修改函数hook的js去打印参数值

对于之前的需求:frida-trace时,打印其中特定的某个ObjC函数的参数

之前不知道如何解决,后来参考这里,突然想到:

倒是可以借助其所说的,对于frida-trace自动为每个类的函数,所生成的js文件:

  • 位置:__handlers__/{ClassName}/{FunctionName}.js

去修改js代码,加上打印对应的args的代码,即可打印对应参数值了。

举例

-[AAAccountManager addAccount:]

frida-trace为函数-[AAAccountManager addAccount:]自动生成的:

  • js文件
    • /Users/crifan/dev/dev_root/iosReverse/AppleStore/AuthKit_akd/dynamicDebug/frida/scripts/__handlers__/AAAccountManager/addAccount_.js
      • frida_trace_gen_js
  • 完整js代码

    /*
    * Auto-generated by Frida. Please modify to match the signature of -[AAAccountManager addAccount:].
    * This stub is currently auto-generated from manpages when available.
    *
    * For full API reference, see: https://frida.re/docs/javascript-api/
    */
    
    {
      /**
        * Called synchronously when about to call -[AAAccountManager addAccount:].
      *
      * @this {object} - Object allowing you to store state for use in onLeave.
      * @param {function} log - Call this function with a string to be presented to the user.
      * @param {array} args - Function arguments represented as an array of NativePointer objects.
      * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
      * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
      * @param {object} state - Object allowing you to keep state across function calls.
      * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
      * However, do not use this to store function arguments across onEnter/onLeave, but instead
      * use "this" which is an object for keeping state local to an invocation.
      */
      onEnter(log, args, state) {
        log(`-[AAAccountManager addAccount:${args[2]}]`);
      },
    
      /**
        * Called synchronously when about to return from -[AAAccountManager addAccount:].
      *
      * See onEnter for details.
      *
      * @this {object} - Object allowing you to access state stored in onEnter.
      * @param {function} log - Call this function with a string to be presented to the user.
      * @param {NativePointer} retval - Return value represented as a NativePointer object.
      * @param {object} state - Object allowing you to keep state across function calls.
      */
      onLeave(log, retval, state) {
      }
    }
    

可以拷贝把其中的:

log(`-[AAAccountManager addAccount:${args[2]}]`);

改为:

log(`-[AAAccountManager addAccount:${new ObjC.Object(args[2])}]`);

就可以:打印出ObjC对象的信息了,而不仅仅是:ptr=NativePointer指针的字符串

results matching ""

    No results matching ""