shlu's note

Frida-trace

模板文件修改，最终效果

//frida-tools 13.6.0 (frida 16.5.7)
defineHandler({
  onEnter(log, args, state) {
    this.ObjCToString=function (obj){
      if(parameters.c2s){
        if(typeof parameters.regex === 'string'&&parameters.regex.length>0){
          const regex=new RegExp(parameters.regex,"i");
          if(regex.test(`-[FMDatabase initWithPath:]`)){
            //@ts-ignore
            return  new ObjC.Object(obj).toString() 
          }
        }
      }
      return obj;
    }

    log(`-[FMDatabase initWithPath:${this.ObjCToString(args[2])}]`);
  },

  onLeave(log, retval, state) {
    log(`EXIT -[FMDatabase initWithPath:]/ret= ${this.ObjCToString(retval)}`)
  }
});

tracer.py

        return """\
/*
 * Auto-generated by Frida. Please modify to match the signature of %(display_name)s.
 * This stub is currently auto-generated from manpages when available.
 *
 * For full API reference, see: https://frida.re/docs/javascript-api/
 */

defineHandler({
  onEnter(log, args, state) {
    this.ObjCToString=function (obj){
      if(parameters.c2s){
        if(typeof parameters.filter === 'string'&&parameters.filter.length>0){
          if(%(display_name)s.toLowerCase().indexOf(parameters.filter.toLowerCase())>-1){
            //@ts-ignore
            return  new ObjC.Object(obj).toString() 
          }
        }
      }
      return obj;
    }
    log(%(log_str)s);
  },

  onLeave(log, retval, state) {
    log(`EXIT %(display_name)s/ret= ${this.ObjCToString(retval)}`)
  }
});
""" % {
            "display_name": target.display_name,
            "log_str": log_str,
        }

第二段

    def _create_objc_logging_code(self, target: TraceTarget) -> str:
        state = {"index": 2}

        def objc_arg(m):
            index = state["index"]
            r = ":${this.ObjCToString(args[%d])} " % index
            state["index"] = index + 1
            return r

        code = "`" + re.sub(r":", objc_arg, target.display_name) + "`"
        if code.endswith("} ]`"):
            code = code[:-3] + "]`"

        return code

声明：转载请注明出处，原文地址：shlu's note

©2025 shlu's note |