逆向工程 - Frida - Dump Hex Value

參考資訊：
https://github.com/frida/frida
https://frida.re/docs/functions/
https://frida.re/docs/installation/

main.c

#include <stdio.h>
#include <unistd.h>
 
static void test(unsigned char *buf)
{
    buf[0] = 0x00;
    buf[1] = 0x11;
    buf[2] = 0x22;
    buf[3] = 0x33;
}
 
int main(int argc, char *argv[])
{
    unsigned char buf[4] = { 0 };

    printf("test()=%p\n", test); 
    usleep(10000000);
    test(buf);
 
    return 0;
}

hook.py

import sys
import frida
 
def on_message(message, data):
    print(message['payload'])
 
session = frida.attach("main")
 
script = session.create_script("""
    Interceptor.attach(ptr("%s"), {
        onEnter: function (args) {
            this.saveArg = args[0]
        },
        onLeave: function (retval) {
            send(hexdump(this.saveArg, {offset:0, length:4}));
        }
    });
""" % int(sys.argv[1], 16))
 
script.on('message', on_message)
script.load()
sys.stdin.read()

編譯、執行

$ gcc main.c -o main
$ ./main&
    test()=0x55cadeb1e149

$ python3 ./hook.py 0x55cadeb1e149
                   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
    7ffdabe5d03c  00 11 22 33                                      .."3