2

im doing some practice stuff about hooking android native lib. I wrote this script:

 function processJniOnLoad(libraryName) {
    const funcSym = "Java_com_mobisec_gonative_FlagChecker_helloFromTheOtherSide";
    const funcPtr = Module.findExportByName(libraryName, funcSym);

    const membase = Module.findBaseAddress(libraryName);
    console.log("Base address is " + membase);
    
    console.log("[+] Hooking " + funcSym + "() @ " + funcPtr + "...");

    Module.enumerateExports(libraryName, { onMatch: function(e) { console.log("type " + e.type + " name of function = " + e.name + " " + e.address); }, onComplete: function() { } });
}

function waitForLibLoading(libraryName) {
    console.log("loaded !!");
    var isLibLoaded = false;

    Interceptor.attach(Module.findExportByName(null, "open"), {
        onEnter: function (args) {
            var libraryPath = Memory.readCString(args[0]);
            console.log(libraryPath);
            if (libraryPath.includes(libraryName)) {
                console.log("[+] Loading library " + libraryPath + "...");
                isLibLoaded = true;
            }
        },
        onLeave: function (args) {
            if (isLibLoaded) {
                processJniOnLoad(libraryName);
                isLibLoaded = false;
            }
        }
    });
}
waitForLibLoading("libnative-lib.so");

But it cant work (base address is null,...), here is the result:

loaded !!
/proc/self/cmdline
/data/app/com.mobisec.gonative-U8SZLMGh96sgK6qTGxmRqQ==/base.apk
/data/app/com.mobisec.gonative-U8SZLMGh96sgK6qTGxmRqQ==/lib/x86/libnative-lib.so
[+] Loading library /data/app/com.mobisec.gonative-U8SZLMGh96sgK6qTGxmRqQ==/lib/x86/libnative-lib.so...
Base address is null
[+] Hooking Java_com_mobisec_gonative_FlagChecker_helloFromTheOtherSide() @ null...

But when i do that manually by typing all the command, its work:

[Google Pixel::com.mobisec.gonative]-> const membase = Module.findBaseAddress("libnative-lib.so");
[Google Pixel::com.mobisec.gonative]-> console.log("Base address is " + membase);
Base address is 0xc935a000
[Google Pixel::com.mobisec.gonative]-> Module.findExportByName("libnative-lib.so","Java_com_mobisec_gonative_FlagChecke r_helloFromTheOtherSide")
"0xc935a630"
[Google Pixel::com.mobisec.gonative]->

So Why does my script failed ??

4
  • 1
    Please do not add console output as screen-shot. Instead please edit your question and add the console output as preformatted/code.
    – Robert
    May 11 at 12:53
  • If I remember correctly open just opens the file as a file stream, therefore in onLeave the library is accessible via it's file-handle but not yet fully loaded in a way that it's loaded and binded. Is it possible that you have mixed up the function open and dlopen?
    – Robert
    May 11 at 13:57
  • @Robert I tried dlopen but still cant.
    – Brian MJ
    May 12 at 2:27
  • I would try to enumerate the modules just to make sure the loaded library has not a different internal name: github.com/poxyran/misc/blob/master/frida-enumerate-modules.py
    – Robert
    May 12 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.