Skip to content

Instantly share code, notes, and snippets.

@SeeFlowerX
Created January 17, 2022 03:48
Show Gist options
  • Save SeeFlowerX/c0de9c1b109ebc025f14d68d916ad301 to your computer and use it in GitHub Desktop.
Save SeeFlowerX/c0de9c1b109ebc025f14d68d916ad301 to your computer and use it in GitHub Desktop.
对NativePointer进行分步readPointer,得到的结果会变化

简要说明:

将定义为std::string ArtMethod::PrettyMethod(ArtMethod* m, bool with_signature)的方法

通过NativeFunction绑定,将返回值设为单个pointer,尝试读取对应的string内容

发现对返回的pointer分步读取(即打印readPointer结果)的值会产生变化


伪代码示意

可以正常获取function_name,解构方式

let std_results: NativePointer = PrettyMethod_func(art_method_ptr, 1);
let PrettyMethod_func = new NativeFunction(PrettyMethod_ptr, "pointer", ["pointer", "bool"]);
let [ptr1, ptr2, ptr3] = [std_results.readU64(), std_results.add(Process.pointerSize).readU64(), std_results.add(Process.pointerSize * 2).readU64()]
let std_string_ptr = Memory.alloc(Process.pointerSize * 3);
std_string_ptr.writeU64(ptr1);
std_string_ptr.add(Process.pointerSize * 1).writeU64(ptr2);
std_string_ptr.add(Process.pointerSize * 2).writeU64(ptr3);
let function_name = readStdString(std_string_ptr);

无法正常获取function_name,直接获取方式

let std_results: NativePointer = PrettyMethod_func(art_method_ptr, 1);
let PrettyMethod_func = new NativeFunction(PrettyMethod_ptr, "pointer", ["pointer", "bool"]);
let std_string_ptr = Memory.alloc(Process.pointerSize * 3);
std_string_ptr.writeU64(std_results.readU64());
std_string_ptr.add(Process.pointerSize * 1).writeU64(std_results.add(Process.pointerSize).readU64());
std_string_ptr.add(Process.pointerSize * 2).writeU64(std_results.add(Process.pointerSize * 2).readU64());
let function_name = readStdString(std_string_ptr);

经过测试发现,如果分步对std_results进行了readxx/readPointer的操作,那么其结果会变化

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment