打开 libunity.so 搜索字符串:Could not load symbol %s : %s
查找引用,进入任意一处
F5显示伪代码:
frida hook代码:
/*
用法:
frida -U -l hook_dlopen.js -f packageName --no-pause
*/
var soName = "libunity.so"
function myfun()
{
var moduleBaseAddress = Module.getBaseAddress(soName);
console.log(soName + "_address:", moduleBaseAddress);
var nativePointer = moduleBaseAddress.add(0x6139C0);//加上偏移地址
Interceptor.attach(nativePointer,
{
onEnter: function (args)
{
console.log("\n");
console.log("==参数0:" + this.context.x0);
console.log("==参数1:" + this.context.x1.readCString())
console.log("==参数2:" + this.context.x2)
},
onLeave: function (retval)
{
console.log("retval",retval,retval.sub(Module.getBaseAddress("libil2cpp.so")));
}
}
);
}
function hook_dlopen()
{
var is_can_hook = false;
Interceptor.attach(Module.findExportByName(null, "dlopen"),
{
onEnter: function (args)
{
var pathptr = args[0];
if (pathptr !== undefined && pathptr != null)
{
var path = ptr(pathptr).readCString();
if (path.indexOf(soName) >= 0)
{
this.is_can_hook = true;
console.log("\n"+soName+"_path:", path);
}
}
},
onLeave: function (retval)
{
if (this.is_can_hook)
{
myfun();
console.log("dlopen finish...");
}
}
}
);
Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
{
onEnter: function (args)
{
var pathptr = args[0];
if (pathptr !== undefined && pathptr != null)
{
var path = ptr(pathptr).readCString();
if (path.indexOf(soName) >= 0)
{
this.is_can_hook = true;
console.log("\n"+soName+"_path:", path);
}
}
},
onLeave: function (retval)
{
if (this.is_can_hook)
{
myfun();
console.log("android_dlopen_ext finish...");
}
}
}
);
}
setImmediate(hook_dlopen);
输出:
总结:
多找找特征,找旧版本对比
欢迎加入QQ群:812701781,542863693,欢迎分享一些骚操作(备注看的什么文章)
微信公众号:MoneyHoneyCome