diff --git a/frida-hooks.js b/frida-hooks.js index a8a809a..504b8fa 100644 --- a/frida-hooks.js +++ b/frida-hooks.js @@ -4,7 +4,7 @@ import { placeholderTypes, sprintf, u16_swap } from "./utils.js"; const hook_fn = (name_in_elf, enter, leave) => { var symbol_addr = DebugSymbol.fromName(name_in_elf).address; - console.log(`${name_in_elf} addr is: ${symbol_addr}, this is ${this}`); + console.log(`${name_in_elf} addr is: ${symbol_addr}`); Interceptor.attach(symbol_addr, { onEnter: enter, onLeave: leave, @@ -12,6 +12,18 @@ const hook_fn = (name_in_elf, enter, leave) => { console.log(`Hooked ${name_in_elf}`); }; +const global = (name_in_elf) => { + //var symbol_addr = DebugSymbol.fromName(name_in_elf).address; + // Module.enumerateSections("libvdp.so").forEach((s) => console.log(JSON.stringify(s, null, 2))); + // "name": ".bss", + //Module.enumerateSymbols("libvdp.so").forEach((s) => console.log(JSON.stringify(s, null, 2))); + const syms = Module.enumerateSymbols("libvdp.so").filter((s) => s.name == name_in_elf); + var symbol_addr = syms[0].address; + console.log(`global ${name_in_elf} addr is: ${symbol_addr}`); + if (symbol_addr == 0x0 || symbol_addr == null) throw new Error(`can't read ${name_in_elf}`); + return new NativePointer(symbol_addr); +}; + function hook_export_fn(name_in_elf, enter, leave) { var symbol_addr = Module.findExportByName("libvdp.so", name_in_elf); console.log(`${name_in_elf} addr is: ${symbol_addr}`); @@ -119,6 +131,74 @@ const hook___android_log_print = () => { }; const hook_udpsend = () => { + const codeTable = global("codeTable"); + /* + * WanAddrGet +139.155.68.77 +P2PLIB = p2pCommon/XQPPP_Socket.c, line 846, XQ_WanAddrGet:ipv4 cAddr=139.155.68.77 +WanAddrGet +119.45.114.92 +P2PLIB = p2pCommon/XQPPP_Socket.c, line 846, XQ_WanAddrGet:ipv4 cAddr=119.45.114.92 +WanAddrGet +162.62.63.154 +P2PLIB = p2pCommon/XQPPP_Socket.c, line 846, XQ_WanAddrGet:ipv4 cAddr=162.62.63.154 +WanAddrGet +3.132.215.40 +*/ + let x = {}; + hook_fn( + "XQ_WanAddrGet", + (args) => { + console.log("WanAddrGet"); + console.log(args[0].readCString()); + x.ret = args[2]; + }, + (retval) => { + console.log("WanAddrGet RET"); + console.log(x.ret.readCString()); + //console.log("on wanaddrget, ret"); + //console.log(hexdump(codeTable.readByteArray(0x548))); + }, + ); + + let d = {}; + hook_fn( + "XqStrDec", + (args) => { + console.log("XqStrDec param1", args[0].readCString()); + console.log("codetable", codeTable.readCString()); + console.log("codetable hexarr\n", hexdump(codeTable.readByteArray(0x548))); + }, + (retval) => { + console.log("XqStrDec RET"); + console.log(retval.readCString()); + //console.log("on wanaddrget, ret"); + //console.log(hexdump(codeTable.readByteArray(0x548))); + }, + ); + hook_fn( + "XqCodeTableInit", + (args) => { + console.log("on codetableinit, it was"); + console.log(hexdump(codeTable.readByteArray(0x548))); + }, + (retval) => { + console.log("on codetableinit, ret"); + console.log(hexdump(codeTable.readByteArray(0x548))); + }, + ); + hook_fn( + "XQ_InitEncryption", + (args) => { + console.log("on initenc, it was"); + console.log(hexdump(codeTable.readByteArray(0x548))); + }, + (retval) => { + console.log("on initenc, ret"); + console.log(hexdump(codeTable.readByteArray(0x548))); + }, + ); + hook_fn( "XQ_UdpPktSend", (args) => { @@ -177,6 +257,7 @@ const hook_udpsend = () => { }, ); + /* let s = {}; hook_fn( "PktSeq_seqGet", @@ -189,6 +270,7 @@ const hook_udpsend = () => { console.log(data); }, ); + */ /* hook_fn( @@ -294,7 +376,7 @@ function doHooks() { // hook_in_out_buf("create_LstReq", 0x1c, 0x1c); //hook_in_out_buf("create_P2pRdy", 0x1c, 0x1c); hook_udpsend(); - doReplaceFunctions(); + //doReplaceFunctions(); // hook_p2p_read(); // hook_pack_P2pId();