I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function I am using this hook
const ghidraImageBase = 0x00100000;
const moduleName = "libclient.so";
const moduleBaseAddress = Module.findBaseAddress(moduleName);
const ghidraFunction = 0x0168a7c8;
const functionRealAddress = moduleBaseAddress.add(ghidraFunction - ghidraImageBase);
Interceptor.attach(functionRealAddress, {
onEnter: function(args) {
console.log("function called");
},
onLeave: function(ignored) {}
});
However function called is never logged even though the function is getting called I am pretty sure something is wrong with the addresses so I tried hooking into a exported function using the address I got from ghidra
which is 0x014ccd08
and ghidra image base is equal to 0x00100000
meaning the offset of the function should be 0x014ccd08
- 0x00100000
= 0x013ccd08
however when I run
console.log("moduleBaseAddress:" + Module.findBaseAddress("libclient.so"))
Module.enumerateExports("libclient.so", {
onMatch: function(e) {
if (e.type == 'function') {
if (e.name == "Java_exported_function etc...") {
console.log("Function found");
console.log(JSON.stringify(e))
}
}
},
onComplete: function() {}
});
the above code execution result is
moduleBaseAddress:0xb6900000
Function recognized by name
{"type":"function","name":"Java_exported_function...","address":"0xb755b9e1"}
the .so library is loaded at 0xb6900000
and the function address is at 0xb755b9e1
meaning the function offset is 0xb755b9e1
- 0xb6900000
= 0x00c5b9e1
entirely different from the 0x013ccd08
I found earlier.
- Can this issue be from the ghidra settings?
- How can I get the correct offset from ghidra?