mobsf 4.3.2__tar.gz → 4.4.0__tar.gz

{mobsf-4.3.2 → mobsf-4.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: mobsf
-Version: 4.3.2
+Version: 4.4.0
 Summary: Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
 Home-page: https://github.com/MobSF/Mobile-Security-Framework-MobSF
 License: GPL-3.0-only
@@ -23,6 +23,7 @@ Requires-Dist: apksigtool (>=0.1.0,<0.2.0)
 Requires-Dist: arpy (>=2.3.0)
 Requires-Dist: asn1crypto (>=1.4.0)
 Requires-Dist: bcrypt (==4.0.1)
+Requires-Dist: bleach (>=6.2.0,<7.0.0)
 Requires-Dist: bs4 (>=0.0.1)
 Requires-Dist: colorlog (>=4.7.2)
 Requires-Dist: defusedxml (>=0.7.1,<0.8.0)
@@ -30,14 +31,15 @@ Requires-Dist: distro (>=1.5.0)
 Requires-Dist: django (>=3.1.5)
 Requires-Dist: django-q2 (>=1.7.4,<2.0.0)
 Requires-Dist: django-ratelimit (>=4.1.0,<5.0.0)
-Requires-Dist: frida (>=16.1.4)
+Requires-Dist: frida (>=17.0.0)
+Requires-Dist: frida-tools (>=14.3.0,<15.0.0)
 Requires-Dist: google-play-scraper (>=0.1.2)
 Requires-Dist: gunicorn (>=20.0.4) ; sys_platform != "win32"
 Requires-Dist: http-tools (>=5.0.0)
 Requires-Dist: ip2location (>=8.10.4,<9.0.0)
 Requires-Dist: libsast (>=3.1.6,<4.0.0)
 Requires-Dist: lief (>=0.15.1,<0.16.0)
-Requires-Dist: lxml (>=4.6.2)
+Requires-Dist: lxml (==5.3.1)
 Requires-Dist: macholib (>=1.14)
 Requires-Dist: openstep-parser (>=2.0.1)
 Requires-Dist: packaging (>=24.2)

{mobsf-4.3.2 → mobsf-4.4.0}/mobsf/DynamicAnalyzer/tools/frida_scripts/android/default/debugger_check_bypass.js

@@ -11,13 +11,16 @@ Java.perform(function () {
  // Following are based on: https://github.com/apkunpacker/FridaScripts
 try {
     /* Bypass Frida Detection Based On Port Number */
-    Interceptor.attach(Module.findExportByName("libc.so", "connect"), {
+    const libc = Process.getModuleByName("libc.so");
+    Interceptor.attach(libc.getExportByName("connect"), {
         onEnter: function(args) {
-            var memory = Memory.readByteArray(args[1], 64);
-            var b = new Uint8Array(memory);
-            if (b[2] == 0x69 && b[3] == 0xa2 && b[4] == 0x7f && b[5] == 0x00 && b[6] == 0x00 && b[7] == 0x01) {
-                this.frida_detection = true;
-            }
+            try{
+                var memory = Memory.readByteArray(args[1], 64);
+                var b = new Uint8Array(memory);
+                if (b[2] == 0x69 && b[3] == 0xa2 && b[4] == 0x7f && b[5] == 0x00 && b[6] == 0x00 && b[7] == 0x01) {
+                    this.frida_detection = true;
+                }
+            } catch(e){}
         },
         onLeave: function(retval) {
             if (this.frida_detection) {
@@ -28,30 +31,31 @@ try {
     });
 } catch(e){}
 try {
-    Interceptor.attach(Module.findExportByName(null, "connect"), {
+    Interceptor.attach(Module.getGlobalExportByName("connect"), {
         onEnter: function(args) {
-            var family = Memory.readU16(args[1]);
+            var family = args[1].readU16();
             if (family !== 2) {
                 return
             }
-            var port = Memory.readU16(args[1].add(2));
+            var port = args[1].add(2).readU16();
             port = ((port & 0xff) << 8) | (port >> 8);
             if (port === 27042) {
                 send('[Debugger Check] Frida Port detection bypassed');
-                Memory.writeU16(args[1].add(2), 0x0101);
+                args[1].add(2).writeU16(0x0101);
             }
         }
     });
 } catch(e){}
 try {
     /* Bypass TracerPid Detection Based On Pid Status */
-    var fgetsPtr = Module.findExportByName("libc.so", "fgets");
+    const libc = Process.getModuleByName("libc.so");
+    var fgetsPtr = libc.getExportByName("fgets");
     var fgets = new NativeFunction(fgetsPtr, 'pointer', ['pointer', 'int', 'pointer']);
     Interceptor.replace(fgetsPtr, new NativeCallback(function(buffer, size, fp) {
         var retval = fgets(buffer, size, fp);
-        var bufstr = Memory.readUtf8String(buffer);
+        var bufstr = buffer.readUtf8String();
         if (bufstr.indexOf("TracerPid:") > -1) {
-            Memory.writeUtf8String(buffer, "TracerPid:\t0");
+            buffer.writeUtf8String("TracerPid:\t0");
             send("[Debugger Check] TracerPID check bypassed");
         }
         return retval;
@@ -60,7 +64,7 @@ try {
 
 try {
     /* Bypass Ptrace Checks */
-    Interceptor.attach(Module.findExportByName(null, "ptrace"), {
+    Interceptor.attach(Module.getGlobalExportByName("ptrace"), {
         onEnter: function(args) {},
         onLeave: function(retval) {
             send("[Debugger Check] Ptrace check bypassed");
@@ -71,7 +75,7 @@ try {
 
 try {
     /* Watch Child Process Forking */
-    var fork = Module.findExportByName(null, "fork")
+    var fork = Module.getGlobalExportByName("fork")
     Interceptor.attach(fork, {
         onEnter: function(args) {},
         onLeave: function(retval) {

{mobsf-4.3.2 → mobsf-4.4.0}/mobsf/DynamicAnalyzer/tools/frida_scripts/android/default/root_bypass.js

@@ -205,39 +205,49 @@ Java.performNow(function () {
 
     // Native Root Check Bypass
 
-    Interceptor.attach(Module.findExportByName("libc.so", "fopen"), {
-        onEnter: function (args) {
-            var path = Memory.readCString(args[0]);
-            path = path.split("/");
-            var executable = path[path.length - 1];
-            var shouldFakeReturn = (RootBinaries.indexOf(executable) > -1)
-            if (shouldFakeReturn) {
-                Memory.writeUtf8String(args[0], "/notexists");
-                send("[RootDetection Bypass] native fopen");
-            }
-        },
-        onLeave: function (retval) {
+    try {
+        const libc = Process.getModuleByName("libc.so");
+        
+        Interceptor.attach(libc.getExportByName("fopen"), {
+            onEnter: function (args) {
+                try{
+                var path = Memory.readCString(args[0]);
+                path = path.split("/");
+                var executable = path[path.length - 1];
+                var shouldFakeReturn = (RootBinaries.indexOf(executable) > -1)
+                if (shouldFakeReturn) {
+                    args[0].writeUtf8String("/notexists");
+                    send("[RootDetection Bypass] native fopen");
+                }
+                } catch(e){}
+            },
+            onLeave: function (retval) {
 
-        }
-    });
-    Interceptor.attach(Module.findExportByName("libc.so", "system"), {
-        onEnter: function (args) {
-            var cmd = Memory.readCString(args[0]);
-            send("[RootDetection Bypass] SYSTEM CMD: " + cmd);
-            if (cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id") {
-                send("[RootDetection Bypass] native system: " + cmd);
-                Memory.writeUtf8String(args[0], "grep");
-            }
-            if (cmd == "su") {
-                send("[RootDetection Bypass] native system: " + cmd);
-                Memory.writeUtf8String(args[0], "justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled");
             }
-        },
-        onLeave: function (retval) {
-
-        }
+        });
+        
+        Interceptor.attach(libc.getExportByName("system"), {
+            onEnter: function (args) {
+                try{
+                var cmd = Memory.readCString(args[0]);
+                send("[RootDetection Bypass] SYSTEM CMD: " + cmd);
+                if (cmd.indexOf("getprop") != -1 || cmd == "mount" || cmd.indexOf("build.prop") != -1 || cmd == "id") {
+                    send("[RootDetection Bypass] native system: " + cmd);
+                    args[0].writeUtf8String("grep");
+                }
+                if (cmd == "su") {
+                    send("[RootDetection Bypass] native system: " + cmd);
+                    args[0].writeUtf8String("justafakecommandthatcannotexistsusingthisshouldthowanexceptionwheneversuiscalled");
+                }
+                } catch(e){}
+            },
+            onLeave: function (retval) {
 
-    });
+            }
+        });
+    } catch (err) {
+        send('[RootDetection Bypass] Error hooking libc.so: ' + err);
+    }
     /*
 
     TO IMPLEMENT:

{mobsf-4.3.2 → mobsf-4.4.0}/mobsf/DynamicAnalyzer/tools/frida_scripts/android/default/ssl_pinning_bypass.js

@@ -65,13 +65,154 @@ Java.perform(function() {
     }
     try {
         var CertificatePinner2 = Java.use('okhttp3.CertificatePinner');
-        CertificatePinner2.check.overload('java.lang.String', 'java.util.List').implementation = function (str) {
-            send('[SSL Pinning Bypass] okhttp3.CertificatePinner.check() bypassed for ' + str);
+        
+        // Hook all check method overloads
+        CertificatePinner2.check.overload('java.lang.String', 'java.util.List').implementation = function (hostname, certificates) {
+            send('[SSL Pinning Bypass] okhttp3.CertificatePinner.check(String, List) bypassed for ' + hostname);
             return;
         };
+        
+        CertificatePinner2.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function (hostname, certificates) {
+            send('[SSL Pinning Bypass] okhttp3.CertificatePinner.check(String, Certificate[]) bypassed for ' + hostname);
+            return;
+        };
+        
+        // Additional check method overload that might exist
+        try {
+            CertificatePinner2.check.overload('java.lang.String', 'java.util.List', 'java.lang.String').implementation = function (hostname, certificates, algorithm) {
+                send('[SSL Pinning Bypass] okhttp3.CertificatePinner.check(String, List, String) bypassed for ' + hostname);
+                return;
+            };
+        } catch(e) {}
+        
+        // Hook the internal pin checking method
+        try {
+            CertificatePinner2.check$okhttp.implementation = function (hostname, certificates) {
+                send('[SSL Pinning Bypass] okhttp3.CertificatePinner.check$okhttp bypassed for ' + hostname);
+                return;
+            };
+        } catch(e) {}
+        
     } catch(err) {
         send('[SSL Pinning Bypass] okhttp3 CertificatePinner not found');
     }
+    
+    // Comprehensive OkHttp3 bypass combining all approaches to avoid redeclaration
+    try {
+        var OkHttpClient = Java.use('okhttp3.OkHttpClient');
+        var OkHttpClientBuilder = Java.use('okhttp3.OkHttpClient$Builder');
+        var CertificatePinner = Java.use('okhttp3.CertificatePinner');
+        
+        // Create empty certificate pinner
+        var EmptyCertificatePinner = CertificatePinner.Builder.$new().build();
+        
+        // Bypass certificate pinner in builder
+        OkHttpClientBuilder.certificatePinner.implementation = function(certificatePinner) {
+            send('[SSL Pinning Bypass] okhttp3.OkHttpClient.Builder.certificatePinner() bypassed');
+            return this;
+        };
+        
+        OkHttpClientBuilder.build.implementation = function() {
+            var client = this.build();
+            try {
+                // Try to replace certificate pinner with empty one
+                var certificatePinnerField = OkHttpClient.class.getDeclaredField('certificatePinner');
+                certificatePinnerField.setAccessible(true);
+                certificatePinnerField.set(client, EmptyCertificatePinner);
+                send('[SSL Pinning Bypass] okhttp3.OkHttpClient certificate pinner replaced with empty pinner');
+            } catch (e) {
+                send('[SSL Pinning Bypass] Failed to replace certificate pinner: ' + e);
+            }
+            return client;
+        };
+        
+        // Hook findMatchingPins method if it exists
+        try {
+            CertificatePinner.findMatchingPins.implementation = function(hostname) {
+                send('[SSL Pinning Bypass] okhttp3.CertificatePinner.findMatchingPins() bypassed for ' + hostname);
+                var ArrayList = Java.use('java.util.ArrayList');
+                return ArrayList.$new(); // Return empty list
+            };
+        } catch(e) {}
+        
+        // Hook sha256 method if it exists
+        try {
+            CertificatePinner.sha256Hash.implementation = function(certificate) {
+                send('[SSL Pinning Bypass] okhttp3.CertificatePinner.sha256Hash() bypassed');
+                // Return a dummy hash that will match
+                var ByteString = Java.use('okio.ByteString');
+                return ByteString.decodeHex('0000000000000000000000000000000000000000000000000000000000000000');
+            };
+        } catch(e) {}
+        
+        // More aggressive approach - completely suppress the certificate pinning exception
+        try {
+            var RealInterceptorChain = Java.use('okhttp3.internal.http.RealInterceptorChain');
+            RealInterceptorChain.proceed.overload('okhttp3.Request').implementation = function(request) {
+                try {
+                    return this.proceed(request);
+                } catch (e) {
+                    if (e.toString().includes('Certificate pinning failure')) {
+                        send('[SSL Pinning Bypass] Certificate pinning failure suppressed for: ' + request.url());
+                        // Return the original method call but without pinning
+                        var originalPinner = this.call().client().certificatePinner();
+                        try {
+                            // Temporarily replace with empty pinner
+                            var clientField = this.call().getClass().getDeclaredField('client');
+                            clientField.setAccessible(true);
+                            var client = clientField.get(this.call());
+                            
+                            var pinnerField = client.getClass().getDeclaredField('certificatePinner');
+                            pinnerField.setAccessible(true);
+                            pinnerField.set(client, EmptyCertificatePinner);
+                            
+                            var result = this.proceed(request);
+                            
+                            // Restore original pinner
+                            pinnerField.set(client, originalPinner);
+                            return result;
+                        } catch (reflectionError) {
+                            send('[SSL Pinning Bypass] Reflection bypass failed: ' + reflectionError);
+                            throw e;
+                        }
+                    }
+                    throw e;
+                }
+            };
+        } catch(interceptorErr) {}
+        
+    } catch(err) {
+        send('[SSL Pinning Bypass] Comprehensive okhttp3 bypass not available');
+    }
+    
+    // Direct bypass for SSLPeerUnverifiedException 
+    try {
+        var SSLPeerUnverifiedException = Java.use('javax.net.ssl.SSLPeerUnverifiedException');
+        SSLPeerUnverifiedException.$init.overload('java.lang.String').implementation = function(message) {
+            if (message && message.includes('Certificate pinning failure')) {
+                send('[SSL Pinning Bypass] SSLPeerUnverifiedException with certificate pinning blocked');
+                // Don't throw the exception, just return
+                return;
+            }
+            return this.$init(message);
+        };
+    } catch(err) {
+        send('[SSL Pinning Bypass] SSLPeerUnverifiedException bypass not available');
+    }
+    
+    // Additional OkHttp3 bypasses for interceptors and connection specs
+    try {
+        // Bypass ConnectionSpec TLS versions
+        var ConnectionSpec = Java.use('okhttp3.ConnectionSpec');
+        ConnectionSpec.isCompatible.implementation = function(sslSocket) {
+            send('[SSL Pinning Bypass] okhttp3.ConnectionSpec.isCompatible() bypassed');
+            return true;
+        };
+    } catch(err) {
+        send('[SSL Pinning Bypass] okhttp3 ConnectionSpec not found');
+    }
+    
+    // Note: RealConnection.connectTls bypass removed to prevent app crashes
     try {
         // https://gist.github.com/cubehouse/56797147b5cb22768b500f25d3888a22
         var dataTheorem = Java.use('com.datatheorem.android.trustkit.pinning.OkHostnameVerifier');
@@ -268,55 +409,54 @@ Java.perform(function() {
         send("[SSL Pinning Bypass] Appmattus CertificateTransparencyInterceptor not found");
     }
     try{
-        bypassOkHttp3CertificateTransparency();
+        bypassCertificateTransparency();
     } catch (err) {
         send('[SSL Pinning Bypass] certificatetransparency.CTInterceptorBuilder not found');
     }
+    
+
 }, 0);
 
 
-function bypassOkHttp3CertificateTransparency() {
+function bypassCertificateTransparency() {
   // https://gist.github.com/m-rey/f2a235123908ca42395b6d3c5fe1128e
-    var CertificateTransparencyInterceptor = Java.use('com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyInterceptor');
-    var OkHttpClientBuilder = Java.use('okhttp3.OkHttpClient$Builder');
-
-    CertificateTransparencyInterceptor.intercept.implementation = function (chain) {
-        var request = chain.request();
-        var url = request.url();
-        var host = url.host();
+    try {
+        var CertificateTransparencyInterceptor = Java.use('com.appmattus.certificatetransparency.internal.verifier.CertificateTransparencyInterceptor');
 
-        // Dynamically access the VerificationResult classes
-        var VerificationResult = Java.use('com.appmattus.certificatetransparency.VerificationResult');
-        var VerificationResultSuccessInsecureConnection = Java.use('com.appmattus.certificatetransparency.VerificationResult$Success$InsecureConnection');
-        var VerificationResultFailureNoCertificates = Java.use('com.appmattus.certificatetransparency.VerificationResult$Failure$NoCertificates');
+        CertificateTransparencyInterceptor.intercept.implementation = function (chain) {
+            var request = chain.request();
+            var url = request.url();
+            var host = url.host();
 
-        // Create instances of the desired VerificationResult classes
-        var success = VerificationResultSuccessInsecureConnection.$new(host);
-        var failureNoCertificates = VerificationResultFailureNoCertificates.$new();
+            // Dynamically access the VerificationResult classes
+            var VerificationResult = Java.use('com.appmattus.certificatetransparency.VerificationResult');
+            var VerificationResultSuccessInsecureConnection = Java.use('com.appmattus.certificatetransparency.VerificationResult$Success$InsecureConnection');
+            var VerificationResultFailureNoCertificates = Java.use('com.appmattus.certificatetransparency.VerificationResult$Failure$NoCertificates');
 
-        // Bypass certificate transparency verification
-        var certs = chain.connection().handshake().peerCertificates();
-        if (certs.length === 0) {
-        send('[SSL Pinning Bypass] Certificate transparency bypassed.');
-        return failureNoCertificates;
-        }
+            // Create instances of the desired VerificationResult classes
+            var success = VerificationResultSuccessInsecureConnection.$new(host);
+            var failureNoCertificates = VerificationResultFailureNoCertificates.$new();
 
-        try {
-        // Proceed with the original request
-        return chain.proceed(request);
-        } catch (e) {
-        // Catch SSLPeerUnverifiedException and return intercepted response
-        if (e.toString().includes('SSLPeerUnverifiedException')) {
-            send('[SSL Pinning Bypass] Certificate transparency failed.');
+            // Bypass certificate transparency verification
+            var certs = chain.connection().handshake().peerCertificates();
+            if (certs.length === 0) {
+            send('[SSL Pinning Bypass] Certificate transparency bypassed.');
             return failureNoCertificates;
-        }
-        throw e;
-        }
-    };
+            }
 
-    OkHttpClientBuilder.build.implementation = function () {
-        // Intercept the OkHttpClient creation
-        var client = this.build();
-        return client;
-    };
+            try {
+            // Proceed with the original request
+            return chain.proceed(request);
+            } catch (e) {
+            // Catch SSLPeerUnverifiedException and return intercepted response
+            if (e.toString().includes('SSLPeerUnverifiedException')) {
+                send('[SSL Pinning Bypass] Certificate transparency failed.');
+                return failureNoCertificates;
+            }
+            throw e;
+            }
+        };
+    } catch (err) {
+        send('[SSL Pinning Bypass] CertificateTransparencyInterceptor not found');
+    }
 }

{mobsf-4.3.2 → mobsf-4.4.0}/mobsf/DynamicAnalyzer/tools/frida_scripts/android/others/helper-convert.js

@@ -11,6 +11,19 @@ function bytes2hex(array) {
 function jhexdump(array) {
     var ptr = Memory.alloc(array.length);
     for (var i = 0; i < array.length; ++i)
-        Memory.writeS8(ptr.add(i), array[i]);
+        ptr.add(i).writeS8(array[i]);
     send(hexdump(ptr, { offset: 0, length: array.length, header: false, ansi: false }));
-}
+}
+
+// Helper functions for converting array to C char array pointer
+// Source: https://github.com/interference-security/frida-scripts
+
+function arrayToC(array) {
+    var cPtr = Memory.alloc(array.length);
+    for (var i = 0; i < array.length; i++) {
+        cPtr.add(i).writeS8(array[i]);
+    }
+    return cPtr;
+}
+
+// Usage: arrayToC([65, 66, 67, 68, 0]);  // "ABCD\0"

mobsf-4.4.0/mobsf/DynamicAnalyzer/tools/frida_scripts/android/others/helper-jni-hook-by-address.js

@@ -0,0 +1,48 @@
+// https://github.com/iddoeldor/frida-snippets#reveal-native-methods
+// Modified to support Frida 17.0.0+
+// Hook JNI by address
+// Hook native method by module name and method address and print arguments.
+const moduleName = "libGLESv2.so";
+const nativeFuncOffset = 0x1234; // Use `nm -D --demangle libGLESv2.so | grep Class::method` to get this offset
+
+try {
+    Interceptor.attach(Module.getGlobalExportByName("dlopen"), {
+        onEnter(args) {
+            this.lib = args[0].readUtf8String();
+            send("[dlopen] called with: " + this.lib);
+        },
+        onLeave(retval) {
+            if (!this.lib || !this.lib.endsWith(moduleName)) return;
+
+            send("[dlopen] loaded target module: " + this.lib + " => " + retval);
+
+            try {
+                const module = Process.getModuleByName(moduleName);
+                const hookAddress = module.base.add(nativeFuncOffset);
+
+                send("[+] Hooking native method at " + hookAddress + " (" + moduleName + "+0x" + nativeFuncOffset.toString(16) + ")");
+
+                Interceptor.attach(hookAddress, {
+                    onEnter(args) {
+                        try {
+                            send("[-] Hook invoked");
+                            send(JSON.stringify({
+                                a1: args[1].toInt32(),
+                                a2: args[2] && args[2].readPointer() ? args[2].readPointer().readUtf8String() : null,
+                                a3: Boolean(args[3].toInt32())
+                            }, null, 2));
+                        } catch (err) {
+                            send("[!] Error reading arguments: " + err);
+                        }
+                    }
+                });
+
+            } catch (e) {
+                send("[!] Error hooking " + moduleName + ": " + e);
+            }
+        }
+    });
+
+} catch (e) {
+    send("[!] Error hooking dlopen: " + e);
+}

mobsf-4.4.0/mobsf/DynamicAnalyzer/tools/frida_scripts/android/others/helper-trace-jni.js

@@ -0,0 +1,51 @@
+/*
+ * raptor_frida_android_*.js - Frida snippets for Android
+ * Copyright (c) 2017 Marco Ivaldi <raptor@0xdeadbeef.info>
+ * Modified to support Frida 17.0.0+
+ */
+Java.perform(function () {
+    try {
+        // Get the libc module and the 'open' function export
+        const libc = Process.getModuleByName("libc.so");
+        const openPtr = libc.getExportByName("open");
+
+        // Attach interceptor to libc open()
+        Interceptor.attach(openPtr, {
+            onEnter: function (args) {
+                this.flag = false;
+
+                try {
+                    // Read filename argument safely
+                    const filename = args[0].readCString();
+
+                    // Uncomment and adjust filtering logic as needed
+                    // if (filename.indexOf("XYZ") === -1 && filename.indexOf("ZYX") === -1) return;
+                    // if (filename.indexOf("my.interesting.file") !== -1)
+
+                    this.flag = true;
+
+                    if (this.flag) {
+                        send("\n[open] file name: " + filename);
+
+                        // Print backtrace
+                        const backtrace = Thread.backtrace(this.context, Backtracer.ACCURATE)
+                            .map(DebugSymbol.fromAddress)
+                            .join("\n");
+                        send("\nBacktrace:\n" + backtrace);
+                    }
+                } catch (e) {
+                    send("[!] Error in onEnter: " + e);
+                }
+            },
+            onLeave: function (retval) {
+                if (this.flag) {
+                    send("[open] retval: " + retval);
+                }
+            }
+        });
+
+        send("[✔] Hook installed on libc open()");
+    } catch (e) {
+        send("[✘] Error hooking libc open: " + e);
+    }
+});