Skip to content

Instantly share code, notes, and snippets.

View eybisi's full-sized avatar
hooking functions

Ahmet Bilal Can eybisi

hooking functions
View GitHub Profile
eybisi / il2cpp-bridge-frida.js
Created November 19, 2023 14:14
snippets for il2cpp-bridge-frida
for (const field of ItemBase.fields) {
if (field.isStatic) continue;
console.log(`${field} ${} \x1b[32m${item_data.field(}\x1B[0m`);
} catch (error) {
console.log(`${field} \x1b[31m${error}\x1B[0m`);
eybisi / dex.h
Created August 14, 2023 22:35
Dex header file to use in IDA
* Copyright (C) 2008 The Android Open Source Project
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
* Unless required by applicable law or agreed to in writing, software
eybisi /
Last active December 16, 2022 08:36
dga for alien sample
from datetime import datetime
import hashlib
def gen_dga_from_day(day):
int i2 = 5;
int i3 = calendar.get(5);
int i4 = calendar.get(1);
eybisi /
Last active January 2, 2024 23:09
bash script with gum for pulling/installing package
gum style --border normal --border-foreground 55 "Hello, there! Give me the $(gum style --foreground 57 'package name') you would like to install/pull."
package_name=$(gum input --placeholder "Package name")
sleep 0.5; clear
gum style --border normal --border-foreground 128 "Looks like $(gum style --foreground 128 $package_name) is installed."
gum input --placeholder "Press any key to pull apk"
path=$(adb shell pm path $package_name)

CFF definition (Sample : 92ae23580c83642ad0e50f19979b9d2122f28d8b3a9d4b17539ce125ae8d93eb)

cff blocks is equal to number of sparse-switch-payload count

  • first bytecode of function is initialization for cff which sets str
1a00(switch reg) ????(strId) -> const string v0, "xxxx"string@strId 
  • each block dispatcher startswith
eybisi / dex.hexpat
Created April 27, 2022 17:18
dex pattern file for imhex
#pragma pattern_limit 0x20000
struct StringDataItem {
u8 size[[hidden]];
char string[size];
struct StringIdItem {
StringDataItem *stringData : u32;
eybisi / hook_multidex.js
Created February 14, 2022 23:26
hook multi dex variant of android packers
// copy file works reeeealy slow, sorry for that. Instead you can hook file.delete since multidex will remove temp dexes.
function copyFile(destPath,sourcePath){
const File = Java.use('');
from androguard.core.bytecodes import apk
import sys
import logging
a = apk.APK(sys.argv[1])
activities = a.get_activities()
application = a.get_attribute_value("application","name")
import os
from androguard.core.apk import APK
import frida
import time
import sys
frida_script = """
Java.perform(function() {
var f = Java.use("")
var flutter = Module.getBaseAddress("")
// search ssl_client, add offset of found function
onEnter: function (args) {
console.log("ssl verify called")
console.log("retval value",retval.toInt32())