-
Notifications
You must be signed in to change notification settings - Fork 7
/
Copy pathprintStack.js
50 lines (44 loc) · 1.76 KB
/
printStack.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
function getModuleByAddressSafe(address) {
try {
// 尝试获取模块
var module = Process.getModuleByAddress(address);
// 如果模块存在,返回模块
if (module) {
return module;
} else {
// 如果没有找到模块,返回 null
return null;
}
} catch (e) {
// 捕获异常,返回 null
return null;
}
}
function main() {
var addr = Module.findBaseAddress("libaes.so").add(0x274DC);
Interceptor.attach(addr, {
onEnter: function (args) {
console.log('called from:\n' +
Thread.backtrace(this.context, Backtracer.ACCURATE)
.map((address) => {
const symbol = DebugSymbol.fromAddress(address);
if (symbol && symbol.name) {
// 如果有符号信息,直接显示
return `${address} ${symbol.moduleName}!${symbol.name}+0x${symbol.address.sub(Module.findBaseAddress(symbol.moduleName)).toString(16)}`;
} else {
// 如果没有符号信息,尝试获取模块和偏移信息
const module = getModuleByAddressSafe(address);
if (module) {
const offset = ptr(address).sub(module.base);
return `${address} ${module.name} + 0x${offset.toString(16)}`;
} else {
return `${address} [Unknown]`;
}
}
})
.join('\n') + '\n');
},
onLeave: function (retval) {}
});
}
setImmediate(main);