- ๐ Hi, Iโm @cryptax
- ๐ Iโm interested in research on Android or IoT malware
- ๐ฑ I'm the lead organizer of Ph0wn CTF
cryptax / misc-code Goto Github PK
View Code? Open in Web Editor NEWMiscellaneous code
Miscellaneous code
also the script is using r2pipe.open(file) and it would be good if could be executed from inside r2 by doing r2pipe.open() if the r2pipe env is set in r2pipe-1.9.0 you can use the r2pipe.in_r2()
method
[0x00170000]> #!pipe python /tmp/ppSearch.py
/tmp/ppSearch.py:150: SyntaxWarning: invalid escape sequence '\s'
instr_pattern1 = re.compile(f"add\s+(x\d+),\s+x27,\s+{first_target},\s+lsl\s+12")
/tmp/ppSearch.py:150: SyntaxWarning: invalid escape sequence '\s'
instr_pattern1 = re.compile(f"add\s+(x\d+),\s+x27,\s+{first_target},\s+lsl\s+12")
/tmp/ppSearch.py:151: SyntaxWarning: invalid escape sequence '\s'
instr_pattern2 = re.compile(f"ldr\s+(x\d+),\s+\[(x\d+),\s+{second_target}]")
usage: ppSearch.py [-h] binary hex_value
ppSearch.py: error: the following arguments are required: binary, hex_value
[0x00170000]>
If I rename a function or class in JEB and use the jeb2frida script to generate a Frida hook, the alias I used when renaming the function/class is included in the jeb2frida output instead of the actual class/function name in the APK. Clearly, the Frida runtime will be unable to hook routines that I've renamed with JEB since the app runtime uses the native names. This also occurs with obfuscated code using unicode function/class names outside of the printable range of characters.
Example, JEB tells me a function is defined as this when I hover my cursor over it
Class: class:Lum/\u1ADC\u1ADD;
Method: method:um.\u1ADC\u1ADD.\u1ADD
However, JEB auto generated names for this class for me (otherwise the names where []
). When I use the jeb2frida script I received this:
Java.perform(function() {
var jeb2frida_class_MTH50910 = Java.use('um.CLS711');
var jeb2frida_method_MTH50910 = jeb2frida_class_MTH50910.MTH50910;
jeb2frida_method_MTH50910.implementation = function() {
console.log('[MTH50910] Hooking um.CLS711.MTH50910( ):);
var ret = this.MTH50910();
console.log('[MTH50910] returns '+ret);
return ret;
};
});
In this particular case, I think I needed
Java.perform(function() {
var jeb2frida_class_MTH50910 = Java.use('um/\u1ADC\u1ADD');
var jeb2frida_method_MTH50910 = jeb2frida_class_MTH50910['\u1ADD'];
jeb2frida_method_MTH50910.implementation = function() {
var ret = this['\u1ADD']();
return ret;
};
});
This is reproducible by simply renaming a function in JEB and using the jeb2frida script on that function. The produced code uses the new function name instead of the natural one (which is required for Frida to successfully hook it).
Can the jeb2frida script be updated to use the native names of functions/classes?
When i load DartBytes.py in JEB , i get this error
Script execution error: com.pnfsoftware.jeb.client.script.ScriptExecutionException: Traceback (most recent call last):
File "/[REDACTED]/DartBytes.py", line 15, in run
fragment = ctx.getFocusedView().getActiveFragment()
AttributeError: 'NoneType' object has no attribute 'getActiveFragment'
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.