Skip to content

Instantly share code, notes, and snippets.

@enovella
Forked from oleavr/simpleceptor-arm.ts
Created September 17, 2023 17:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save enovella/4efad2f4bafffe0fc3f9d6dd5e875690 to your computer and use it in GitHub Desktop.
Save enovella/4efad2f4bafffe0fc3f9d6dd5e875690 to your computer and use it in GitHub Desktop.
Simplified Interceptor reimplemented in TypeScript
const THUMB_HOOK_REDIRECT_SIZE = 8;
const THUMB_BIT_REMOVAL_MASK = ptr(1).not();
const trampolines: NativePointer[] = [];
const replacements: NativePointer[] = [];
export function makeTrampoline(target: NativePointer): NativePointer {
const targetAddress = target.and(THUMB_BIT_REMOVAL_MASK);
const trampoline = Memory.alloc(Process.pageSize);
Memory.patchCode(trampoline, 128, code => {
const writer = new ThumbWriter(code, { pc: trampoline });
const relocator = new ThumbRelocator(targetAddress, writer);
let n: number;
do {
n = relocator.readOne();
} while (n < THUMB_HOOK_REDIRECT_SIZE);
relocator.writeAll();
if (!relocator.eoi) {
writer.putLdrRegAddress(ArmRegister.Pc, target.add(n));
}
writer.flush();
});
trampolines.push(trampoline);
return trampoline.or(1);
}
export function replace(target: NativePointer, replacement: NativePointer): void {
const targetAddress = target.and(THUMB_BIT_REMOVAL_MASK);
Memory.patchCode(targetAddress, 128, code => {
const writer = new ThumbWriter(code, { pc: targetAddress });
writer.putLdrRegAddress(ArmRegister.Pc, replacement);
writer.flush();
});
replacements.push(replacement);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment