frida_script/test.js at main · thouger/frida_script · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
function hook_dlopen(so_name = null, hook_func = null, so_addr = null) {
   console.log('hook_dlopen');

    // Flag to track if we already hooked the first non-system SO
    var hookedFirstNonSystemSo = false;

    // Function to check if a path belongs to a system library
    function isSystemLibrary(path) {
        return path.startsWith("/system/") ||
               path.startsWith("/apex/") ||
               path.startsWith("/vendor/");
    }

    // Function to check if a path is a shared object file
    function isSharedObject(path) {
        return path.endsWith(".so");
    }

    // Function to execute when first non-system SO is detected
    function onFirstNonSystemSo() {
        if (!hookedFirstNonSystemSo) {
           console.log('Hooking first non-system SO');
            hookedFirstNonSystemSo = true;
            hookStringFunctions();
        }
    }

    // Hook android_dlopen_ext
    var android_dlopen_ext = Module.findExportByName(null, "android_dlopen_ext");
    if (android_dlopen_ext != null) {
        Interceptor.attach(android_dlopen_ext, {
            onEnter: function (args) {
                var soName = args[0].readCString();

                // Check if this is a non-system shared object library
                if (!isSystemLibrary(soName) && isSharedObject(soName) && !hookedFirstNonSystemSo) {
                   console.log('Found first non-system SO in android_dlopen_ext: ' + soName);
                    this.hookNonSystemSo = true;
                }

                // Also check for the specific SO name if provided
                if (so_name && soName.indexOf(so_name) != -1) {
                   console.log('Found specific SO in android_dlopen_ext: ' + soName);
                    this.hookSpecificSo = true;
                }
            },
            onLeave: function (retval) {
                // Hook the first non-system SO
                if (this.hookNonSystemSo) {
                    onFirstNonSystemSo();
                }

                // Also call the custom hook function if a specific SO was requested
                if (this.hookSpecificSo && hook_func) {
                    hook_func(so_addr);
                }
            }
        });
    }

    // Hook dlopen
    var dlopen = Module.findExportByName(null, "dlopen");
    if (dlopen != null) {
        Interceptor.attach(dlopen, {
            onEnter: function (args) {
                var soName = args[0].readCString();

                // Check if this is a non-system shared object library
                if (!isSystemLibrary(soName) && isSharedObject(soName) && !hookedFirstNonSystemSo) {
                   console.log('Found first non-system SO in dlopen: ' + soName);
                    this.hookNonSystemSo = true;
                }

                // Also check for the specific SO name if provided
                if (so_name && soName.indexOf(so_name) != -1) {
                   console.log('Found specific SO in dlopen: ' + soName);
                    this.hookSpecificSo = true;
                }
            },
            onLeave: function (retval) {
                // Hook the first non-system SO
                if (this.hookNonSystemSo) {
                    onFirstNonSystemSo();
                }

                // Also call the custom hook function if a specific SO was requested
                if (this.hookSpecificSo && hook_func) {
                    hook_func(so_addr);
                }
            }
        });
    }
}


hook_dlopen()