为了达到在应用启动时 hook RegisterNatives 查看注册函数对应关系，特意找了一下 frida hook RegisterNatives 的方法。发现没有现成可用的。翻了一下 frida 源码，自己整理了一个方法，给同学们提供一下方便。
直接上 frida 脚本：
function hook_registNatives() {
var env = Java.vm.getEnv();
var handlePointer = env.handle.readPointer();
console.log("handle: " + handlePointer);
var nativePointer = handlePointer.add(215 * Process.pointerSize).readPointer();
console.log("register: " + nativePointer);
/**
typedef struct {
const char* name;
const char* signature;
void* fnPtr;
} JNINativeMethod;
jint RegisterNatives(JNIEnv* env, jclass clazz, const JNINativeMethod* methods, jint nMethods)
*/
Interceptor.attach(nativePointer, {
onEnter: function(args) {
var env = Java.vm.getEnv();
var methods = args[2];
var methodcount = args[3].toInt32();
var name = env.getClassName(args[1]);
console.log("==== class: " + name + " ====");
console.log("==== methods: " + methods + " nMethods: " + methodcount + " ====");
for (var i = 0; i < methodcount; i ++ ) {
var idx = i * 12;
var fnPtr = methods.add(idx + 8).readPointer();
const infoArr = getModuleInfoByPtr(fnPtr);
const modulename = infoArr[0];
const modulebase = infoArr[1];
var logstr = "name: " + methods.add(idx).readPointer().readCString()
+ ", signature: " + methods.add(idx + 4).readPointer().readCString()
+ ", fnPtr: " + fnPtr
+ ", modulename: " + modulename + " -> base: " + modulebase;
if (null != modulebase) {
logstr += ", offset: " + fnPtr.sub(modulebase);
}
DMLog.i(tag, logstr);
}
}
});
}
完整的代码：我把这块单独整理到了github
项目用的是 frida 作者 oleavr 推荐的开发环境，按说明初始化环境，用 pycharm 打开可以看到 frida 代码补全提示，感兴趣的同学可以用用看。
效果展示：
[INFO][fridaRegstNtv]: hello, i am loaded
handle: 0xefb71cbc
register: 0xef9ba4f1
==== class: com.meituan.android.cipstorage.MMKV ====
==== methods: 0xcd52d428 nMethods: 41 ====
[INFO][fridaRegstNtv]: name: initialize, signature: ()V, fnPtr: 0xcd50b6bd, modulename: libcips.so -> base: 0xcd505000, offset: 0x66bd
[INFO][fridaRegstNtv]: name: onExit, signature: ()V, fnPtr: 0xcd50b6c7, modulename: libcips.so -> base: 0xcd505000, offset: 0x66c7
[INFO][fridaRegstNtv]: name: getMMKVWithID, signature: (Ljava/lang/String;ILjava/lang/String;)J, fnPtr: 0xcd50b6d1, modulename: libcips.so -> base: 0xcd505000, offset: 0x66d1
[INFO][fridaRegstNtv]: name: encodeBool, signature: (JLjava/lang/String;Z)Z, fnPtr: 0xcd50b76d, modulename: libcips.so -> base: 0xcd505000, offset: 0x676d
[INFO][fridaRegstNtv]: name: decodeBool, signature: (JLjava/lang/String;Z)Z, fnPtr: 0xcd50b7bf, modulename: libcips.so -> base: 0xcd505000, offset: 0x67bf
[INFO][fridaRegstNtv]: name: encodeInt, signature: (JLjava/lang/String;I)Z, fnPtr: 0xcd50b80f, modulename: libcips.so -> base: 0xcd505000, offset: 0x680f
[INFO][fridaRegstNtv]: name: decodeInt, signature: (JLjava/lang/String;I)I, fnPtr: 0xcd50b85b, modulename: libcips.so -> base: 0xcd505000, offset: 0x685b
[INFO][fridaRegstNtv]: name: encodeLong, signature: (JLjava/lang/String;J)Z, fnPtr: 0xcd50b8a5, modulename: libcips.so -> base: 0xcd505000, offset: 0x68a5
[INFO][fridaRegstNtv]: name: decodeLong, signature: (JLjava/lang/String;J)J, fnPtr: 0xcd50b8f7, modulename: libcips.so -> base: 0xcd505000, offset: 0x68f7
[INFO][fridaRegstNtv]: name: encodeFloat, signature: (JLjava/lang/String;F)Z, fnPtr: 0xcd50b953, modulename: libcips.so -> base: 0xcd505000, offset: 0x6953
......
Github 地址：https://github.com/deathmemory/fridaRegstNtv
[复制链接]
发表于 2020-5-20 10:29
|
发表于 2020-5-20 12:32
yang神？
