DLL 동적 IL 덤프
var js_rids_literal_code = {}; var dumped = []; var display_dump_size = 32; var find_target_function = false; var count = 10; var target_dll_addr = 0; var target_dll_size = 0; var target_file_name = NaN; var load_dll_flag = false; var in_jit_compile = false; var code_size = NaN; // void *dlsym(void *restrict handle, const char *restrict name); Interceptor.attach(Module.findExportByName("libc.so", "dlsym"), { onEnter: function(args) { var message = {}; if (find_target_function) { return; } message["function"] = "dlsym"; message["handle"] = args[0]; message["name"] = Memory.readUtf8String(args[1]); var flag = true; if (message["name"].indexOf("mono_image_open_from_data_with_name") == 0) { find_target_function = true;
const dlsym = new NativeFunction(Module.findExportByName(null, 'dlsym'), 'pointer', ['pointer', 'pointer']) var mono_jit_compile_method = dlsym(message["handle"], Memory.allocUtf8String("mono_jit_compile_method_inner")); var mono_method_get_header = dlsym(message["handle"], Memory.allocUtf8String("mono_method_get_header_checked")); console.log("mono_jit_compile_method - " + mono_jit_compile_method); rid = NaN; funcname = NaN; Interceptor.attach(mono_jit_compile_method, { onEnter: function(args) { if (!load_dll_flag) { return; } if (!flag) { return; }
// MonoMethodHeader* mono_jit_compile_method (MonoMethod *method, MonoError *error) // mono_jit_compile_method_inner (MonoMethod *method, MonoDomain *target_domain, int opt, MonoError *error) var method = args[0];
var token = Memory.readPointer(method.add(4), 4); rid = token & 0x00ffffff; if (js_rids_literal_code.hasOwnProperty(rid) != -1) { var funcname_ptr = ptr(Memory.readPointer(method.add(16), 4)); funcname = Memory.readCString(funcname_ptr); if(funcname == js_rids_literal_code[rid]) { in_jit_compile = true; } } return; }, onLeave: function(vvvv) { if (in_jit_compile) { in_jit_compile = false; } }, }); Interceptor.attach(mono_method_get_header, { onEnter: function(args) { }, onLeave: function(vvv) { if(in_jit_compile) { return; var code_size = Memory.readPointer(vvv.add(4), 4).toInt32(); var code = ptr(Memory.readPointer(vvv, 4));
console.log("RID : " + rid); console.log("Function name : " + funcname); console.log("Code size : " + code_size);
var code = ptr(Memory.readPointer(vvv, 4)); // dump here
in_jit_compile = false; } } });
// send(message); } }, onLeave: function(vv) {
} }); |