frida hookso层函数常用脚本

最新推荐文章于 2024-07-07 20:39:36 发布

f4ck3sdn

最新推荐文章于 2024-07-07 20:39:36 发布

阅读量348

点赞数

文章标签： javascript 开发语言 ecmascript

本文链接：https://blog.csdn.net/ymswx/article/details/129738441

版权

function print_string(addr) {
    var base_hello_jni = Module.findBaseAddress("libxxxx.so");
    var addr_str = base_hello_jni.add(addr);
    console.log("addr:", addr, " ", ptr(addr_str).readCString());
}

function hook_libart() {
    var module_libart = Process.findModuleByName("libart.so");
    var symbols = module_libart.enumerateSymbols();     //枚举模块的符号

    var addr_GetStringUTFChars = null;
    var addr_FindClass = null;
    var addr_GetStaticFieldID = null;
    var addr_SetStaticIntField = null;
    var addr_RegisterNatives = null;        

    for (var i = 0; i < symbols.length; i++) {
        var name = symbols[i].name;
        if (name.indexOf("art") >= 0) {//动态获取各个函数的地址
            if ((name.indexOf("CheckJNI") == -1) && (name.indexOf("JNI") >= 0)) {
                if (name.indexOf("GetStringUTFChars") >= 0) {
                    console.log(name);
                    addr_GetStringUTFChars = symbols[i].address;
                } else if (name.indexOf("FindClass") >= 0) {
                    console.log(name);
                    addr_FindClass = symbols[i].address;
                } else if (name.indexOf("GetStaticFieldID") >= 0) {
                    console.log(name);
                    addr_GetStaticFieldID = symbols[i].address;
                } else if (name.indexOf("SetStaticIntField") >= 0) {
                    console.log(name);
                    addr_SetStaticIntField = symbols[i].address;
                } else if (name.indexOf("RegisterNatives") >= 0) {
                    console.log(name);
                    addr_RegisterNatives = symbols[i].address;
                }
            }
        }
    }

    if (addr_RegisterNatives) {
        Interceptor.attach(addr_RegisterNatives, {
            onEnter: function (args) {
                console.log("addr_RegisterNatives:", hexdump(args[2]));    //打印第三个参数，也就是java和native映射的数组首地址
                console.log("addr_RegisterNatives name:", ptr(args[2]).readPointer().readCString())//java层函数名称
                console.log("addr_RegisterNatives sig:", ptr(args[2]).add(Process.pointerSize).readPointer().readCString());//函数参数
                console.log("addr_RegisterNatives addr:", ptr(args[2]).add(Process.pointerSize+Process.pointerSize));//native函数入口地址
            }, onLeave: function (retval) {

            }
        });
    }
}
-----------------------------------