frida / frida-gum

Cross-platform instrumentation and introspection library written in C
https://frida.re
Other
727 stars 240 forks source link

Add ability to run a function on a given thread #762

Closed WorksButNotTested closed 6 months ago

WorksButNotTested commented 8 months ago

Architecture specific code is based on gum_stalker_infect, so backend support is quite small. Support for x86, x64, arm and arm64 as well as QuickJS and V8. Includes supporting unit tests.

WorksButNotTested commented 7 months ago
(gdb) bt
#0  0x570de920 in test_memory_access_monitor_notify_on_read_access (fixture=0xeff61b78, data=<optimized out>) at ../tests/core/memoryaccessmonitor.c:28
#1  0x571fa8b0 in test_case_run (tc=<optimized out>) at ../../../deps/glib/glib/gtestutils.c:2933
#2  g_test_run_suite_internal (suite=<optimized out>, path=<optimized out>) at ../../../deps/glib/glib/gtestutils.c:3021
#3  0x571faae3 in g_test_run_suite_internal (suite=<optimized out>, path=<optimized out>) at ../../../deps/glib/glib/gtestutils.c:3037
#4  0x571faae3 in g_test_run_suite_internal (suite=<optimized out>, path=<optimized out>) at ../../../deps/glib/glib/gtestutils.c:3037
#5  0x571f9e4a in g_test_run_suite (suite=0xf7e5da40) at ../../../deps/glib/glib/gtestutils.c:3115
#6  0x571f9d14 in g_test_run () at ../../../deps/glib/glib/gtestutils.c:2234
#7  0x570cd345 in main (argc=<optimized out>, argv=<optimized out>) at ../tests/gumtest.c:305
(gdb) x/80i test_memory_access_monitor_notify_on_read_access
   0x570de829 <test_memory_access_monitor_notify_on_read_access>:       push   %ebp
   0x570de82a <test_memory_access_monitor_notify_on_read_access+1>:     mov    %esp,%ebp
   0x570de82c <test_memory_access_monitor_notify_on_read_access+3>:     push   %ebx
   0x570de82d <test_memory_access_monitor_notify_on_read_access+4>:     push   %edi
   0x570de82e <test_memory_access_monitor_notify_on_read_access+5>:     push   %esi
   0x570de82f <test_memory_access_monitor_notify_on_read_access+6>:     and    $0xfffffff0,%esp
   0x570de832 <test_memory_access_monitor_notify_on_read_access+9>:     sub    $0x10,%esp
   0x570de835 <test_memory_access_monitor_notify_on_read_access+12>:    mov    0x8(%ebp),%esi
   0x570de838 <test_memory_access_monitor_notify_on_read_access+15>:    call   0x570de83d <test_memory_access_monitor_notify_on_read_access+20>
   0x570de83d <test_memory_access_monitor_notify_on_read_access+20>:    pop    %ebx
   0x570de83e <test_memory_access_monitor_notify_on_read_access+21>:    add    $0x10b2ccb,%ebx
   0x570de844 <test_memory_access_monitor_notify_on_read_access+27>:    mov    0x4(%esi),%ecx
   0x570de847 <test_memory_access_monitor_notify_on_read_access+30>:    mov    0x10(%esi),%eax
   0x570de84a <test_memory_access_monitor_notify_on_read_access+33>:    lea    0x4(%esi),%edi
   0x570de84d <test_memory_access_monitor_notify_on_read_access+36>:    movb   $0x13,(%ecx,%eax,1)
   0x570de851 <test_memory_access_monitor_notify_on_read_access+40>:    mov    %ecx,0x4(%esp)
   0x570de855 <test_memory_access_monitor_notify_on_read_access+44>:    mov    0x14(%esi),%eax
   0x570de858 <test_memory_access_monitor_notify_on_read_access+47>:    movb   $0x37,(%ecx,%eax,1)
   0x570de85c <test_memory_access_monitor_notify_on_read_access+51>:    cmpl   $0x0,(%esi)
   0x570de85f <test_memory_access_monitor_notify_on_read_access+54>:    jne    0x570dee7b <test_memory_access_monitor_notify_on_read_access+1618>
   0x570de865 <test_memory_access_monitor_notify_on_read_access+60>:    sub    $0x4,%esp
   0x570de868 <test_memory_access_monitor_notify_on_read_access+63>:    xor    %ecx,%ecx
   0x570de86a <test_memory_access_monitor_notify_on_read_access+65>:    lea    -0x10b14f7(%ebx),%eax
   0x570de870 <test_memory_access_monitor_notify_on_read_access+71>:    inc    %ecx
   0x570de871 <test_memory_access_monitor_notify_on_read_access+72>:    push   $0x0
   0x570de873 <test_memory_access_monitor_notify_on_read_access+74>:    push   %esi
   0x570de874 <test_memory_access_monitor_notify_on_read_access+75>:    push   %eax
   0x570de875 <test_memory_access_monitor_notify_on_read_access+76>:    push   %ecx
   0x570de876 <test_memory_access_monitor_notify_on_read_access+77>:    push   $0x7
   0x570de878 <test_memory_access_monitor_notify_on_read_access+79>:    push   %ecx
   0x570de879 <test_memory_access_monitor_notify_on_read_access+80>:    push   %edi
   0x570de87a <test_memory_access_monitor_notify_on_read_access+81>:    call   0x5711d341 <gum_memory_access_monitor_new>
   0x570de87f <test_memory_access_monitor_notify_on_read_access+86>:    add    $0x20,%esp
   0x570de882 <test_memory_access_monitor_notify_on_read_access+89>:    test   %eax,%eax
   0x570de884 <test_memory_access_monitor_notify_on_read_access+91>:    mov    %eax,(%esi)
   0x570de886 <test_memory_access_monitor_notify_on_read_access+93>:    je     0x570deeb7 <test_memory_access_monitor_notify_on_read_access+1678>
   0x570de88c <test_memory_access_monitor_notify_on_read_access+99>:    sub    $0x8,%esp
   0x570de88f <test_memory_access_monitor_notify_on_read_access+102>:   push   $0x0
   0x570de891 <test_memory_access_monitor_notify_on_read_access+104>:   push   %eax
   0x570de892 <test_memory_access_monitor_notify_on_read_access+105>:   call   0x5711d410 <gum_memory_access_monitor_enable>
   0x570de897 <test_memory_access_monitor_notify_on_read_access+110>:   add    $0x10,%esp
   0x570de89a <test_memory_access_monitor_notify_on_read_access+113>:   test   %eax,%eax
   0x570de89c <test_memory_access_monitor_notify_on_read_access+115>:   je     0x570deee7 <test_memory_access_monitor_notify_on_read_access+1726>
   0x570de8a2 <test_memory_access_monitor_notify_on_read_access+121>:   mov    0x1c(%esi),%eax
   0x570de8a5 <test_memory_access_monitor_notify_on_read_access+124>:   test   %eax,%eax
   0x570de8a7 <test_memory_access_monitor_notify_on_read_access+126>:   je     0x570de919 <test_memory_access_monitor_notify_on_read_access+240>
   0x570de8a9 <test_memory_access_monitor_notify_on_read_access+128>:   movq   -0x1a9ccc0(%ebx),%xmm1
   0x570de8b1 <test_memory_access_monitor_notify_on_read_access+136>:   movd   %eax,%xmm0
   0x570de8b5 <test_memory_access_monitor_notify_on_read_access+140>:   por    %xmm1,%xmm0
   0x570de8b9 <test_memory_access_monitor_notify_on_read_access+144>:   subsd  %xmm1,%xmm0
   0x570de8bd <test_memory_access_monitor_notify_on_read_access+148>:   sub    $0x30,%esp
   0x570de8c0 <test_memory_access_monitor_notify_on_read_access+151>:   andl   $0x0,0x24(%esp)
   0x570de8c5 <test_memory_access_monitor_notify_on_read_access+156>:   andl   $0x0,0x20(%esp)
   0x570de8ca <test_memory_access_monitor_notify_on_read_access+161>:   lea    -0x1aee512(%ebx),%edx
   0x570de8d0 <test_memory_access_monitor_notify_on_read_access+167>:   lea    -0x1afe02c(%ebx),%ecx
   0x570de8d6 <test_memory_access_monitor_notify_on_read_access+173>:   lea    -0x1b307f1(%ebx),%eax
   0x570de8dc <test_memory_access_monitor_notify_on_read_access+179>:   movsd  %xmm0,0x14(%esp)
   0x570de8e2 <test_memory_access_monitor_notify_on_read_access+185>:   movl   $0x69,0x28(%esp)
   0x570de8ea <test_memory_access_monitor_notify_on_read_access+193>:   movl   $0x1a,0x8(%esp)
   0x570de8f2 <test_memory_access_monitor_notify_on_read_access+201>:   mov    %edx,0x10(%esp)
   0x570de8f6 <test_memory_access_monitor_notify_on_read_access+205>:   mov    %ecx,0xc(%esp)
   0x570de8fa <test_memory_access_monitor_notify_on_read_access+209>:   lea    -0x1b73727(%ebx),%edx
   0x570de900 <test_memory_access_monitor_notify_on_read_access+215>:   lea    -0x1b065d1(%ebx),%ecx
   0x570de906 <test_memory_access_monitor_notify_on_read_access+221>:   mov    %eax,0x1c(%esp)
   0x570de90a <test_memory_access_monitor_notify_on_read_access+225>:   mov    %edx,0x4(%esp)
   0x570de90e <test_memory_access_monitor_notify_on_read_access+229>:   mov    %ecx,(%esp)
   0x570de911 <test_memory_access_monitor_notify_on_read_access+232>:   call   0x571fad4c <g_assertion_message_cmpnum>
   0x570de916 <test_memory_access_monitor_notify_on_read_access+237>:   add    $0x30,%esp
   0x570de919 <test_memory_access_monitor_notify_on_read_access+240>:   mov    0x10(%esi),%eax
   0x570de91c <test_memory_access_monitor_notify_on_read_access+243>:   mov    0x4(%esp),%edi
=> 0x570de920 <test_memory_access_monitor_notify_on_read_access+247>:   mov    (%edi,%eax,1),%al
(gdb) info reg
eax            0x800               2048
ecx            0xffffb4ec          -19220
edx            0x2000              8192
ebx            0x58191508          1478038792
esp            0xffffd610          0xffffd610
ebp            0xffffd638          0xffffd638
esi            0xeff61b78          -269083784
edi            0xef8da000          -275931136
eip            0x570de920          0x570de920 <test_memory_access_monitor_notify_on_read_access+247>
eflags         0x10246             [ PF ZF IF RF ]
cs             0x23                35
ss             0x2b                43
ds             0x2b                43
es             0x2b                43
fs             0x6b                107
gs             0x63                99