let OFFSET_APPLY_TILE_EFFECT = 0x458d10
let APPLY_TILE_EFFECT_ENTITY_PARAMETER_INDEX = 2;
let ENTITY_TYPE_OFFSET = 1;
let ENTITY_TYPE_CAT_VALUE = 1166;
let ENTITY_POSITION_OFFSET = 7;
let BOARD_POSITION_X_OFFSET = 7;
let BOARD_POSITION_Y_OFFSET = 0xf;
function reset_cat_position(){
var base_address = Module.findBaseAddress("libapp.so");
Interceptor.attach(base_address.add(OFFSET_APPLY_TILE_EFFECT), {
onEnter: function () {
let entity = dart_get_arg(this.context, APPLY_TILE_EFFECT_ENTITY_PARAMETER_INDEX);
let entity_type = entity.add(ENTITY_TYPE_OFFSET).readInt() * 2
if (entity_type == ENTITY_TYPE_CAT_VALUE){
let entity_position =
get_pointer_with_heap_bit(entity, ENTITY_POSITION_OFFSET, this.context);
let entity_position_x =
entity_position.add(BOARD_POSITION_X_OFFSET).readInt();
let entity_position_y =
entity_position.add(BOARD_POSITION_Y_OFFSET).readInt();
if ((entity_position_x > 1) || (entity_position_y > 1)){
console.log(
Resetting position of cat (${entity}): (${entity_position_x}, ${entity_position_y})
);
entity_position.add(BOARD_POSITION_X_OFFSET).writeInt(0);
entity_position.add(BOARD_POSITION_Y_OFFSET).writeInt(0);
}
}
}
});
}
As you mention in the website https://www.guardsquare.com/blog/how-classical-attacks-apply-to-flutter-apps
let OFFSET_APPLY_TILE_EFFECT = 0x458d10 let APPLY_TILE_EFFECT_ENTITY_PARAMETER_INDEX = 2; let ENTITY_TYPE_OFFSET = 1; let ENTITY_TYPE_CAT_VALUE = 1166; let ENTITY_POSITION_OFFSET = 7; let BOARD_POSITION_X_OFFSET = 7; let BOARD_POSITION_Y_OFFSET = 0xf;
function reset_cat_position(){ var base_address = Module.findBaseAddress("libapp.so"); Interceptor.attach(base_address.add(OFFSET_APPLY_TILE_EFFECT), { onEnter: function () { let entity = dart_get_arg(this.context, APPLY_TILE_EFFECT_ENTITY_PARAMETER_INDEX); let entity_type = entity.add(ENTITY_TYPE_OFFSET).readInt() * 2 if (entity_type == ENTITY_TYPE_CAT_VALUE){ let entity_position = get_pointer_with_heap_bit(entity, ENTITY_POSITION_OFFSET, this.context); let entity_position_x = entity_position.add(BOARD_POSITION_X_OFFSET).readInt(); let entity_position_y = entity_position.add(BOARD_POSITION_Y_OFFSET).readInt(); if ((entity_position_x > 1) || (entity_position_y > 1)){ console.log(
Resetting position of cat (${entity}): (${entity_position_x}, ${entity_position_y})
); entity_position.add(BOARD_POSITION_X_OFFSET).writeInt(0); entity_position.add(BOARD_POSITION_Y_OFFSET).writeInt(0); } } } }); }