frida so Hook 函数参数返回值修改

![](https://s1.51cto.com/images/blog/201905/21/e59d78e7f1f9e60f376fd81c75cbd12f.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=)
# -*- coding: UTF-8 -*-
import frida, sys

jsCode = """

Java.perform(function(){

    var nativePointer = Module.findExportByName("libhello.so", "Java_com_xiaojianbang_app_NativeHelper_add");
    send("native: " + nativePointer);
    Interceptor.attach(nativePointer, {
        onEnter: function(args){
            send(args[0]);
            send(args[1]);
            send(args[2].toInt32());
            send(args[3].toInt32());
            send(args[4].toInt32());
            args[4] = ptr(1000);   //new NativePointer
            send(args[4].toInt32());
        },
        onLeave: function(retval){
            send(retval.toInt32());
            retval.replace(10000);
            send(retval.toInt32());
        }
    });

});

""";

def message(message, data):
    if message["type"] == ‘send‘:
        print(u"[*] {0}".format(message[‘payload‘]))
    else:
        print(message)

process = frida.get_remote_device().attach("com.xiaojianbang.app")
script= process.create_script(jsCode)
script.on("message", message)
script.load()
sys.stdin.read()

原文地址：https://blog.51cto.com/haidragon/2397665