#A preliminary study on App reverse engineering

// hook_common.js
Java.perform(function () {
  // 1. 替换成目标类的完整包名
  var TargetClass = Java.use("com.example.app.utils.SignUtils");
  // 2. 替换成目标方法名（支持重载：["getSign", "[B", "java.lang.String"]）
  var TargetMethod = TargetClass["getSign"];

  // 重写目标方法
  TargetMethod.implementation = function () {
    console.log("\n========== 目标方法被调用 ==========");
    console.log(`🔍 调用类: ${this.getClass().getName()}`);

    // 打印所有入参
    console.log(`📥 入参数量: ${arguments.length}`);
    for (let i = 0; i < arguments.length; i++) {
      let arg = arguments[i];
      // 自动识别类型并转成字符串
      let argType = arg ? arg.getClass().getName() : "null";
      let argStr = arg
        ? argType === "[B"
          ? "Hex: " + byteArrayToHex(arg)
          : arg.toString()
        : "null";
      console.log(`  参数${i}[${argType}]: ${argStr}`);
    }

    // 调用原方法获取返回值
    let result = this.getSign.apply(this, arguments);

    // 打印返回值
    let resType = result ? result.getClass().getName() : "null";
    let resStr = result
      ? resType === "[B"
        ? "Hex: " + byteArrayToHex(result)
        : result.toString()
      : "null";
    console.log(`📤 返回值[${resType}]: ${resStr}`);

    // 打印调用栈（想查看是谁调用了目标方法时启用）
    // console.log("\n📌 调用栈:");
    // console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));

    console.log("=====================================\n");
    return result; // 必须返回原方法的结果，否则 App 会崩溃
  };

  // 辅助函数：字节数组转 Hex 字符串
  function byteArrayToHex(byteArray) {
    var hex = "";
    for (var i = 0; i < byteArray.length; i++) {
      var b = byteArray[i] & 0xff;
      if (b < 0x10) hex += "0";
      hex += b.toString(16);
    }
    return hex;
  }
});

// ssl_pinning_bypass.js
console.log("[.] 开始绕过 SSL Pinning...");

Java.perform(function () {
  // 1. 绕过 OkHttp3/4 CertificatePinner
  try {
    var CertificatePinner = Java.use("okhttp3.CertificatePinner");
    CertificatePinner.check.overload("java.lang.String", "java.util.List").implementation = function () {};
    CertificatePinner.check.overload(
      "java.lang.String",
      "java.security.cert.Certificate",
      "java.util.List"
    ).implementation = function () {};
    console.log("[+] OkHttp3/4 CertificatePinner 绕过成功");
  } catch (e) {}

  // 2. 绕过 Android 7+ Conscrypt TrustManagerImpl
  try {
    var TrustManagerImpl = Java.use("com.android.org.conscrypt.TrustManagerImpl");
    TrustManagerImpl.verifyChain.implementation = function () {
      return arguments[0]; // 直接返回证书链，不校验
    };
    console.log("[+] Android 7+ Conscrypt TrustManagerImpl 绕过成功");
  } catch (e) {}

  // 3. 绕过 Android 6+ X509TrustManager 扩展
  try {
    var X509ExtendedTrustManager = Java.use("javax.net.ssl.X509ExtendedTrustManager");
    var EmptyTrustManager = Java.registerClass({
      name: "com.example.EmptyTrustManager",
      implements: [X509ExtendedTrustManager],
      methods: {
        checkClientTrusted: function () {},
        checkServerTrusted: function () {},
        getAcceptedIssuers: function () {
          return [];
        },
        checkClientTrustedSSLEngine: function () {},
        checkServerTrustedSSLEngine: function () {},
      },
    });
    var SSLContext = Java.use("javax.net.ssl.SSLContext");
    SSLContext.init
      .overload(
        "[Ljavax.net.ssl.KeyManager;",
        "[Ljavax.net.ssl.TrustManager;",
        "java.security.SecureRandom"
      )
      .implementation = function (km, tm, sr) {
        var emptyTm = Java.array("Ljavax.net.ssl.TrustManager;", [EmptyTrustManager.$new()]);
        return this.init
          .overload(
            "[Ljavax.net.ssl.KeyManager;",
            "[Ljavax.net.ssl.TrustManager;",
            "java.security.SecureRandom"
          )
          .call(this, km, emptyTm, sr);
      };
    console.log("[+] X509ExtendedTrustManager 绕过成功");
  } catch (e) {}

  // 4. 绕过 WebView SSL 错误（可选，抓 H5 包时用）
  try {
    var WebViewClient = Java.use("android.webkit.WebViewClient");
    WebViewClient.onReceivedSslError.implementation = function (view, handler, error) {
      handler.proceed();
    };
    console.log("[+] WebView SSL 错误 绕过成功");
  } catch (e) {}

  console.log("[✅] 所有 SSL Pinning 绕过完成！");
});

// root_bypass.js
console.log("[.] 开始绕过 Root 检测...");

Java.perform(function () {
  // 1. 隐藏常见的 Root 相关文件
  try {
    var File = Java.use("java.io.File");
    var rootFiles = [
      "/sbin/su",
      "/system/bin/su",
      "/system/xbin/su",
      "/data/local/xbin/su",
      "/data/local/bin/su",
      "/system/sd/xbin/su",
      "/system/bin/failsafe/su",
      "/data/local/su",
      "/su/bin/su",
      "/sbin/which",
      "/system/bin/which",
      "/system/xbin/which",
      "/system/app/Superuser.apk",
      "/system/app/SuperSU.apk",
      "/system/app/Magisk.apk",
    ];

    // 重写 File 构造函数
    File.$init.overload("java.lang.String").implementation = function (path) {
      if (rootFiles.indexOf(path) !== -1) path = "/nonexistent_file_xyz";
      return this.$init.overload("java.lang.String").call(this, path);
    };

    // 重写 File.exists()
    File.exists.implementation = function () {
      var path = this.getAbsolutePath().toString();
      if (rootFiles.indexOf(path) !== -1) return false;
      return this.exists.call(this);
    };

    console.log("[+] Root 相关文件隐藏成功");
  } catch (e) {}

  // 2. 修改 Build.TAGS 为 release-keys
  try {
    var Build = Java.use("android.os.Build");
    Build.TAGS.value = "release-keys";
    console.log("[+] Build.TAGS 修改成功");
  } catch (e) {}

  // 3. 修改系统属性 ro.debuggable/ro.secure（可选）
  try {
    var SystemProperties = Java.use("android.os.SystemProperties");
    SystemProperties.get.overload("java.lang.String").implementation = function (key) {
      if (key === "ro.debuggable") return "0";
      if (key === "ro.secure") return "1";
      if (key === "ro.build.type") return "user";
      return this.get.overload("java.lang.String").call(this, key);
    };
    console.log("[+] 系统属性修改成功");
  } catch (e) {}

  console.log("[✅] 所有 Root 检测绕过完成！");
});