### Get Class Details Example Source: https://github.com/jshookapp/document/blob/main/en/api/md23.md Demonstrates how to retrieve and display detailed information for a specific class, including its name, superclass, interfaces, and methods. This is useful for understanding class structure. ```javascript dex.init(null); var info = JSON.parse(dex.getClassData('com.example.VipManager')); if (info.name) { console.log('Class:', info.name); console.log('Super:', info.superClass); console.log('Interfaces:', JSON.stringify(info.interfaces)); console.log('Methods:', info.methods.length); for (var i = 0; i < info.methods.length; i++) { var m = info.methods[i]; console.log(' Method:', m.name + '(' + m.paramTypes.join(',') + ') -> ' + m.returnType); } } dex.close(); ``` -------------------------------- ### Example of Using dialog.input Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-ui-interaction.md Demonstrates how to call `dialog.input` to prompt the user for a username, handle the entered value, or log cancellation. ```javascript dialog.input('Enter username', { ok: function(username) { console.log('User entered: ' + username); }, cancel: function() { console.log('Dialog cancelled'); } }, 'default_user'); ``` -------------------------------- ### Perform Native HTTP GET Request with curl Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-http-network.md Use the `curl` function for native-level HTTP requests, available only in the FridaMod framework. This example performs a GET request to a URL and logs the response. The callback receives the response as a string. ```javascript curl('https://www.baidu.com', 'get', null, null, function(response) { console.log('Response: ' + response); }); ``` -------------------------------- ### Resize ModMenu Window Example Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-modmenu.md Resizes a ModMenu window to specific pixel dimensions using the `size` method. The example sets the width to 400px and height to 600px. ```javascript menu.size(400, 600); ``` -------------------------------- ### Start Activity Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-app.md Launch a specific Android Activity by providing its package and class name. Requires an Activity object as an argument. ```javascript app.startActivity({ packageName: 'com.example.myapp', className: 'com.example.myapp.MainActivity' }); ``` -------------------------------- ### media.create Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-media.md Create and start playing an audio file from a URL or base64 encoded data. Audio begins playing automatically. ```APIDOC ## media.create(data) ### Description Create and start playing an audio file. Audio begins playing automatically upon creation. ### Parameters #### Path Parameters - **data** (string) - Required - URL (http://, https://) or base64-encoded audio data ### Request Example (Remote URL) ```javascript var player = media.create('https://example.com/sound.mp3'); ``` ### Request Example (Base64 Audio) ```javascript var audioBase64 = 'SUQzBAA...'; // Base64 encoded MP3 var player = media.create(audioBase64); ``` ``` -------------------------------- ### Start Home Activity Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-app.md Return the user to the device's home screen (launcher), effectively leaving the hooked application. This function takes no arguments. ```javascript app.startHomeActivity(); ``` -------------------------------- ### Get Supported CPU Architectures (ABIs) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves a comma-separated list of supported CPU architectures (ABIs) on the device. Returns a string. ```javascript var abis = device.getABIs(); console.log('Supported ABIs: ' + abis); ``` -------------------------------- ### Create and Draw with moddraw Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-drawing.md Example of creating a moddraw window and drawing a rectangle and text within its draw callback. ```javascript var dw = device.getScreenWidth(); var dh = device.getScreenHeight(); var draw1 = moddraw.create({ draw: function() { draw1.rect({ 'x': 100, 'y': 100, 'width': 200, 'height': 300, 'border': 3, 'border_color': '#FF0000' }); draw1.text({ 'x': 150, 'y': 150, 'size': 40, 'color': '#FFFFFF', 'data': 'Score: 1000' }); } }); ``` -------------------------------- ### runtime.packageName Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-runtime.md Gets the package name of the target application that is currently being hooked. ```APIDOC ## runtime.packageName ### Description Get the package name of the target application being hooked. ### Returns string — Full package name (e.g., `com.example.myapp`) ### Example ```javascript console.log('Target package: ' + runtime.packageName); ``` ``` -------------------------------- ### Example JsHook Script for Kernel Mode Source: https://github.com/jshookapp/document/blob/main/en/guide/kernel.md This script demonstrates how to use kernel-specific APIs to read memory in kernel mode and falls back to normal Frida APIs in normal mode. ```javascript if (runtime.isKernel) { // Kernel mode — use kernel API to operate target process memory var base = kernel.getModuleBase('libil2cpp.so'); console.log('libil2cpp base: ' + base); if (base && base !== '0x0') { var health = kernel.readFloat( '0x' + (parseInt(base, 16) + 0x1A2B3C4).toString(16) ); console.log('Health: ' + health); } } else { // Normal mode — use Frida API to hook Java.perform(function () { // ... }); } ``` -------------------------------- ### Create ModMenu Window Example Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-modmenu.md Creates a new floating menu window with specified title, controls, and a change callback function. The callback logs changes and specific button clicks. ```javascript var menu = modmenu.create('Settings', [ { 'type': 'text', 'val': 'Configuration Panel', 'size': 50, 'color': '#FFFFFF' }, { 'type': 'switch', 'id': 'feature1', 'title': 'Enable Feature', 'val': false }, { 'type': 'slider', 'id': 'speed', 'title': 'Speed:', 'val': 50, 'min': 0, 'max': 100 }, { 'type': 'button', 'id': 'save_btn', 'title': 'Save Settings' } ], { onchange: function(result) { console.log('Changed: ' + result.id + ' = ' + result.value); if (result.id === 'save_btn') { console.log('User clicked Save'); } } }); ``` -------------------------------- ### Create and Use moddraw Instance Source: https://github.com/jshookapp/document/blob/main/en/api/md17.md This example demonstrates how to create a moddraw instance and use its drawing methods within a draw callback. It includes functions for generating player data and updating screen dimensions. Ensure data assembly logic is outside the draw callback to prevent rendering delays. ```javascript var dw = device.getScreenWidth() var dh = device.getScreenHeight() var playerCount = 10 var players = [] const draw1 = moddraw.create({ draw: function () { for (var i = 0; i < players.length; i++) { draw1.line({ 'start_x': dw / 2, 'start_y': 0, 'end_x': players[i][0] + players[i][2] / 2, 'end_y': players[i][1], }) draw1.rect({ 'x': players[i][0], 'y': players[i][1], 'width': players[i][2], 'height': players[i][3], 'border': 2, 'border_color': '#FF0000', 'border_color_alpha': 0.8, 'background': '#000000', 'background_alpha': 0.8, 'raduis': 0 }) } draw1.text({ 'x': 600, 'y': 800, 'size': 60, 'color': '#FFFFFF', 'color_alpha': 0.8, 'padding': 10, 'data': 'test', 'border': 2, 'border_color': '#FF0000', 'border_color_alpha': 0.8, 'background': '#000000', 'background_alpha': 0.8, 'raduis': 10 }) draw1.image({ 'x': 300, 'y': 800, 'width': 60, 'height': 60, 'data': 'https://jsonet.cdnipcs.com/test.jpg', 'border': 2, 'border_color': '#FF0000', 'border_color_alpha': 0.8, 'background': '#000000', 'background_alpha': 0.8, 'raduis': 10 }) } }) function random(min, max) { return Math.floor(Math.random() * (max - min + 1)) + min } function playerdata() { var newPlayers = [] for (var i = 0; i < playerCount; i++) { var playerWidth = random(30, 100) var playerHeight = 2 * playerWidth var color = random(0, 1) ? "#ff0000" : "#00ff00" var player = [ random(0, dw), random(0, dh), playerWidth, playerHeight, color ] newPlayers.push(player) } players = newPlayers } setInterval(function () { dw = device.getScreenWidth() dh = device.getScreenHeight() }, 1000) setInterval(function () { playerdata() }, 100) ``` -------------------------------- ### Display ModMenu Status Bar Example Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-modmenu.md Calls the `state` method on a ModMenu instance to display the ImGui status bar, which shows performance metrics. ```javascript menu.state(); ``` -------------------------------- ### Create Media Player from Remote URL Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-media.md Use this snippet to create and start playing an audio file from a remote URL. Audio begins playing automatically. ```javascript var player = media.create('https://example.com/sound.mp3'); ``` -------------------------------- ### Get Process Information as JSON Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-r2frida.md Use `r2.info()` to retrieve detailed process information, including PID, architecture, and platform, formatted as a JSON string. ```javascript r2.info(); ``` -------------------------------- ### app.getActivityList() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-app.md Get the stack of currently open Activities in the target application. Returns an array of Activity objects. ```APIDOC ## app.getActivityList() ### Description Get the stack of currently open Activities in the target application. ### Returns List — Array of Activity objects in stack order ### Activity Item Structure ```javascript { packageName: string, className: string, isResumed: boolean } ``` ### Example ```javascript var activities = app.getActivityList(); for (var i = 0; i < activities.size(); i++) { var act = activities.get(i); console.log('Activity: ' + act.className); } ``` ``` -------------------------------- ### runtime.modVersion Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-runtime.md Gets the semantic version string of the FridaMod framework, if the fridamod framework is being used. ```APIDOC ## runtime.modVersion ### Description Get the semantic version string of the FridaMod framework (if using fridamod framework). ### Returns string — Version in format like `1.0.0` ### Example ```javascript console.log('FridaMod version: ' + runtime.modVersion); ``` ``` -------------------------------- ### Complete DexKit and Frida Hooking Workflow Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-dex.md This snippet demonstrates a full workflow: initializing DexKit, finding classes based on string content, retrieving detailed class information, identifying potential methods to hook (like boolean return type methods starting with 'is' or containing 'check'), and then using Frida to hook these methods to return 'true'. It's useful for dynamic analysis and behavior modification of Android applications. ```javascript // Initialize dex.init(null); // Find VIP-related classes var vipResults = JSON.parse(dex.findClassByStrings('["VIP","premium","license"]', 'com.example', null)); console.log('Found ' + vipResults.length + ' VIP classes'); for (var i = 0; i < vipResults.length; i++) { var className = vipResults[i].name; // Get detailed info for each class var classData = JSON.parse(dex.getClassData(className)); console.log(' Class: ' + className); // Look for check/verify methods for (var j = 0; j < classData.methods.length; j++) { var m = classData.methods[j]; if (m.returnType === 'boolean' && (m.name.includes('is') || m.name.includes('check'))) { console.log(' Method to hook: ' + m.name); // Now use Frida to hook this method Java.perform(function() { var cls = Java.use(className); cls[m.name].implementation = function() { console.log('Method called, returning true'); return true; }; }); } } } dex.close(); ``` -------------------------------- ### Create Media Player from Base64 Audio Data Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-media.md Use this snippet to create and start playing an audio file from base64 encoded data. Audio begins playing automatically. ```javascript var audioBase64 = 'SUQzBAA...'; // Base64 encoded MP3 var player = media.create(audioBase64); ``` -------------------------------- ### Get Application Information Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-app.md Retrieve detailed information about the target application, including its package name, version, and display name. Returns an object containing app details. ```javascript var info = app.getAppInfo(); console.log('App Name: ' + info.appName); console.log('Version: ' + info.versionName); ``` -------------------------------- ### Close ModMenu Window Example Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-modmenu.md Demonstrates closing a ModMenu window after a specified delay. The menu is created with an empty options array and a placeholder callback. ```javascript var menu = modmenu.create('Menu', [], { onchange: function() {} }); setTimeout(function() { menu.close(); }, 5000); // Close after 5 seconds ``` -------------------------------- ### Get Android OS Version Name Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves the human-readable Android OS version name. Returns a string. ```javascript var version = device.getSDKVersionName(); console.log('Android version: ' + version); ``` -------------------------------- ### Complete Hook Example for Game.ShopManager Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-il2cpp.md This snippet demonstrates how to hook methods in the Game.ShopManager class to modify game behavior. It hooks GetPrice, CanAfford, and Purchase methods to make items free and log purchase events. ```javascript Il2Cpp.perform(() => { const shopClass = Il2Cpp.domain.assembly('Assembly-CSharp') .image.class('Game.ShopManager'); // Hook GetPrice to return 0 shopClass.method('GetPrice').implementation = function(itemId) { console.log('Getting price for item: ' + itemId); return 0; // Free items }; // Hook CanAfford to always return true shopClass.method('CanAfford').implementation = function(price) { return true; }; // Hook purchase shopClass.method('Purchase').implementation = function(itemId) { console.log('Purchased item: ' + itemId); return true; }; }); ``` -------------------------------- ### keys.click(x, y) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-ui-interaction.md Simulates a touch click at the specified screen coordinates (x, y). This requires the Magisk module `jshook_keys` to be installed. ```APIDOC ## keys.click(x, y) ### Description Simulate a touch click at screen coordinates (x, y). Requires Magisk module. ### Parameters #### Path Parameters - **x** (int) - Required - X coordinate in pixels - **y** (int) - Required - Y coordinate in pixels ### Returns void ### Requirements Magisk module `jshook_keys` must be installed ### Example ```javascript // Tap at coordinates (500, 500) keys.click(500, 500); ``` ``` -------------------------------- ### Get FridaMod Version String Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-runtime.md Retrieve the semantic version string of the FridaMod framework. This provides a human-readable version identifier. ```javascript console.log('FridaMod version: ' + runtime.modVersion); ``` -------------------------------- ### Simulate Touch Click Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-ui-interaction.md Simulates a touch click at specified screen coordinates (x, y). Requires the Magisk module 'jshook_keys' to be installed. ```javascript // Tap at coordinates (500, 500) keys.click(500, 500); ``` -------------------------------- ### draw1.line Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-drawing.md Draws a line on the ImGui drawing surface. Supports specifying start and end points, line thickness, and color. ```APIDOC ## draw1.line(options) ### Description Draws a line segment. ### Parameters #### Path Parameters - **options** (object) - Required - Object containing line drawing parameters - **start_x** (number) - Required - Starting X coordinate - **start_y** (number) - Required - Starting Y coordinate - **end_x** (number) - Required - Ending X coordinate - **end_y** (number) - Required - Ending Y coordinate - **volume** (number) - Optional - Line thickness - **color** (string) - Optional - Line color (e.g., '#FF0000') - **color_alpha** (number) - Optional - Line color alpha (0.0-1.0) ``` -------------------------------- ### Get Application Information Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-runtime.md Retrieve metadata about the currently hooked application, including its package name, version, and main activity class. This is useful for conditional logic based on the target application. ```javascript var info = runtime.appInfo; console.log('App: ' + info.packageName); console.log('Version: ' + info.versionName + ' (' + info.versionCode + ')'); ``` -------------------------------- ### instance.start Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-media.md Resume playback if paused. If already playing, this method has no effect. ```APIDOC ## [instance].start() ### Description Resume playback if paused. If already playing, has no effect. ### Returns void ### Request Example ```javascript player.pause(); setTimeout(function() { player.start(); // Resume after 2 seconds }, 2000); ``` ``` -------------------------------- ### Get Android API Level Code Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves the Android API level code as an integer. For example, 31 for Android 12. ```javascript var apiLevel = device.getSDKVersionCode(); console.log('API level: ' + apiLevel); ``` -------------------------------- ### app.startHomeActivity() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-app.md Return to the device home screen, leaving the hooked application. This method does not take any parameters. ```APIDOC ## app.startHomeActivity() ### Description Return to the device home screen (launcher). Leaves the hooked application. ### Returns void ### Example ```javascript app.startHomeActivity(); ``` ``` -------------------------------- ### file.readliens(path, num) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-file-io.md Read a specific number of lines from a file, starting from the beginning. This function takes an absolute file path and the number of lines to read, returning an array of strings. ```APIDOC ## file.readliens(path, num) ### Description Read a specific number of lines from a file, starting from the beginning. ### Parameters #### Path Parameters - **path** (string) - Required - Absolute file path - **num** (long) - Required - Number of lines to read ### Returns - **List** - Array of line strings ### Example ```javascript var lines = file.readliens('/data/data/com.example/log.txt', 10); for (var i = 0; i < lines.size(); i++) { console.log('Line ' + i + ': ' + lines.get(i)); } ``` ``` -------------------------------- ### app.startActivity(activity) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-app.md Launch an Activity by name or intent specification. Requires an Activity object with package and class name. ```APIDOC ## app.startActivity(activity) ### Description Launch an Activity by name or intent specification. ### Parameters #### Path Parameters - **activity** (Activity object) - Required - Activity descriptor with package and class name ### Activity Object Structure ```javascript { packageName: string, className: string } ``` ### Returns void ### Example ```javascript app.startActivity({ packageName: 'com.example.myapp', className: 'com.example.myapp.MainActivity' }); ``` ``` -------------------------------- ### Perform HTTP GET Request Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-http-network.md Use `http.get` to perform an asynchronous HTTP GET request. Provide the full URL, headers, and a callback object with success and error functions. Requires `android.permission.INTERNET`. ```javascript http.get('https://api.example.com/data', { 'User-Agent': 'MyApp/1.0' }, { success: function(response) { console.log('Response: ' + response); }, error: function(error) { console.log('Error: ' + error); } }); ``` -------------------------------- ### instance.loop Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-media.md Enable or disable looping playback for the audio instance. ```APIDOC ## [instance].loop(state) ### Description Enable or disable looping playback. ### Parameters #### Path Parameters - **state** (boolean) - Required - true to enable looping, false to play once ### Default false (play once only) ### Returns void ### Request Example ```javascript var loopPlayer = media.create('https://example.com/bgm.mp3'); loopPlayer.loop(true); // Play continuously ``` ``` -------------------------------- ### convert.outputStreamToByte Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-data-conversion.md Gets all written bytes from an OutputStream. ```APIDOC ## convert.outputStreamToByte(data) ### Description Gets all written bytes from an OutputStream. ### Parameters #### Path Parameters - None #### Query Parameters - None #### Request Body - **data** (OutputStream) - Required - Output stream ### Response #### Success Response - **bytes** (byte[]) - All bytes written to stream ``` -------------------------------- ### keys.swipe(x, y, tox, toy, time) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-ui-interaction.md Simulates a swipe or drag gesture from a starting point (x, y) to an ending point (tox, toy) over a specified duration. This requires the Magisk module `jshook_keys`. ```APIDOC ## keys.swipe(x, y, tox, toy, time) ### Description Simulate a swipe/drag gesture from one point to another over a duration. ### Parameters #### Path Parameters - **x** (int) - Required - Starting X coordinate - **y** (int) - Required - Starting Y coordinate - **tox** (int) - Required - Ending X coordinate - **toy** (int) - Required - Ending Y coordinate - **time** (int) - Required - Duration of swipe in milliseconds ### Returns void ### Example ```javascript // Swipe from left to right over 500ms keys.swipe(100, 500, 900, 500, 500); ``` ``` -------------------------------- ### device.getManufacturer() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Gets the manufacturer name of the device (e.g., Samsung, OnePlus). ```APIDOC ## device.getManufacturer() ### Description Get the device manufacturer name (e.g., Samsung, OnePlus, Xiaomi). ### Returns - string — Manufacturer name ### Example ```javascript var manufacturer = device.getManufacturer(); console.log('Manufacturer: ' + manufacturer); ``` ``` -------------------------------- ### [instance].state Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-modmenu.md Displays the ImGui status bar at the bottom of the window, showing performance metrics. ```APIDOC ## [instance].state() ### Description Display the ImGui status bar at the bottom of the window showing performance metrics. ### Example ```javascript menu.state(); ``` ``` -------------------------------- ### r2.trace(address) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-r2frida.md Starts tracing function calls at a given address or Java method signature. It automatically logs parameters and return values, aiding in dynamic analysis. ```APIDOC ## r2.trace(address) ### Description Trace function calls, automatically logging parameters and return values. ### Parameters #### Path Parameters - **address** (string | NativePointer | string) - Required - Address or `java:com.example.Class.method` ### Returns void ### Example ```javascript // Trace native function r2.trace(base.add(0x1234)); // Trace Java method r2.trace('java:com.example.App.checkLicense'); ``` ``` -------------------------------- ### r2.disasm(address, count) Source: https://github.com/jshookapp/document/blob/main/api/md24.md Disassembles code starting from a given address. ```APIDOC ## r2.disasm(address, count) ### Description Disassembles code starting from the specified address. ### Method N/A (Function call) ### Endpoint N/A ### Parameters #### Path Parameters - **address** (string or number) - Required - The starting address for disassembly. - **count** (number) - Optional - The number of instructions to disassemble. ### Request Example ```javascript var base = Module.findBaseAddress("libgame.so"); r2.disasm(base, 20); ``` ### Response #### Success Response - **instructions** (string) - A string representing the disassembled code. ``` -------------------------------- ### Dex Class Data Result Format Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-dex.md Example structure of the JSON output when retrieving complete class data. Includes class name, superclass, interfaces, access flags, and arrays for fields and methods. ```json { "name": "com.example.MyClass", "superClass": "java.lang.Object", "interfaces": ["java.io.Serializable"], "accessFlags": 1, "fields": [ /* field array */ ], "methods": [ /* method array */ ] } ``` -------------------------------- ### Kernel Mode Memory Scan and Modification Example Source: https://github.com/jshookapp/document/blob/main/api/md18.md This script demonstrates how to use Frida in both non-kernel and kernel modes to find and modify a variable's value. It first finds the base address of 'libil2cpp.so' in non-kernel mode, then uses a dialog to input a value to search for within the module's memory range. Once found, it logs the address and value of 'staticA' and modifies it to 1000. In kernel mode, it periodically reads and writes a random value to a hardcoded address. ```javascript //内存扫描 const memoryScan = (m, pattern, call) => { Memory.scan(m.base, m.size, pattern, { onMatch(address, size) { call(address) return 'stop'; }, onComplete() { } }); } function getRandomInt(min, max) { return Math.floor(Math.random() * (max - min + 1)) + min; } //开始使用内核 if (runtime.isKernel) { console.log('kernel start') const time = setInterval(() => { const il2cpp = kernel.getModuleBase('libil2cpp.so') if (il2cpp) { clearInterval(time) console.log('il2cpp', il2cpp) //读取/修改数据 setInterval(() => { const newval = getRandomInt(100, 999) console.log('newval', newval) kernel.writeDword('0x7e3fe30c30', newval) const kernel_staticA = kernel.readDword('0x7e3fe30c30') console.log('staticA', kernel_staticA) }, 3000) } }, 100) } else { //非内核模式下通过frida找到变量的内存基址,你也可以通过其他方法获取 const time = setInterval(() => { const addr = Module.findBaseAddress('libil2cpp.so') if (addr) { clearInterval(time) console.log('libil2cpp ok') //il2cpp模块地址是动态的 const il2cpp = ptr(addr) console.log('il2cpp', il2cpp) //这个0x667F14是偏移,固定的,指向 ShowResult 方法 Interceptor.attach(il2cpp.add(0x667F14), { onEnter: function (args) { //当前实例 const instance = args[0] //输入当前 staticA 的值去搜索内存 dialog.input('search_val', { ok: function (res) { //获取搜索范围 const range = Process.findRangeByAddress(instance) //搜索条件 const pattern = ptr(parseInt(res)).toMatchPattern().replace(' 00 00 00 00', '') memoryScan(range, pattern, (address) => { //变量内存地址 console.log('staticA_address', address) //变量内存值 const staticA = ptr(address).readInt() console.log('staticA', staticA) //修改 ptr(address).writeInt(1000) }) }, cancel: function () { } }, '') }, onLeave: function (retval) { } }) } }, 100) } ``` -------------------------------- ### r2.hexdump(address, length) Source: https://github.com/jshookapp/document/blob/main/api/md24.md Performs a hexdump of memory starting from a given address. ```APIDOC ## r2.hexdump(address, length) ### Description Performs a hexdump of memory starting from the specified address. ### Method N/A (Function call) ### Endpoint N/A ### Parameters #### Path Parameters - **address** (string or number) - Required - The starting address for the hexdump. - **length** (number) - Required - The number of bytes to dump. ### Request Example ```javascript r2.hexdump(h.address, 32); ``` ### Response #### Success Response - **hexdump** (string) - A string representing the hexdump of the memory region. ``` -------------------------------- ### Get DEX Class Data Source: https://github.com/jshookapp/document/blob/main/_autodocs/INDEX.md Retrieve the complete structure of a class from a DEX file. ```javascript dex.getClassData() ``` -------------------------------- ### Initialize DexKit with APK Path Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-dex.md Initializes DexKit for DEX analysis using the path to an APK file. Use null to auto-detect the current app's APK. ```javascript var success = dex.init(null); // Use current app APK if (success) { console.log('DexKit initialized'); } ``` -------------------------------- ### keys.home() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-ui-interaction.md Simulates pressing the system home button (KEYCODE_HOME). This requires the Magisk module `jshook_keys`. ```APIDOC ## keys.home() ### Description Simulate pressing the home button (KEYCODE_HOME). ### Returns void ### Example ```javascript keys.home(); ``` ``` -------------------------------- ### device.getScreenDensity() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Gets the screen pixel density, a multiplier relative to the baseline 160 dpi. ```APIDOC ## device.getScreenDensity() ### Description Get the screen pixel density (multiplier relative to baseline 160 dpi). ### Returns - float — Density value (1.0 for baseline, 1.5 for ldpi, 2.0 for xhdpi, etc.) ### Example ```javascript var density = device.getScreenDensity(); console.log('Screen density: ' + density + 'x'); ``` ``` -------------------------------- ### dex.init(apkPath) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-dex.md Initializes DexKit for DEX analysis. It can use a specified APK path or auto-detect the current app's APK. ```APIDOC ## dex.init(apkPath) ### Description Initialize DexKit for DEX analysis. ### Parameters #### Path Parameters - **apkPath** (string | null) - Required - Path to APK file, or null to auto-detect current app's APK ### Returns - **boolean** - true if initialization successful ### Request Example ```javascript var success = dex.init(null); // Use current app APK if (success) { console.log('DexKit initialized'); } ``` ``` -------------------------------- ### Get Screen Height Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves the screen height in physical pixels (px). Returns an integer. ```javascript var height = device.getScreenHeight(); console.log('Screen height: ' + height + ' px'); ``` -------------------------------- ### Get Screen Width Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves the screen width in physical pixels (px). Returns an integer. ```javascript var width = device.getScreenWidth(); console.log('Screen width: ' + width + ' px'); ``` -------------------------------- ### Connect to frida-gadget using port forwarding and attach Source: https://github.com/jshookapp/document/blob/main/md7.md Use this command to forward the frida-gadget port and then attach to a process using Gadget. Ensure frida-gadget is configured with the specified port. ```shell #端口转发 adb forward tcp:28042 tcp:28042 #attach frida -H 127.0.0.1:28042 Gadget -l test.js ``` -------------------------------- ### Get Device Manufacturer Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves the device manufacturer name, such as Samsung or Xiaomi. Returns a string. ```javascript var manufacturer = device.getManufacturer(); console.log('Manufacturer: ' + manufacturer); ``` -------------------------------- ### Get Device Model Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves the device model name, such as SM-G950F or OnePlus 8. Returns a string. ```javascript var model = device.getModel(); console.log('Device model: ' + model); ``` -------------------------------- ### r2.dlopen(path) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-r2frida.md Loads a dynamic library into the target process. This is equivalent to calling `dlopen` on the target system. ```APIDOC ## r2.dlopen(path) ### Description Load a dynamic library. ### Parameters #### Path Parameters - **path** (string) - Required - Path to the dynamic library ``` -------------------------------- ### Get Screen Density in DPI Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves the screen density in dots per inch (dpi). Returns an integer. ```javascript var dpi = device.getScreenDensityDpi(); console.log('Screen DPI: ' + dpi); ``` -------------------------------- ### [instance].icon(img) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-modmenu.md Sets the icon for the window, which is displayed on the floating button. ```APIDOC ## [instance].icon(img) ### Description Sets the window's icon, which is displayed on the floating button. ### Parameters #### Path Parameters - **img** (string) - Required - Image URL or base64-encoded image data. ### Request Example ```javascript menu.icon('https://example.com/icon.png'); ``` ``` -------------------------------- ### Get Device Android ID Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves the unique Android ID for the device in hexadecimal format. Returns a string. ```javascript var androidId = device.getAndroidID(); console.log('Device Android ID: ' + androidId); ``` -------------------------------- ### Check Runtime Environment Information Source: https://github.com/jshookapp/document/blob/main/_autodocs/README.md This snippet shows how to access and log various runtime environment details, including package name, app version, kernel mode status, and screen width to infer device type. ```javascript console.log('Package: ' + runtime.packageName); console.log('App Version: ' + runtime.appInfo.versionName); console.log('Kernel Mode: ' + runtime.isKernel); if (device.getScreenWidth() > 1000) { console.log('Likely a tablet'); } ``` -------------------------------- ### device.getABIs() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Fetches a comma-separated list of supported CPU architectures (ABIs) on the device. ```APIDOC ## device.getABIs() ### Description Get the supported CPU architectures (ABIs) on the device. ### Returns - string — Comma-separated ABI list (e.g., `arm64-v8a,armeabi-v7a`) ### Example ```javascript var abis = device.getABIs(); console.log('Supported ABIs: ' + abis); ``` ``` -------------------------------- ### Simulate Swipe Gesture Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-ui-interaction.md Simulates a swipe/drag gesture from a starting point to an ending point over a specified duration in milliseconds. ```javascript // Swipe from left to right over 500ms keys.swipe(100, 500, 900, 500, 500); ``` -------------------------------- ### Connect to frida-server using port forwarding and spawn Source: https://github.com/jshookapp/document/blob/main/md7.md Use this command to forward the frida-server port and then spawn a process for injection. Ensure frida-server is running on the specified port. ```shell #端口转发 adb forward tcp:28042 tcp:28042 #spawn frida -H 127.0.0.1:28042 -f com.android.xxx -l test.js ``` -------------------------------- ### Connect to frida-server using port forwarding and attach Source: https://github.com/jshookapp/document/blob/main/md7.md Use this command to forward the frida-server port and then attach to a running process. Ensure frida-server is running on the specified port. ```shell #端口转发 adb forward tcp:28042 tcp:28042 #attach frida -H 127.0.0.1:28042 -n com.android.xxx -l test.js ``` -------------------------------- ### Get Screen Density Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-device.md Retrieves the screen pixel density as a multiplier relative to baseline 160 dpi. Returns a float. ```javascript var density = device.getScreenDensity(); console.log('Screen density: ' + density + 'x'); ``` -------------------------------- ### Basic Class Search Source: https://github.com/jshookapp/document/blob/main/en/api/md23.md Initializes DexKit, searches for classes containing specific strings, and logs the found class names. Remember to release resources using dex.close() when done. ```javascript // Initialize DexKit (auto-detect current app's APK) dex.init(null); console.log('DEX file count:', dex.getDexCount()); // Search classes containing "VIP" and "expired" var classes = JSON.parse(dex.findClassByStrings('["VIP","expired"]', null, null)); for (var i = 0; i < classes.length; i++) { console.log('Found class:', classes[i].name); } // Release resources dex.close(); ``` -------------------------------- ### Get FridaMod Version Code Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-runtime.md Retrieve the integer version code of the FridaMod framework. This is useful for programmatic version comparisons. ```javascript var code = runtime.modVersionCode; console.log('FridaMod version code: ' + code); ``` -------------------------------- ### app.getInternalAppDataPath() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-app.md Get the path to the target application's internal storage data directory. Returns an absolute path string. ```APIDOC ## app.getInternalAppDataPath() ### Description Get the path to the target application's internal storage data directory. ### Returns string — Absolute path to internal app data directory ### Example ```javascript var dataPath = app.getInternalAppDataPath(); console.log('Internal data: ' + dataPath); // Usually: /data/data/com.example.myapp ``` ``` -------------------------------- ### [instance].size Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-modmenu.md Resizes the window to specified dimensions in pixels. ```APIDOC ## [instance].size(width, height) ### Description Resize the window to specified dimensions in pixels. ### Parameters #### Path Parameters - **width** (int) - Window width in px - **height** (int) - Window height in px ### Example ```javascript menu.size(400, 600); ``` ``` -------------------------------- ### http.get Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-http-network.md Perform an HTTP GET request asynchronously. It takes the URL, headers, and a callback object with success and error functions. ```APIDOC ## http.get(url, headers, callback) ### Description Perform an HTTP GET request asynchronously. It takes the URL, headers, and a callback object with success and error functions. ### Parameters #### Path Parameters - **url** (string) - Required - Full URL to fetch (http:// or https://) - **headers** (object) - Required - HTTP headers as key-value object; can be empty `{}` - **callback** (object) - Required - Callback object with `success` and `error` functions Callback Structure: ```javascript { success: function(result) { /* result is response body as string */ }, error: function(error) { /* error is error message string */ } } ``` ### Returns void (asynchronous) ### Requirements Target application must have `android.permission.INTERNET` ### Example ```javascript http.get('https://api.example.com/data', { 'User-Agent': 'MyApp/1.0' }, { success: function(response) { console.log('Response: ' + response); }, error: function(error) { console.log('Error: ' + error); } }); ``` ``` -------------------------------- ### dex.initByClassLoader() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-dex.md Initializes DexKit using the target application's ClassLoader for in-memory DEX data. Use this when the APK file path is not accessible. ```APIDOC ## dex.initByClassLoader() ### Description Initialize DexKit using the target application's ClassLoader (in-memory DEX data). ### Returns - **boolean** - true if successful ### Use When APK file path is not accessible, but you have access to loaded classes ### Request Example ```javascript var success = dex.initByClassLoader(); ``` ``` -------------------------------- ### Unity Il2Cpp Initialization Source: https://github.com/jshookapp/document/blob/main/_autodocs/INDEX.md Perform operations within the Unity Il2Cpp runtime, managing threads. ```javascript Il2Cpp.perform() ``` -------------------------------- ### Find and Hook Methods by String Source: https://github.com/jshookapp/document/blob/main/_autodocs/README.md This snippet demonstrates how to find methods containing specific strings within a given package and then hook them. It uses dex.init, dex.findMethodByStrings, and dex.close for method discovery and hooks the found methods to log their execution and force success. ```javascript dex.init(null); var methods = JSON.parse(dex.findMethodByStrings('["license","premium"]', 'com.example')); dex.close(); for (var i = 0; i < methods.length; i++) { var m = methods[i]; Java.perform(function() { var cls = Java.use(m.className); cls[m.name].implementation = function() { console.log('Hooked: ' + m.name); return true; // Force success }; }); } ``` -------------------------------- ### Get View Position Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-ui-interaction.md Retrieves the screen coordinates (x, y) of a View's top-left corner. Requires a View object as input. ```javascript var views = view.findViewByText('Button'); if (views.size() > 0) { var pos = view.getPosition(views.get(0)); console.log('View at x=' + pos.get(0) + ', y=' + pos.get(1)); } ``` -------------------------------- ### Initialize DexKit with ClassLoader Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-dex.md Initializes DexKit using the target application's ClassLoader for in-memory DEX data. Use this when the APK file path is not accessible. ```javascript var success = dex.initByClassLoader(); ``` -------------------------------- ### Get file size in bytes Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-file-io.md Use file.getSize to retrieve the size of a file in bytes. This function requires the file path as input. ```javascript var size = file.getSize('/data/data/com.example/data.db'); console.log('File size: ' + size + ' bytes'); ``` -------------------------------- ### Get filename from path Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-file-io.md Use file.getName to extract just the filename from a complete file path. This is useful for isolating the last component of a path. ```javascript var name = file.getName('/data/data/com.example/config.txt'); console.log(name); // config.txt ``` -------------------------------- ### app.getAppInfo() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-app.md Retrieve detailed information about the target application, including package name, version, and app name. ```APIDOC ## app.getAppInfo() ### Description Retrieve detailed information about the target application. ### Returns object with keys: - `packageName`: string - `versionName`: string - `versionCode`: int - `appName`: string (display name) - `flags`: int ### Example ```javascript var info = app.getAppInfo(); console.log('App Name: ' + info.appName); console.log('Version: ' + info.versionName); ``` ``` -------------------------------- ### runtime.appInfo Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-runtime.md Retrieves metadata about the currently hooked application, including its package name, version, flags, and main activity class. ```APIDOC ## runtime.appInfo ### Description Get metadata about the currently hooked application. ### Returns ApplicationInfo object ### Returns Structure ``` { packageName: string, // Application package name versionName: string, // Application version name versionCode: int, // Application version code flags: int, // Application flags className: string // Main activity class name } ``` ### Example ```javascript var info = runtime.appInfo; console.log('App: ' + info.packageName); console.log('Version: ' + info.versionName + ' (' + info.versionCode + ')'); ``` ``` -------------------------------- ### Get Target Package Name Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-runtime.md Retrieve the full package name of the target application being hooked. This is a direct way to identify the application. ```javascript console.log('Target package: ' + runtime.packageName); ``` -------------------------------- ### view.getPosition(view) Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-ui-interaction.md Gets the screen coordinates (x, y) of a View's top-left corner. It returns an array containing the x and y coordinates in pixels. ```APIDOC ## view.getPosition(view) ### Description Get the screen coordinates (x, y) of a View's top-left corner. ### Parameters #### Path Parameters - **view** (View) - Required - The View object ### Returns List — [x, y] coordinates in pixels ### Example ```javascript var views = view.findViewByText('Button'); if (views.size() > 0) { var pos = view.getPosition(views.get(0)); console.log('View at x=' + pos.get(0) + ', y=' + pos.get(1)); } ``` ``` -------------------------------- ### Get Process Name Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-runtime.md Retrieve the name of the process being hooked. This is important for multi-process applications where the process name may differ from the package name. ```javascript console.log('Process: ' + runtime.processName); ``` -------------------------------- ### DEX Initialization and Closing Source: https://github.com/jshookapp/document/blob/main/_autodocs/INDEX.md Initialize and close DEX analysis context. Can be initialized with a specific DEX file or by ClassLoader. ```javascript dex.init() dex.initByClassLoader() dex.close() ``` -------------------------------- ### Get Class Data Source: https://github.com/jshookapp/document/blob/main/en/api/md23.md Retrieves detailed information about a specific class, including its superclass, interfaces, fields, and methods. Use this to inspect the structure of a class. ```json { "name": "com.example.MyClass", "superClass": "java.lang.Object", "interfaces": ["java.io.Serializable"], "accessFlags": 1, "fields": [{"className":"com.example.MyClass","name":"id","type":"int","accessFlags":2,"descriptor":"..."}], "methods": [{"className":"com.example.MyClass","name":"getId","returnType":"int","paramTypes":[],"accessFlags":1,"descriptor":"..."}] } ``` -------------------------------- ### Media Playback Functions Source: https://github.com/jshookapp/document/blob/main/_autodocs/INDEX.md Functions for creating and controlling audio playback instances. ```APIDOC ## Media Playback Functions ### Description Functions for creating and controlling audio playback instances. ### Player Creation - `media.create(url)`: Creates a new media player instance for the given URL. ### Player Controls - `start()`: Starts playback. - `pause()`: Pauses playback. - `stop()`: Stops playback. - `loop()`: Toggles looping for the media. ### Batch Operations - `media.closeAll()`: Closes all active media player instances. ``` -------------------------------- ### r2.info() Source: https://github.com/jshookapp/document/blob/main/_autodocs/api-reference-r2frida.md Fetches detailed process information, including PID, architecture, platform, and more, in JSON format. This provides a comprehensive overview of the target process. ```APIDOC ## r2.info() ### Description Get process information as JSON (PID, arch, platform, etc.). ### Returns string — JSON string containing process information ``` -------------------------------- ### Monitor ImGui logs for rendering enhancement compatibility Source: https://github.com/jshookapp/document/blob/main/md7.md Run this command in a root terminal to continuously output logs related to ImGui. This output is used to help developers add compatibility for your device's rendering enhancement. ```shell su logcat|grep ImGui ```