2

Is it possible to hook a sub_... object in Frida ? I disassembled an arm64 executable, when running the app on my iPhone, I can see a lot of classes also in the disassembled executable, but I can't reach these sub_... objects. If this is possible, I'd like to know how can I edit them to change a certain procedure (in my case b.ne to b.eq), and also if it is possible to hook some loc_... objects.

Thanks for all your answers.

2
  • Such methods don't have a name and thus need to be accessed using their address. You need to check the used base address of the used decompiler (IDA, Ghidra or want else?) Substract that from the shown address in the function name and in Frida at runtime add the base address of the module the function belongs to. That is the address you can hook in Frida. Frida has the capability to patch memory, check Frida API documentation. I assume you have to know the address and the new hex value of the encoded b.eq command.
    – Robert
    Nov 7, 2022 at 22:00
  • 2
    An example for an method address calculation in the app main binary is shown here: reverseengineering.stackexchange.com/a/30881/1848
    – Robert
    Nov 8, 2022 at 8:19

1 Answer 1

1

Update: First, you need the base address of the module where your loc_... or sub_... is. To get it, do:

var adr = Process.findModuleByName("YOURMODULENAME")["base"];

Then, get the offset of your loc_... or sub_.... It is easy since they are named from it, like so: loc_342964. So now, add this offset to the base of your module like so:

var n_adr = adr.add(ptr(0x342964));

You can ensure it is the correct address by displaying the instruction at the place of the address by:

console.log(Instruction.parse(n_adr).toString(););

If it is not a procedure, use:

console.log(Memory.ReadCString(n_adr););

The you can attach it like this:

Interceptor.attach(n_adr, function() {
    console.log(JSON.Stringify(this.context));
});

To edit values, edit directly the this.context object. Ex:

Interceptor.attach(n_adr, function() {
    this.context.w0 = ptr(0x0);
});

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.