easylinux/cam-reverse
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implement some more functions

Browse Source
This commit is contained in:
DavidVentura
2024-01-18 17:17:16 +01:00
parent a4a0119f97
commit 8d1abd2266
2 changed files with 231 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
asd.js
+48 -100
View File
@@ -1,14 +1,14 @@
import { replaceFunctions } from "./func_replacements.js";
function hook_fn(name_in_elf, enter, leave) {
const hook_fn = (name_in_elf, enter, leave) => {
var symbol_addr = DebugSymbol.fromName(name_in_elf).address;
console.log(`${name_in_elf} addr is: ${symbol_addr}`);
console.log(`${name_in_elf} addr is: ${symbol_addr}, this is ${this}`);
Interceptor.attach(symbol_addr, {
onEnter: enter,
onLeave: leave,
});
console.log(`Hooked ${name_in_elf}`);
}
};
function hook_export_fn(name_in_elf, enter, leave) {
var symbol_addr = Module.findExportByName("libvdp.so", name_in_elf);
@@ -39,58 +39,13 @@ const hook_p2p_read = () => {
);
};
const hook_pack_ClntPkt = () => {
let sym = "pack_ClntPkt";
hook_fn(
sym,
(args) => {
console.log(`onEnter ${sym}`);
/*
* onEnter pack_ClntPkt
2 0x7b5ef9c640
onExit pack_ClntPkt, ret=24
0 1 2 3 4 5 6 7 8 9 A B C D E F
0123456789ABCDEF 00000000 f1 67 00 14 42 41 54 43 00 00 00 00 00 09 4c
fb .g..BATC......L. 00000010 45 58 4c 56 53 00 00 00 EXLVS...
*/
// f1 30 00 00 heartbeat?
// int pack_ClntPkt(int m_type_or_len,ushort *pkt_buf,long
// something_out)
let m_ptype = args[0].toInt32();
// type = 2 == LanSearch, LanSearchExt, ServerReq, Hello, DevQuery
// 2 = P2P?
// let m_buf = args[1].readByteArray(m_ptype); // len??
let m_out = args[2];
this.outBuf = args[2];
this.inBuf = args[1];
var trace = Thread.backtrace(this.context, Backtracer.ACCURATE).map(
DebugSymbol.fromAddress,
);
for (var j in trace) {
console.log(trace[j]);
}
console.log(m_ptype);
},
(retval) => {
console.log(`onExit ${sym}, ret=${retval.toInt32()}`);
console.log("out\n", this.outBuf.readByteArray(retval.toInt32()));
console.log("in\n", this.inBuf.readByteArray(retval.toInt32()));
console.log(
"############################################################",
);
},
);
};
const hook___android_log_print = () => {
const sym = "__android_log_print";
hook_fn(
sym,
(args) => {
// (ushort *param_1,int param_2,undefined4 *param_3,undefined8 param_4
let _prio = args[0].toInt32();
let _tag = args[1].readCString();
// let _prio = args[0].toInt32();
// let _tag = args[1].readCString();
let fmt = args[2].readCString();
// console.log(fmt); // debug if crashes due to missing placeholder
const types = placeholderTypes(fmt); // ['s', 'd', ..]`
@@ -99,6 +54,8 @@ const hook___android_log_print = () => {
s: (x) => x.readCString(),
d: (x) => x.toInt32(),
u: (x) => x.toInt32(),
z: (x) => x.toInt64(),
l: (x) => x.toInt64(),
x: (x) => x.toInt32().toString(16),
f: (x) => x.toFloat(),
};
@@ -110,72 +67,63 @@ const hook___android_log_print = () => {
() => {},
);
};
const hook_pack_P2pId = () => {
var sym = "pack_P2pId";
sym = "pack_P2pHdr";
sym = "Send_Pkt";
hook_fn(
sym,
(args) => {
console.log(`onEnter ${sym}`);
// (ushort *param_1,int param_2,undefined4 *param_3,undefined8 param_4
let m_ptype = args[1].toInt32();
let m_data = args[0].readByteArray(m_ptype); // len??
let m_sock = args[2];
let m_p4 = args[3];
console.log(m_data, m_ptype, m_sock, m_p4);
},
() => {},
);
};
const hook_create_P2pRdy = () => {
var sym = "create_P2pRdy";
const hook_in_out_buf = (sym, insize, outsize) => {
let obj = {};
hook_fn(
sym,
(args) => {
console.log(`onEnter ${sym}`);
// (ushort *param_1,int param_2,undefined4 *param_3,undefined8 param_4
this.out = args[0]; // u16 ptr
let _in = args[1].readByteArray(2);
console.log("in", _in);
console.log(`onEnter ${sym} ${this}`);
obj.outbuf = args[0];
obj.inbuf = args[1];
},
(retval) => {
console.log(`onExit ${sym}, retval ${retval}`);
console.log(this.out.readByteArray(0x18)); // _g_p2prdy_size = 0x14, retruns +4
console.log(`${sym} done, dumping`);
console.log("in");
console.log(obj.inbuf.readByteArray(insize));
console.log("out");
console.log(obj.outbuf.readByteArray(outsize));
console.log("retval", retval);
},
);
};
let indent = 0;
function doHooks() {
var libnative_addr = Module.findBaseAddress("libvdp.so");
function doReplaceFunctions() {
// const prefixes = ["Send_Pkt*", "P2P*", "*RcvTh*", "parse_*"]; // "XQP2P*",
// const prefixes = ["parse_*", "pack_*", "Send_Pkt*", "create_*"];
const prefixes = ["create_*"];
const spam = ["XQP2P_Check_Buffer", "P2P_ChannelBufferCheck"];
const replaced = replaceFunctions();
prefixes
.map((prefix) => DebugSymbol.findFunctionsMatching(prefix))
.flat()
.map(DebugSymbol.fromAddress)
.filter((dbg) => !spam.includes(dbg.name))
.map((dbg) => {
Interceptor.attach(dbg.address, {
onEnter: (args) => {
indent = indent + 1;
let flag = !replaced.includes(dbg.name) ? "[NOT REPLACED] " : "";
console.log(" ".repeat(indent) + flag + dbg.name);
},
onLeave: (retval) => {
indent = indent - 1;
},
});
console.log(`Hooked ${dbg.name}`);
});
}
function doHooks() {
var libnative_addr = Module.findBaseAddress("libvdp.so");
if (libnative_addr) {
hook___android_log_print();
hook_create_P2pRdy;
const replaced = replaceFunctions();
console.log(replaced);
prefixes
.map((prefix) => DebugSymbol.findFunctionsMatching(prefix))
.flat()
.map(DebugSymbol.fromAddress)
.filter((dbg) => !spam.includes(dbg.name))
.map((dbg) => {
Interceptor.attach(dbg.address, {
onEnter: (args) => {
indent = indent + 1;
let flag = replaced.includes(dbg.name) ? "[REPLACED] " : "";
console.log(" ".repeat(indent) + flag + dbg.name);
},
onLeave: (retval) => {
indent = indent - 1;
},
});
console.log(`Hooked ${dbg.name}`);
});
// hook_create_P2pRdy();
// hook_in_out_buf("create_LstReq", 0x1c, 0x1c);
hook_in_out_buf("create_P2pRdy", 0x1c, 0x1c);
doReplaceFunctions();
// hook_p2p_read();
// hook_pack_P2pId();