quarkslab / titanm

This repository contains the tools we used in our research on the Google Titan M chip
Apache License 2.0
181 stars 14 forks source link

Frida callapp.js script doesn't work #6

Closed NewDwarf closed 2 years ago

NewDwarf commented 3 years ago

The frida script 'callapp.js' has several issues. I guess, the code base was slightly modified after original creating of the frida script. Below is the patch:

$ git diff callapp.js
diff --git a/nugget_toolkit/scripts/frida/callapp.js b/nugget_toolkit/scripts/frida/callapp.js
index c75fc10..333f222 100644
--- a/nugget_toolkit/scripts/frida/callapp.js
+++ b/nugget_toolkit/scripts/frida/callapp.js
@@ -14,7 +14,7 @@ var app_id, param;
 var request, request_size;
 var reply, reply_size_addr, reply_size;

-var libname = "parser.so";
+var libname = "libparser.so";
 var libdir = "/data/local/tmp/";
 var libpath = libdir + libname;

@@ -25,7 +25,7 @@ log("Found sanity function at: " + sanity_func);
 var sanity_res = sanity_func();
 log("Sanity function returned " + sanity_res);

-var parser_func = new NativeFunction(Module.findExportByName(libname, "_Z6parserjjPcjS_Pj"), "void", ["int", "int", "pointer", "int", "pointer", "pointer"]);
+var parser_func = new NativeFunction(Module.findExportByName(libname, "parser"), "void", ["int", "int", "pointer", "int", "pointer", "int"]);

 Interceptor.attach(moduleBase, {
     onEnter: function(args) {
@@ -63,8 +63,8 @@ Interceptor.attach(moduleBase, {
             log("Reply has null size");
         }

-        parser_func(app_id, param, request, request_size, reply, reply_size_addr);
+        parser_func(app_id, param, request, request_size, reply, reply_size);

         log("------------------------------------------------------------------------------------------------------");
     }
-});
\ No newline at end of file
+});
NewDwarf commented 3 years ago

BTW, using the __android_log_write() for logging is not a good candidate as it truncates the messages.