-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathHook_SetAt1.js
67 lines (60 loc) · 1.85 KB
/
Hook_SetAt1.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
function GetStackTraceString(traces, tab) {
// range 含有以下三个属性
// base: 0x76894000
// size: 61440
// protection: r-x
var range;
// "base": "0x768a5000",
// "name": "libComm.so",
// "path": "/data/data/com.Autel.maxi/app_myLibs/libComm.so",
// "size": 376832
var module;
// "offset": 12288,
// "path": "/system/lib/libc.so",
// "size": 0
var rangeFile = null;
var str;
var tabstr = "";
for (var i = 0; i != tab; i++) {
tabstr += " ";
}
var traceString = "";
for (var i in traces) {
var moduleName = "null";
var moduleBase = 0;
//range = Process.findRangeByAddress(traces[i]);
module = Process.findModuleByAddress(traces[i]);
if (module) {
moduleName = module.name;
moduleBase = module.base;
}
str = i + ": " + moduleName + ", address: " + traces[i] + ", offset: 0x" + (parseInt(traces[i]) - parseInt(moduleBase)).toString(16).toUpperCase() + "\n";
traceString += tabstr + str;
}
return traceString;
}
var MaxiDasBase = Module.findBaseAddress("libMaxiDas.so");
/*
Interceptor.attach(ptr(parseInt(MaxiDasBase) + 0xA2455), {
onEnter: function (args) {
this.log = "libMaxiDas.so.sub_A2454:\n";
this.log += " trace:\n" + GetStackTraceString(Thread.backtrace(this.context), 2);
},
onLeave: function (retval) {
this.log += " ret: " + retval + "\n";
console.log(this.log + "\n");
}
});
*/
Interceptor.attach(Module.findExportByName("libc.so", "fopen"), {
onEnter: function (args) {
this.log = "libc.fopen:\n";
this.log += " pathname: " + Memory.readCString(args[0]) + "\n";
this.log += " mode: " + Memory.readCString(args[1]) + "\n";
this.log += " trace:\n" + GetStackTraceString(Thread.backtrace(this.context), 2);
},
onLeave: function (retval) {
this.log += " ret: " + retval + "\n";
console.log(this.log + "\n");
}
});