From 26b85c3e4acdf570bdcae8204128a63d5ab60a77 Mon Sep 17 00:00:00 2001 From: iddoeldor Date: Mon, 2 Sep 2019 16:47:58 +0300 Subject: [PATCH] intercept read/pread/readv from file descriptors --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6984328..5ba2e16 100644 --- a/README.md +++ b/README.md @@ -266,7 +266,7 @@ var fds = {}; Interceptor.attach(Module.findExportByName(null, 'open'), { onEnter: function (args) { var fname = args[0].readCString(); - if (fname.endsWith('kdc')) { + if (fname.endsWith('.jar')) { this.flag = true; this.fname = fname; } @@ -282,7 +282,8 @@ Interceptor.attach(Module.findExportByName(null, 'open'), { onEnter: function (args) { var fd = args[0]; if (fd in fds) - console.log(`${fnc}: ${fds[fd]}\n\t${Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n\t')}`); + console.log(`${fnc}: ${fds[fd]} + \t${Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n\t')}`); } }); });