当前位置：首页 > news >正文

Frida 动态 Hook 安卓 WebView 与第三方内核完全指南

news 2025/8/21 11:53:31

Frida 动态 Hook 安卓 WebView 与第三方内核完全指南
使用了虚构的「DragonWeb 内核」作为示例，避免了任何真实厂商的包名和标识：

在移动应用安全分析、逆向工程和漏洞挖掘中，WebView 是一个极其重要的攻击面。无论是传统的系统 WebView 还是第三方内核，对其内部方法的监控都至关重要。本文将详细介绍如何使用 Frida 这一强大动态插桩工具来 Hook 系统 WebView 和第三方内核的关键方法。

一、环境准备

安装 Frida

# 安装 Frida 命令行工具
pip install frida-tools

设备端配置
Root 设备或模拟器（推荐 Genymotion 或已 Root 的真机）

下载并推送 frida-server 到设备：

# 从 https://github.com/frida/frida/releases 下载对应版本
adb push frida-server /data/local/tmp/
adb shell
su
cd /data/local/tmp
chmod 755 frida-server
./frida-server &

验证连接：
```
frida-ps -U
```

二、WebView 类结构对比

功能系统 WebView (Android) DragonWeb 内核 (第三方)
核心组件 android.webkit.WebView com.dragon.webkit.engine.WebView
事件处理 android.webkit.WebViewClient com.dragon.webkit.engine.WebViewClient
浏览器行为 android.webkit.WebChromeClient com.dragon.webkit.engine.WebChromeClient
JS 接口 @JavascriptInterface 同名注解

三、Frida Hook 脚本大全

通用 Hook 脚本（同时捕获系统和第三方内核）

// universal_webview_hook.js
Java.perform(function () {console.log("[*] Starting Universal WebView Hook...");// 要 Hook 的类列表var targetClasses = [// 系统 WebView 类"android.webkit.WebView","android.webkit.WebViewClient", "android.webkit.WebChromeClient",// DragonWeb 内核类"com.dragon.webkit.engine.WebView","com.dragon.webkit.engine.WebViewClient","com.dragon.webkit.engine.WebChromeClient","com.dragonwebkit.engine.WebView", // 可能的变体"com.dragonwebkit.engine.WebViewClient"];targetClasses.forEach(function(className) {try {var targetClass = Java.use(className);// Hook loadUrl 方法if ('loadUrl' in targetClass) {targetClass.loadUrl.overload('java.lang.String').implementation = function(url) {console.log("\n[🌐] " + className + ".loadUrl() called");console.log("[📝] URL: " + url);return this.loadUrl(url);};}// Hook WebViewClient 方法if ('onPageStarted' in targetClass) {targetClass.onPageStarted.implementation = function(view, url, favicon) {console.log("\n[▶️] " + className + ".onPageStarted: " + url);return this.onPageStarted(view, url, favicon);};}} catch (e) {// 类不存在是正常的，静默跳过}});
});

专用第三方内核 Hook 脚本

// thirdparty_webview_hook.js
Java.perform(function () {console.log("[*] Starting Third-party WebView Hook...");// DragonWeb 内核类var DragonWebView = Java.use("com.dragon.webkit.engine.WebView");var DragonWebViewClient = Java.use("com.dragon.webkit.engine.WebViewClient");var DragonWebChromeClient = Java.use("com.dragon.webkit.engine.WebChromeClient");// Hook loadUrlDragonWebView.loadUrl.overload('java.lang.String').implementation = function(url) {console.log("\n[🎯DragonWeb] WebView.loadUrl() called!");console.log("[📝] URL: " + url);console.log("[🔍] Call Stack: " + Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));return this.loadUrl(url);};// Hook 页面事件DragonWebViewClient.onPageStarted.implementation = function(view, url, favicon) {console.log("\n[🌐DragonWeb] onPageStarted: " + url);return this.onPageStarted(view, url, favicon);};DragonWebViewClient.onPageFinished.implementation = function(view, url) {console.log("\n[✅DragonWeb] onPageFinished: " + url);return this.onPageFinished(view, url);};// Hook URL 拦截DragonWebViewClient.shouldOverrideUrlLoading.overload('com.dragon.webkit.engine.WebView', 'com.dragon.webkit.engine.model.WebResourceRequest').implementation = function(view, request) {var url = request.getUrl().toString();console.log("\n[🛑DragonWeb] shouldOverrideUrlLoading: " + url);return false; // 让内核处理请求};// Hook Console 日志DragonWebChromeClient.onConsoleMessage.overload('com.dragon.webkit.engine.model.ConsoleMessage').implementation = function(consoleMessage) {var msg = consoleMessage.message();console.log("\n[💬DragonWeb Console] > " + msg);return this.onConsoleMessage(consoleMessage);};
});

JSBridge 接口监控脚本

// jsbridge_hook.js
Java.perform(function () {console.log("[*] Starting JSBridge Hook...");var classList = ["android.webkit.WebView","com.dragon.webkit.engine.WebView","com.dragonwebkit.engine.WebView","com.custom.webengine.WebView" // 其他可能的包名];classList.forEach(function(className) {try {var WebViewClass = Java.use(className);WebViewClass.addJavascriptInterface.overload('java.lang.Object', 'java.lang.String').implementation = function(obj, interfaceName) {console.log("\n[🤝JSBridge] " + className + ".addJavascriptInterface");console.log("[📝] Interface Name: " + interfaceName);console.log("[📝] Object Class: " + obj.$className);// 枚举所有可调用方法try {var clazz = obj.getClass ? obj.getClass() : obj.$class;var methods = clazz.getDeclaredMethods();console.log("[🔧] Exposed Methods:");for (var i = 0; i < methods.length; i++) {console.log("    - " + methods[i].getName());}} catch (e) {console.log("[❌] Error enumerating methods: " + e.message);}return this.addJavascriptInterface(obj, interfaceName);};} catch (e) {// 静默处理类不存在的情况}});
});

四、自动识别第三方内核

// detect_webview_engine.js
Java.perform(function () {console.log("[*] Detecting WebView Engines...");var thirdPartyIndicators = ["dragon", "webkit", "xengine", "uc", "quark", "crosswalk", "gecko", "blink", "custom", "webengine"];Java.enumerateLoadedClasses({onMatch: function(className) {// 检测系统 WebViewif (className.includes("android.webkit")) {console.log("[✓] System WebView detected: " + className);}// 检测第三方内核thirdPartyIndicators.forEach(function(indicator) {if (className.toLowerCase().includes(indicator) && className.includes("web") && !className.includes("android")) {console.log("[🎯] Third-party WebView detected: " + className);}});},onComplete: function() {console.log("[*] WebView detection completed");}});
});

五、使用方法

启动时注入

# 检测使用的内核
frida -U -f com.target.app -l detect_webview_engine.js --no-pause# 通用 Hook
frida -U -f com.target.app -l universal_webview_hook.js --no-pause# 专用第三方内核 Hook  
frida -U -f com.target.app -l thirdparty_webview_hook.js --no-pause# JSBridge 监控
frida -U -f com.target.app -l jsbridge_hook.js --no-pause

附加到运行中进程

frida -U com.target.app -l universal_webview_hook.js

六、实战技巧

动态扩展检测列表

如果发现新的第三方内核，可以动态添加到检测列表中：

// 在 detect_webview_engine.js 中添加
var additionalEngines = ["neweb", "fastweb", "smartweb"];
thirdPartyIndicators = thirdPartyIndicators.concat(additionalEngines);

过滤特定 URL

// 在 Hook 方法中添加过滤逻辑
var sensitiveKeywords = ["login", "auth", "token", "password"];DragonWebViewClient.shouldOverrideUrlLoading.implementation = function(view, request) {var url = request.getUrl().toString();if (sensitiveKeywords.some(keyword => url.toLowerCase().includes(keyword))) {console.log("\n[🔒敏感请求] " + url);// 进行深度分析...}return false;
};