jstring __fastcall Java_com_yxcorp_gifshow_util_CPU_getClock(JNIEnv *env, jobject thiz, jobject arg1, jbyteArray arg2, jint arg3)
{
  char **v5; // r6
  jbyteArray v6; // r5
  jobject v7; // r4
  char *v8; // r8
  char *v10; // r4
  int v11; // r9
  int v12; // r10
  const char *v13; // r4
  signed int v14; // r4
  signed int v15; // r9
  int v16; // [sp+0h] [bp-C0h]
  char *v17; // [sp+4h] [bp-BCh]
  char v18; // [sp+10h] [bp-B0h]
  unsigned __int8 v19; // [sp+68h] [bp-58h]
  unsigned __int8 v20; // [sp+69h] [bp-57h]
  unsigned __int8 v21; // [sp+6Ah] [bp-56h]
  unsigned __int8 v22; // [sp+6Bh] [bp-55h]
  unsigned __int8 v23; // [sp+6Ch] [bp-54h]
  unsigned __int8 v24; // [sp+6Dh] [bp-53h]
  unsigned __int8 v25; // [sp+6Eh] [bp-52h]
  unsigned __int8 v26; // [sp+6Fh] [bp-51h]
  unsigned __int8 v27; // [sp+70h] [bp-50h]
  unsigned __int8 v28; // [sp+71h] [bp-4Fh]
  unsigned __int8 v29; // [sp+72h] [bp-4Eh]
  unsigned __int8 v30; // [sp+73h] [bp-4Dh]
  unsigned __int8 v31; // [sp+74h] [bp-4Ch]
  unsigned __int8 v32; // [sp+75h] [bp-4Bh]
  unsigned __int8 v33; // [sp+76h] [bp-4Ah]
  unsigned __int8 v34; // [sp+77h] [bp-49h]
  char s; // [sp+78h] [bp-48h]
  __int16 v36; // [sp+7Ah] [bp-46h]
  int v37; // [sp+7Ch] [bp-44h]
  int v38; // [sp+80h] [bp-40h]
  int v39; // [sp+84h] [bp-3Ch]
  int v40; // [sp+88h] [bp-38h]
  int v41; // [sp+8Ch] [bp-34h]
  int v42; // [sp+90h] [bp-30h]
  int v43; // [sp+94h] [bp-2Ch]

  v5 = (char **)env;
  v6 = arg2;
  v7 = arg1;
  if ( !arg2 )
    return 0;
  if ( !dword_5078 )
  {
    v8 = (char *)sub_9D0(&unk_3844, 32);
    dword_5074 = sub_CA8(v5, (int)v7, v8);
    free(v8);
    dword_5078 = 1;
  }
  if ( dword_5074 )
    return 0;
  v10 = *v5;
  v11 = (*((int (__fastcall **)(char **, jbyteArray, _DWORD))*v5 + 184))(v5, v6, 0);
  v17 = v10;
  v12 = (*((int (__fastcall **)(char **, jbyteArray))v10 + 171))(v5, v6);
  v13 = (const char *)dword_5070;
  if ( !dword_5070 )
  {
    v13 = (const char *)sub_9D0(&unk_3834, 16);
    dword_5070 = (int)v13;
  }
  _aeabi_memclr8(&s, 33);
  v14 = strlen(v13);
  sub_158C(&v18);
  v16 = v11;
  sub_15BC(&v18, v11, v12);
  if ( v14 >= 1 )
  {
    v15 = 0;
    do
    {
      sprintf(&s, "%c%c", *(unsigned __int8 *)(dword_5070 + v15), *(unsigned __int8 *)(dword_5070 + v15 + 1), v16);
      sub_15BC(&v18, &s, 2);
      v15 += 2;
    }
    while ( v15 < v14 );
  }
  sub_164C(&v18);
  sprintf(&s, "%02x", v19);
  sprintf((char *)&v36, "%02x", v20);
  sprintf((char *)&v37, "%02x", v21);
  sprintf((char *)((unsigned int)&s | 6), "%02x", v22);
  sprintf((char *)&v38, "%02x", v23);
  sprintf((char *)&v38 + 2, "%02x", v24);
  sprintf((char *)&v39, "%02x", v25);
  sprintf((char *)&v39 + 2, "%02x", v26);
  sprintf((char *)&v40, "%02x", v27);
  sprintf((char *)&v40 + 2, "%02x", v28);
  sprintf((char *)&v41, "%02x", v29);
  sprintf((char *)&v41 + 2, "%02x", v30);
  sprintf((char *)&v42, "%02x", v31);
  sprintf((char *)&v42 + 2, "%02x", v32);
  sprintf((char *)&v43, "%02x", v33);
  sprintf((char *)&v43 + 2, "%02x", v34);
  (*((void (__fastcall **)(char **, jbyteArray, int, signed int))v17 + 192))(v5, v6, v16, 2);
  return (jstring)(*((int (__fastcall **)(char **, char *))v17 + 167))(v5, &s);
}

我想hook sub_9d0这个函数查看输入和输出，hook代码如下，地址也是使用getClock绝对地址-相对地址+9d0 然后运行代码之后没有函数的任何输入和输出，请问是地址原因还是其实原因导致没有输入和输出呢。。。

hook_native_get_clock = '''
Java.perform(function () {
    send('native_hook')
    var nativePointer = Module.getExportByName('libcore.so','Java_com_yxcorp_gifshow_util_CPU_getClock');
    var basePointer = nativePointer.sub(0x1240);
    send('nativePointer:'+nativePointer);
    send('basePointer:'+basePointer);
    var sub_9D0 = basePointer.add(0x9D0);
    Interceptor.attach(sub_9D0,{
        onEnter:function(args){
            send('so hook success!');
            send('args[0]: '+ args[0]);
            send('args[1]: '+ args[1]);
        },
        onLeave:function(res){
            send('res: ' + res);
        }
    });
});
'''

对了 补充一点：是Interceptor.attach下之后就没有任何输入输出了，然后地址应该也是没问题的,因为我试了+1或者不+1不管从导入函数还是so基地取获得地址其实都一样，我想知道是否还有其他原因。。。函数也是调用了的，因为hook导出函getClock数没问题

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课