-
-
Notifications
You must be signed in to change notification settings - Fork 111
/
EarlyJava.js
39 lines (38 loc) · 1.43 KB
/
EarlyJava.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
var Duplicate = [];
Module.enumerateExportsSync("libart.so").forEach(function(exp) {
if (exp.name.indexOf("ClassLinker") != -1 && exp.name.indexOf("FindClassE") != -1) {
Interceptor.attach(exp.address, {
onEnter: function(args) {
this.name = Memory.readCString(args[2]);
},
onLeave: function(retval) {
if (Duplicate.indexOf(this.name) >= 0) return;
if (retval.toInt32() !== 0) {
Duplicate.push(this.name);
let MClass = this.name.match(/^L(.*);$/);
if (MClass !== null && MClass.length > 1) {
const clearName = MClass[1].replace(/\//g, ".")
HookClass(clearName);
//console.log(clearName); //Print all loaded class
}
}
}
})
}
})
function HookClass(ClassName) {
if (ClassName.indexOf("com.loaded.class.name.here") >= 0) {
console.log("Hooking : ", ClassName);
try {
Java.perform(function() {
var Cls = Java.use("com.loaded.class");
Cls.a.overload("java.lang.String").implementation = function(str) {
console.warn("Ret : ", str);
return this.a(str);
}
})
} catch (e) {
console.error(e);
}
}
}