Repository navigation
Replies: 1 comment
|
Yep, totally doable. It depends a bit on which direction you mean, so here's what I'd try: Native code calling into Java ( jnitrace does exactly this. It's built on Frida and logs every JNI call a pip install jnitrace
jnitrace -l libnative-lib.so com.example.appIt hasn't been updated in a while, so if it breaks on a recent Frida, install an older Java calling native methods Hook every Java.perform(() => {
const Modifier = Java.use('java.lang.reflect.Modifier');
Java.enumerateLoadedClasses({
onMatch(name) {
if (!name.startsWith('com.example.')) return; // keep this narrow, hooking everything is slow
let wrapper;
try { wrapper = Java.use(name); } catch (e) { return; }
wrapper.class.getDeclaredMethods().forEach(m => {
if (!Modifier.isNative(m.getModifiers())) return;
const methodName = m.getName();
wrapper[methodName].overloads.forEach(overload => {
overload.implementation = function (...args) {
const ret = overload.apply(this, args);
console.log(`${name}.${methodName}(${args.join(', ')}) => ${ret}`);
return ret;
};
});
});
},
onComplete() {}
});
});Classes that load later won't be caught, so run it once the app has warmed up or hook Finding where the native code actually lives A lot of apps don't export const art = Process.getModuleByName('libart.so');
const registerNatives = art.enumerateSymbols()
.find(s => s.name.includes('RegisterNatives') && !s.name.includes('CheckJNI'));
Interceptor.attach(registerNatives.address, {
onEnter(args) {
const methods = args[2];
const count = args[3].toInt32();
const ps = Process.pointerSize;
for (let i = 0; i < count; i++) {
const entry = methods.add(i * ps * 3);
const name = entry.readPointer().readCString();
const sig = entry.add(ps).readPointer().readCString();
const fnPtr = entry.add(ps * 2).readPointer();
const mod = Process.findModuleByAddress(fnPtr);
console.log(`${name}${sig} -> ${fnPtr} (${mod ? mod.name : '?'})`);
}
}
});Spawn the app with it ( For what you describe (the .so calling into Java and seeing what comes back), jnitrace is the closest fit. The other two are handy when you also want the Java side, or when the native methods are registered dynamically and you need to find them first. |
Uh oh!
There was an error while loading. Please reload this page.
Hello. I want to capture the shared objects method calls to Java to see what they call and what is returned from those calls to the native methods. I want to do this for all native methods calls all at once. Is this possible to accomplish using frida?
Thank you.
All reactions