Skip to content

Instantly share code, notes, and snippets.

@NSEcho
Created June 2, 2022 13:43
Show Gist options
  • Save NSEcho/fa1a88f2d10c1ede95aabc0895eb7506 to your computer and use it in GitHub Desktop.
Save NSEcho/fa1a88f2d10c1ede95aabc0895eb7506 to your computer and use it in GitHub Desktop.
Replace native function with frida
/*
1. First we need to obtain the aslr value address.
In case we are dealing with the first module we can use something like
var base = Process.enumerateModules()[0].base.sub(ptr('0x100000000'));
If we want it by the name, we can use var base = Module.findBaseAddress("name").base.sub(ptr('0x100000000'));
2. Get the address of the function/method we want to replace
3. Replace it using the Interceptor.replace in format
Interceptor.replace(addrOfFunction, new NativeCallback(function(param1, param2, paramN) {
// do the work
}, 'return type', ['paramType1', 'paramType2', 'paramTypeN']));
*/
var base = Process.enumerateModules()[0].base.sub(ptr('0x100000000')); // Module base address
var p = base.add(0x00000001000752e0); // Method address inside the hopper
Interceptor.replace(p, new NativeCallback(function() {
console.log("I am poor void function");
}, 'void', [])); // void is return type, in [] goes func parameters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment