修改函数hook的js去打印参数值
对于之前的需求:frida-trace时,打印其中特定的某个ObjC函数的参数
之前不知道如何解决,后来参考这里,突然想到:
倒是可以借助其所说的,对于frida-trace自动为每个类的函数,所生成的js文件:
- 位置:
__handlers__/{ClassName}/{FunctionName}.js
去修改js代码,加上打印对应的args
的代码,即可打印对应参数值了。
举例
-[AAAccountManager addAccount:]
frida-trace为函数-[AAAccountManager addAccount:]
自动生成的:
- js文件
/Users/crifan/dev/dev_root/iosReverse/AppleStore/AuthKit_akd/dynamicDebug/frida/scripts/__handlers__/AAAccountManager/addAccount_.js
完整js代码
/* * Auto-generated by Frida. Please modify to match the signature of -[AAAccountManager addAccount:]. * This stub is currently auto-generated from manpages when available. * * For full API reference, see: https://frida.re/docs/javascript-api/ */ { /** * Called synchronously when about to call -[AAAccountManager addAccount:]. * * @this {object} - Object allowing you to store state for use in onLeave. * @param {function} log - Call this function with a string to be presented to the user. * @param {array} args - Function arguments represented as an array of NativePointer objects. * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8. * It is also possible to modify arguments by assigning a NativePointer object to an element of this array. * @param {object} state - Object allowing you to keep state across function calls. * Only one JavaScript function will execute at a time, so do not worry about race-conditions. * However, do not use this to store function arguments across onEnter/onLeave, but instead * use "this" which is an object for keeping state local to an invocation. */ onEnter(log, args, state) { log(`-[AAAccountManager addAccount:${args[2]}]`); }, /** * Called synchronously when about to return from -[AAAccountManager addAccount:]. * * See onEnter for details. * * @this {object} - Object allowing you to access state stored in onEnter. * @param {function} log - Call this function with a string to be presented to the user. * @param {NativePointer} retval - Return value represented as a NativePointer object. * @param {object} state - Object allowing you to keep state across function calls. */ onLeave(log, retval, state) { } }
可以拷贝把其中的:
log(`-[AAAccountManager addAccount:${args[2]}]`);
改为:
log(`-[AAAccountManager addAccount:${new ObjC.Object(args[2])}]`);
就可以:打印出ObjC对象的信息了,而不仅仅是:ptr
=NativePointer
的指针的字符串