frida / frida-core

Frida core library intended for static linking into bindings
https://frida.re
Other
609 stars 193 forks source link

how to get Swift.String value when hooking swift function #278

Open netv1 opened 4 years ago

netv1 commented 4 years ago

Hi, I'm trying to hook a Swift function that looks like this: static TestLib.TestFacade.isReady(name: Swift.String, isTest: Swift.Bool) -> Swift.Bool

I'm hooking its symbol name (mangled): $s12TestLib11TestFacadeC02isC5Ready9name10isTestSbSS_SbtFZ like so:

Interceptor.attach(Module.findExportByName(null, '$s12TestLib11TestFacadeC02isC5Ready9name10isTestSbSS_SbtFZ'), { onEnter: function (args) { console.log(' isTokenReady: 0:' + args[0] + ', 1:' + args[1]); //console.log(' isTokenReady:' + Memory.readCString(args[0])); //console.log(' isTokenReady:' + Memory.readCString(ptr(args[0]))); //console.log(' isTokenReady:' + Memory.readUtf8String(ptr(args[0]))); //console.log('*** isTokenReady:' + Memory.readUtf16String(ptr(args[0]))); }, onLeave: function (retval) { } });

The problem is that I don't know how to get the actual content of the string (its value) to display it / use it. The only ideas I came up with are:

1). try something like args[0].add(OFFSET).readPointer().readUtf8String(); -- however I don't know the offset (since I don't know the internal representation of Swift's string) and also I'm not sure if it's UTF-8 or 16 (since before Swift 5 UTF-16 was used).

2). somehow (but how?) to create a NSString from the swift string object and display that instead.

How would you deal with this? I've searched and searched but couldn't find anything useful on this. Thanks

eugenekolo commented 4 years ago

I would do #1. The Swift spec is public. While it can be terse and difficult if inexperienced with spec reading, it will explain to the layout of Swift objects and provide you with that offset.

2 is interesting too, but I don't know off the top of my head the syntax for that and it sounds like additional computational over head, which starts to matter when you're doing things like say dumping every string on the heap.