Skip to content

Instantly share code, notes, and snippets.

@schirrmacher
Last active February 3, 2024 12:32
Show Gist options
  • Save schirrmacher/05ad9f1a0ba428e0cc6aeed46036ccd6 to your computer and use it in GitHub Desktop.
Save schirrmacher/05ad9f1a0ba428e0cc6aeed46036ccd6 to your computer and use it in GitHub Desktop.
Frida: How to read a struct or a struct pointer or a pointer of a struct pointer?
/*
typedef struct {
int size;
char* data;
} test_struct;
void some_func(test_struct **s);
*/
const some_func_pointer = Module.getExportByName('libsrtp', 'some_func');
const some_func = new NativeFunction(some_func_pointer, "void", ["pointer"]);
Interceptor.replace(some_func_pointer, new NativeCallback(function (pointer) {
console.log(pointer.readPointer().readInt()) // size
console.log(pointer.readPointer().add(Process.pointerSize).readPointer().readUtf8String()); // data
some_func(pointer);
}, "void", ["pointer"]));
/*
typedef struct {
int size;
char* data;
} test_struct;
void some_func(test_struct *s);
*/
const some_func_pointer = Module.getExportByName('libsrtp', 'some_func');
const some_func = new NativeFunction(some_func_pointer, "void", ["pointer"]);
Interceptor.replace(some_func_pointer, new NativeCallback(function (pointer) {
console.log(pointer.readInt()) // size
console.log(pointer.add(Process.pointerSize).readPointer().readUtf8String()); // data
some_func(pointer);
}, "void", ["pointer"]));
/*
typedef struct {
int size;
char* data;
} test_struct;
void some_func(test_struct s);
*/
const some_func_pointer = Module.getExportByName('libsrtp', 'some_func');
const some_func = new NativeFunction(some_func_pointer, "void", ["int", "pointer"]);
Interceptor.replace(some_func_pointer, new NativeCallback(function (size, data) {
console.log(size)
console.log(data.readUtf8String())
some_func(size, data);
}, "void", ["int", "pointer"]));
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment