1

I have been recently trying to decrypt .luac files inside an encrypted android app. I tried to follow some of the previous threads here but the following frida script didn't give any output.

Interceptor.attach(Module.findExportByName("libcocos2dlua.so", "xxtea[i]decrypt"), {
    onEnter: function(args) {
        send(Memory.readUtf8String(args[1]));
    },
    onLeave:function(retval){}
});

When I tried to hook lua[/i]load buffer, I got the decrypted lua file contents in response.

Interceptor.attach(Module.findExportByName("libcocos2dlua.so" , "luaL_loadbuffer"), {
    onEnter: function(args) {
        send(Memory.readUtf8String(args[1]));
    },
    onLeave:function(retval){}
});

since there is very less documentation on frida android hooking can someone here help me write a frida script to dump all the decrypted luac files

  • 2
    In the future, please avoid styling your entire question with bold. – NirIzr Dec 1 '17 at 2:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.