frida 主动调用so native实例函数的问题

Pansy``

已于 2023-05-19 12:10:15 修改

阅读量959

点赞数 1

文章标签： android c++

于 2023-05-17 10:14:06 首次发布

本文链接：https://blog.csdn.net/a1663049254/article/details/130719721

版权

调用实例函数，第一个参数为this指针

var module=Process.getModuleByName("libart.so");
var symbols=module.enumerateSymbols();
var pretty_addr=module.getExportByName("_ZN3art9ArtMethod12PrettyMethodEb");
  
for(let i=0;i<symbols.length;i++){
    var name=symbols[i].name;
    var addr=symbols[i].address

    if(name==="_ZN3art9ArtMethod14RegisterNativeEPKvb"){
         Interceptor.attach(addr,{
            onEnter:function (args){
                var thisPointer=ptr(args[0]);          
                var native_fun= new NativeFunction(pretty_addr,"pointer",["pointer","bool"]);
                var result=native_fun(thisPointer,1);
            },
            onLeave:function (ret){    
            }
        });  
        break;  
    } 
}

报错
Error: access violation accessing 0xd

PrettyMethod函数原型
std::string PrettyMethod(bool with_signature = true)

查看frida文档
For C++ scenarios involving a return value that is larger than Process.pointerSize, a typical ABI may expect that a NativePointer to preallocated space must be passed in as the first parameter. (This scenario is common in WebKit, for example.)

也就是说，如果c++函数的返回长度大于一个指针的大小，第一个参数必须是一个指针，用于预分配空间，
而c++的string指针长度是8个字节在这里插入图片描述
因此要这样写：

var result=Memory.alloc(3*Process.pointerSize);
var native_fun= new NativeFunction(pretty_addr,"pointer",["pointer","pointer","bool"]);
native_fun(result,thisPointer,1);
var str=result.add(2*Process.pointerSize).readPointer().readUtf8String();