Frida查找Native函数地址和所属SO模块的方法

1. Frida hook RegisterNatives

动态注册的Native函数, 一般会调用RegisterNatives来注册Native函数。

从libart.so中查找RegisterNatives函数的指针地址, 然后使用 Interceptor.attach 来hook.

function find_RegisterNatives(params) {
    let symbols = Module.enumerateSymbolsSync("libart.so");
    let addrRegisterNatives = null;
    for (let i = 0; i < symbols.length; i++) {
        let symbol = symbols[i];
        
        //_ZN3art3JNI15RegisterNativesEP7_JNIEnvP7_jclassPK15JNINativeMethodi
        if (symbol.name.indexOf("art") >= 0 &&
                symbol.name.indexOf("JNI") >= 0 && 
                symbol.name.indexOf("RegisterNatives") >= 0 && 
                symbol.name.indexOf("CheckJNI") < 0) {
            addrRegisterNatives = symbol.address;
            console.log("RegisterNatives is at ", symbol.address, symbol.name);
            hook_RegisterNatives(addrRegisterNatives)
        }
    }

}

function hook_RegisterNatives(addrRegisterNatives) {

    if (addrRegisterNatives != null) {
        Interceptor.attach(addrRegisterNatives, {
            onEnter: function (args) {
                console.log("[RegisterNatives] method_count:", args[3]);
                let java_class = args[1];
                let class_name = Java.vm.tryGetEnv().getClassName(java_class);
                //console.log(class_name);

                let methods_ptr = ptr(args[2]);

                let method_count = parseInt(args[3]);
                for (let i = 0; i < method_count; i++) {
                    let name_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3));
                    let sig_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize));
                    let fnPtr_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize * 2));

                    let name = Memory.readCString(name_ptr);
                    let sig = Memory.readCString(sig_ptr);
                    let symbol = DebugSymbol.fromAddress(fnPtr_ptr)
                    console.log("[RegisterNatives] java_class:", class_name, "name:", name, "sig:", sig, "fnPtr:", fnPtr_ptr,  " fnOffset:", symbol, " callee:", DebugSymbol.fromAddress(this.returnAddress));
                }
            }
        });
    }
}

setImmediate(find_RegisterNatives);

2. Frida获取指定方法的ArtMethod结构体地址后查找偏移

查看frida源码得知对于某个类的某个函数, 都有一个handle属性(例如android/os/Process::getElapsedCpuTime, 有Java.use("android/os/Process").getElapsedCpuTime.handle), 这个handle属性是通过env->GetStaticMethodID或者env->GetMethodID获取,
在aosp中methodID为ArtMethod结构体指针, ArtMethod结构体中的entry_point_from_jni_属性是方法的入口指针地址, 根据该指针地址可以得到所属SO模块和在SO模块中的偏移.
由于AOSP每个版本的ArtMethod结构体entry_point_from_jni_属性的指针偏移地址可能不同, 因此需要通过计算得到, 思路是查找一个已知Native方法是由哪个SO模块中的某个方法实现的, 然后计算其在SO模块中的偏移。

function getJNICodeOffset() {
    const env = Java.vm.getEnv();
    const process = env.findClass("android/os/Process");
    const getElapsedCpuTime = env.getStaticMethodId(process, "getElapsedCpuTime", "()J");
    env.deleteLocalRef(process);

    const runtimeModule = Process.getModuleByName('libandroid_runtime.so');
    const runtimeStart = runtimeModule.base;
    const runtimeEnd = runtimeStart.add(runtimeModule.size);

    let jniCodeOffset = -1;
    for (let offset = 0; offset !== 64; offset += 4) {
        const field = getElapsedCpuTime.add(offset);
        const address = field.readPointer();
        if (address.compare(runtimeStart) >= 0 && address.compare(runtimeEnd) < 0) {
          jniCodeOffset = offset;
          break;
        }
    }

    return jniCodeOffset;
}

拿到偏移后可得到所属SO模块, 示例代码如下

function getMethodModule(method) {
    const handle = method.handle;
    const jni_code_offset = getJNICodeOffset();
    const entry = ptr(handle).add(jni_code_offset).readPointer();
    const module = Process.findModuleByAddress(entry);
    const offset = entry.sub(module?.base || 0);
    console.log(`module: ${module?.name}, entry: 0x${entry.toString(16)}, offset: 0x${offset.toString(16)}`);
    return [
        module,
        entry,
        offset
    ];
}

Java.perform(() => {
    getMethodModule(Java.use("com.meituan.android.common.mtguard.ShellBridge").main);
});

👀关注公众号：Android老皮！！！欢迎大家来找我探讨交流👀