heibai2006/frida-snippets
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

unpack dex 64bit version

Browse Source
This commit is contained in:
iddoeldor 2019-09-12 13:07:45 +03:00 committed by GitHub
parent dbef1c1a78
commit d2c52a1dbd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
scripts/WIP_unpack_64.js Normal file
View File

@ -0,0 +1,21 @@
var art_DexFile_OpenMemory = Module.findExportByName('libart.so','_ZN3art7DexFile10OpenMemoryEPKhmRKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEjPNS_6MemMapEPKNS_10OatDexFileEPS9_'); // art::DexFile::OpenMemory > 64bit version
console.log(art_DexFile_OpenMemory);
Interceptor.attach(art_DexFile_OpenMemory, {
onEnter: function (_args) {
var begin = this.context.x0;
this.o = {};
this.o.begin = begin;
this.o.magic = Memory.readUtf8String(begin);
var address = parseInt(begin, 16) + 0x20;
var dexSize = Memory.readInt(ptr(address));
this.o.dexSize = dexSize;
var file = new File('/sdcard/unpack/' + dexSize + '.dex', 'wb');
file.write(Memory.readByteArray(begin, dexSize));
file.flush();
file.close();
},
onLeave: function (retval) {
this.o.retval = retval;
console.log(JSON.stringify(this.o, null, 2));
}
});