-
Notifications
You must be signed in to change notification settings - Fork 142
/
Copy pathtraceLibc.js
74 lines (58 loc) · 2.06 KB
/
traceLibc.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
function traceNativeExport(){
var modules = Process.enumerateModules();
for(var i = 0;i<modules.length;i++){
var module = modules[i];
if(module.name.indexOf("libc.so")<0){
continue;
}
var exports = module.enumerateExports();
console.log('module.addr',module.base);
for(var j = 0;j<exports.length;j++){
//console.log("module name is =>",module.name," symbol name is =>",exports[j].name)
//var path = "/sdcard/Download/so/"+module.name+".txt"
if(exports[j].type == "function"){
if(exports[j].name.indexOf("str") >= 0 && exports[j].name.indexOf("_l") < 0 && exports[j].name.indexOf("ld") < 0 && exports[j].name.indexOf("pthread_") < 0){
attach(exports[j].name,exports[j].address)
}
}
}
}
}
function attach(name,address){
console.log("attaching ",name);
Interceptor.attach(address,{
onEnter:function(args){
console.log("Entering => " ,name)
console.log("args[0] => ",args[0].readCString() )
console.log("args[1] => ",args[1].readCString())
// console.log("args[2] => ",args[2])
},onLeave:function(retval){
//console.log("retval is => ",retval)
}
})
}
function traceNativeSymbol(){
var modules = Process.enumerateModules();
for(var i = 0;i<modules.length;i++){
var module = modules[i];
if(module.name.indexOf('libc.so')<0){
continue
}
// console.log(module.name);
var exports = module.enumerateSymbols()
// console.log(JSON.stringify(exports))
for(var j = 0;j<exports.length;j++){
if(exports[j].type == "function"){
if(exports[j].name.indexOf("str") >= 0){
attach(exports[j].name,exports[j].address)
}
}
}
}
}
function main(){
console.log("Entering main")
traceNativeExport();
// traceNativeSymbol();
}
setImmediate(main)