Skip to content

Instantly share code, notes, and snippets.

@FrankSpierings
Last active January 20, 2024 21:54
Show Gist options
  • Save FrankSpierings/792933493adf6f6769ca1f93a601eef0 to your computer and use it in GitHub Desktop.
Save FrankSpierings/792933493adf6f6769ca1f93a601eef0 to your computer and use it in GitHub Desktop.
Generate Frida hooks based on c header files using pyclibrary
from pyclibrary import CParser
import re
hook_template = '''
(function() {
var name = '__NAME__';
var address = Module.findExportByName(null, name);
if (address != null) {
console.log('[!] Hooking: ' + name + ' @ 0x' + address.toString(16));
try {
Interceptor.attach(address, {
onEnter: function(args) {
this.args = [];
__ENTERARGS__
},
onLeave: function(result) {
__LEAVELOG__
},
});
}
catch (error) {
console.error(error);
}
}
})();
'''
def generate_hooks(header, pattern=None):
output = []
cparser = CParser(header, cache='/tmp/cparser.{0}.cache'.format(header.replace('/', '_')))
functions = cparser.defs['functions']
for function in functions.keys():
if (pattern and re.match(pattern, function, re.IGNORECASE)) or not pattern:
hook = hook_template
hook = hook.replace('__NAME__', function)
declaration = functions[function].declarators[0]
enter_arguments = ' '.join(['this.args.push(args[{0}]);'.format(i) for i in range(len(declaration))])
hook = hook.replace('__ENTERARGS__', enter_arguments)
leave_arguments = " + ', ' + ".join(["'{0}=' + this.args[{1}]".format(declaration[i][0], i) for i in range(len(declaration))])
line = ' + '.join(["name", "'('", leave_arguments, "') = ' + result"])
line = "console.log({0});".format(line)
hook = hook.replace('__LEAVELOG__', line)
output.append(hook)
return output
outputfile = '/tmp/frida-hooks.js'
with open(outputfile, 'w') as f:
for hook in generate_hooks('/usr/include/openssl/ssl.h'):
print(hook)
f.write(hook)
for hook in generate_hooks('/usr/include/openssl/hmac.h'):
print(hook)
f.write(hook)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment