, str, jSONObject) {
                console.log(`IMessageReceiveListener.onConnection is called: i=${i}, str=${str}, jSONObject=${jSONObject}`);
                this["onConnection"](i, str, jSONObject);
            };
            IMessageReceiveListener["onFeedBackLog"].implementation = function (str) {
                console.log(`IMessageReceiveListener.onFeedBackLog is called: str=${str}`);
                this["onFeedBackLog"](str);
            };
            IMessageReceiveListener["onMessage"].implementation = function (bArr, i) {
                console.log(`IMessageReceiveListener.onMessage is called: bArr=${bArr}, i=${i}`);
                this["onMessage"](bArr, i);
            };

            let IWsClient = Java.use("com.bytedance.frameworks.baselib.network.http.cronet.websocket.IWsClient");
            IWsClient["sendMessage"].implementation = function (bArr, i) {
                console.log(`IWsClient.sendMessage is called: bArr=${bArr}, i=${i}`);
                let result = this["sendMessage"](bArr, i);
                console.log(`IWsClient.sendMessage result=${result}`);
                return result;
            };
        }

        function hookDebugMode() {
            let DebugUtil = Java.use("com.bytedance.bdp.appbase.debug.DebugUtil");
            DebugUtil["debug"].implementation = function () {
                console.log(`DebugUtil.debug is called`);
                let result = this["debug"]();
                console.log(`DebugUtil.debug result=${result}`);
                return true;
            };
            DebugUtil["checkDebugSign"].implementation = function (str) {
                console.log(`DebugUtil.checkDebugSign is called: str=${str}`);
                let result = this["checkDebugSign"](str);
                console.log(`DebugUtil.checkDebugSign result=${result}`);
                return true;
            };

            let ChannelUtil = Java.use("com.tt.miniapp.util.ChannelUtil");
            ChannelUtil["isLocalTest"].implementation = function () {
                console.log(`ChannelUtil.isLocalTest is called`);
                let result = this["isLocalTest"]();
                console.log(`ChannelUtil.isLocalTest result=${result}`);
                return true;
            };

            DebugUtil.DEBUG = true;
        }

        Java.perform(function () {
            logColor("HookDY.js is loaded", LogColor.GREEN_TEXT);
            // hookDebugMode();
            // hookTextView();
            // hookSocket();

            let OnMessageListener = Java.use("com.ss.ugc.live.sdk.message.interfaces.OnMessageListener");
            OnMessageListener["onMessage"].implementation = function (iMessage) {
                console.log(`OnMessageListener.onMessage is called: iMessage=${iMessage}`);
                logColor("OnMessageListener.onMessage is called: iMessage=" + iMessage, LogColor.RED_TEXT);
                this["onMessage"](iMessage);
            };

            // let C2120008In = Java.use("X.08In");
            // C2120008In["onMessage"].implementation = function (iMessage) {
            //     console.log(`C2120008In.onMessage is called: iMessage=${iMessage}`);
            //     console.log("performClick triggered, printing stack trace:");
            //     Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()).split("\n").forEach(function (line) {
            //         console.log(line);
            //     });
            //     this["onMessage"](iMessage);
            // };
            //
            // let C1420440n0C = Java.use("X.0n0C");
            // C1420440n0C["onMessage"].implementation = function (iMessage) {
            //     console.log(`C1420440n0C.onMessage is called: iMessage=${iMessage}`);
            //     this.printStackTrace();
            //     this["onMessage"](iMessage);
            // };
            let GsonUtil = Java.use("com.bytedance.android.ec.core.utils.GsonUtil");

            let HandlerC8064033h = Java.use("X.033h");
            HandlerC8064033h["handleMessage"].implementation = function (msg) {
                //解析 android.os.Message
                let what = msg.what.value;
                // console.log(`msg.what:${what}`);
                let objArr = msg.obj.value;
                if (what !== 202 && objArr != null) {
                    let ArrayList = Java.use("java.util.ArrayList");
                    let objList = Java.cast(objArr, ArrayList);
                    for (let index = 0; index < objList.size(); index++) {
                        logColor(`---------------------------------------------------------------------------------------------------------------------------------`, LogColor.RED_TEXT);
                        let obj = objList.get(index);
                        let toString = obj.toString();
                        if (toString.includes("Gift")/*||toString.includes("gift")*/) {
                            logColor(`what:${what}\t\t obj${index}\t\tclass:${obj.getClass().getName()} =>\n` + GsonUtil.toJson(obj), LogColor.YELLOW_TEXT);
                        } else {
                            logColor(`what:${what}\t\t obj${index}\t\tclass:${obj.getClass().getName()} =>\n` + obj, LogColor.GREEN_TEXT);
                        }
                        logColor(`---------------------------------------------------------------------------------------------------------------------------------`, LogColor.RED_TEXT);
                    }
                }

                this["handleMessage"](msg);
            };

            //hook X.0mSO
            // setTimeout(function (){
            //     let use = Java.use("X.0mSO");
            //     if (use!==null){
            //         console.log("hook java")
            //         use.LIZJ.overload().implementation=function () {
            //             let lizj = this.LIZJ();
            //             console.log("call lizj:",lizj);
            //             return lizj;
            //         }
            //     }
            //
            // },5000);
            // setTimeout(function () {
            //     //hook webview的load url的所有方法
            //     Java.perform(function () {
            //         Java.use("android.webkit.WebView").loadUrl.overload("java.lang.String").implementation = function (url) {
            //             console.log("load url:", url);
            //             return this.loadUrl(url);
            //         }
            //     });
            // }, 5000);
        });
    }
}