Use bpf programs as filters for seccomp, the one in the example will block all the write syscalls after it's loaded.
Compile it with just
gcc main.c
| #include <iostream> | |
| #include <iomanip> | |
| #include <cstdlib> | |
| #include <cstdint> | |
| #include <cstring> | |
| #include <jni.h> | |
| #include <set> | |
| #include "LIEF/ELF.hpp" |
| #!/usr/bin/python3 | |
| ''' | |
| author: ceres-c | |
| usage: ./frida-extract-keystore.py | |
| Once the keystore(s) have been exported you have to convert them to PKCS12 using keytool | |
| NOTE: Updated Frida 17 fork here https://github.com/JJK96/frida-extract-keystore | |
| ''' | |
| import frida, sys, time |
| #... | |
| function gitzip() { | |
| git archive -o $@.zip HEAD | |
| } | |
| #... gitzip ZIPPED_FILE_NAME |
| #include <android/log.h> | |
| #include <jni.h> | |
| #include <binder/Binder.h> | |
| #include <binder/Parcel.h> | |
| #include <binder/IServiceManager.h> | |
| #include <dlfcn.h> | |
| #include <stdio.h> | |
| #include <stdlib.h> | |
| #include <unistd.h> |
| #include <fcntl.h> | |
| #include <linux/hw_breakpoint.h> | |
| #include <linux/perf_event.h> | |
| #include <signal.h> | |
| #include <stdint.h> | |
| #include <stdio.h> | |
| #include <stdlib.h> | |
| #include <string.h> | |
| #include <sys/syscall.h> | |
| #include <sys/types.h> |
| #!/bin/sh | |
| DIR="tmp_"$$ | |
| JAR=`echo $1 | tr '.' ' ' | awk '{ print $1 }'` | |
| rm -rf $JAR.jar | |
| mkdir $DIR | |
| cp $1 $DIR | |
| cd $DIR | |
| echo "** Compiling java file..." | |
| javac -d . -g $1 | |
| echo "** Creating temporary jar..." |