norsecode-autoscript.js

// tested with frida server 12.10.4 on a rooted device
// click top left getflag button to display flag in frida console

function onLoad(name, callback) {
    var Runtime = Java.use('java.lang.Runtime');
    var System = Java.use('java.lang.System');
    var VMStack = Java.use('dalvik.system.VMStack');
    var VERSION = Java.use('android.os.Build$VERSION');
    System.loadLibrary.overload('java.lang.String').implementation = function(libName) {
        if (VERSION.SDK_INT.value >= 29) {
            Runtime.getRuntime().loadLibrary0(Java.use('sun.reflect.Reflection').getCallerClass(), libName);
        } else if (VERSION.SDK_INT.value >= 24) {
            Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), libName);
        } else {
            Runtime.getRuntime().loadLibrary(libName, VMStack.getCallingClassLoader());
        }
        if(libName === name) {
            callback();
        }
    };
}

NativePointer.prototype.addr = function(m) {
    return this.toInt32() - m.base.toInt32();
};

rpc.exports = {
    init: function(stage, options) {
        Java.perform(function() {
            onLoad('hello-jnicallback', function() {
                var module = Process.findModuleByName('libhello-jnicallback.so');
                var base = module.base;
                Memory.protect(module.base, module.size, 'rwx');

                // disable loop that makes the app crashing
                base.add(0xD1C).writeByteArray([0x16, 0x01, 0x80, 0x52]);

                var MainActivity = Java.use('com.example.hellojnicallback.MainActivity');
                MainActivity.onClickBtn.implementation = function(v) {
                    this.hour.value = 1337;
                    this.onClickBtn(v);
                };

                var inst;
                var i;
                var list = [];
                var v;
                v = {};
                for (i = 0xDC8; i < 0x1188; i += 4) {
                    inst = Instruction.parse(base.add(i));
                    if (inst.mnemonic === 'ldrb') {
                        v.loc = parseInt(inst.opStr.split('#')[1], 16);
                    }
                    if (inst.mnemonic === 'cmp') {
                        v.reg = inst.opStr.split(',')[0];
                        v.val = parseInt(inst.opStr.split('x')[1], 16);
                    }
                    if (inst.mnemonic === 'b.ne') {
                        list.push(v);
                        v = {};
                    }
                }

                Interceptor.attach(base.add(0xDC8), function () {
                    var pArray = this.context.x20;
                    this.context.w8 = this.context.x20;
                    this.context.w9 = this.context.x20.add(10);
                    this.context.w10 = this.context.x20;

                    for (var j = 0; j < list.length; j += 1) {
                        var item = list[j];
                        if (item.loc) {
                            this.context.x20.add(item.loc).writeU8(item.val);
                        } else {
                            this.context[item.reg].writeU8(item.val);
                        }
                    }
                    var encoded = pArray.readCString(81);
                    var dFlag = [];
                    for (i = 0; i < 81; i += 3) {
                        dFlag.push(parseInt('' + encoded[i] + encoded[i + 1] + encoded[i + 2], 10));
                    }
                    var flag = Memory.alloc(28);
                    flag.writeByteArray(new Uint8Array(dFlag));

                    console.log('flag', flag.readCString());
                });
            });
        });
    }
};