search

lasting-yang / frida_hook_libart

Frida hook some jni functions
MIT License
1.48k stars 484 forks source link

hook_Registernatives.js fnoffset计算的问题 #13

Open Ossianaa opened 2 years ago

Ossianaa commented 2 years ago

commit c42bb2e0beb00f51b13a9482641fbeda0e2c4dba里 把上一条修改fnOffset的地方回退了 " fnOffset:", ptr(fnPtr_ptr).sub(find_module.base)

现在: " fnOffset:", symbol,

lasting-yang commented 2 years ago

symbol这里有模块名，有地址或符号名，

把你的样本发我看看，

Yooi commented 2 years ago

[RegisterNatives] java_class: tv.danmaku.ijk.media.player.cache.WBCacheManager name: nativeCheckCacheExist sig: (Ljava/lang/String;Ljava/lang/String;)I fnPtr: 0xd1e841c4 fnOffset: 0xd1e841c4 callee: 0xb9599579 libhoudini.so!0x212579 [RegisterNatives] java_class: tv.danmaku.ijk.media.player.cache.WBCacheManager name: nativeGetCacheFullPath sig: (Ljava/lang/String;)Ljava/lang/String; fnPtr: 0xd1e8418c fnOffset: 0xd1e8418c callee: 0xb9599579 libhoudini.so!0x212579 [RegisterNatives] java_class: tv.danmaku.ijk.media.player.cache.WBCacheManager name: nativeGetCacheTraceLogString sig: (Ljava/lang/String;)Ljava/lang/String; fnPtr: 0xd1e84154 fnOffset: 0xd1e84154 callee: 0xb9599579 libhoudini.so!0x212579

两个值都是一样的，而且callee没有返回 调用的lib 返回的 libhoudini.so 是系统的

lasting-yang commented 2 years ago

[RegisterNatives] java_class: tv.danmaku.ijk.media.player.cache.WBCacheManager name: nativeCheckCacheExist sig: (Ljava/lang/String;Ljava/lang/String;)I fnPtr: 0xd1e841c4 fnOffset: 0xd1e841c4 callee: 0xb9599579 libhoudini.so!0x212579 [RegisterNatives] java_class: tv.danmaku.ijk.media.player.cache.WBCacheManager name: nativeGetCacheFullPath sig: (Ljava/lang/String;)Ljava/lang/String; fnPtr: 0xd1e8418c fnOffset: 0xd1e8418c callee: 0xb9599579 libhoudini.so!0x212579 [RegisterNatives] java_class: tv.danmaku.ijk.media.player.cache.WBCacheManager name: nativeGetCacheTraceLogString sig: (Ljava/lang/String;)Ljava/lang/String; fnPtr: 0xd1e84154 fnOffset: 0xd1e84154 callee: 0xb9599579 libhoudini.so!0x212579

两个值都是一样的，而且callee没有返回 调用的lib 返回的 libhoudini.so 是系统的

libhoudini.so 是模拟器翻译arm的模块，建议换真机

ys1231 commented 2 years ago

我有两个问题:

  1. 在查找符号的时候 if (symbol.name.indexOf("art") >= 0 && symbol.name.indexOf("JNI") >= 0 && symbol.name.indexOf("RegisterNatives") >= 0 这样做以ida分析的符号是有的 但是 在frida里面 直接打印出来name的时候 是 没有上面的符号的 . 想请教一下
    1. 在获取 typedef struct { const char* name; const char* signature; void* fnPtr; } JNINativeMethod; 这些地址的时候 我没有明白 为什么是 let name_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3)); let sig_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize)); let fnPtr_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize * 2));
      • 3 可以帮我解惑吗?
lasting-yang commented 2 years ago
  1. 可能不同手机的符号有一些差异，ida分析出来的符号是经过格式化的函数名，frida里找出来的符号是名称粉碎的
  2. Process.pointerSize 是为了适配32位和64位so