heibai2006/frida-snippets
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

intercept read/pread/readv from file descriptor

Browse Source
This commit is contained in:
iddoeldor 2019-09-02 16:46:58 +03:00 committed by GitHub
parent 0fc76eafb3
commit e151ca90fb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
README.md
View File

@ -266,8 +266,7 @@ var fds = {};
Interceptor.attach(Module.findExportByName(null, 'open'), {
onEnter: function (args) {
var fname = args[0].readCString();
if (fname.endsWith('.jar')) {
console.log('open: ' + fname);
if (fname.endsWith('kdc')) {
this.flag = true;
this.fname = fname;
}
@ -275,18 +274,17 @@ Interceptor.attach(Module.findExportByName(null, 'open'), {
onLeave: function (retval) {
if (this.flag) {
fds[retval] = this.fname;
console.warn(retval);
}
}
});
Interceptor.attach(Module.findExportByName(null, 'read'), {
onEnter: function (args) {
var fd = args[0];
if (fd in fds) {
console.log('read: ' + fds[fd]);
console.warn(Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
['read', 'pread', 'readv'].forEach(fnc => {
Interceptor.attach(Module.findExportByName(null, fnc), {
onEnter: function (args) {
var fd = args[0];
if (fd in fds)
console.log(`${fnc}: ${fds[fd]}\n\t${Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n\t')}`);
}
}
});
});
```