Skip to content

Instantly share code, notes, and snippets.

@SeeFlowerX
Created July 23, 2021 01:30
Show Gist options
  • Save SeeFlowerX/81e0dab07d6b4eafa7271f9f64db0d06 to your computer and use it in GitHub Desktop.
Save SeeFlowerX/81e0dab07d6b4eafa7271f9f64db0d06 to your computer and use it in GitHub Desktop.
针对自定义格式化输出函数的hook,直接打印结果而不关心最后的输出逻辑
let funcs = {};
let sprintf_ptr = Module.findExportByName("libc.so", "sprintf");
Interceptor.attach(base_addr.add(0x58E490), {
onEnter: function (args) {
let fmt = args[1].readUtf8String();
let count = (fmt.split("%%").join("").match(/%/g) || []).length;
if(count == 0) return;
if (!funcs[count]){
funcs[count] = new NativeFunction(sprintf_ptr, 'int', new Array(2 + count).fill("pointer"));
}
let sptr = Memory.alloc(0xffff);
let params = [sptr, args[1]];
for (let i = 0; i < count; i++){params.push(args[i + 2])};
funcs[count].apply(null, params);
console.log(`[CLog] => ${sptr.readUtf8String()}`);
},
onLeave: function (retval) {
}
});
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment