Created
June 2, 2022 13:43
-
-
Save NSEcho/fa1a88f2d10c1ede95aabc0895eb7506 to your computer and use it in GitHub Desktop.
Replace native function with frida
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* | |
1. First we need to obtain the aslr value address. | |
In case we are dealing with the first module we can use something like | |
var base = Process.enumerateModules()[0].base.sub(ptr('0x100000000')); | |
If we want it by the name, we can use var base = Module.findBaseAddress("name").base.sub(ptr('0x100000000')); | |
2. Get the address of the function/method we want to replace | |
3. Replace it using the Interceptor.replace in format | |
Interceptor.replace(addrOfFunction, new NativeCallback(function(param1, param2, paramN) { | |
// do the work | |
}, 'return type', ['paramType1', 'paramType2', 'paramTypeN'])); | |
*/ | |
var base = Process.enumerateModules()[0].base.sub(ptr('0x100000000')); // Module base address | |
var p = base.add(0x00000001000752e0); // Method address inside the hopper | |
Interceptor.replace(p, new NativeCallback(function() { | |
console.log("I am poor void function"); | |
}, 'void', [])); // void is return type, in [] goes func parameters |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment