function hook_open() {
/
/
https:
/
/
blog.csdn.net
/
a656343072
/
article
/
details
/
40539889
/
*
函数原型:
int
open
( const char
*
pathname,
int
oflags);
int
open
( const char
*
pathname,
int
oflags, mode_t mode);
mode仅当创建新文件时才使用,用于指定文件的访问权限。
pathname 是待打开
/
创建文件的路径名;
oflags用于指定文件的打开
/
创建模式,这个参数可由以下常量(定义于 fcntl.h)通过逻辑或构成。
O_RDONLY 只读模式
O_WRONLY 只写模式
O_RDWR 读写模式
以上三者是互斥的,即不可以同时使用。
*
/
var open_addr
=
Module.findExportByName(
"libc.so"
,
"open"
)
var io_map
=
Memory.allocUtf8String(
"/proc/13585/maps"
);
Interceptor.attach(open_addr, {
onEnter: function (args) {
console.log(
'targetFunction called from:\n'
+
Thread.backtrace(this.context, Backtracer.ACCURATE)
.
map
(DebugSymbol.fromAddress).join(
'\n'
)
+
'\n'
);
if
(args[
0
].readCString().indexOf(
"/proc/"
)!
=
-
1
&& args[
0
].readCString().indexOf(
"maps"
)!
=
-
1
){
args[
0
]
=
io_map
/
/
ptr(args[
0
]).writePointer(Memory.allocUtf8String(args[
0
].readCString().replaceAll(
/
\d
+
/
g,
"1"
)))
/
/
args[
0
]
=
Memory.allocUtf8String(
"/proc/1/maps"
)
/
/
Memory.protect(ptr(args[
0
]), args[
0
].readCString().length,
'rwx'
);
/
/
var value_new_str
=
Memory.allocUtf8String(
"/proc/1/maps"
)
/
/
console.log(
"args0="
+
args[
0
].readCString())
/
/
ptr(args[
0
]).writeByteArray([
0x2f
,
0x70
,
0x72
,
0x6f
,
0x63
,
0x2f
,
0x32
,
0x2f
,
0x6d
,
0x61
,
0x70
,
0x73
,
0x0
])
/
/
console.log(
"args0="
+
args[
0
].readCString())
}
this.pathname
=
args[
0
]
this.oflags
=
args[
1
]
this.mode
=
args[
2
]
},
onLeave: function (retval) {
console.log(
"retval="
+
retval
+
"---"
+
"pathname="
+
this.pathname.readCString()
+
"---oflags="
+
this.oflags)
if
(this.pathname.readCString().indexOf(
"libmsaoaidsec"
)!
=
-
1
){
/
/
过了惠头条
retval.replace(
0xffffffff
)
}
console.log(
"open pathname="
+
this.pathname.readCString()
+
"---oflags="
+
this.oflags)
if
(this.pathname.readCString().indexOf(
"/proc/"
)!
=
-
1
&& this.pathname.readCString().indexOf(
"maps"
)!
=
-
1
){
retval.replace(
0x0
)
}
}
})
}