Native开发与逆向第四篇 - hook JNI函数GetStringUTFChars

修改测试demo
通过GetStringUTFChars 获取java层传入的字符串参数。

extern "C" JNIEXPORT jstring JNICALL
Java_com_mycode_nativehello_MainActivity_stringFromJNI(
        JNIEnv* env,
        jobject /* this */,jstring s) {
    std::string hello = env->GetStringUTFChars(s, 0);
    return env->NewStringUTF(hello.c_str());
}

目标hook GetStringUTFChars 打印字符串。
hook 代码如下：

function hook_jni_3(){
    var symbols = Process.getModuleByName("libart.so").enumerateSymbols();
    var addr_GetStringUTFChars = NULL;
    for (var index = 0; index < symbols.length; index++) {
     const symbols_one = symbols[index];
     if (symbols_one.name.indexOf("art") >= 0){
         if (symbols_one.name.indexOf("checkJNI") == -1 && symbols_one.name.indexOf("GetStringUTFChars")>= 0){
             console.log("GetStringUTFChars ",JSON.stringify(symbols_one));
             addr_GetStringUTFChars = symbols_one.address;
             console.log("GetStringUTFChars address = " + addr_GetStringUTFChars); 
             break
         }
     }    
    }
    Interceptor.attach(addr_GetStringUTFChars,{
     onEnter:function(args){
         var env = args[0];
         var param1 = args[1];
         console.log("env :",env,"param1 ", Java.vm.getEnv().getStringUtfChars(param1, null).readCString());
     },onLeave:function (retval) {
         console.log("GetStringUTFChars retval :", ptr(retval).readCString());
     }
    })
}
setImmediate(hook_jni_3);

运行打印结果：参数和返回值都正常打印出字符串。
env : 0x7d44041250 param1 Hello stringFromJNI
GetStringUTFChars retval : Hello stringFromJNI