frida 命令参数作用
frida-traces是一个动态跟踪函数调用的工具。
# 在Safari中跟踪recv*和send*API，在日志记录中插入库名称
frida-trace --decorate -i "recv*" -i "send*" Safari
# 跟踪Safari中的ObjC方法调用
frida-trace -m "-[NSView drawRect:]" Safari
# 在您的iPhone上启动SnapChat并跟踪加密API调用
frida-trace -U -f com.toyopagroup.picaboo -I "libcommonCrypto*"
# 在您的Android设备上启动YouTube并跟踪签名中带有“证书”的Java方法，
# 忽略大小写（i）并仅在用户定义的类中搜索（u）
frida-trace -U -f com.google.android.youtube --runtime=v8 -j '*!*certificate*/isu'
# 在Android上跟踪三星FaceService应用程序中的所有JNI功能
frida-trace -U -i "Java_*" com.samsung.faceservice
# 跟踪Windows进程对msvcrt. dll中“mem*”函数的调用
frida-trace -p 1372 -i "msvcrt.dll!*mem*"
# 跟踪进程中除msvcrt. dll之外的所有匹配“*open*”的函数
frida-trace -p 1372 -i "*open*" -x "msvcrt.dll!*open*"
# 跟踪libjpeg.so中未导出的函数
frida-trace -p 1372 -a "libjpeg.so!0x4793c"
frida -h参数
usage: frida [options] target
positional arguments:
args extra arguments and/or target
options:
-h, --help 展示参数解释（帮助）
-D ID, --device ID 通过设备ID连接
-U, --usb 连接USB设备
-R, --remote 连接远程 frida-server
-H HOST, --host HOST 通过HOST连接远程frida-server
--certificate CERTIFICATE
TLS证书文件路径
--origin ORIGIN 设置 header 为“Origin”来连接远程frida-server
--token TOKEN authenticate with HOST using TOKEN
--keepalive-interval INTERVAL
set keepalive interval in seconds, or 0 to disable (defaults to -1 to auto-select based on
transport)
--p2p 与目标建立点对点连接
--stun-server ADDRESS
set STUN server ADDRESS to use with --p2p
--relay address,username,password,turn-{udp,tcp,tls}
add relay to use with --p2p
-f TARGET, --file TARGET
指定app包名
-F, --attach-frontmost
连接当前打开的app
-n NAME, --attach-name NAME
attach to NAME
-N IDENTIFIER, --attach-identifier IDENTIFIER
attach to IDENTIFIER
-p PID, --attach-pid PID
attach to PID
-W PATTERN, --await PATTERN
await spawn matching PATTERN
--stdio {inherit,pipe}
stdio behavior when spawning (defaults to “inherit”)
--aux option set aux option when spawning, such as “uid=(int)42” (supported types are: string, bool, int)
--realm {native,emulated}
realm to attach in
--runtime {qjs,v8} script runtime to use
--debug enable the Node.js compatible script debugger
--squelch-crash if enabled, will not dump crash report to console
-O FILE, --options-file FILE
text file containing additional command line options
--version show program`s version number and exit
-l SCRIPT, --load SCRIPT
load SCRIPT
-P PARAMETERS_JSON, --parameters PARAMETERS_JSON
parameters as JSON, same as Gadget
-C USER_CMODULE, --cmodule USER_CMODULE
load CMODULE
--toolchain {any,internal,external}
CModule toolchain to use when compiling from source code
-c CODESHARE_URI, --codeshare CODESHARE_URI
load CODESHARE_URI
-e CODE, --eval CODE evaluate CODE
-q quiet mode (no prompt) and quit after -l and -e
-t TIMEOUT, --timeout TIMEOUT
seconds to wait before terminating in quiet mode
--pause leave main thread paused after spawning program
-o LOGFILE, --output LOGFILE
output to log file
--eternalize eternalize the script before exit
--exit-on-error exit with code 1 after encountering any exception in the SCRIPT
--kill-on-exit kill the spawned program when Frida exits
--auto-perform wrap entered code with Java.perform
--auto-reload Enable auto reload of provided scripts and c module (on by default, will be required in the
future)
--no-auto-reload Disable auto reload of provided scripts and c module
frida-trace -h 管方
Usage: frida-trace [options] target
Options:
--version 显示程序的版本号并退出
-h, --help 显示此帮助消息并退出
-D ID, --device=ID 连接到具有给定ID的设备
-U, --usb 连接到USB设备
-R, --remote 连接到远程frida-server
-H HOST, --host=HOST 连接到HOST上的远程frida-server
-f FILE, --file=FILE 指定app包名
-F, --attach-frontmost
连接到当前打开的app
-n NAME, --attach-name=NAME
连接到进程名称
-p PID, --attach-pid=PID
连接到进程id
--stdio=inherit|pipe stdio behavior when spawning (defaults
to “inherit”)
--aux=option set aux option when spawning, such as
“uid=(int)42” (supported types are:
string, bool, int)
--runtime=duk|v8 script runtime to use
--debug 启用Node. js兼容脚本调试器
--squelch-crash 如果启用，将不会输出崩溃报告
-O FILE, --options-file=FILE
通过文本文件传递命令行选项
-I MODULE, --include-module=MODULE
操作模块
-X MODULE, --exclude-module=MODULE
排除模块
-i FUNCTION, --include=FUNCTION
操作函数/模块 [MODULE]![FUNCTION]
-x FUNCTION, --exclude=FUNCTION
排除函数/模块 [MODULE]![FUNCTION]
-a MODULE!OFFSET, --add=MODULE!OFFSET
add MODULE!OFFSET
-T, --include-imports
包括程序的导入
-t MODULE, --include-module-imports=MODULE
包括模块的导入
-m OBJC_METHOD, --include-objc-method=OBJC_METHOD
include OBJC_METHOD
-M OBJC_METHOD, --exclude-objc-method=OBJC_METHOD
exclude OBJC_METHOD
-j JAVA_METHOD, --include-java-method=JAVA_METHOD
include JAVA_METHOD
-J JAVA_METHOD, --exclude-java-method=JAVA_METHOD
exclude JAVA_METHOD
-s DEBUG_SYMBOL, --include-debug-symbol=DEBUG_SYMBOL
include DEBUG_SYMBOL
-q, --quiet do not format output messages
-d, --decorate 将模块名称添加到生成的onEnter日志语句
-S PATH, --init-session=PATH
用于初始化session(会话)的JavaScript文件的路径
-P PARAMETERS_JSON, --parameters=PARAMETERS_JSON
parameters as JSON, exposed as a global named
'parameters'
-o OUTPUT, --output=OUTPUT
将消息转储到文件
原文地址：https://blog.csdn.net/qq_43557600/article/details/142342509
免责声明：本站文章内容转载自网络资源，如本站内容侵犯了原著者的合法权益，可联系本站删除。更多内容请关注自学内容网（zxcms.com）！