1

I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported functions, tried possibilities but still no luck, for example; this stack overflow question though it looks like my problem and still get not applicable the solution mentioned there.

previously I loaded the lib into ghidra and auto analyzed it and then used this python script, just to get frida hooks on functions interested. what this script does is that it gets all functions in the lib and then generates frida hook script for them, may be technically some fallacies, didn't investigate it. btw the plugin outputs the function interested hook:

//Hook function setAuthUser @ 0x8e427c
Interceptor.attach(Module.findBaseAddress("librhodes.so").add(ptr(0x7e427c)), {
  onEnter: function (args) {
    console.log("=> setAuthUser(" + args[0] + ")")
  },
  onLeave: function (result) {
    console.log("setAuthUser() => " + result)
  },
})

when I ran this script with the apk attached with frida gadget, I got no results. so apparently the function address is a miss. so what I wanted is that is there in frida a way to get all non-exported functions and their addresses to hook them. because I believe the offsets given by ghidra is not matching to the running apk lib? may be? no idea and I'm beginner to this.

please help this

6
  • The base address of an Android app is random (because of ASLR), so you have to do some math to convert the function address from Ghidra to the hooking address in Frida stackoverflow.com/a/68335254/150978
    – Robert
    Aug 2 at 18:39
  • @Robert, Thank you for putting up with my ignorance. now looks like I am getting a result, when I run the above frida script with slight modification of .add(ptr(0x7e4de8-00100000)) 00100000 is the imageBase I got from ghidra. now the output is: setAuthUser(0xb6319ee0, 0xb6319e9c) the args is hex but then I used Memory.readUtf8String(args[1]) then become setAuthUser(0xb6319ee0, ) the second argument value returned as empty and another run I get this error Error: can't decode byte 0xb6 in position 3 at onEnter (<input>:4) where to from here plz?
    – hanan
    Aug 3 at 9:07
  • Are you sure base is 00100000 and not 0x100000 (hex)? In your question on SO you wrote that the argument type is String&. Memory.readUtf8String only works for char* arguments. I don't know what type is String&. Please re-read my comments on your old Stackoverflow question, I already showed you multiple options to read C++ String arguments.
    – Robert
    Aug 3 at 9:48
  • @Robert, well when I click set Image Base on ghidra I'm getting 00100000 value. so I need to do it as 0x100000 during subtraction? I can confirm that it produces different memory addresses when using the two values 00100000 and 0x100000.
    – hanan
    Aug 3 at 10:22
  • Addresses in Ghidra mostly shown as hexadecimal, base image address is definitely shown in hex, even if it is shown without prefix.
    – Robert
    Aug 3 at 11:32

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.