某汽车APP的接口分析

// TraceOkHttp.js
Java.perform(function () {

    /* ---------- 0. 想 hook 的类 & 方法 ---------- */
    var targets = [
        { cls: 'com.android.org.conscrypt.NativeSsl',          mtd: 'doHandshake' },
        { cls: 'com.google.android.gms.org.conscrypt.NativeSsl',mtd: 'doHandshake' },
        { cls: 'org.conscrypt.NativeSsl',                      mtd: 'doHandshake' } // 一些厂商把包名改回纯 org.conscrypt.*
    ];

    var Throwable = Java.use('java.lang.Throwable');
    var Log       = Java.use('android.util.Log');

    /* ---------- 1. 通用挂钩函数：遍历所有 overload ---------- */
    function hookAllOverloads(className, methodName) {
        try {
            var Cls = Java.use(className);

            Cls[methodName].overloads.forEach(function (ov) {

                console.log('[+] Hooking ' +
                    className + '.' + methodName +
                    '(' + ov.argumentTypes.map(function (t) { return t.className; }).join(', ') + ')');

                ov.implementation = function () {

                    /* ----- 打印参数 ----- */
                    for (var i = 0; i < arguments.length; i++) {
                        console.log('arg[' + i + '] → ' + arguments[i]);
                    }

                    /* ----- 打印调用栈 ----- */
                    console.log('---- stack ----\n' +
                        Log.getStackTraceString(Throwable.$new()).replace(/(\sat\s)/g, '\n$1'));

                    return ov.apply(this, arguments);
                };
            });

        } catch (e) {
            // 类不存在（ROM／APP 未使用对应 Conscrypt 版本），静默跳过
        }
    }

    /* ---------- 2. 批量挂钩 ---------- */
    targets.forEach(function (t) { hookAllOverloads(t.cls, t.mtd); });

    console.log('[*] SSL Handshake loaded');
});

//frida -U -f com.byd.aeri.caranywhere -l .\TraceOkHttp.js

/**
 * 通用 SSL Pinning 绕过脚本
 *  1) 绕过各类 X509/TrustManager 校验
 *  2) 绕过 HostnameVerifier / OkHostnameVerifier
 *  3) 绕过 OkHttp3/4 的 CertificatePinner
 *  4) 覆盖 Conscrypt / TrustManagerImpl / WebViewClient / HttpsURLConnection / TrustKit 等常见路径
 */

function hookAllOverloads(targetClass, methodName, cb) {
    try {
        const klass = Java.use(targetClass);
        const overloads = klass[methodName].overloads;
        overloads.forEach(function (ov) {
            ov.implementation = function () {
                try {
                    return cb.call(this, ov, arguments);
                } catch (e) {
                    console.log(`[!] ${targetClass}.${methodName} bypass error: ${e}`);
                    // 如果出错时继续调用原方法
                    return ov.apply(this, arguments);
                }
            };
        });
        console.log(`[+] Hooked ${targetClass}.${methodName} (${overloads.length} overloads)`);
    } catch (e) {
        // console.log(`[i] ${targetClass}.${methodName} not found: ${e}`);
    }
}

setImmediate(function() {
    Java.perform(function() {

        // ------------------------------------------------------------------------------------
        // 1) 构造完全信任的 TrustManager，并把它塞进 SSLContext.init
        // ------------------------------------------------------------------------------------
        try {
            const X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
            const SSLContext = Java.use('javax.net.ssl.SSLContext');

            const TrustManager = Java.registerClass({
                name: 'com.frida.FakeTrustManager',
                implements: [X509TrustManager],
                methods: {
                    getAcceptedIssuers: function () { return []; },
                    checkClientTrusted: function (chain, authType) {},
                    checkServerTrusted: function (chain, authType) {}
                }
            });

            const TrustManagers = [TrustManager.$new()];

            SSLContext.init.overload(
                '[Ljavax.net.ssl.KeyManager;',
                '[Ljavax.net.ssl.TrustManager;',
                'java.security.SecureRandom'
            ).implementation = function (km, tm, sr) {
                console.log('[+] SSLContext.init() => replacing TrustManagers');
                return this.init(km, TrustManagers, sr);
            };
            console.log('[+] Hooked SSLContext.init');
        } catch (e) {
            console.log('[i] SSLContext hook failed: ' + e);
        }

        // ------------------------------------------------------------------------------------
        // 2) Conscrypt / TrustManagerImpl / X509TrustManagerExtensions
        //    (Android 7+ 常见证书校验入口)
        // ------------------------------------------------------------------------------------
        const tmImpls = [
            'com.android.org.conscrypt.TrustManagerImpl',
            'android.net.http.X509TrustManagerExtensions',
        ];
        tmImpls.forEach(function(name) {
            try {
                const TM = Java.use(name);
                // 常见 3 参数签名
                if (TM.checkServerTrusted) {
                    TM.checkServerTrusted.overloads.forEach(function (ov) {
                        ov.implementation = function () {
                            let host = '';
                            try {
                                // 不同 Overload 第三个参数可能是 host、SSLSession、Socket 等，安全打印
                                host = arguments.length >= 3 ? arguments[2] : '';
                            } catch (e) {}
                            console.log(`[+] ${name}.checkServerTrusted() bypassed for host: ${host}`);
                            // 尽量返回原来的证书链或空数组，类型要与原方法返回一致
                            try {
                                return ov.returnType.className === 'java.util.List'
                                    ? Java.use('java.util.ArrayList').$new()
                                    : arguments[0];
                            } catch(e) {
                                return arguments[0];
                            }
                        };
                    });
                    console.log(`[+] Hooked ${name}.checkServerTrusted (${TM.checkServerTrusted.overloads.length} overloads)`);
                }
            } catch (e) {
                // console.log(`[i] ${name} not found: ${e}`);
            }
        });

        // ------------------------------------------------------------------------------------
        // 3) 直接 Hook 常见 checkServerTrusted / checkClientTrusted（反射式兜底）
        // ------------------------------------------------------------------------------------
        [
            'javax.net.ssl.X509TrustManager',
            'javax.net.ssl.X509ExtendedTrustManager'
        ].forEach(function (klass) {
            hookAllOverloads(klass, 'checkServerTrusted', function (ov, args) {
                console.log(`[+] ${klass}.checkServerTrusted bypassed`);
                // 返回值是 void，直接 return
                return;
            });

            hookAllOverloads(klass, 'checkClientTrusted', function (ov, args) {
                console.log(`[+] ${klass}.checkClientTrusted bypassed`);
                return;
            });
        });

        // ------------------------------------------------------------------------------------
        // 4) OkHttp3 / OkHttp4 CertificatePinner.check
        // ------------------------------------------------------------------------------------
        [
            'okhttp3.CertificatePinner',                    // OkHttp 3.x
            'okhttp3.internal.tls.CertificatePinner'        // 某些版本 / 变体（少见）
        ].forEach(function (klass) {
            hookAllOverloads(klass, 'check', function (ov, args) {
                let hostname = '';
                try { hostname = args[0]; } catch (e) {}
                console.log(`[+] ${klass}.check(${hostname}) bypassed`);
                return; // 不抛异常视为通过
            });
        });

        // ------------------------------------------------------------------------------------
        // 5) HostnameVerifier / OkHostnameVerifier：主机名校验直接返回 true
        // ------------------------------------------------------------------------------------
        hookAllOverloads('javax.net.ssl.HostnameVerifier', 'verify', function (ov, args) {
            let host = '';
            try { host = args[0]; } catch (e) {}
            console.log(`[+] HostnameVerifier.verify(${host}) => true`);
            return true;
        });

        // okhttp3.internal.tls.OkHostnameVerifier (OkHttp3/4)
        [
            'okhttp3.internal.tls.OkHostnameVerifier',                 // OkHttp 3.x/4.x
            'com.datatheorem.android.trustkit.pinning.OkHostnameVerifier' // TrustKit
        ].forEach(function (klass) {
            hookAllOverloads(klass, 'verify', function (ov, args) {
                let host = '';
                try { host = args[0]; } catch (e) {}
                console.log(`[+] ${klass}.verify(${host}) => true`);
                return true;
            });
        });

        // ------------------------------------------------------------------------------------
        // 6) WebViewClient.onReceivedSslError：直接调用 handler.proceed()
        // ------------------------------------------------------------------------------------
        try {
            const WebViewClient = Java.use('android.webkit.WebViewClient');
            WebViewClient.onReceivedSslError.implementation = function (view, handler, error) {
                console.log('[+] WebViewClient.onReceivedSslError bypassed, proceed()');
                handler.proceed();
            };
            console.log('[+] Hooked WebViewClient.onReceivedSslError');
        } catch (e) {
            // console.log('[i] WebViewClient not found: ' + e);
        }

        // ------------------------------------------------------------------------------------
        // 7) HttpsURLConnection.setDefaultHostnameVerifier 拦截替换
        // ------------------------------------------------------------------------------------
        try {
            const HttpsURLConnection = Java.use('javax.net.ssl.HttpsURLConnection');
            HttpsURLConnection.setDefaultHostnameVerifier.implementation = function (verifier) {
                console.log('[+] HttpsURLConnection.setDefaultHostnameVerifier blocked');
                // 不调用原方法，保持我们自己的 true verifier（上面已经全局 hook 了）
                return;
            };
            console.log('[+] Hooked HttpsURLConnection.setDefaultHostnameVerifier');
        } catch (e) {
            // console.log('[i] HttpsURLConnection not found: ' + e);
        }

        console.log('[*] SSL pinning bypass script loaded.');
    });
});

//frida -U -f com.byd.aeri.caranywhere -l .\SSLbypass.js

function hook_dyn_dex() {
    Java.perform(function () {
        //hook 动态加载的dex
        Java.enumerateClassLoaders({   //枚举classLoader
            onMatch: function (loader) {
                try {
                    if (loader.findClass("com.byd.aeri.caranywhere.MyApplication")) {
                        console.log(loader);
                        Java.classFactory.loader = loader;      //切换classloader
                    }
                } catch (error) {
                }
            }, onComplete: function () {
            }
        });
		
let CheckCodeUtil = Java.use("com.bangcle.comapiprotect.CheckCodeUtil");
CheckCodeUtil["checkcode"].overload('java.lang.String', 'int', 'java.lang.String').implementation = function (str, i, str2) {
    console.log(`CheckCodeUtil.checkcode is called: str=${str}, i=${i}, str2=${str2}`);
    let result = this["checkcode"](str, i, str2);
    console.log(`CheckCodeUtil.checkcode result=${result}`);
    return result;
};

});
}
setImmediate(function() {
    setTimeout(hook_dyn_dex, 1000);
});
    //frida -U -f com.byd.aeri.caranywhere -l hookcheck.js

function dump_so(so_name) {
    Java.perform(function () {
        var currentApplication = Java.use("android.app.ActivityThread").currentApplication();
        var dir = currentApplication.getApplicationContext().getFilesDir().getPath();
        var libso = Process.getModuleByName(so_name);
        console.log("[name]:", libso.name);
        console.log("[base]:", libso.base);
        console.log("[size]:", ptr(libso.size));
        console.log("[path]:", libso.path);
        var file_path = dir + "/" + libso.name + "_" + libso.base + "_" + ptr(libso.size) + ".so";
        var file_handle = new File(file_path, "wb");
        if (file_handle && file_handle != null) {
            Memory.protect(ptr(libso.base), libso.size, 'rwx');
            var libso_buffer = ptr(libso.base).readByteArray(libso.size);
            file_handle.write(libso_buffer);
            file_handle.flush();
            file_handle.close();
            console.log("[dump]:", file_path);
 
        }
    });
}

dump_so("libencrypt.so")

function hookcheckcode(){
    Java.perform(function() {
        var base_addr = Module.findBaseAddress("libencrypt.so");
        var real_addr = base_addr.add(0x253AC);
		console.log(real_addr)
        var obj = Java.use("java.lang.Object");
		var String_java = Java.use('java.lang.String');
        var ByteString = Java.use("com.android.okhttp.okio.ByteString");
       
        Interceptor.attach(real_addr, {
            onEnter: function (args) {
                 console.log("hook success!")
                    console.log("arg0 :" + args[0]) //JNIENV
                    console.log("arg1 :" + args[1] ) //jclazz
                console.log("arg2:"+Java.cast(args[2],String_java));
				console.log("arg3:"+args[3].toInt32());
				console.log("arg4:"+Java.cast(args[4],String_java));
			
                // regs
                console.log(JSON.stringify(this.context))
               
            }
        });
    })
}
setImmediate(function() {
    //延迟1秒调用Hook方法
    setTimeout(hookcheckcode, 5000);
    });