-
-
Save o0xmuhe/98299328206820d2c55a7f44d300cdc0 to your computer and use it in GitHub Desktop.
enable system webview debug and append js flags to system webview, works on Pixel3, enjoy!
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Java.perform(function() { | |
var Webview = Java.use("android.webkit.WebView") | |
Webview.loadUrl.overload("java.lang.String").implementation = function(url) { | |
console.log("[+]Loading URL from", url); | |
this.setWebContentsDebuggingEnabled(true); | |
this.loadUrl.overload("java.lang.String").call(this, url); | |
} | |
}); | |
// var dlopen_addr = Module.findExportByName(null, 'dlopen'); | |
var android_dlopen_ext_addr = Module.findExportByName(null, 'android_dlopen_ext'); | |
if(android_dlopen_ext_addr){ | |
Interceptor.attach(android_dlopen_ext_addr, function (args) { | |
if(args[0].readCString().endsWith('libmonochrome.so')){ | |
console.log("[+]I see you...."); | |
Java.perform(function () { | |
Java.enumerateClassLoaders({ | |
onMatch: function (loader) { | |
try { | |
if(loader.findClass("org.chromium.base.CommandLine")){ | |
console.log("[+]Successfully found loader") | |
console.log(loader); | |
Java.classFactory.loader = loader; | |
let CommandLine = Java.use("org.chromium.base.CommandLine"); | |
CommandLine.nativeInit.implementation = function(...args){ | |
this.nativeInit(...args); | |
this.nativeAppendSwitchWithValue("--js-flags", "--allow-natives-syntax"); | |
} | |
} | |
} | |
catch(error){ | |
console.log("[!]Find error:" + error) | |
} | |
}, | |
onComplete: function () { | |
console.log("[+]onComplete"); | |
} | |
}); | |
}); | |
} | |
}); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment