I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function I am using this hook
const ghidraImageBase = 0x00100000; const moduleName = "libclient.so"; const moduleBaseAddress = Module.findBaseAddress(moduleName); const ghidraFunction = 0x0168a7c8; const functionRealAddress = moduleBaseAddress.add(ghidraFunction - ghidraImageBase); Interceptor.attach(functionRealAddress, { onEnter: function(args) { console.log("function called"); }, onLeave: function(ignored) {} }); However function called is never logged even though the function is getting called I am pretty sure something is wrong with the addresses so I tried hooking into a exported function using the address I got from ghidra
which is 0x014ccd08 and ghidra image base is equal to 0x00100000 meaning the offset of the function should be 0x014ccd08 - 0x00100000 = 0x013ccd08 however when I run
console.log("moduleBaseAddress:" + Module.findBaseAddress("libclient.so")) Module.enumerateExports("libclient.so", { onMatch: function(e) { if (e.type == 'function') { if (e.name == "Java_exported_function etc...") { console.log("Function found"); console.log(JSON.stringify(e)) } } }, onComplete: function() {} }); the above code execution result is
moduleBaseAddress:0xb6900000 Function recognized by name {"type":"function","name":"Java_exported_function...","address":"0xb755b9e1"} the .so library is loaded at 0xb6900000 and the function address is at 0xb755b9e1 meaning the function offset is 0xb755b9e1 - 0xb6900000 = 0x00c5b9e1 entirely different from the 0x013ccd08 I found earlier.
- Can this issue be from the ghidra settings?
- How can I get the correct offset from ghidra?
