heibai2006/frida-snippets
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update unity.js

Browse Source
This commit is contained in:
iddoeldor 2018-08-07 03:50:04 +03:00 committed by GitHub
parent 8b27ea4663
commit 5a607ca359
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 77 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
scripts/unity.js
View File

@ -1,3 +1,80 @@
/*
1. Get image by name [call mono_image_loaded]
2. Get class by name [call mono_class_from_name](#http://docs.go-mono.com/?link=api%3amono_class_from_name)
3. Get method in class by name [call mono_class_get_method_from_name](#http://docs.go-mono.com/index.aspx?link=xhtml%3Adeploy%2Fmono-api-class.html)
4. Compile method to get address [call mono_compile_method](#http://docs.go-mono.com/index.aspx?link=xhtml%3Adeploy%2Fmono-api-unsorted.html)
5. Intercept compiled method
*/
function Main() {
var awaitForCondition = function(callback) {
var int = setInterval(function() {
if (Module.findExportByName(null, "mono_get_root_domain")) {
clearInterval(int);
callback();
return;
}
}, 0);
}
function hook() {
Interceptor.attach(Module.findExportByName(null, "mono_assembly_load_from_full"), {
onEnter: function(args) {
this._image = args[0];
this._fname = Memory.readUtf8String(args[1]);
this._status = args[2];
this._refonly = args[3];
console.log('[E]', args[0], Memory.readUtf8String(args[1]));
},
onLeave: function(retval) {
if (this._fname.indexOf("Assembly-CSharp.dll") != -1) {
console.log("mono_class_from_name", Module.findExportByName(null, "mono_class_from_name") );
Interceptor.attach(Module.findExportByName(null, "mono_class_from_name"), {
onEnter: function(args) {
var name_space = Memory.readUtf8String(args[1]).toString();
if (
!name_space.startsWith("System") &&
!name_space.startsWith("Unity") &&
!name_space.startsWith("Facebook") &&
!name_space.startsWith("Google")
) {
console.log('[E2]', args[0], name_space, Memory.readUtf8String(args[2]) );
this._namespace = name_space;
}
else this._namespace = null;
},
onLeave: function(retval) {
if (this._namespace) console.log('[L2]', this._namespace, retval);
}
});
}
}
});
}
awaitForCondition(hook);
}
Java.perform(Main);
// apk/assets/bin/Data/Managed$ for i in *.dll; do echo "[*] $i"; rabin2 -zzz $i | grep -i certificate; done