2

I want to hook a xxtea_decrypt but it not trigger and on other games it trigger but some games not trigger it. On ida pro its trigger the xxtea_decrypt but frida nope here is the code that i using it

var nptr = Module.findExportByName("libcocos2dlua.so", "xxtea_decrypt");
function fn() {
  nptr = Module.findExportByName("libcocos2dlua.so", "xxtea_decrypt");
 // nptr = Module.findExportByName("libcocos2dlua.so", "luaL_loadbuffer");
  if (!nptr) {
    console.log("xxtea_decrypt cannot be found!");
    setTimeout(fn, 900);
  // } else {

  //   // console.log("xxtea_decrypt");

  } else {
    Interceptor.attach(nptr, {
     
    
      onEnter: function(args) {
       
        console.log("----------------BEGIN----------------");
        console.log("Key: ");
        console.log(hexdump(Memory.readByteArray(args[1], 5000),{
         offset: 0,
         length: 500,
         header: true,
         ansi: true
        }));

        console.log("sign:");
        console.log(hexdump(Memory.readByteArray(args[2], 12),{
            offset: 0,
            length: 12,
            header: true,
            ansi: true
        }));
      },
      onLeave: function(retval) {
        // console.log("Decrypt:");
        // console.log(hexdump(Memory.readByteArray(retval, 50),{
        //  offset: 0,
        //  length: 50,
        //  header: true,
        //  ansi: true
        // }));
        // console.log("-----------------END-----------------");   
      }
    })
  }
}
var timeout = setTimeout(fn, 500);

The following screen shot shows the xxtea_decrypt function in IDA: enter image description here

7
  • Are you sure the xxtea_decrypt function is exported by libcocos2dlua.so? If not your hook will never be installed and thus never trigger. Frida can also hook non-exported functions but that requires to do some address calculation.
    – Robert
    Mar 30, 2023 at 20:05
  • 1
    its inside but not trigger it do you have a way how to pause the game and resume it? without frida ?
    – xbuyk987
    Mar 30, 2023 at 21:10
  • That the method is inside the library was not the question. My question was if the function you want to hook is in the list of exported functions (check e.g. in iDA). Because if it is not your code can not work.
    – Robert
    Mar 30, 2023 at 21:46
  • Yes its inside ida imgur.com/a/xueQCze
    – xbuyk987
    Mar 30, 2023 at 22:41
  • Again that was not my question. Is the method listed on the Exports tab in IDA? Module.findExportByName requires the method be listed in the Exports section of the binary.
    – Robert
    Mar 31, 2023 at 7:03

1 Answer 1

3

Your problem is that the name of the function you want to hook is not xxtea_decrypt and because of this you can not hook it:

In your IDA scren shot the function is shown as xxtea_decrypt(uchar *,uint,uchar *,uchar *).

That the function has not only a name but also argument types displayed means it is not a plain C function but instead a C++ function which uses name mangling.

Name mangling encodes the argument types in the function name, which means the function name displayed by IDA is not the real function name, but the demangled function name which is optimized for human readability.

You will see the real function name if you disable name mangling in IDA. You can find the option in the context menu of the function.

Most likely IDA will display the function name without demangling as _Z13xxtea_decryptPhjS_jPj. This is the real function name you have to use for hooking in Frida.

This function name I got from a library of the same name I found on the Internet, and the xxtea_decrypt function seems to have the same argument types as the one in your library, so the function may be the same but you should better check in IDA with disabled name mangling and copy the function name from there.

If you want to hook the xxtea_decrypt function you have to use this hook:

var nptr = Module.findExportByName("libcocos2dlua.so", "_Z13xxtea_decryptPhjS_jPj");

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.