lasting-yang / frida-qbdi-tracer

frida-qbdi-tracer's Issues

不支持arm32吗

Failed to load /data/user/0/com.cibn.tv/files/libQBDI.so (dlopen failed: "/data/user/0/com.cibn.tv/files/libQBDI.so" is 64-bit instead of 32-bit)

增加node module初始化和读文件编码问题

def init_node_env():
    node_modules_path = './node_modules'
    if os.path.exists(node_modules_path):
        print("no need init")
    else:
        os.system("npm install")

def read_agent_js_source():
    with open("_agent.js", "r", encoding='utf-8') as f:
        return f.read()

frida.InvalidArgumentError: could not load module 'QBDI/frida-qbdi.js'

PS H:\IDA\frida-qbdi-tracer> Python .\start_trace.py

build
frida-compile agent.js -o _agent.js -c -S

Traceback (most recent call last):
File "H:\IDA\frida-qbdi-tracer\start_trace.py", line 40, in
script = session.create_script(read_agent_js_source())
File "D:\Python310\lib\site-packages\frida\core.py", line 26, in wrapper
return f(*args, **kwargs)
File "D:\Python310\lib\site-packages\frida\core.py", line 262, in create_script
return Script(self._impl.create_script(*args, **kwargs))
frida.InvalidArgumentError: could not load module 'QBDI/frida-qbdi.js'
PS H:\IDA\frida-qbdi-tracer> frida --version
15.1.17
PS H:\IDA\frida-qbdi-tracer> node --version
v18.4.0
PS H:\IDA\frida-qbdi-tracer> python --version
Python 3.10.4
PS H:\IDA\frida-qbdi-tracer>

启动start_trace.py提示错误could not load module 'QBDI/frida-qbdi.js'

紧修改了warp_vm_run.js文件：
`/**

• warp_vm_run的函数定义不要修改

• @param {*} vm_run_func 会调用qbdi的vm.call

• @param {*} log_file_path 日志文件的路径
  */
  export default function warp_vm_run(vm_run_func, log_file_path) {
  // let baselibEncryptor = Module.findBaseAddress("libEncryptor.so");
  // let addr_2BD8 = baselibEncryptor.add(0x2BD8);
  // let str0 = "0123456789abcdef";
  // let arg0 = Memory.allocUtf8String(str0);
  // let ret_len = str0.length + 0x76;

  // let arg1 = Memory.alloc(ret_len);
  // let arg2 = Memory.alloc(16);
  // arg2.writeU64(ret_len);
  let baselibEncryptor = Module.findBaseAddress("libnative-lib.so");
  let addr_FF30 = baselibEncryptor.add(0xFF30);
  let str0 = "e4Uyx8KwqBtrjXcOhLVs0xWjeGp3kaF3HoQc";
  let arg0 = Memory.allocUtf8String(str0);

  /**

  • addr_2BD8 是主动调用函数的地址
  • [arg0, str0.length, arg1, arg2] 是参数
  • log_file_path 日志文件的路径
    */
    // let ret = vm_run_func(addr_2BD8, [arg0, str0.length, arg1, arg2], log_file_path)
    let ret = vm_run_func(addr_FF30, [arg0], log_file_path)

  console.log(ret, "\r\n", hexdump(ret, {
  length: ret_len
  }))
  }运行python start_trace.py提示如下错误：C:\Users\shmily\Desktop\frida-qbdi-tracer-master\frida-qbdi-tracer-master>python start_trace.py

build
frida-compile agent.js -o _agent.js -c -S

Traceback (most recent call last):
File "C:\Users\xxxx\Desktop\frida-qbdi-tracer-master\frida-qbdi-tracer-master\start_trace.py", line 40, in
script = session.create_script(read_agent_js_source())
File "C:\Users\xxxx\Desktop\frida-qbdi-tracer-master\frida-qbdi-tracer-master\start_trace.py", line 9, in read_agent_js_source
return f.read()
UnicodeDecodeError: 'gbk' codec can't decode byte 0x84 in position 68: illegal multibyte sequence修改start_trace.py代码如下：def read_agent_js_source():
with open("_agent.js", "r", encoding="utf-8") as f:
return f.read()运行提示如下错误：C:\Users\xxxx\Desktop\frida-qbdi-tracer-master\frida-qbdi-tracer-master>python start_trace.py

build
frida-compile agent.js -o _agent.js -c -S

Traceback (most recent call last):
File "C:\Users\xxxx\Desktop\frida-qbdi-tracer-master\frida-qbdi-tracer-master\start_trace.py", line 40, in
script = session.create_script(read_agent_js_source())
File "C:\Users\xxxx\AppData\Local\Programs\Python\Python310\lib\site-packages\frida\core.py", line 26, in wrapper
return f(*args, **kwargs)
File "C:\Users\xxxx\AppData\Local\Programs\Python\Python310\lib\site-packages\frida\core.py", line 262, in create_script
return Script(self._impl.create_script(*args, **kwargs))
frida.InvalidArgumentError: could not load module 'QBDI/frida-qbdi.js'`
github下载frida-qbdi-tracer文件并运行，路径应该没有问题，其他文件并未修改，不知道问什么提示此错误，请各位大佬解答

请问主动调用函数vm_run_func的参数[arg0, arg1, arg2]问题？

请问，要是想trace导出函数，那么【arg0是JniEnv，arg1是jclass，arg2是真实参数】吗？还是从arg0开始就是真实参数呢（JniEnv和jclass是怎么处理）？

frida.core.RPCException

build
frida-compile agent.js -o _agent.js -c -S

start vmrun
Traceback (most recent call last):
File "/root/Desktop/frida-qbdi-tracer/start_trace.py", line 53, in
script.exports_sync.vmrun(log_path)
File "/root/.pyenv/versions/3.9.8/lib/python3.9/site-packages/frida/core.py", line 179, in method
return script._rpc_request("call", js_name, args, **kwargs)
File "/root/.pyenv/versions/3.9.8/lib/python3.9/site-packages/frida/core.py", line 86, in wrapper
return f(*args, **kwargs)
File "/root/.pyenv/versions/3.9.8/lib/python3.9/site-packages/frida/core.py", line 491, in _rpc_request
raise result.error
frida.core.RPCException: Error: Expected an array
at toJni (frida/node_modules/frida-java-bridge/lib/types.js:292)
at toJni (frida/node_modules/frida-java-bridge/lib/types.js:300)
at array (frida/node_modules/frida-java-bridge/lib/class-factory.js:197)
at array (frida/node_modules/frida-java-bridge/index.js:273)
at a (/warp_vm_run.js:1)
at (/agent.js:1)
at vmrun (/agent.js:1)
at apply (native)
at (frida/runtime/message-dispatcher.js:13)
at c (frida/runtime/message-dispatcher.js:23)