Advertisement
Mr_hEx

check OS libs loaded and print the addres of load libs

Feb 28th, 2025 (edited)
183
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. //check OS libs loaded and print the addres of load libs
  2. console.log("[*] Starting script to track loaded .so files...");
  3.  
  4. function hookDlopen(funcName) {
  5.     const addr = Module.findExportByName(null, funcName);
  6.     if (!addr) {
  7.         console.log("[!] " + funcName + " not found, skipping hook");
  8.         return;
  9.     }
  10.  
  11.     Interceptor.attach(addr, {
  12.         onEnter: function (args) {
  13.             if (!args[0].isNull()) {
  14.                 this.libName = Memory.readUtf8String(args[0]);
  15.             } else {
  16.                 this.libName = null;
  17.             }
  18.         },
  19.         onLeave: function (retval) {
  20.             // Check if it ends with ".so"
  21.             if (this.libName && this.libName.endsWith(".so")) {
  22.                 // Attempt to find the library's base address
  23.                 let baseAddr = Module.findBaseAddress(this.libName);
  24.                
  25.                 if (baseAddr !== null) {
  26.                     console.log("[*] " + funcName + " called with: " + this.libName +
  27.                                 "\nBase address: " + baseAddr);
  28.                 } else {
  29.                     console.log("[*] " + funcName + " called with: " + this.libName +
  30.                                 "\nBase address not found (may need to parse the path).");
  31.                 }
  32.             }
  33.         }
  34.     });
  35. }
  36.  
  37. // Hook both dlopen and android_dlopen_ext
  38. hookDlopen("dlopen");
  39. hookDlopen("android_dlopen_ext");
  40.  
  41. console.log("[*] Script loaded, waiting for dlopen calls...");
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement