针对自定义格式化输出函数的hook，直接打印结果而不关心最后的输出逻辑

fmt_log.js

let funcs = {};
let sprintf_ptr = Module.findExportByName("libc.so", "sprintf");
Interceptor.attach(base_addr.add(0x58E490), {
    onEnter: function (args) {
        let fmt = args[1].readUtf8String();
        let count = (fmt.split("%%").join("").match(/%/g) || []).length;
        if(count == 0) return;
        if (!funcs[count]){
            funcs[count] = new NativeFunction(sprintf_ptr, 'int', new Array(2 + count).fill("pointer"));
        }
        let sptr = Memory.alloc(0xffff);
        let params = [sptr, args[1]];
        for (let i = 0; i < count; i++){params.push(args[i + 2])};
        funcs[count].apply(null, params);
        console.log(`[CLog] => ${sptr.readUtf8String()}`);
    },
    onLeave: function (retval) {
    }
});