heibai2006/frida-snippets
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

intercept read/pread/readv from file descriptor

Browse Source
This commit is contained in:
iddoeldor 2019-09-02 16:46:58 +03:00 committed by GitHub
parent 0fc76eafb3
commit e151ca90fb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
README.md
View File

@ -266,8 +266,7 @@ var fds = {};
Interceptor.attach(Module.findExportByName(null, 'open'), { Interceptor.attach(Module.findExportByName(null, 'open'), {
onEnter: function (args) { onEnter: function (args) {
var fname = args[0].readCString(); var fname = args[0].readCString();
if (fname.endsWith('.jar')) { if (fname.endsWith('kdc')) {
console.log('open: ' + fname);
this.flag = true; this.flag = true;
this.fname = fname; this.fname = fname;
} }
@ -275,18 +274,17 @@ Interceptor.attach(Module.findExportByName(null, 'open'), {
onLeave: function (retval) { onLeave: function (retval) {
if (this.flag) { if (this.flag) {
fds[retval] = this.fname; fds[retval] = this.fname;
console.warn(retval);
} }
} }
}); });
Interceptor.attach(Module.findExportByName(null, 'read'), { ['read', 'pread', 'readv'].forEach(fnc => {
onEnter: function (args) { Interceptor.attach(Module.findExportByName(null, fnc), {
var fd = args[0]; onEnter: function (args) {
if (fd in fds) { var fd = args[0];
console.log('read: ' + fds[fd]); if (fd in fds)
console.warn(Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n')); console.log(`${fnc}: ${fds[fd]}\n\t${Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n\t')}`);
} }
} });
}); });
``` ```