Frida not hook functions

Question

I want to hook a xxtea_decrypt but it not trigger and on other games it trigger but some games not trigger it. On ida pro its trigger the xxtea_decrypt but frida nope here is the code that i using it

var nptr = Module.findExportByName("libcocos2dlua.so", "xxtea_decrypt");
function fn() {
  nptr = Module.findExportByName("libcocos2dlua.so", "xxtea_decrypt");
 // nptr = Module.findExportByName("libcocos2dlua.so", "luaL_loadbuffer");
  if (!nptr) {
    console.log("xxtea_decrypt cannot be found!");
    setTimeout(fn, 900);
  // } else {

  //   // console.log("xxtea_decrypt");

  } else {
    Interceptor.attach(nptr, {
     
    
      onEnter: function(args) {
       
        console.log("----------------BEGIN----------------");
        console.log("Key: ");
        console.log(hexdump(Memory.readByteArray(args[1], 5000),{
         offset: 0,
         length: 500,
         header: true,
         ansi: true
        }));

        console.log("sign:");
        console.log(hexdump(Memory.readByteArray(args[2], 12),{
            offset: 0,
            length: 12,
            header: true,
            ansi: true
        }));
      },
      onLeave: function(retval) {
        // console.log("Decrypt:");
        // console.log(hexdump(Memory.readByteArray(retval, 50),{
        //  offset: 0,
        //  length: 50,
        //  header: true,
        //  ansi: true
        // }));
        // console.log("-----------------END-----------------");   
      }
    })
  }
}
var timeout = setTimeout(fn, 500);

The following screen shot shows the xxtea_decrypt function in IDA:

Answer 1

Your problem is that the name of the function you want to hook is not xxtea_decrypt and because of this you can not hook it:

In your IDA scren shot the function is shown as xxtea_decrypt(uchar *,uint,uchar *,uchar *).

That the function has not only a name but also argument types displayed means it is not a plain C function but instead a C++ function which uses name mangling.

Name mangling encodes the argument types in the function name, which means the function name displayed by IDA is not the real function name, but the demangled function name which is optimized for human readability.

You will see the real function name if you disable name mangling in IDA. You can find the option in the context menu of the function.

Most likely IDA will display the function name without demangling as _Z13xxtea_decryptPhjS_jPj. This is the real function name you have to use for hooking in Frida.

This function name I got from a library of the same name I found on the Internet, and the xxtea_decrypt function seems to have the same argument types as the one in your library, so the function may be the same but you should better check in IDA with disabled name mangling and copy the function name from there.

If you want to hook the xxtea_decrypt function you have to use this hook:

var nptr = Module.findExportByName("libcocos2dlua.so", "_Z13xxtea_decryptPhjS_jPj");