frida stalker
<pre><code>//对arm64比较友好,arm32的可能崩溃function call_1CFF0(input_str) {
var base_hello_jni = Module.findBaseAddress("libhello-jni.so");
var sub_1CFF0 = new NativeFunction(base_hello_jni.add(0x1CFF0), "int", ["pointer", "int", "pointer"]);
// var input_str = "0123456789abcdef";
var arg0 = Memory.allocUtf8String(input_str);
var arg1 = input_str.length;
var arg2 = Memory.alloc(arg1);
sub_1CFF0(arg0, arg1, arg2);
}
function get_diff_regs(context, pre_regs) {
//pre_regs是调用之前的寄存器
var diff_regs = {};
// console.log(Object.keys(JSON.parse(JSON.stringify(context))));
for (const of Object.entries(JSON.parse(JSON.stringify(context)))) {
if (reg_name != "pc" && pre_regs !== reg_value) {
pre_regs = reg_value;
diff_regs = reg_value;
}
}
return diff_regs;
}
function StalkerTrace() {
var base_hello_jni = Module.findBaseAddress("libhello-jni.so");
var sub_1CFF0 = base_hello_jni.add(0x1CFF0);
console.log(sub_1CFF0);
var module_hello_jni = Process.findModuleByName("libhello-jni.so");
var module_start = module_hello_jni.base;
//模块结束地址= base+size
var module_end = module_hello_jni.base + module_hello_jni.size;
var pre_regs = {}
Interceptor.attach(sub_1CFF0, {
onEnter: function (args) {
this.arg0 = args;
this.arg1 = args;
this.arg2 = args;
//当前线程id
this.tid = Process.getCurrentThreadId();
// 只记录当前线程的指令
Stalker.follow(this.tid, {
events: {
call: false, // CALL instructions: yes please
// Other events:
ret: false, // RET instructions
exec: true, // all instructions: not recommended as it's
// a lot of data
block: false, // block executed: coarse execution trace
compile: false // block compiled: useful for coverage
},
// onCallSummary(summary) {
// // 打印obj的对象
// console.log("onCallSummary:", Object.entries(summary));
// },
// onReceive(events) {
// // console.log(Stalker.parse(events))
// for (const of Object.entries(Stalker.parse(events))) {
// if (value.indexOf("exec") >= 0) {
// var address = value.toString().split(",")
// var addr = address;
// var module = Process.findModuleByAddress(addr);
// if (module) {
// //减去模块的基址，求得相对偏移ptr(addr).sub(module.base)。
// //这里打印了 所有函数执行的地址
// //Instruction.parse打印出当前指令，如果需要看里面的内容就使用transform方法。
// console.log("onReceive:", module.name + "!" + ptr(addr).sub(module.base), Instruction.parse(ptr(addr)));
// }
// }
// }
// },
transform(iterator) {
let instruction = iterator.next();
do {
const startAddress = instruction.address;
const is_module_code = startAddress.compare(module_start) >= 0 &&
startAddress.compare(module_end) === -1;
//在模块起始地址才打印
if (is_module_code) {
// console.log(startAddress, instruction);
//指令执行之后调用，context寄存器上下文
iterator.putCallout(function (context) {
var pc = context.pc; //获取pc寄存器，当前地址
var module = Process.findModuleByAddress(pc);
if (module) {
//如果模块存在
var diff_regs = get_diff_regs(context, pre_regs);
console.log(module.name + "!" + ptr(pc).sub(module.base),
Instruction.parse(ptr(pc)),
JSON.stringify(diff_regs));
}
});
}
iterator.keep();
} while ((instruction = iterator.next()) !== null);
}
});
}, onLeave: function (retval) {
// 结束的时候不记录了，避免其他线程干扰。
Stalker.unfollow(this.tid);
console.log("sub_1CFF0:", hexdump(this.arg0, { length: parseInt(this.arg1) }),
"\r\n", hexdump(this.arg2, { length: parseInt(this.arg1) }))
}
})
}
setImmediate(StalkerTrace);
</code></pre><br><br>
来源：https://www.cnblogs.com/c-x-a/p/17076881.html
頁:
[1]