【2021春节】Android中级题

最新推荐文章于 2024-07-18 11:07:23 发布

R玍一世ㄜ

最新推荐文章于 2024-07-18 11:07:23 发布

阅读量117

点赞数 1

分类专栏：安卓逆向文章标签： android

本文链接：https://blog.csdn.net/weixin_48076656/article/details/128520456

版权

安卓逆向专栏收录该内容

8 篇文章 0 订阅

订阅专栏

ida截图：
在这里插入图片描述


function main(){
    var check_addr = Module.findExportByName('libnative-lib.so','Java_cn_pojie52_cm01_MainActivity_check');
    var so_addr = Module.findBaseAddress('libnative-lib.so');
    // if(check_addr != null){
    //     Interceptor.attach(check_addr,{
    //         onEnter:function(args){
    //             console.log( hexdump(args[1]));
    //         },onLeave:function(){

    //         }
    //     })
    // }

    var addr_b90 = so_addr.add(0xb90);
    var b90 = new NativeFunction(addr_b90,'int',['pointer','int','pointer']);
    var arg1 = Memory.allocUtf8String('123456789012345678901234567890');
    var arg2 = 30;
    var arg3 = Memory.allocUtf8String('areyousure??????');

    var result_b90 = b90(arg1,arg2,arg3);
    console.log(Memory.readByteArray(arg1,64));

    console.log(result_b90);


    // var addr_d90 = so_addr.add(0xd90);
 
    // var sub_d90 = new NativeFunction(addr_d90 , 'pointer', ['pointer', 'int' ]);

    // var arg1 = Memory.allocUtf8String('123456789012345678901234567890');

    // var arg2 = 30; 

    // var ret_d90 = sub_d90(arg1,arg2);

    // console.log(Memory.readByteArray(ret_d90,64));
    // console.log(ret_d90.readCString());


}

function hook_b90(){
    
    var so_addr = Module.findBaseAddress('libnative-lib.so');
    if(so_addr != null){
        var b90_addr = so_addr.add(0xb90);
        Interceptor.attach(b90_addr,{
            onEnter:function(args){
                this.arg0 = args[0];
                this.arg1 = args[1];
                this.arg2 = args[2];
                console.log(hexdump(args[0]));
                console.log(args[1]);
                console.log(hexdump(args[2]));
            },onLeave:function(retval){
                console.log('---------------------');
                console.log(hexdump(this.arg0));
                // console.log(retval);
            }
        })
    }
}

var destAddr = '';  //定位xsp地址
 
  
 
function inline_hook() {
 
    var so_addr = Module.findBaseAddress("libnative-lib.so");
 
     
 
     
 
    if (so_addr) {
 
        console.log("so_addr:", so_addr);
 
         
 
        var addr_b90 = so_addr.add(0xB90);
 
        var sub_b90 = new NativeFunction(addr_b90 , 'int', ['pointer', 'int', 'pointer']);
 
        Interceptor.attach(sub_b90, { 
 
            onEnter: function(args) 
 
            {  
 
            destAddr = args[0];

            console.log('onEnter B90');
            console.log('args[0]',hexdump(args[0]) ); 
 
            },
 
            //在hook函数之后执行的语句
 
            onLeave:function(retval)
 
            { 
 
            console.log('onLeave B90');
 
            } 
 
        }); 
 
 
 
      
 
        var addr_b2c = so_addr.add(0xb2c);
 
        console.log("The addr_b2c:", addr_b2c);
 
        Java.perform(function() {
 
            Interceptor.attach(addr_b2c, {
 
                onEnter: function(args) { 
                console.log("addr_b2c OnEnter :",  Memory.readByteArray(destAddr.sub(0x38),64) );
 
                }
 
            })
 
        })
 
    } 
 
}

function hook_x9(){
    var so_addr = Module.findBaseAddress('libnative-lib.so');
    var b30_addr = so_addr.add(0xb30);
    Interceptor.attach(b30_addr,{
        onEnter:function(args){
            console.log('x9=',hexdump(this.context.x9));
            console.log('x9->',Memory.readCString(this.context.x9) );
            // console.log('x8->',this.context.w10);
        },onLeave:function(retval){

        }
    })
}
setImmediate(hook_x9);