import {logHHex} from "./logger"; import {SoName} from "./config"; export let HookImpl = { start: function () { let module = Process.findModuleByName(SoName); // Interceptor.attach(module.base.add(0x6A65EC), { // onEnter: function (args) { // var pointer = args[0]; // // pointer.add(0x18).writeU32(100); // //101 // console.log("pointer " + pointer) // logHHex(pointer) // this.ptr =pointer; // }, // onLeave: function (ret) { // console.log("level"); // logHHex(this.ptr) // return ret; // } // //32 // }) setTimeout(function (){ let globalHead = module.base.add(0x9AD338).readPointer(); let metadataReg = module.base.add(0x9AD308).readPointer(); let codeReg = module.base.add(0x9AD300).readPointer(); let injectso = Module.load("/data/data/com.DefaultCompany.Demo1/files/libil2cppdumper.so"); let nativePointer1 = injectso.findExportByName("_ZN12Il2CppDumper5startEPvS0_S0_S0_"); console.log("my so inject addr "+nativePointer1) let startFun = new NativeFunction(nativePointer1,"void",['pointer','pointer','pointer','pointer']); let il2cpp = Process.findModuleByName(SoName); console.log("base "+il2cpp.base) startFun(il2cpp.base,globalHead,metadataReg,codeReg); },2000); } }