@zsa233/frida-analykit-agent 2.0.0 → 2.0.1

package/dist/elf/xref.js

@@ -0,0 +1,271 @@
+import { help } from "../helper.js";
+import { ScanAdrpCMod } from "../cmodule/scan_adrp.js";
+import { setGlobalProperties } from "../config.js";
+import { InstructionSequence } from "./insn.js";
+function countLeadingSignBits(input, width) {
+    if (width < 1 || width > 64) {
+        throw new RangeError('width must be between 1 and 64');
+    }
+    const mask = (1n << BigInt(width)) - 1n;
+    let value = BigInt(input) & mask;
+    const signBit = (value >> BigInt(width - 1)) & 1n;
+    let count = 0;
+    for (let i = width - 1; i >= 0; i--) {
+        const bit = (value >> BigInt(i)) & 1n;
+        if (bit === signBit) {
+            count++;
+        }
+        else {
+            break;
+        }
+    }
+    return count;
+}
+function choiceMatchPattern(p, byteNum) {
+    return p.toMatchPattern().split(/\s+/).slice(0, byteNum).join(' ');
+}
+function stripLeadingZeros(hexDump) {
+    const parts = hexDump.trim().split(/\s+/);
+    let count = 0;
+    for (const part of parts) {
+        if (part.toLowerCase() === '00') {
+            count++;
+        }
+        else {
+            break;
+        }
+    }
+    const strippedParts = parts.slice(count);
+    return {
+        count,
+        stripped: strippedParts.join(' ')
+    };
+}
+export class AdrlXref {
+    constructor(target) {
+        this.target = target;
+    }
+    get targetPage() {
+        return this.target.and(ptr('0xfff').not());
+    }
+    get targetPageOffset() {
+        return this.target.and('0xfff');
+    }
+    scanAdrl(scanRange, maxGapToAdd = 16) {
+        const { base, size } = scanRange;
+        const targetPage = this.targetPage;
+        // adrp
+        const op = ptr(0b1);
+        const adrpMatches = [];
+        const pageMask = ptr(Process.pageSize - 1).not();
+        const adrpImmLenMask = ptr(0x1FFFFF);
+        help.memoryReadDo(base, size, (makeReadable, makeRecovery) => {
+            makeReadable();
+            const ranges = [];
+            if (this.target <= base) {
+                ranges.push({ base, size, high: true });
+            }
+            else if (this.target >= base.add(size)) {
+                ranges.push({ base, size, high: false });
+            }
+            else {
+                ranges.push({ base, size: Number(this.target.sub(base)), high: false });
+                ranges.push({ base: this.target, size: size - Number(this.target.sub(base)), high: true });
+            }
+            for (let range of ranges) {
+                const minPage = range.base.and(pageMask);
+                const maxPage = range.base.add(range.size).and(pageMask);
+                const maxPageDelta = targetPage.sub(minPage).shr(12).and(adrpImmLenMask);
+                const minPageDelta = targetPage.sub(maxPage).shr(12).and(adrpImmLenMask);
+                let immVal;
+                let leadingCount;
+                if (range.high) {
+                    leadingCount = countLeadingSignBits(BigInt(minPageDelta.toString()), 21);
+                    immVal = adrpImmLenMask;
+                }
+                else {
+                    leadingCount = countLeadingSignBits(BigInt(maxPageDelta.toString()), 21);
+                    immVal = NULL;
+                }
+                const immMask = ptr((((1n << BigInt(leadingCount)) - 1n) << BigInt(21 - leadingCount)).toString());
+                const B = ptr(1);
+                const immloMask = immMask.and(0b11);
+                const immhiMask = immMask.shr(2);
+                const anyRdMask = NULL;
+                const adrpMask = choiceMatchPattern(NULL.or(B.shl(31))
+                    .or(immloMask.shl(29))
+                    .or(AdrlXref.ADRP_FIXED28_24_BITSET_MASK)
+                    .or(immhiMask.shl(5))
+                    .or(anyRdMask), 4);
+                const { stripped: adrpMaskStripped, count: alignOffset } = stripLeadingZeros(adrpMask);
+                const immlo = immVal.and(0b11);
+                const immhi = immVal.shr(2);
+                const anyRd = NULL;
+                const adrpSign = choiceMatchPattern(NULL.or(op.shl(31))
+                    .or(immlo.shl(29))
+                    .or(AdrlXref.ADRP_FIXED28_24_BITSET_MASK)
+                    .or(immhi.shl(5))
+                    .or(anyRd), 4);
+                const adrpSignStripped = adrpSign.split(/\s+/).slice(alignOffset).join(' ');
+                const scanPattern = `${adrpSignStripped} : ${adrpMaskStripped}`;
+                const scanRes = ScanAdrpCMod.scan(range, scanPattern, this.target, alignOffset);
+                if (scanRes.length) {
+                    adrpMatches.push(...scanRes);
+                }
+            }
+            makeRecovery();
+        });
+        const adrpInstructions = adrpMatches.reduce((acc, v) => {
+            const adrl = this.verify(v, maxGapToAdd);
+            if (adrl) {
+                acc.push(adrl);
+            }
+            return acc;
+        }, []);
+        return adrpInstructions;
+    }
+    // adrp + add
+    scanAdrlSlow(scanRange, maxGapToAdd = 16) {
+        const { base, size } = scanRange;
+        const targetPage = this.targetPage;
+        // adrp
+        const op = ptr(0b1);
+        const adrpPageMask = choiceMatchPattern(ptr(0x9fffffe0), 4);
+        const adrpMatches = [];
+        help.memoryReadPageDo(base, size, (page) => {
+            const { readable } = page;
+            const range = { base: page.base, size: page.size };
+            if (!range) {
+                return false;
+            }
+            else if (!readable) {
+                console.error(`[AdrlXref] scanAdrp base[${range.base} => ${range.base.add(range.size)}] is unreadable.`);
+                return false;
+            }
+            const pcPage = range.base;
+            const pageDelta = targetPage.sub(pcPage).shr(3 * 4).and(0x1FFFFF); // immhi:immlo = 21位
+            const immlo = pageDelta.and(0b11);
+            const immhi = pageDelta.shr(2);
+            const anyRd = NULL;
+            const adrpSign = choiceMatchPattern(NULL.or(op.shl(31))
+                .or(immlo.shl(29))
+                .or(AdrlXref.ADRP_FIXED28_24_BITSET_MASK)
+                .or(immhi.shl(5))
+                .or(anyRd), 4);
+            const scanPattern = `${adrpSign} : ${adrpPageMask}`;
+            const scanResults = Memory.scanSync(range.base, range.size, scanPattern).filter(v => {
+                return v.address.and(0x3).isNull();
+            });
+            adrpMatches.push(...scanResults);
+            return false;
+        });
+        const adrpInstructions = adrpMatches.reduce((acc, v) => {
+            const adrl = this.verify(v.address, maxGapToAdd);
+            if (adrl) {
+                acc.push(adrl);
+            }
+            return acc;
+        }, []);
+        return adrpInstructions;
+    }
+    verify(p, maxGapToAdd = 16) {
+        try {
+            const maybeAdrl = Adrl.loadFromPointer(p);
+            const adrpInsn = maybeAdrl.adrpInsn;
+            if (adrpInsn.mnemonic !== 'adrp') {
+                return null;
+            }
+            if (maybeAdrl.getTarget(false, maxGapToAdd)?.equals(this.target)) {
+                return maybeAdrl;
+            }
+            return null;
+        }
+        catch (error) {
+        }
+        return null;
+    }
+    scanAdr() {
+        // TODO:
+        return [];
+    }
+}
+/*  adr/adrp Xi, #{imm1}
+    ------------------------------------------------------------------
+    | 31  | 30 ─ 29 | 28 27 26 25 24 | 23 ──────────────── 5 | 4 ─ 0 |
+    | op  |  immlo  |    1 0 0 0 0   |     immhi (19b)       |  Rd   |
+    ------------------------------------------------------------------
+    adr : op=0
+    adrp: op=1
+*/
+/*  add Xm, Xn, #{imm2}
+    ----------------------------------------------------------------------
+    | 31 | 30 | 29 | 28 27 26 25 24 | 23 ─ 22 | 21 ─ 10  | 9 ─ 5 | 4 ─ 0 |
+    | sf | op |  S |   1 0 0 0 1    |   sh    |   imm12  |  Rn   |  Rd   |
+    ----------------------------------------------------------------------
+*/
+AdrlXref.ADRP_FIXED28_24_BITSET_MASK = ptr(0b10000).shl(24);
+export class Adrl extends InstructionSequence {
+    constructor(adrp, add) {
+        super(adrp);
+        this.adrpInsn = adrp;
+        this.addInsn = add;
+    }
+    get instruction() {
+        return Instruction.parse(this.$handle);
+    }
+    scanBL(base, maxGap = 16) {
+        if (!base) {
+            base = this.$handle;
+        }
+        let inc = 0;
+        for (const insn of this) {
+            switch (insn.mnemonic) {
+                case 'bl':
+                    return {
+                        src: this,
+                        insn: insn,
+                        next: insn.next,
+                    };
+            }
+            inc++;
+            if (inc >= maxGap)
+                return null;
+        }
+        return null;
+    }
+    getTarget(mustFoundAdd = false, maxGapToAdd = 16) {
+        const [op1, op2] = this.adrpInsn.operands;
+        const target = ptr(op2.value.toString());
+        if (!this.addInsn) {
+            let inc = 0;
+            verifyLoop: for (const insn of this) {
+                switch (insn.mnemonic) {
+                    case 'add':
+                        if (insn.operands.length !== 3) {
+                            break;
+                        }
+                        const [addOp1, addOp2, addOp3] = insn.operands;
+                        if (addOp1.value !== op1.value) {
+                            break;
+                        }
+                        if (addOp2.value !== addOp1.value) {
+                            console.error(`[Adrl] findAdd [${insn}] op2，来源于另一个寄存器，无法预估目标地址。`);
+                            break;
+                        }
+                        this.addInsn = insn;
+                        break verifyLoop;
+                }
+                inc++;
+                if (inc >= maxGapToAdd)
+                    return mustFoundAdd ? null : target;
+            }
+        }
+        if (!this.addInsn) {
+            return target;
+        }
+        return target.add(this.addInsn.operands[2].value.toString());
+    }
+}
+setGlobalProperties({
+    AdrlXref,
+});

package/dist/func.d.ts

@@ -0,0 +1,7 @@
+export declare class FuncHelper {
+    static list: any[];
+    static $nativeWrapper<RetType extends NativeFunctionReturnType>(retType: RetType, argTypes: any[]): (f: NativePointer, wrapFunc: AnyFunction) => NativeCallback<RetType, any[]>;
+    static atexit: (f: NativePointer, wrapFunc: AnyFunction) => NativeCallback<"void", any[]>;
+    static pthread_start_routine: (f: NativePointer, wrapFunc: AnyFunction) => NativeCallback<"pointer", any[]>;
+    static SSL_CTX_keylog_callback: (f: NativePointer, wrapFunc: AnyFunction) => NativeCallback<"void", any[]>;
+}

package/dist/func.js

@@ -0,0 +1,23 @@
+var _a;
+import { nativeFunctionOptions } from "./consts.js";
+export class FuncHelper {
+    static $nativeWrapper(retType, argTypes) {
+        return function (f, wrapFunc) {
+            const impl = f.isNull() ? NULL : new NativeFunction(f, retType, argTypes, nativeFunctionOptions);
+            const wrapper = function () {
+                return wrapFunc(impl, ...Array.from(arguments));
+            };
+            const cb = new NativeCallback(wrapper, retType, argTypes);
+            _a.list.push(cb);
+            return cb;
+        };
+    }
+}
+_a = FuncHelper;
+FuncHelper.list = [];
+// int __cxa_atexit(void (*f)(void *), void *objptr, void *dso);
+FuncHelper.atexit = _a.$nativeWrapper('void', ['pointer']);
+// int pthread_create(pthread_t *thread, const pthread_attr_t *attr, void *(*start_routine)(void *), void *arg);
+FuncHelper.pthread_start_routine = _a.$nativeWrapper('pointer', ['pointer']);
+// void (*keylog_callback)(const SSL *ssl, const char *line)
+FuncHelper.SSL_CTX_keylog_callback = _a.$nativeWrapper('void', ['pointer', 'pointer']);

package/dist/helper.d.ts

@@ -0,0 +1,130 @@
+import { Libc } from './lib/libc.js';
+import { RPCMsgType } from './message.js';
+import { LogLevel } from './config.js';
+export declare class NativePointerObject {
+    protected readonly _handle: NativePointer;
+    constructor(handle: NativePointer);
+    get $handle(): NativePointer;
+    $isNull(): boolean;
+}
+export declare function downAlign(value: number, alignTo: number): number;
+export declare function upAlign(value: number, alignTo: number): number;
+export declare function page_start(value: number): number;
+export declare function page_end(value: number): number;
+export declare class LoggerState {
+    private msgs;
+    private base_msgs;
+    private match_offset;
+    private depth;
+    private counter;
+    private index;
+    constructor(depth?: number);
+    onLog(msg: string): string[];
+}
+export declare class FileHelper extends NativePointerObject {
+    private _isClosed;
+    private readonly _weakRefId;
+    constructor(pathname: string, mode: string);
+    close(): number;
+    writeLine(data: string, append?: string): number;
+    flush(): number;
+}
+export type MemoryProtect = {
+    originProts: string;
+    newProts: string;
+    range: RangeDetails | null;
+    protectResult?: boolean;
+    recoverResult?: boolean;
+    readable: boolean;
+};
+export type MemoryPage = {
+    base: NativePointer;
+    size: number;
+} & MemoryProtect;
+export declare class BatchSender {
+    private _source;
+    private _batch_list;
+    constructor(source: string);
+    send(message: any, data?: ArrayBuffer | null): void;
+    rpcResponse(): (ArrayBuffer | {
+        type: RPCMsgType;
+        source: string;
+        data: {
+            message_list: any[];
+            data_sizes: number[];
+        };
+    })[];
+    clear(): void;
+    flush(): void;
+}
+export declare class ProgressNotify {
+    private readonly ID;
+    readonly tag: string;
+    private step;
+    private startTime;
+    constructor(tag: string);
+    notify(extra?: {
+        [key: string]: any;
+    }, err?: Error): void;
+    log(name: any, extra: any, lines?: string[]): void;
+}
+declare class Helper {
+    static libc: Libc;
+    private static _logStates;
+    private static _android_api_level?;
+    private static _dataDir;
+    private static _logfiles;
+    static get dataDir(): string;
+    static setOutputDir(dir: string): void;
+    static get outputDir(): string;
+    private static _loggerPrefix;
+    private static _prelog;
+    static assert(cond: any): void;
+    static $log(level: LogLevel, logger: (...args: any[]) => void, ...args: any): void;
+    static $debug(...args: any): void;
+    static $info(...args: any): void;
+    static $warn(...args: any): void;
+    static $error(...args: any): void;
+    static walkDir(path: string, fn: AnyFunction): null | undefined;
+    static getFdLinked(fd: number): string | null;
+    static getFileStreamLinked(stream: any): string | null;
+    static readProcMaps(pid?: number | string): string;
+    static readCmdline(pid?: number | string): string;
+    static readFile(path: string): ArrayBuffer;
+    static openFile(pathname: string, mode: string): FileHelper;
+    static isFilePath(str: string): boolean;
+    static joinPath(dir: string, file: string): string;
+    static readTextFile(path: string): string;
+    static dumpProcMaps(tag: string, pid?: number | string): void;
+    static dumpTextFile(tag: string, srcPath: string): void;
+    static backtrace({ context, addrHandler, backtracer }?: {
+        context?: undefined | CpuContext;
+        addrHandler?: (addr: any) => any;
+        backtracer?: Backtracer;
+    }): void;
+    static saveFile(tag: string, bs: string | ArrayBuffer | null, mode: string, source: string): false | undefined;
+    static androidGetApiLevel(): number;
+    static memoryReadDo(address: NativePointer, size: number, doFunc: (makeReadable: () => MemoryProtect[], makeRecovery: () => MemoryProtect[]) => void): void;
+    static memoryReadPageDo(base: NativePointer, size: number, doFunc: (page: MemoryPage) => boolean): MemoryPage[];
+    static newBatchSender(source: string): BatchSender;
+    static getLogfile(tag: string, mode: string): FileHelper;
+    static $send(message: any, data?: ArrayBuffer | number[] | null): void;
+    static scanMemory(scanRange: {
+        base: NativePointer;
+        size: number;
+    }, pattern: string, { limit, maxMatchNum, onMatch }: {
+        limit?: number;
+        maxMatchNum?: number;
+        onMatch?: (match: MemoryScanMatch) => boolean;
+    }): MemoryScanMatch[];
+}
+export { Helper as help };
+declare global {
+    const help: Helper;
+}
+export declare const print: (...args: any[]) => void;
+export declare const printErr: (...args: any[]) => void;
+declare global {
+    function print(...args: any): void;
+    function printErr(...args: any): void;
+}