// https://codeshare.frida.re/@lichao890427/find-android-hook/edit // Any questions submit to https://github.com/lichao890427/frida_script // Usage: /* // Get All Modules from /proc/self/maps [Xiaomi MI 4LTE::com.baidu.wallet]-> getAllModules() { "path": "/data/app-lib/com.baidu.wallet-1/libbdpush_V2_7.so", "vmmax": "2140905472", "vmmin": "2140844032" }, { "path": "/data/data/com.baidu.wallet/files/.1/dex/apkDex/1-2.4.5.dex", "vmmax": "2161364992", "vmmin": "2160836608" }, { "path": "/data/local/tmp/re.frida.server/frida-agent-32.so", "vmmax": "2172952576", "vmmin": "2161606656" }, { "path": "/data/data/com.baidu.wallet/files/.100015/dex/apkDex/100015-1.0.0.dex", "vmmax": "2189901824", "vmmin": "2189869056" } ................... // Check got table hook [Xiaomi MI 4LTE::com.baidu.wallet]-> checkConsistency("libdvm.so", 4) check .got .got 39/349 addr:41764b28 file-mem:0-40109708 __aeabi_idiv->libc.so.__divsi3 .got 44/349 addr:41764b3c file-mem:0-4010a2ec __aeabi_fadd->libc.so.__addsf3 .got 45/349 addr:41764b40 file-mem:0-4010a2e8 __aeabi_fsub->libc.so.__aeabi_frsub .got 50/349 addr:41764b54 file-mem:0-40109864 __aeabi_dadd->libc.so.__adddf3 .got 115/349 addr:41764c58 file-mem:1f738-40109708 __aeabi_idiv->libc.so.__divsi3 .got 129/349 addr:41764c90 file-mem:1f738-4010a134 __aeabi_cdcmple->libc.so.__aeabi_cdcmpeq .got 130/349 addr:41764c94 file-mem:1f738-401521e0 __aeabi_cfcmple->libm.so.__aeabi_cfrcmple .got 136/349 addr:41764cac file-mem:1f738-7549c681 __android_log_print->libbaiduprotect.so.unknown .got 138/349 addr:41764cb4 file-mem:1f738-4013a919 _Znaj->libstdc++.so._Znwj .got 139/349 addr:41764cb8 file-mem:1f738-4013a927 _ZdaPv->libstdc++.so._ZdlPv .got 161/349 addr:41764d10 file-mem:1f738-402d461b _ZSt24__stl_throw_length_errorPKc->libstlport.so._ZSt25__stl_throw_runtime_errorPKc .got 190/349 addr:41764d84 file-mem:1f738-40109640 __aeabi_uidiv->libc.so.__udivsi3 .got 228/349 addr:41764e1c file-mem:1f738-7549c691 read->libbaiduprotect.so.unknown .got 230/349 addr:41764e24 file-mem:1f738-71c17101 dlsym->libsechook.so._ZNK7android12SortedVectorIP6soinfoE8do_splatEPvPKvj .got 231/349 addr:41764e28 file-mem:1f738-71c17421 dlopen->libsechook.so._ZNK7android12SortedVectorIP6soinfoE10do_compareEPKvS5_ .got 232/349 addr:41764e2c file-mem:1f738-400b4dad dlerror->linker._start .got 292/349 addr:41764f1c file-mem:1f738-71c16f05 socket->libsechook.so.__socket .got 334/349 addr:41764fc4 file-mem:1f738-4176ee11 _ZN4MaAcC1EiPKtib->libqc-opt.so._ZN4MaAcC2EiPKtib .got 338/349 addr:41764fd4 file-mem:1f738-4176ee61 _ZN4MaAcD1Ev->libqc-opt.so._ZN4MaAcD2Ev // Check inline hook [Xiaomi MI 4LTE::com.baidu.wallet]-> checkConsistency("libdvm.so", 2) check .text .text addr:_Z17dvmDbgIsInterfacey+7 file-mem:14-df may be hook .text addr:_Z18dvmDbgGetClassListPjPPy+0 file-mem:4b-f8 may be hook .text addr:_Z18dvmDbgGetClassListPjPPy+1 file-mem:15-0 may be hook .text addr:_Z18dvmDbgGetClassListPjPPy+2 file-mem:4a-f0 may be hook .text addr:_Z18dvmDbgGetClassListPjPPy+3 file-mem:7b-1 may be hook .text addr:_Z18dvmDbgGetClassListPjPPy+4 file-mem:44-73 may be hook .text addr:_Z18dvmDbgGetClassListPjPPy+5 file-mem:73-7f may be hook .text addr:_Z18dvmDbgGetClassListPjPPy+6 file-mem:b5-7f may be hook // Dump elf [Xiaomi MI 4LTE::com.baidu.wallet]-> dumpModule("libbaiduprotect.so") write /sdcard/libbaiduprotect.so file->mem 2bf0->75492bf0 size:45e98 */ var O_RDONLY = 0; var O_WRONLY = 1; var O_RDWR = 2; var O_APPEND = 1024; var O_LARGEFILE = 32768; var O_CREAT = 64; var S_IWUSR = 128; var S_IRWXU = 448; var S_IRUSR = 256; var SEEK_SET = 0; var SEEK_CUR = 1; var SEEK_END = 2; function allocStr(str) { return Memory.allocUtf8String(str); } function getStr(addr) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.readUtf8String(addr); } function putStr(addr, str) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.writeUtf8String(addr, str); } function getByteArr(addr, l) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.readByteArray(addr, l); } function getU8(addr) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.readU8(addr); } function putU8(addr, n) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.writeU8(addr, n); } function getU16(addr) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.readU16(addr); } function putU16(addr, n) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.writeU16(addr, n); } function getU32(addr) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.readU32(addr); } function putU32(addr, n) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.writeU32(addr, n); } function getU64(addr) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.readU64(addr); } function putU64(addr, n) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.writeU64(addr, n); } function getPt(addr) { if (typeof addr == "number") { addr = ptr(addr); } return Memory.readPointer(addr); } function putPt(addr, n) { if (typeof addr == "number") { addr = ptr(addr); } if (typeof n == "number") { n = ptr(n); } return Memory.writePointer(addr, n); } function getExportFunction(type, name, ret, args) { var nptr; nptr = Module.findExportByName(null, name); if (nptr === null) { console.log("cannot find " + name); return null; } else { if (type === "f") { var funclet = new NativeFunction(nptr, ret, args); if (typeof funclet === "undefined") { console.log("parse error " + name); return null; } return funclet; } else if (type === "d") { var datalet = Memory.readPointer(nptr); if (typeof datalet === "undefined") { console.log("parse error " + name); return null; } return datalet; } } } function dumpMemory(addr, length) { console.log(hexdump(Memory.readByteArray(addr, length), { offset: 0, length: length, header: true, ansi: true })); } wrapper_open = getExportFunction("f", "open", "int", ["pointer", "int", "int"]); read = getExportFunction("f", "read", "int", ["int", "pointer", "int"]); write = getExportFunction("f", "write", "int", ["int", "pointer", "int"]); lseek = getExportFunction("f", "lseek", "int", ["int", "int", "int"]); wrapper_errno = getExportFunction("f", "__errno", "pointer", []); close = getExportFunction("f", "close", "int", ["int"]); dladdr = getExportFunction("f", "dladdr", "int", ["pointer", "pointer"]); wrapper_sscanf = getExportFunction("f", "sscanf", "int", ["pointer", "pointer", "pointer", "pointer", "pointer", "pointer", "pointer", "pointer", "pointer", "pointer", "pointer", "pointer", "pointer"]); getpid = getExportFunction("f", "getpid", "int", []); wrapper_popen = getExportFunction("f", "popen", "pointer", ["pointer", "pointer"]); pclose = getExportFunction("f", "pclose", "int", ["pointer"]); fgets = getExportFunction("f", "fgets", "pointer", ["pointer", "int", "pointer"]); function errno() { return getU32(wrapper_errno()); } function popen(command, type) { if (typeof command == "string") { command = allocStr(command); } if (typeof type == "string") { type = allocStr(type); } return wrapper_popen(command, type); } function getCommandOutput(cmd) { var fp = popen(cmd, "r"); if (fp.isNull()) { return null; } var output = ""; var buffer = malloc(1024); while (fgets(buffer, 1024, fp) > 0) { output += getStr(buffer); } pclose(fp); return output; } function getProcessName() { var fd = open("/proc/" + getpid() + "/cmdline", O_RDONLY, 0); if (fd == -1) { return "unknown"; } var buffer = malloc(32); read(fd, buffer, 32); close(fd); return getStr(buffer); } function open(pathname, flags, mode) { if (typeof pathname == "string") { pathname = allocStr(pathname); } return wrapper_open(pathname, flags, mode); } function getFileSize(fd) { return lseek(fd, 0, SEEK_END); } function malloc(size) { return Memory.alloc(size); } function memcpy(dst, src, n) { return Memory.copy(dst, src, n); } function sscanf(buffer, format, np1, np2, np3, np4, np5, np6, np7, np8, np9, np10, np11) { if (typeof format == "string") { format = allocStr(format); } return wrapper_sscanf(buffer, format, np1, np2, np3, np4, np5, np6, np7, np8, np9, np10, np11); } function getSymbol(addr) { if (addr == 0) { return new Object(); } var dlinfo = malloc(32); var npaddr = ptr(addr); putU64(dlinfo.add(0), 0); putU64(dlinfo.add(8), 0); putU64(dlinfo.add(16), 0); putU64(dlinfo.add(24), 0); dladdr(npaddr, dlinfo); var sym = new Object(); if (Process.pointerSize == 4) { libnameptr = getPt(dlinfo.add(0)); if (libnameptr.isNull()) { sym.libname = "unknown"; } else { sym.libname = getStr(libnameptr); } funcnameptr = getPt(dlinfo.add(8)); if (funcnameptr.isNull()) { sym.funcname = "unknown"; } else { sym.funcname = getStr(funcnameptr); } sym.libbase = getU32(dlinfo.add(4)); sym.funcoff = npaddr.sub(getPt(dlinfo.add(12))); } else { libnameptr = getPt(dlinfo.add(0)); if (libnameptr.isNull()) { sym.libname = "unknown"; } else { sym.libname = getStr(libnameptr); } funcnameptr = getPt(dlinfo.add(16)); if (funcnameptr.isNull()) { sym.funcname = "unknown"; } else { sym.funcname = getStr(funcnameptr); } sym.libbase = getU64(dlinfo.add(8)); sym.funcoff = npaddr.sub(getPt(dlinfo.add(24))); } if (sym.libname == "unknown" || sym.funcname == "unknown") { for (var i = global_symbols.length - 1; i >= 0; i--) { if (addr >= global_symbols[i].address) { sym.libname = global_symbols[i].path; sym.funcname = global_symbols[i].name; sym.funcoff = addr - global_symbols[i].address; break; } } } return sym; } function readSmallFile(filepath) { var fd = open(filepath, O_RDONLY, 0); if (fd == -1) { return null; } var buffersize = 0x1000; var buffer = malloc(buffersize); lseek(fd, 0, SEEK_SET); var output = ""; while (read(fd, buffer, buffersize) != 0) { output += getStr(buffer); } close(fd); return output; } function getAllModules() { // Some modules may hide themselves in 'solist', so we use maps instead var modulelines = readSmallFile("/proc/self/maps").split("\n"); var modules = new Array(); var buffer = malloc(512); for (var i = 0; i < modulelines.length; i++) { putStr(buffer.add(256), modulelines[i]); putU64(buffer.add(0), 0); // begin address putU64(buffer.add(8), 0); // end address putU64(buffer.add(16), 0); // permission putU64(buffer.add(24), 0); // pgoff putU64(buffer.add(32), 0); // major putU64(buffer.add(40), 0); // minor putU64(buffer.add(48), 0); // ino putU64(buffer.add(56), 0); // path sscanf(buffer.add(256), "%lx-%lx %c%c%c%c %llx %x:%x %lu %s", buffer.add(0), buffer.add(8), buffer.add(16), buffer.add(17), buffer.add(18), buffer.add(19), buffer.add(24), buffer.add(32), buffer.add(40), buffer.add(48), buffer.add(56)); var vmmin = getU64(buffer.add(0)); var vmmax = getU64(buffer.add(8)); var path = getStr(buffer.add(56)); if (path[0] != "/") { continue; } // Check exist var exist = false; for (var j = 0; j < modules.length; j++) { if (modules[j].path == path) { if (modules[j].vmmin > vmmin) { modules[j].vmmin = vmmin; } if (modules[j].vmmax < vmmax) { modules[j].vmmax = vmmax; } exist = true; break; } } if (!exist) { var module = new Object(); module.vmmin = vmmin; module.vmmax = vmmax; module.path = path; modules.push(module); } } return modules; } // Export function: get all loaded module info function checkAllModules() { if (modules == null) { modules = getAllModules(); } for (var i = 0; i < modules.length; i++) { console.log("start:" + modules[i].vmmin.toString(16) + " end:" + modules[i].vmmax.toString(16) + " path:" + modules[i].path); } } function getModuleInfo(name) { if (modules == null) { modules = getAllModules(); } for (var i = 0; i < modules.length; i++) { if (modules[i].path.indexOf(name) != -1) { console.log(i + " start:" + modules[i].vmmin.toString(16) + " end:" + modules[i].vmmax.toString(16) + " path:" + modules[i].path); } } } function getElfData(module) { if ("sections" in module) { return true; } var fd = open(module.path, O_RDONLY, 0); if (fd == -1) { return false; } // Read elf header var size_of_Elf32_Ehdr = 52; var off_of_Elf32_Ehdr_phoff = 28; // 4 var off_of_Elf32_Ehdr_shoff = 32; // 4 var off_of_Elf32_Ehdr_phentsize = 42; // 2 var off_of_Elf32_Ehdr_phnum = 44; // 2 var off_of_Elf32_Ehdr_shentsize = 46; // 2 var off_of_Elf32_Ehdr_shnum = 48; // 2 var off_of_Elf32_Ehdr_shstrndx = 50; // 2 var size_of_Elf64_Ehdr = 64; var off_of_Elf64_Ehdr_phoff = 32; // 8 var off_of_Elf64_Ehdr_shoff = 40; // 8 var off_of_Elf64_Ehdr_phentsize = 54; // 2 var off_of_Elf64_Ehdr_phnum = 56; // 2 var off_of_Elf64_Ehdr_shentsize = 58; // 2 var off_of_Elf64_Ehdr_shnum = 60; // 2 var off_of_Elf64_Ehdr_shstrndx = 62; // 2 // Parse Ehdr var ehdr = malloc(64); lseek(fd, 0, SEEK_SET); read(fd, ehdr, 64); var is32bit = getU8(ehdr.add(4)) != 2; // 1:32 2:64 if (is32bit) { var phoff = getU32(ehdr.add(off_of_Elf32_Ehdr_phoff)); var shoff = getU32(ehdr.add(off_of_Elf32_Ehdr_shoff)); var phentsize = getU16(ehdr.add(off_of_Elf32_Ehdr_phentsize)); var phnum = getU16(ehdr.add(off_of_Elf32_Ehdr_phnum)); var shentsize = getU16(ehdr.add(off_of_Elf32_Ehdr_shentsize)); var shnum = getU16(ehdr.add(off_of_Elf32_Ehdr_shnum)); var shstrndx = getU16(ehdr.add(off_of_Elf32_Ehdr_shstrndx)); var off_of_Elf_Shdr_shname = 0; // 4 var off_of_Elf_Shdr_shaddr = 12; // 4 var off_of_Elf_Shdr_shoffset = 16; // 4 var off_of_Elf_Shdr_shsize = 20; // 4 } else { var phoff = getU64(ehdr.add(off_of_Elf64_Ehdr_phoff)); var shoff = getU64(ehdr.add(off_of_Elf64_Ehdr_shoff)); var phentsize = getU16(ehdr.add(off_of_Elf64_Ehdr_phentsize)); var phnum = getU16(ehdr.add(off_of_Elf64_Ehdr_phnum)); var shentsize = getU16(ehdr.add(off_of_Elf64_Ehdr_shentsize)); var shnum = getU16(ehdr.add(off_of_Elf64_Ehdr_shnum)); var shstrndx = getU16(ehdr.add(off_of_Elf64_Ehdr_shstrndx)); var off_of_Elf_Shdr_shname = 0; // 4 var off_of_Elf_Shdr_shaddr = 16; // 8 var off_of_Elf_Shdr_shoffset = 24; // 8 var off_of_Elf_Shdr_shsize = 28; // 8 } // Parse Shdr var shdrs = malloc(shentsize * shnum); lseek(fd, shoff, SEEK_SET); read(fd, shdrs, shentsize * shnum); if (is32bit) { shstr_offset = getU32(shdrs.add(shentsize * shstrndx + off_of_Elf_Shdr_shoffset)); shstr_size = getU32(shdrs.add(shentsize * shstrndx + off_of_Elf_Shdr_shsize)); } else { shstr_offset = getU64(shdrs.add(shentsize * shstrndx + off_of_Elf_Shdr_shoffset)); shstr_size = getU64(shdrs.add(shentsize * shstrndx + off_of_Elf_Shdr_shsize)); } var str_tbl = malloc(shstr_size); lseek(fd, shstr_offset, SEEK_SET); read(fd, str_tbl, shstr_size); var sections = new Array(); for (var i = 0; i < shnum; i++) { if (is32bit) { var shname_off = getU32(shdrs.add(i * shentsize + off_of_Elf_Shdr_shname)); var shname = getStr(str_tbl.add(shname_off)); var shaddr = getU32(shdrs.add(i * shentsize + off_of_Elf_Shdr_shaddr)); var shoffset = getU32(shdrs.add(i * shentsize + off_of_Elf_Shdr_shoffset)); var shsize = getU32(shdrs.add(i * shentsize + off_of_Elf_Shdr_shsize)); } else { var shname_off = getU32(shdrs.add(i * shentsize + off_of_Elf_Shdr_shname)); var shname = getStr(str_tbl.add(shname_off)); var shaddr = getU64(shdrs.add(i * shentsize + off_of_Elf_Shdr_shaddr)); var shoffset = getU64(shdrs.add(i * shentsize + off_of_Elf_Shdr_shoffset)); var shsize = getU64(shdrs.add(i * shentsize + off_of_Elf_Shdr_shsize)); } if (shname == ".text" || shname == ".rodata" || shname == ".got" || shname == ".got.plt") { // Check item var section = new Object(); section.name = shname; section.memaddr = shaddr + module.vmmin; section.memoff = shaddr; section.fileoff = shoffset; section.size = shsize; section.data = malloc(shsize); lseek(fd, shoffset, SEEK_SET); read(fd, section.data, shsize); sections.push(section); } if (shname == ".dynsym" || shname == ".dynstr" || shname == ".rel.dyn" || shname == ".rel.plt") { var section = new Object(); section.size = shsize; section.memaddr = shaddr + module.vmmin; section.memoff = shaddr; section.fileoff = shoffset; module[shname] = section; } } if (Process.pointerSize == 4) { var sym_2_str = []; if ((".dynsym" in module) && (".dynstr" in module)) { for (var i = 0; i < module[".dynsym"].size / 16; i++) { sym_2_str.push(getStr(module[".dynstr"].memaddr + getU32(module[".dynsym"].memaddr + 16 * i))); } } module.sym_2_str = sym_2_str; var relmap = {}; if (".rel.dyn" in module) { var shsize = module[".rel.dyn"].size; var memaddr = module[".rel.dyn"].memaddr; for (var j = 0; j < shsize / 8; j++) { var key = getU32(memaddr + j * 8); var val = getU32(memaddr + j * 8 + 4) >> 8; if (key != 0 && val != 0) { relmap[key] = val; } } } if (".rel.plt" in module) { var shsize = module[".rel.plt"].size; var memaddr = module[".rel.plt"].memaddr; for (var j = 0; j < shsize / 8; j++) { var key = getU32(memaddr + j * 8); var val = getU32(memaddr + j * 8 + 4) >> 8; if (key != 0 && val != 0) { relmap[key] = val; } } } module.dyn_2_name = relmap; } module.sections = sections; return true; } function compareMemory(module, mask) { for (var i = 0; i < module.sections.length; i++) { section = module.sections[i]; if (section.name == ".rodata" && (mask & 1) != 0) { // Compare directly console.log("check .rodata"); var filedata = new Uint8Array(getByteArr(section.data, section.size)); var memdata = new Uint8Array(getByteArr(ptr(section.memaddr), section.size)); for (var j = 0; j < section.size; j++) { if (filedata[j] != memdata[j]) { console.log(".rodata\taddr:" + (section.memaddr + j).toString(16) + " file-mem:" + filedata[j].toString(16) + "-" + memdata[j].toString(16)); } } } else if (section.name == ".text" && (mask & 2) != 0) { // Compare and get symbol console.log("check .text"); var filedata = new Uint8Array(getByteArr(section.data, section.size)); var memdata = new Uint8Array(getByteArr(ptr(section.memaddr), section.size)); for (var j = 0; j < section.size; j++) { if (filedata[j] != memdata[j]) { sym = getSymbol(section.memaddr + j); console.log(".text\taddr:" + sym.funcname + "+" + sym.funcoff.toString(16) + " file-mem:" + filedata[j].toString(16) + "-" + memdata[j].toString(16)); if ((memdata[j] == 0x01 && memdata[j + 1] == 0x00 && memdata[j + 2] == 0x9f && memdata[j + 3] == 0xef) || (memdata[j] == 0xf0 && memdata[j + 1] == 0x01 && memdata[j + 2] == 0xf0 && memdata[j + 3] == 0xe7) || (memdata[j] == 0x01 && memdata[j + 1] == 0xde) || (memdata[j] == 0xf0 && memdata[j + 1] == 0xf7 && memdata[j + 2] == 0x00 && memdata[j + 3] == 0xa0) || (memdata[j] == 0x0d && memdata[j + 1] == 0x00 && memdata[j + 2] == 0x05 && memdata[j + 3] == 0x00) || (memdata[j] == 0x00 && memdata[j + 1] == 0x00 && memdata[j + 2] == 0x20 && memdata[j + 3] == 0xd4) || memdata[j] == 0xcc) { console.log("software breakpoint detected!!!"); j = j + 4; } else { console.log("may be hook"); } } } } else if (section.name == ".got" && (mask & 4) != 0) { console.log("check .got"); if (Process.pointerSize == 4) { var filedata = new Uint32Array(getByteArr(section.data, section.size)); var memdata = new Uint32Array(getByteArr(ptr(section.memaddr), section.size)); for (var j = 0; j < section.size / 4; j++) { var F = filedata[j]; var M = memdata[j]; if (F + module.vmmin != M && F != M) { var msym = getSymbol(M); var fsym = module.sym_2_str[module.dyn_2_name[section.memoff + j * 4]]; if (msym.funcname != fsym) { console.log(".got " + j + "/" + section.size / 4 + "\taddr:" + (section.memaddr + j * 4).toString(16) + " file-mem:" + F.toString(16) + "-" + M.toString(16) + " " + fsym + "->" + msym.libname + "." + msym.funcname + "+" + msym.funcoff); } } } } else { var filedata = new Uint32Array(getByteArr(section.data, section.size)); var memdata = new Uint32Array(getByteArr(ptr(section.memaddr), section.size)); for (var j = 0; j < section.size / 8; j++) { var F = filedata[j * 2] * 0x100000000 + filedata[j * 2 + 1]; var M = memdata[j * 2] * 0x100000000 + memdata[j * 2 + 1]; if (F + module.vmmin != M && F != M) { var msym = getSymbol(M); var fsym = module.sym_2_str[module.dyn_2_name[section.memoff + j * 4]]; if (msym.funcname != fsym) { console.log(".got " + j + "/" + section.size / 8 + "\taddr:" + (section.memaddr + j * 8).toString(16) + " file-mem:" + F.toString(16) + "-" + M.toString(16) + " " + fsym + "->" + msym.libname + "." + msym.funcname + "+" + msym.funcoff); } } } } } else if (section.name == ".got.plt" && (mask & 8) != 0) { console.log("check .got.plt"); if (Process.pointerSize == 4) { var filedata = new Uint32Array(getByteArr(section.data, section.size)); var memdata = new Uint32Array(getByteArr(ptr(section.memaddr), section.size)); for (var j = 3; j < section.size / 4; j++) { // First 3 is special var F = filedata[j]; var M = memdata[j]; if (F + module.vmmin != M && F != M) { var msym = getSymbol(M); var fsym = module.sym_2_str[module.dyn_2_name[section.memoff + j * 4]]; if (msym.funcname != fsym) { console.log(".got.plt " + j + "/" + section.size / 4 + "\taddr:" + (section.memaddr + j * 4).toString(16) + " file-mem:" + F.toString(16) + "-" + M.toString(16) + " " + fsym + "->" + msym.libname + "." + msym.funcname + "+" + msym.funcoff); } } } } else { var filedata = new Uint32Array(getByteArr(section.data, section.size)); var memdata = new Uint32Array(getByteArr(ptr(section.memaddr), section.size)); for (var j = 0; j < section.size / 8; j++) { var F = filedata[j * 2] * 0x100000000 + filedata[j * 2 + 1]; var M = memdata[j * 2] * 0x100000000 + memdata[j * 2 + 1]; if (F + module.vmmin != M && F != M) { var msym = getSymbol(M); var fsym = module.sym_2_str[module.dyn_2_name[section.memoff + j * 4]]; if (msym.funcname != fsym) { console.log(".got " + j + "/" + section.size / 8 + "\taddr:" + (section.memaddr + j * 8).toString(16) + " file-mem:" + F.toString(16) + "-" + M.toString(16) + " " + fsym + "->" + msym.libname + "." + msym.funcname + "+" + msym.funcoff); } } } } } } } // Export function: check all loaded module consistence with file /** nfilter : null for all modules, "libc.so" for libc.so mask : 0x1 for .rodata, 0x2 for .text, 0x4 for .got, 0x8 for .plt.got */ var global_symbols = new Array(); var modules = null; function checkConsistency(nfilter, mask) { if (modules == null) { modules = getAllModules(); } if (global_symbols.length == 0) { for (var i = 0; i < modules.length; i++) { // modules address/name/type var tp = modules[i].path.split("/"); var path = tp[tp.length - 1]; var modsym = Module.enumerateExportsSync(path); var modbase = new Object(); modbase.address = modules[i].vmmin; modbase.name = "unknown"; modbase.type = "modbase"; modsym.push(modbase); modsym.sort(function(v1, v2) { return v1.address - v2.address; }); for (var j = 0; j < modsym.length; j++) { modsym[j].path = path; } global_symbols = global_symbols.concat(modsym); } } for (var i = 0; i < modules.length; i++) { if (nfilter == null || modules[i].path.indexOf(nfilter) != -1) { if (getElfData(modules[i])) { compareMemory(modules[i], mask); } } } } function dumpModule(name) { if (modules == null) { modules = getAllModules(); } var modindx = -1; for (var i = 0; i < modules.length; i++) { if (modules[i].path.indexOf(name) != -1) { // Get file name modindx = i; break; } } if (modindx != -1) { var filepath = modules[modindx].path; var tp = filepath.split("/"); var filename = tp[tp.length - 1]; var textindx = -1; var sections = null; if (getElfData(modules[modindx])) { // Recover .text section sections = modules[modindx].sections; for (var j = 0; j < sections.length; j++) { if (sections[j].name == ".text") { textindx = j; break; } } } var newpath = "/sdcard/" + filename; getCommandOutput("cp " + filepath + " " + newpath); var fmodule = open(newpath, O_WRONLY, 0); if (textindx != -1 && fmodule != -1) { console.log("write " + newpath + " file->mem " + sections[textindx].fileoff.toString(16) + "->" + sections[textindx].memaddr.toString(16) + " size:" + sections[textindx].size.toString(16)); lseek(fmodule, sections[textindx].fileoff, SEEK_SET); write(fmodule, ptr(sections[textindx].memaddr), sections[textindx].size); close(fmodule); } } }

Project: find android hook