Skip to content

Commit 41725bd

Browse files
committed
Improve Frida script syntax
1 parent eae728b commit 41725bd

File tree

1 file changed

+41
-32
lines changed

1 file changed

+41
-32
lines changed

script.js

+41-32
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,46 @@
1+
const LIBXPC_PATH = '/usr/lib/system/libxpc.dylib';
2+
3+
// ObjC classes
4+
const {
5+
NSData,
6+
NSPropertyListSerialization,
7+
NSXPCDecoder,
8+
} = ObjC.classes;
9+
110
// Intercept these functions
2-
var xpc_connection_send_notification = Module.findExportByName(null, "xpc_connection_send_notification");
3-
var xpc_connection_send_message = Module.findExportByName(null, "xpc_connection_send_message");
4-
var xpc_connection_send_message_with_reply = Module.findExportByName(null, "xpc_connection_send_message_with_reply");
5-
var xpc_connection_send_message_with_reply_sync = Module.findExportByName(null, "xpc_connection_send_message_with_reply_sync");
6-
var xpc_connection_create_mach_service = Module.findExportByName(null, "xpc_connection_create_mach_service");
7-
var xpc_connection_set_event_handler = Module.findExportByName(null, "xpc_connection_set_event_handler");
11+
const xpc_connection_send_notification = Module.findExportByName(LIBXPC_PATH, "xpc_connection_send_notification");
12+
const xpc_connection_send_message = Module.findExportByName(LIBXPC_PATH, "xpc_connection_send_message");
13+
const xpc_connection_send_message_with_reply = Module.findExportByName(LIBXPC_PATH, "xpc_connection_send_message_with_reply");
14+
const xpc_connection_send_message_with_reply_sync = Module.findExportByName(LIBXPC_PATH, "xpc_connection_send_message_with_reply_sync");
15+
const xpc_connection_create_mach_service = Module.findExportByName(LIBXPC_PATH, "xpc_connection_create_mach_service");
16+
const xpc_connection_set_event_handler = Module.findExportByName(LIBXPC_PATH, "xpc_connection_set_event_handler");
817

9-
var __CFBinaryPlistCreate15 = DebugSymbol.fromName('__CFBinaryPlistCreate15').address;
10-
var _xpc_connection_call_event_handler = DebugSymbol.fromName("_xpc_connection_call_event_handler").address;
11-
var CFBinaryPlistCreate15 = new NativeFunction(__CFBinaryPlistCreate15, "pointer", ["pointer", "int", "pointer"]);
12-
var xpc_connection_call_event_handler = new NativeFunction(_xpc_connection_call_event_handler, "void", ["pointer", "pointer"]);
18+
const __CFBinaryPlistCreate15 = DebugSymbol.fromName('__CFBinaryPlistCreate15').address;
19+
const _xpc_connection_call_event_handler = DebugSymbol.fromName("_xpc_connection_call_event_handler").address;
20+
const CFBinaryPlistCreate15 = new NativeFunction(__CFBinaryPlistCreate15, "pointer", ["pointer", "int", "pointer"]);
21+
const xpc_connection_call_event_handler = new NativeFunction(_xpc_connection_call_event_handler, "void", ["pointer", "pointer"]);
1322

1423
// Use these functions to make sense out of xpc_object_t and xpc_connection_t
15-
var xpc_connection_get_name = getFunc("xpc_connection_get_name", "pointer", ["pointer"]);
16-
var xpc_get_type = getFunc("xpc_get_type", "pointer", ["pointer"]);
17-
var xpc_type_get_name = getFunc("xpc_type_get_name", "pointer", ["pointer"]);
18-
var xpc_dictionary_get_value = getFunc("xpc_dictionary_get_value", "pointer", ["pointer", "pointer"]);
19-
var xpc_string_get_string_ptr = getFunc("xpc_string_get_string_ptr", "pointer", ["pointer"]);
20-
var xpc_copy_description = getFunc("xpc_copy_description", "pointer", ["pointer"]);
24+
const xpc_connection_get_name = getFunc("xpc_connection_get_name", "pointer", ["pointer"]);
25+
const xpc_get_type = getFunc("xpc_get_type", "pointer", ["pointer"]);
26+
const xpc_type_get_name = getFunc("xpc_type_get_name", "pointer", ["pointer"]);
27+
const xpc_dictionary_get_value = getFunc("xpc_dictionary_get_value", "pointer", ["pointer", "pointer"]);
28+
const xpc_string_get_string_ptr = getFunc("xpc_string_get_string_ptr", "pointer", ["pointer"]);
29+
const xpc_copy_description = getFunc("xpc_copy_description", "pointer", ["pointer"]);
2130

22-
var xpc_uint64_get_value = getFunc("xpc_uint64_get_value", "int", ["pointer"]);
23-
var xpc_int64_get_value = getFunc("xpc_int64_get_value", "int", ["pointer"]);
24-
var xpc_double_get_value = getFunc("xpc_double_get_value", "double", ["pointer"]);
25-
var xpc_bool_get_value = getFunc("xpc_bool_get_value", "bool", ["pointer"]);
26-
var xpc_uuid_get_bytes = getFunc("xpc_uuid_get_bytes", "pointer", ["pointer"]);
31+
const xpc_uint64_get_value = getFunc("xpc_uint64_get_value", "int", ["pointer"]);
32+
const xpc_int64_get_value = getFunc("xpc_int64_get_value", "int", ["pointer"]);
33+
const xpc_double_get_value = getFunc("xpc_double_get_value", "double", ["pointer"]);
34+
const xpc_bool_get_value = getFunc("xpc_bool_get_value", "bool", ["pointer"]);
35+
const xpc_uuid_get_bytes = getFunc("xpc_uuid_get_bytes", "pointer", ["pointer"]);
2736

28-
var xpc_array_get_count = getFunc("xpc_array_get_count", "int", ["pointer"]);
29-
var xpc_array_get_value = getFunc("xpc_array_get_value", "pointer", ["pointer", "int"]);
37+
const xpc_array_get_count = getFunc("xpc_array_get_count", "int", ["pointer"]);
38+
const xpc_array_get_value = getFunc("xpc_array_get_value", "pointer", ["pointer", "int"]);
3039

31-
var xpc_data_get_length = getFunc("xpc_data_get_length", "int", ["pointer"]);
32-
var xpc_data_get_bytes = getFunc("xpc_data_get_bytes", "int", ["pointer", "pointer", "int", "int"]);
40+
const xpc_data_get_length = getFunc("xpc_data_get_length", "int", ["pointer"]);
41+
const xpc_data_get_bytes = getFunc("xpc_data_get_bytes", "int", ["pointer", "pointer", "int", "int"]);
3342

34-
var xpc_connection_get_pid = getFunc("xpc_connection_get_pid", "int", ["pointer"]);
43+
const xpc_connection_get_pid = getFunc("xpc_connection_get_pid", "int", ["pointer"]);
3544

3645
// helper function that will create new NativeFunction
3746
function getFunc(name, ret_type, args) {
@@ -64,7 +73,7 @@ function getXPCString(val) {
6473
function getXPCData(conn, dict, buff, n) {
6574
const hdr = buff.readCString(8);
6675
if (hdr == "bplist15") {
67-
const plist = CFBinaryPlistCreate15(buff, n, ptr("0x0"));
76+
const plist = CFBinaryPlistCreate15(buff, n, NULL);
6877
return ObjC.Object(plist).description().toString();
6978
} else if (hdr == "bplist17") {
7079
if (conn != null) {
@@ -75,11 +84,11 @@ function getXPCData(conn, dict, buff, n) {
7584
} else if (hdr == "bplist00") {
7685
const format = Memory.alloc(8);
7786
format.writeU64(0xaaaaaaaa);
78-
var ObjCData = ObjC.classes.NSData.dataWithBytes_length_(buff, n);
79-
const plist = ObjC.classes.NSPropertyListSerialization.propertyListWithData_options_format_error_(ObjCData, 0, format, ptr(0x0));
87+
var ObjCData = NSData.dataWithBytes_length_(buff, n);
88+
const plist = NSPropertyListSerialization.propertyListWithData_options_format_error_(ObjCData, 0, format, NULL);
8089
return ObjC.Object(plist).description().toString();
8190
} else {
82-
var ObjCData = ObjC.classes.NSData.dataWithBytes_length_(buff, n);
91+
var ObjCData = NSData.dataWithBytes_length_(buff, n);
8392
var base64Encoded = ObjCData.base64EncodedStringWithOptions_(0).toString();
8493
return base64Encoded;
8594
}
@@ -106,7 +115,7 @@ function getKeys(description) {
106115

107116
// https://github.com/nst/iOS-Runtime-Headers/blob/master/Frameworks/Foundation.framework/NSXPCDecoder.h
108117
function parseBPList17(conn, dict) {
109-
var decoder = ObjC.classes.NSXPCDecoder.alloc().init();
118+
var decoder = NSXPCDecoder.alloc().init();
110119
decoder["- set_connection:"](conn);
111120
decoder["- _startReadingFromXPCObject:"](dict);
112121
return decoder.debugDescription().toString();
@@ -169,7 +178,7 @@ var ps = new NativeCallback((fnName, conn, dict) => {
169178
ret["pid"] = xpc_connection_get_pid(conn);
170179
if (conn != null) {
171180
var connName = xpc_connection_get_name(conn);
172-
if (connName != 0x0) {
181+
if (! connName.isNull()) {
173182
ret["connName"] = rcstr(connName);
174183
}
175184
}

0 commit comments

Comments
 (0)