function
startHook() {
Java.perform(
function
() {
var
baseAddress = Module.getBaseAddress(
"libtestapp.so"
);
console.log(baseAddress);
Interceptor.attach(baseAddress.add(0x808), {
onEnter:
function
(args) {
var
input = args[0].readUtf8String();
console.log(
"Hook Success -> "
, input);
}, onLeave:
function
(retval) { }
});
});
}
function
main() {
var
dlopenAdd = Module.findExportByName(
"libdl.so"
,
"android_dlopen_ext"
);
var
isHooked =
false
;
Interceptor.attach(dlopenAdd, {
onEnter:
function
(args) {
if
(args[0].readCString().indexOf(
"libtestapp.so"
) != -1) {
console.log(
"Loaded dlopen with -> "
+ args[0].readCString());
var
Symbols = Process.getModuleByName(
"linker64"
).enumerateSymbols();
for
(
var
index = 0; index < Symbols.length; index++) {
if
(Symbols[index].name.indexOf(
"__dl__ZN6soinfo17call_constructorsEv"
) != -1) {
console.log(
"callConstructorAdd -> "
, Symbols[index].address);
Interceptor.attach(Symbols[index].address, {
onEnter:
function
(args) {
if
(!isHooked) {
console.log(
"callConstructorAdd Called!"
);
isHooked =
true
;
startHook();
}
}, onLeave:
function
(retval) { }
});
}
}
}
}, onLeave(retVal) {
}
})
}
setImmediate(main);