Question

如标题所述，如何使用Frida钩住os_log？在下面尝试过，不起作用。

Interceptor.attach(Module.findExportByName("libSystem.B.dylib", "os_log"), {
    onEnter: function (args) {
        console.log(args[0] + args[1]);
    }
});

Answer 1

启用所有日志

var m = 'libsystem_trace.dylib';
// bool os_log_type_enabled(os_log_t oslog, os_log_type_t type);
var isEnabledFunc = Module.findExportByName(m, 'os_log_type_enabled');
// _os_log_impl(void *dso, os_log_t log, os_log_type_t type, const char *format, uint8_t *buf, unsigned int size);
var logFunc = Module.findExportByName(m, '_os_log_impl');

Interceptor.attach(isEnabledFunc, {
  onLeave: function (ret) {
    // console.log('log_enabled', ret);
    ret.replace(0x1);
  }
});

Interceptor.attach(logFunc, {
  onEnter: function (a) {
    var type = a[2]; // https://github.com/darlinghq/darling/blob/master/src/libc/os/log.h#L105
    var format = a[3];
    if (type != 0x2) {
      console.log(JSON.stringify({
        type: type,
        format: format.readCString(),
        //buf: a[4].readPointer().readCString()
      }, null, 2));
    }
  }
})

如何使用Frida挂钩os_log

1 个答案: