SHARE
TWEET

Untitled

a guest Jul 3rd, 2018 70 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. var test = false;
  2. Interceptor.attach(Module.findExportByName("libc.so", "open"), {
  3.     onEnter: function() {
  4.         var what = Memory.readUtf8String(this.context.x0);
  5.         if (what.indexOf("libnative.so") >= 0) {
  6.             test = true;
  7.         }
  8.     },
  9.     onLeave: function(ret) {
  10.         if (test) {
  11.             test = false;
  12.             var symb = Module.enumerateSymbolsSync("linker64");
  13.             var prelink_image = null;
  14.             var baseaddr = null;
  15.  
  16.             for (var sym in symb) {
  17.                 if (symb[sym].name.indexOf("phdr_table_get_dynamic_section") >= 0) {
  18.                     console.log("SYMBOL NAME = " + symb[sym].name)
  19.                     prelink_image = symb[sym].address
  20.                 }
  21.             }
  22.  
  23.             if(prelink_image != null)
  24.             {
  25.                 Interceptor.attach(prelink_image, function() {
  26.                     //console.log(JSON.stringify(this.context))
  27.                     var x2_load_bias = parseInt(this.context.x2.toString(), "16");
  28.                     var _init_offset = 0x15a8
  29.                     var _init = x2_load_bias + _init_offset;
  30.  
  31.                     Interceptor.attach(ptr(_init), {
  32.                         onEnter: function(args){
  33.                             console.log("Calling global constructor")
  34.                         },
  35.                         onLeave: function(retval){
  36.                         }
  37.                     });
  38.                 });
  39.             }
  40.         }            
  41.     }
  42. });
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top