Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

jeb2frida Uses Function Alias Instead of Native Function Name #1

Closed
H0r53 opened this issue Mar 23, 2022 · 2 comments
Closed

jeb2frida Uses Function Alias Instead of Native Function Name #1

H0r53 opened this issue Mar 23, 2022 · 2 comments

Comments

@H0r53
Copy link

H0r53 commented Mar 23, 2022

If I rename a function or class in JEB and use the jeb2frida script to generate a Frida hook, the alias I used when renaming the function/class is included in the jeb2frida output instead of the actual class/function name in the APK. Clearly, the Frida runtime will be unable to hook routines that I've renamed with JEB since the app runtime uses the native names. This also occurs with obfuscated code using unicode function/class names outside of the printable range of characters.

Example, JEB tells me a function is defined as this when I hover my cursor over it

Class: class:Lum/\u1ADC\u1ADD;
  Method: method:um.\u1ADC\u1ADD.\u1ADD

However, JEB auto generated names for this class for me (otherwise the names where []). When I use the jeb2frida script I received this:

Java.perform(function() {
  var jeb2frida_class_MTH50910 = Java.use('um.CLS711');
  var jeb2frida_method_MTH50910 = jeb2frida_class_MTH50910.MTH50910;
  jeb2frida_method_MTH50910.implementation = function() {
    console.log('[MTH50910] Hooking um.CLS711.MTH50910(  ):);
    var ret = this.MTH50910();
    console.log('[MTH50910] returns '+ret);
    return ret;
  };
});

In this particular case, I think I needed

Java.perform(function() {
  var jeb2frida_class_MTH50910 = Java.use('um/\u1ADC\u1ADD');
  var jeb2frida_method_MTH50910 = jeb2frida_class_MTH50910['\u1ADD'];
  jeb2frida_method_MTH50910.implementation = function() {
    var ret = this['\u1ADD']();
    return ret;
  };
});

This is reproducible by simply renaming a function in JEB and using the jeb2frida script on that function. The produced code uses the new function name instead of the natural one (which is required for Frida to successfully hook it).

Can the jeb2frida script be updated to use the native names of functions/classes?

@cryptax
Copy link
Owner

cryptax commented Mar 28, 2022

Ah yes, this is a bug indeed. I need to fix it.

@cryptax
Copy link
Owner

cryptax commented Apr 12, 2024

You should be using GenerateFridaSnippetForDex.py from https://github.com/pnfsoftware/jeb-samplecode/blob/master/scripts/GenerateFridaSnippetForDex.py. However, there is a small error in that one too. Be sure to apply patch pnfsoftware/jeb-samplecode#7

@cryptax cryptax closed this as completed Apr 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants