Is it possible to hook a sub_... object in Frida ? I disassembled an arm64 executable, when running the app on my iPhone, I can see a lot of classes also in the disassembled executable, but I can't reach these sub_... objects. If this is possible, I'd like to know how can I edit them to change a certain procedure (in my case b.ne to b.eq), and also if it is possible to hook some loc_... objects.
Thanks for all your answers.
Update: First, you need the base address of the module where your loc_... or sub_... is. To get it, do:
var adr = Process.findModuleByName("YOURMODULENAME")["base"]; Then, get the offset of your loc_... or sub_.... It is easy since they are named from it, like so: loc_342964. So now, add this offset to the base of your module like so:
var n_adr = adr.add(ptr(0x342964)); You can ensure it is the correct address by displaying the instruction at the place of the address by:
console.log(Instruction.parse(n_adr).toString();); If it is not a procedure, use:
console.log(Memory.ReadCString(n_adr);); The you can attach it like this:
Interceptor.attach(n_adr, function() { console.log(JSON.Stringify(this.context)); }); To edit values, edit directly the this.context object. Ex:
Interceptor.attach(n_adr, function() { this.context.w0 = ptr(0x0); });