0x01 作用

hook native层的RegisterNatives函数，打印注册的函数名和函数地址

0x02 代码

  1. var ishook_libart = true;
  3. function hook_libart() {
  4.     if (ishook_libart === false) {
  5.         return;
  6.     }
  7.     var symbols = Module.enumerateSymbolsSync("libart.so");
  8.     var addrGetStringUTFChars = null;
  9.     var addrNewStringUTF = null;
  10.     var addrFindClass = null;
  11.     var addrGetMethodID = null;
  12.     var addrGetStaticMethodID = null;
  13.     var addrGetFieldID = null;
  14.     var addrGetStaticFieldID = null;
  15.     var addrRegisterNatives = null;
  16.     var addrAllocObject = null;
  17.     var addrCallObjectMethod = null;
  18.     var addrGetObjectClass = null;
  19.     var addrReleaseStringUTFChars = null;
  20.     for (var i = 0; i < symbols.length; i++) {
  21.         var symbol = symbols[i];
  22.         if (symbol.name == "_ZN3art3JNI17GetStringUTFCharsEP7_JNIEnvP8_jstringPh") {
  23.             addrGetStringUTFChars = symbol.address;
  24.             // console.log("GetStringUTFChars is at ", symbol.address, symbol.name);
  25.         } else if (symbol.name == "_ZN3art3JNI12NewStringUTFEP7_JNIEnvPKc") {
  26.             addrNewStringUTF = symbol.address;
  27.             // console.log("NewStringUTF is at ", symbol.address, symbol.name);
  28.         } else if (symbol.name == "_ZN3art3JNI9FindClassEP7_JNIEnvPKc") {
  29.             addrFindClass = symbol.address;
  30.             // console.log("FindClass is at ", symbol.address, symbol.name);
  31.         } else if (symbol.name == "_ZN3art3JNI11GetMethodIDEP7_JNIEnvP7_jclassPKcS6_") {
  32.             addrGetMethodID = symbol.address;
  33.             // console.log("GetMethodID is at ", symbol.address, symbol.name);
  34.         } else if (symbol.name == "_ZN3art3JNI17GetStaticMethodIDEP7_JNIEnvP7_jclassPKcS6_") {
  35.             addrGetStaticMethodID = symbol.address;
  36.             // console.log("GetStaticMethodID is at ", symbol.address, symbol.name);
  37.         } else if (symbol.name == "_ZN3art3JNI10GetFieldIDEP7_JNIEnvP7_jclassPKcS6_") {
  38.             addrGetFieldID = symbol.address;
  39.             // console.log("GetFieldID is at ", symbol.address, symbol.name);
  40.         } else if (symbol.name == "_ZN3art3JNI16GetStaticFieldIDEP7_JNIEnvP7_jclassPKcS6_") {
  41.             addrGetStaticFieldID = symbol.address;
  42.             // console.log("GetStaticFieldID is at ", symbol.address, symbol.name);
  43.         } else if (symbol.name == "_ZN3art3JNI15RegisterNativesEP7_JNIEnvP7_jclassPK15JNINativeMethodi") {
  44.             addrRegisterNatives = symbol.address;
  45.             console.log("RegisterNatives is at ", symbol.address, symbol.name);
  46.         } else if (symbol.name.indexOf("_ZN3art3JNI11AllocObjectEP7_JNIEnvP7_jclass") >= 0) {
  47.             addrAllocObject = symbol.address;
  48.             // console.log("AllocObject is at ", symbol.address, symbol.name);
  49.         }  else if (symbol.name.indexOf("_ZN3art3JNI16CallObjectMethodEP7_JNIEnvP8_jobjectP10_jmethodIDz") >= 0) {
  50.             addrCallObjectMethod = symbol.address;
  51.             // console.log("CallObjectMethod is at ", symbol.address, symbol.name);
  52.         } else if (symbol.name.indexOf("_ZN3art3JNI14GetObjectClassEP7_JNIEnvP8_jobject") >= 0) {
  53.             addrGetObjectClass = symbol.address;
  54.             // console.log("GetObjectClass is at ", symbol.address, symbol.name);
  55.         } else if (symbol.name.indexOf("_ZN3art3JNI21ReleaseStringUTFCharsEP7_JNIEnvP8_jstringPKc") >= 0) {
  56.             addrReleaseStringUTFChars = symbol.address;
  57.             // console.log("ReleaseStringUTFChars is at ", symbol.address, symbol.name);
  58.         }
  59.     }
  61.     if (addrRegisterNatives != null) {
  62.         Interceptor.attach(addrRegisterNatives, {
  63.             onEnter: function (args) {
  64.                 console.log("[RegisterNatives] method_count:", args[3]);
  65.                 var env = args[0];
  66.                 var java_class = args[1];
  68.                 var funcAllocObject = new NativeFunction(addrAllocObject, "pointer", ["pointer", "pointer"]);
  69.                 var funcGetMethodID = new NativeFunction(addrGetMethodID, "pointer", ["pointer", "pointer", "pointer", "pointer"]);
  70.                 var funcCallObjectMethod = new NativeFunction(addrCallObjectMethod, "pointer", ["pointer", "pointer", "pointer"]);
  71.                 var funcGetObjectClass = new NativeFunction(addrGetObjectClass, "pointer", ["pointer", "pointer"]);
  72.                 var funcGetStringUTFChars = new NativeFunction(addrGetStringUTFChars, "pointer", ["pointer", "pointer", "pointer"]);
  73.                 var funcReleaseStringUTFChars = new NativeFunction(addrReleaseStringUTFChars, "void", ["pointer", "pointer", "pointer"]);
  75.                 var clz_obj = funcAllocObject(env, java_class);
  76.                 var mid_getClass = funcGetMethodID(env, java_class, Memory.allocUtf8String("getClass"), Memory.allocUtf8String("()Ljava/lang/Class;"));
  77.                 var clz_obj2 = funcCallObjectMethod(env, clz_obj, mid_getClass);
  78.                 var cls = funcGetObjectClass(env, clz_obj2);
  79.                 var mid_getName = funcGetMethodID(env, cls, Memory.allocUtf8String("getName"), Memory.allocUtf8String("()Ljava/lang/String;"));
  80.                 var name_jstring = funcCallObjectMethod(env, clz_obj2, mid_getName);
  81.                 var name_pchar = funcGetStringUTFChars(env, name_jstring, ptr(0));
  82.                 var class_name = ptr(name_pchar).readCString();
  83.                 funcReleaseStringUTFChars(env, name_jstring, name_pchar);
  85.                 //console.log(class_name);
  87.                 var methods_ptr = ptr(args[2]);
  89.                 var method_count = parseInt(args[3]);
  90.                 for (var i = 0; i < method_count; i++) {
  91.                     var name_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3));
  92.                     var sig_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize));
  93.                     var fnPtr_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize * 2));
  95.                     var name = Memory.readCString(name_ptr);
  96.                     var sig = Memory.readCString(sig_ptr);
  97.                     var find_module = Process.findModuleByAddress(fnPtr_ptr);
  98.                     console.log("[RegisterNatives] java_class:", class_name, "name:", name, "sig:", sig, "fnPtr:", fnPtr_ptr, "module_name:", find_module.name, "module_base:", find_module.base, "offset:", ptr(fnPtr_ptr).sub(find_module.base));
  100.                 }
  101.             },
  102.             onLeave: function (retval) { }
  103.         });
  104.     }
  106.     ishook_libart = true;
  107. }
  109. hook_libart();
  111. //frida -U --no-pause -f co.c0c.myApplication -l hookregisternatives.js