安卓系统进程system_server

此处列出frida-trace去hook安卓系统进程system_server的效果：

去hook：

• 类的全部函数
  • ActivityManager
• 类的部分函数
  • ProcessList
  • ActivityManagerService

命令：

frida-trace -U -n system_server --runtime=v8 -j '*ActivityManager!*' -j '*!startProcessLocked' -j '*!handleProcessStartedLocked'

测试和触发：

测试了2次进程被杀和重启

redfin:/ # ps -A | grep lift
u0_a243      14053 12478 14853776 110652 do_epoll_wait      0 S com.lift.filemanager.android:sist
u0_a243      14380 12478 33445164 159208 do_epoll_wait      0 S com.lift.filemanager.android
u0_a243      16957 12478 14876024 110164 do_epoll_wait      0 S com.lift.filemanager.android:lift
u0_a243      20739 12478 14909548 110300 do_epoll_wait      0 S com.lift.filemanager.android:dae
redfin:/ # kill 16957
redfin:/ # ps -A | grep lift
u0_a243      28151 26549 14881452 110076 do_epoll_wait      0 S com.lift.filemanager.android:sist
u0_a243      28164 26549 14828204 109280 do_epoll_wait      0 S com.lift.filemanager.android:dae
u0_a243      28337 26549 33535192 167804 do_epoll_wait      0 S com.lift.filemanager.android
u0_a243      30398 26549 14895600 112296 do_epoll_wait      0 S com.lift.filemanager.android:lift
redfin:/ # kill 28164
redfin:/ # ps -A | grep lift
u0_a243       2519 26549 14968296 108068 do_epoll_wait      0 S com.lift.filemanager.android:dae
u0_a243      28151 26549 14881452 108304 do_epoll_wait      0 S com.lift.filemanager.android:sist
u0_a243      28337 26549 33482836 166176 do_epoll_wait      0 S com.lift.filemanager.android
u0_a243      30398 26549 14878116 110572 do_epoll_wait      0 S com.lift.filemanager.android:lift
redfin:/ # kill 30398

log：

➜  frida git:(master) ✗ frida-trace -U -n system_server --runtime=v8 -j '*ActivityManager!*' -j '*!startProcessLocked' -j '*!handleProcessStartedLocked'
Instrumenting...
NfcActivityManager.$init: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/keepAlive/LiftFileManager/dynamicDebug/frida/frida/__handlers__/android.nfc.NfcActivityManager/_init.js"
...
IActivityManager.addInstrumentationResults: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/keepAlive/LiftFileManager/dynamicDebug/frida/frida/__handlers__/android.app.IActivityManager/addInstrumentationResults.js"
...
ActivityManager.-$$Nest$smgetTaskService: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/keepAlive/LiftFileManager/dynamicDebug/frida/frida/__handlers__/android.app.ActivityManager/___Nest_smgetTaskService.js"
ActivityManager.$init: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/keepAlive/LiftFileManager/dynamicDebug/frida/frida/__handlers__/android.app.ActivityManager/_init.js"
ActivityManager.broadcastStickyIntent: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/keepAlive/LiftFileManager/dynamicDebug/frida/frida/__handlers__/android.app.ActivityManager/broadcastStickyIntent.js"
...
ActivityManagerService.startProcessLocked: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/keepAlive/LiftFileManager/dynamicDebug/frida/frida/__handlers__/com.android.server.am.ActivityManagerService/startProcessLocked.js"
Started tracing 375 functions. Press Ctrl+C to stop.
           /* TID 0x71c9 */
  1223 ms  ActivityManager.checkUidPermission("android.permission.INTERACT_ACROSS_USERS_FULL", 10241)
  1227 ms  <= -1
...


 11257 ms  ActivityManager.checkComponentPermission("android.permission.GET_TASKS", 10241, -1, true)
 11257 ms  <= 0
           /* TID 0x6880 */
 12225 ms  ActivityManagerService.startProcessLocked("com.lift.filemanager.android:dae", "<instance: android.content.pm.ApplicationInfo>", true, 0, "<instance: com.android.server.am.HostingRecord>", 0, false, false)
 12230 ms     | ProcessList.startProcessLocked("com.lift.filemanager.android:dae", "<instance: android.content.pm.ApplicationInfo>", true, 0, "<instance: com.android.server.am.HostingRecord>", 0, false, false, 0, false, 0, null, null, null, null, null)
 12232 ms     |    | ProcessList.startProcessLocked("<instance: com.android.server.am.ProcessRecord>", "<instance: com.android.server.am.HostingRecord>", 0, null)
 12233 ms     |    |    | ProcessList.startProcessLocked("<instance: com.android.server.am.ProcessRecord>", "<instance: com.android.server.am.HostingRecord>", 0, false, false, null)
 12234 ms     |    |    |    | ProcessList.startProcessLocked("<instance: com.android.server.am.HostingRecord>", "android.app.ActivityThread", "<instance: com.android.server.am.ProcessRecord>", 10243, [3002,3003,50243,20243,9997], 17377280, 0, 1, "default:targetSdkVersion=33:complete", "arm64-v8a", "arm64", null, "371714070", "371714070")
 12235 ms     |    |    |    | <= true
 12235 ms     |    |    | <= true
 12235 ms     |    | <= true
 12236 ms     | <= "<instance: com.android.server.am.ProcessRecord>"
 12236 ms  <= "<instance: com.android.server.am.ProcessRecord>"
           /* TID 0x6881 */
 12272 ms  ProcessList.handleProcessStartedLocked("<instance: com.android.server.am.ProcessRecord>", "<instance: android.os.Process$ProcessStartResult>", "132")
 12273 ms     | ProcessList.handleProcessStartedLocked("<instance: com.android.server.am.ProcessRecord>", 2519, false, "132", false)
 12274 ms     | <= true
 12274 ms  <= true
           /* TID 0x71c8 */
 12368 ms  ActivityManager.processStateAmToProto(4)

...


 62818 ms  ActivityManager.isForegroundService(8)
 62818 ms  <= false
 62818 ms  ActivityManager.processStateAmToProto(19)
 62818 ms  <= 1018
 62818 ms  ActivityManager.isForegroundService(19)
 62819 ms  <= false
           /* TID 0x6880 */
 63812 ms  ActivityManagerService.startProcessLocked("com.lift.filemanager.android:lift", "<instance: android.content.pm.ApplicationInfo>", true, 0, "<instance: com.android.server.am.HostingRecord>", 0, false, false)
 63818 ms     | ProcessList.startProcessLocked("com.lift.filemanager.android:lift", "<instance: android.content.pm.ApplicationInfo>", true, 0, "<instance: com.android.server.am.HostingRecord>", 0, false, false, 0, false, 0, null, null, null, null, null)
 63823 ms     |    | ProcessList.startProcessLocked("<instance: com.android.server.am.ProcessRecord>", "<instance: com.android.server.am.HostingRecord>", 0, null)
 63826 ms     |    |    | ProcessList.startProcessLocked("<instance: com.android.server.am.ProcessRecord>", "<instance: com.android.server.am.HostingRecord>", 0, false, false, null)
 63834 ms     |    |    |    | ProcessList.startProcessLocked("<instance: com.android.server.am.HostingRecord>", "android.app.ActivityThread", "<instance: com.android.server.am.ProcessRecord>", 10243, [3002,3003,50243,20243,9997], 17377280, 0, 1, "default:targetSdkVersion=33:complete", "arm64-v8a", "arm64", null, "371765665", "371765665")
 63838 ms     |    |    |    | <= true
 63839 ms     |    |    | <= true
 63840 ms     |    | <= true
 63841 ms     | <= "<instance: com.android.server.am.ProcessRecord>"
 63843 ms  <= "<instance: com.android.server.am.ProcessRecord>"
           /* TID 0x6881 */
 63861 ms  ProcessList.handleProcessStartedLocked("<instance: com.android.server.am.ProcessRecord>", "<instance: android.os.Process$ProcessStartResult>", "133")
 63862 ms     | ProcessList.handleProcessStartedLocked("<instance: com.android.server.am.ProcessRecord>", 2782, false, "133", false)
 63863 ms     | <= true
 63863 ms  <= true
           /* TID 0x71c9 */
 63927 ms  ActivityManager.processStateAmToProto(4)
...

截图：