frida初探 hook 之操作window notepad.e

为了方便需要环境python3.7，使用Anaconda3 Prompt

 pip install frida-tools

打开notepad.exe

在e判编写一个test.py
填写如下内容:

import frida

def on_message(message, data):
    print("[on_message] message:", message, "data:", data)

session = frida.attach("notepad.exe")

script = session.create_script("""'use strict';

rpc.exports.enumerateModules = function () {
  return Process.enumerateModulesSync();
};
""")
script.on("message", on_message)
script.load()

print([m["name"] for m in script.exports.enumerate_modules()])

执行
python test.py
下图分别演示进程不存在，和存在的不同操作结果。

image.png

mac切换环境

 source activate

创建环境

 conda create env_name -n luozheng

必须退出环境才能创建

aaadeMacBook-Pro:~ aaa$ conda create -n luozheng
Solving environment: done


==> WARNING: A newer version of conda exists. <==
  current version: 4.5.4
  latest version: 4.5.8

Please update conda by running

    $ conda update -n base conda



## Package Plan ##

  environment location: /Users/aaa/anaconda3/envs/luozheng


Proceed ([y]/n)? 

查看所有环境

aaadeMacBook-Pro:~ aaa$ conda info -e
# conda environments:
#
base                  *  /Users/aaa/anaconda3
luozheng                 /Users/aaa/anaconda3/envs/luozheng

mac进入环境

aaadeMacBook-Pro:~ aaa$ source activate luozheng
(luozheng) aaadeMacBook-Pro:~ aaa$ 

如果不填写环境名,默认进入的是base.
输入python发现环境是3.6.5
https://blog.csdn.net/lq_547762983/article/details/81003528