Hooking function with frida

Question

How can i hook functions with frida? Can someone give me an example please, for something that do that?

Hook at 0x412312 and change the assembly code to "mov eax, 999"

I Arleady tried something like: https://pastebin.com/eGPf5k0R

but it doesn't work for me, thx for helping!

Answer 1

Try using Memory.patchCode to achieve this. Here's a short example.

int test() { return 1024; }

int main(int argc, char **argv) {
    printf("%d\n", test());
    return 0;
}

When compiled this looks like

[0x00400560]> s sym.test
[0x00400656]> pdf
┌ (fcn) sym.test 11
│   sym.test ();
│           ; CALL XREF from main @ 0x400670
│           0x00400656      55             push rbp
│           0x00400657      4889e5         mov rbp, rsp
│           0x0040065a      b800040000     mov eax, 0x400              ; 1024
│           0x0040065f      5d             pop rbp
└           0x00400660      c3             ret
[0x00400656]> s sym.main
[0x00400661]> pdf
┌ (fcn) main 44
│   int main (int argc, char **argv, char **envp);
│           ; var char **var_10h @ rbp-0x10
│           ; var int32_t var_4h @ rbp-0x4
│           ; arg int argc @ rdi
│           ; arg char **argv @ rsi
│           ; DATA XREF from entry0 @ 0x40057d
│           0x00400661      55             push rbp
│           0x00400662      4889e5         mov rbp, rsp
│           0x00400665      4883ec10       sub rsp, 0x10
│           0x00400669      897dfc         mov dword [var_4h], edi     ; argc
│           0x0040066c      488975f0       mov qword [var_10h], rsi    ; argv
│           0x00400670      e8e1ffffff     call sym test()             ; sym.test
│           0x00400675      89c6           mov esi, eax
│           0x00400677      bf24084000     mov edi, 0x400824           ; const char *format
│           0x0040067c      b800000000     mov eax, 0
│           0x00400681      e89afeffff     call sym.imp.printf         ; int printf(const char *format)
│           0x00400686      b800000000     mov eax, 0
│           0x0040068b      c9             leave
└           0x0040068c      c3             ret

At 0x0040065a, the constant 1024(0x400) is copied to eax. When run this looks like

$ ./test
1024

This can be patched at runtime by frida using patchCode

var pc = new NativePointer(0x0040065a)
Memory.patchCode(pc, 5, function (code) {
  var cw = new X86Writer(code, { pc: pc });
  cw.putMovRegU32('eax', 999);
  cw.flush();
});

When run

$ frida -q -l patch_code.js -f ./test --no-pause
Spawned `./test`. Resuming main thread!                                  
999
Process terminated

Another method of hooking a function is to use an Interceptor with onEnter to access args and onLeave to access the return value.

function hook(address) {
    Interceptor.attach(address, {
        onEnter: function (args) {
            console.log(args[0])
        },
        onLeave: function (ret) {
            ret.replace(999)
        }
    })
}