0

I have a code like this:

class CURLNetRequest : public CNetRequestBase
{
    DEFINE_LOGCLASS;
    
    struct ProxySettings
    {
        void initFromConfig();
        
        String  host;
        int     port;
        String  username;
        String  password;
    };

    struct AuthSettings
    {
        AuthSettings( AuthMethod m, const String& u, const String& p )
        : method(m)
        , user(u)
        , password(p)
        {}

        const AuthMethod method;
        const String user;
        const String password;
    };
...

I want to hook the structure members i.e. user and password using frida. so far I did like below:

const some_func_pointer = Module.getExportByName('librhodes.so', '_ZN3rho3net14CURLNetRequest10CURLHolder11set_optionsEPKcRKNSt6__ndk
112basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEESD_PNS0_11IRhoSessionEPNS_9HashtableISB_SB_EERKNS1_13ProxySettingsERKNS1_12AuthSettingsE');
const some_func = new NativeFunction(some_func_pointer, "void", ["int", "pointer"]);
Interceptor.replace(some_func_pointer, new NativeCallback(function (size, data) {
  console.log(size)
  console.log(data.readUtf8String())
  some_func(size, data);
}, "void", ["int", "pointer"]));

and I can only get the AuthMethod m which could either be POST or GET in this case. How can I hook others like username and password.

FYI, this is rhomobile built app, and the above snippet taken from the open source code, so apparently decompiling librhodes.so produces some stripped functions, etc.

please help me with this.

9
  • Based on your question which had been posted on SO some days ago you have made no progress at all. At least you should mention what you have tried so far even if it didn't work.
    – Robert
    Aug 1 at 13:31
  • still no progress, may be if you know a way to debug lib.so on apks you could help me with this. any resource any link?
    – hanan
    Aug 1 at 13:51
  • Search Stackoverflow-com and reversengineering.stackexchange.com for the [frida] tag, the number of posts is not very high. In the end you can hook the method using name or address - just what matches your situation: stackoverflow.com/questions/68332781/… I already gave you a lot of hints on stackoverflow, as I don't know what type is used in your case you have to investigate it yourself, look at the dumped memory and check out how to read it.
    – Robert
    Aug 1 at 14:01
  • @Robert, I have decompiled librhodes.so on ghidra and then tried to find the address of the function wanted to hook and then wrote this frida script: //Hook function setAuthUser @ 0x8e427c Interceptor.attach(Module.findBaseAddress('librhodes13.5.1.so').add(ptr(0x7e427c)), { onEnter: function(args) { console.log("=> setAuthUser(" + args[0] + ")"); }, onLeave: function(result) { console.log("setAuthUser() => " + result); } });
    – hanan
    Aug 2 at 10:53
  • @Robert but still no output I got don't know what wrong
    – hanan
    Aug 2 at 10:54

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.