function dumpAddr(address, length) {
length = length || 1024;
console.log(hexdump(address, {
offset: 0,
length: length,
header: true,
ansi: true
}));
}
function showStacks() {
Java.perform(function () {
console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
});
}
function hook_dy_so2() {
hook_dy();
var time = 1000;
var base_addr = Module.findBaseAddress("libmetasec_ml.so");
if (base_addr == null) {
setTimeout(hook_dy_so2, time);
} else {
var modLibil2cpp = Process.getModuleByName("libmetasec_ml.so")
console.log("hook_dy_so2 base_addr:", base_addr, modLibil2cpp.base, modLibil2cpp.size.toString(16));
var iSignOffset = 0xXXXXX;
iSignOffset = 0xXXXXX;
iSignOffset = 0xXXXXX;
iSignOffset = 0xXXXXX;
var func_addr = base_addr.add(iSignOffset);
console.log(" hook_dy_so2: my_make_XGorgon be found 2", base_addr.toString(16), func_addr.toString(16))
var src_func = new NativePointer(ptr(func_addr));
Interceptor.attach(src_func, {
onEnter: function (args) {
console.log("args0",args[0].readCString());
console.log("args1", args[1].readCString());
if (args[1] != null) {
console.log("args2", args[2].readCString());
}
},
onLeave: function (retval) {
console.log("return:" + retval, retval.readCString());
}
});
}
}
function hook_dy() {
Java.perform(function () {
if (Java.available) {
var javaString = Java.use('java.lang.String')
var CharSequence = Java.use('java.lang.CharSequence');
var MainActivity = Java.use('android.widget.Toast');
if (MainActivity != null) {
MainActivity.makeText.overload('android.content.Context', 'java.lang.CharSequence', 'int').implementation = function (a, b, c) {
console.log("call Toast makeText: ", b);
showStacks();
var bRet = this.makeText(a, b, c);
return bRet;
}
}
MainActivity = Java.use('J.N');
if (MainActivity != null) {
MainActivity.MnXVOzVo.implementation = function (obj, j, str, i, i2, z, z2, z3, z4, i3, z5, i4) {
console.log("\r\n call nativeCreateRequestAdapter: " + str);
return this.MnXVOzVo(obj,j, str, i, i2, z, z2, z3, z4, i3, z5, i4);
}
}
var bHaveFlag = false;
MainActivity = Java.use('org.chromium.CronetClient');
if (MainActivity != null) {
MainActivity.openConnection.implementation = function (context, str, z, str2, executor) {
console.log("\r\n call openConnection: ", str);
if (!bHaveFlag) {
Java.choose("org.chromium.CronetClient", {
onMatch: function (instance) {
console.log("Found instance: " + instance);
bHaveFlag = true;
},
onComplete: function () { }
});
}
return this.openConnection(context, str, z, str2, executor);
}
}
hookAllOverloads("com.bytedance.common.utility.DigestUtils", "md5Hex");
hookAllOverloads("com.ss.bduploader.BDAuthHelper","setStringValue");
MainActivity = Java.use('com.alipay.sdk.util.f');
if (MainActivity != null) {
MainActivity.LIZIZ.overload('java.lang.String', 'java.lang.String').implementation = function (str1 ,str2) {
console.log("\r\n call com.alipay.sdk.util.f.LIZIZ: ", str1,str2);
return this.LIZIZ(str1,str2);
}
}
MainActivity = Java.use('com.bytedance.retrofit2.mime.DigestUtil');
if (MainActivity != null) {
MainActivity.md5Hex.overload('[B').implementation = function (byteArray) {
var result = this.md5Hex(byteArray);
var result1 = JSON.stringify(byteArray);
var strByte = byteToString(byteArray);
console.log('byteArray,byte src :', result1);
console.log(strByte);
console.log('byteArray,md5str: ', result);
return result;
}
}
MainActivity = Java.use('android.os.Debug');
if (MainActivity != null) {
MainActivity.isDebuggerConnected.implementation = function () {
console.log("call isDebuggerConnected");
showStacks();
var bRet = this.isDebuggerConnected();
console.log("isDebuggerConnected bRet: ", bRet);
return bRet;
}
}
MainActivity = Java.use('android.os.Process');
if (MainActivity != null) {
MainActivity.killProcess.implementation = function (pid) {
console.log("call killProcess");
showStacks();
var bRet = this.killProcess(pid);
return bRet;
}
}
}
});
}
function byteToString(arr) {
if (typeof arr === 'string') {
return arr;
}
var str = '',
_arr = arr;
for (var i = 0; i < _arr.length; i++) {
var one = _arr[i].toString(2),
v = one.match(/^1+?(?=0)/);
if (v && one.length == 8) {
var bytesLength = v[0].length;
var store = _arr[i].toString(2).slice(7 - bytesLength);
for (var st = 1; st < bytesLength; st++) {
store += _arr[st + i].toString(2).slice(2);
}
str += String.fromCharCode(parseInt(store, 2));
i += bytesLength - 1;
} else {
str += String.fromCharCode(_arr[i]);
}
}
return str;
}
function get_func_addr(module, offset) {
var base_addr = Module.findBaseAddress(module);
console.log("base_addr: " + base_addr);
console.log(hexdump(ptr(base_addr), {
length: 16,
header: true,
ansi: true
}))
var func_addr = base_addr.add(offset);
if (Process.arch == 'arm')
return func_addr.add(1);
else
return func_addr;
}
