function hook_dlopen(so_name) {
Interceptor.attach(Module.findExportByName(null,
"android_dlopen_ext"
), {
onEnter: function (args) {
var pathptr
=
args[
0
];
if
(pathptr !
=
=
undefined && pathptr !
=
null) {
var path
=
ptr(pathptr).readCString();
/
/
console.log(path)
if
(path.indexOf(so_name) !
=
=
-
1
) {
this.match
=
true
}
}
},
onLeave: function (retval) {
if
(this.match) {
console.log(so_name,
"加载成功"
);
var base
=
Module.findBaseAddress(
"libDexHelper.so"
)
patch_func_nop(base.add(
322008
));
patch_func_nop(base.add(
308756
));
}
}
});
}
function patch_func_nop(addr) {
Memory.patchCode(addr,
8
, function (code) {
code.writeByteArray([
0xE0
,
0x03
,
0x00
,
0xAA
]);
code.writeByteArray([
0xC0
,
0x03
,
0x5F
,
0xD6
]);
console.log(
"patch code at "
+
addr)
});
}
hook_dlopen(
"libDexHelper.so"
)