diff --git a/frida_mode/GNUmakefile b/frida_mode/GNUmakefile index 6f58ebbb..e568ea6e 100644 --- a/frida_mode/GNUmakefile +++ b/frida_mode/GNUmakefile @@ -165,10 +165,19 @@ ifndef OS $(error "Operating system unsupported") endif -GUM_DEVKIT_VERSION=16.0.11 +GUM_DEVKIT_VERSION=16.1.11 GUM_DEVKIT_FILENAME=frida-gumjs-devkit-$(GUM_DEVKIT_VERSION)-$(OS)-$(ARCH).tar.xz GUM_DEVKIT_URL="https://github.com/frida/frida/releases/download/$(GUM_DEVKIT_VERSION)/$(GUM_DEVKIT_FILENAME)" +IS_GUM_16_6_PLUS := $(shell VERSION="$(GUM_DEVKIT_VERSION)"; \ + MAJOR=$${VERSION%%.*}; \ + MINOR=$${VERSION#*.}; MINOR=$${MINOR%%.*}; \ + if [ $$MAJOR -gt 16 ] || { [ $$MAJOR -eq 16 ] && [ $$MINOR -ge 6 ]; }; then \ + echo 1; \ + fi) + +CFLAGS += $(if $(IS_GUM_16_6_PLUS),-DGUM_16_6_PLUS) + GUM_DEVKIT_TARBALL:=$(FRIDA_BUILD_DIR)$(GUM_DEVKIT_FILENAME) ifdef FRIDA_SOURCE GUM_DEVIT_LIBRARY=$(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/lib/libfrida-gumjs-1.0.a diff --git a/frida_mode/src/asan/asan.c b/frida_mode/src/asan/asan.c index ad171337..66ff7eac 100644 --- a/frida_mode/src/asan/asan.c +++ b/frida_mode/src/asan/asan.c @@ -27,6 +27,29 @@ void asan_init(void) { } +#ifdef GUM_16_6_PLUS +static gboolean asan_exclude_module(GumModule *module, + gpointer user_data) { + + gchar *symbol_name = (gchar *)user_data; + GumAddress address; + const GumMemoryRange *range = gum_module_get_range(module); + + address = gum_module_find_export_by_name(module, symbol_name); + if (address == 0) { return TRUE; } + + /* If the reported address of the symbol is outside of the range of the module + * then ignore it */ + if (address < range->base_address) { return TRUE; } + if (address > (range->base_address + range->size)) { + return TRUE; + } + + ranges_add_exclude((GumMemoryRange *) range); + return FALSE; + +} +#else static gboolean asan_exclude_module(const GumModuleDetails *details, gpointer user_data) { @@ -49,10 +72,10 @@ static gboolean asan_exclude_module(const GumModuleDetails *details, return FALSE; } +#endif void asan_exclude_module_by_symbol(gchar *symbol_name) { gum_process_enumerate_modules(asan_exclude_module, symbol_name); } - diff --git a/frida_mode/src/lib/lib.c b/frida_mode/src/lib/lib.c index 7fac755a..f774333d 100644 --- a/frida_mode/src/lib/lib.c +++ b/frida_mode/src/lib/lib.c @@ -39,6 +39,25 @@ typedef struct { static guint64 text_base = 0; static guint64 text_limit = 0; +#ifdef GUM_16_6_PLUS +static gboolean lib_find_exe(GumModule *module, + gpointer user_data) { + + lib_details_t *lib_details = (lib_details_t *)user_data; + const gchar *name = gum_module_get_name(module); + const gchar *path = gum_module_get_path(module); + const GumMemoryRange *range = gum_module_get_range(module); + + strncpy(lib_details->name, name, PATH_MAX); + strncpy(lib_details->path, path, PATH_MAX); + lib_details->name[PATH_MAX] = '\0'; + lib_details->path[PATH_MAX] = '\0'; + lib_details->base_address = range->base_address; + lib_details->size = range->size; + return FALSE; + +} +#else static gboolean lib_find_exe(const GumModuleDetails *details, gpointer user_data) { @@ -53,6 +72,7 @@ static gboolean lib_find_exe(const GumModuleDetails *details, return FALSE; } +#endif static void lib_validate_hdr(Elf_Ehdr *hdr) { @@ -190,4 +210,3 @@ guint64 lib_get_text_limit(void) { } #endif - diff --git a/frida_mode/src/lib/lib_apple.c b/frida_mode/src/lib/lib_apple.c index d29d0303..5046c34f 100644 --- a/frida_mode/src/lib/lib_apple.c +++ b/frida_mode/src/lib/lib_apple.c @@ -12,6 +12,25 @@ extern void gum_darwin_enumerate_modules(mach_port_t task, static guint64 text_base = 0; static guint64 text_limit = 0; +#ifdef GUM_16_6_PLUS +static gboolean lib_get_main_module(GumModule *module, + gpointer user_data) { + + GumDarwinModule **ret = (GumDarwinModule **)user_data; + const gchar *path = gum_module_get_path(module); + const GumMemoryRange *range = gum_module_get_range(module); + GumDarwinModule *darwin_module = gum_darwin_module_new_from_memory( + path, mach_task_self(), range->base_address, + GUM_DARWIN_MODULE_FLAGS_NONE, NULL); + + FVERBOSE("Found main module: %s", darwin_module->name); + + *ret = darwin_module; + + return FALSE; + +} +#else static gboolean lib_get_main_module(const GumModuleDetails *details, gpointer user_data) { @@ -27,6 +46,7 @@ static gboolean lib_get_main_module(const GumModuleDetails *details, return FALSE; } +#endif gboolean lib_get_text_section(const GumDarwinSectionDetails *details, gpointer user_data) { @@ -85,4 +105,3 @@ guint64 lib_get_text_limit(void) { } #endif - diff --git a/frida_mode/src/prefetch.c b/frida_mode/src/prefetch.c index f093cd53..74291859 100644 --- a/frida_mode/src/prefetch.c +++ b/frida_mode/src/prefetch.c @@ -262,9 +262,13 @@ static int prefetch_on_fork(void) { } static void prefetch_hook_fork(void) { - +#ifdef GUM_16_6_PLUS + void *fork_addr = + GSIZE_TO_POINTER(gum_module_find_global_export_by_name("fork")); +#else void *fork_addr = GSIZE_TO_POINTER(gum_module_find_export_by_name(NULL, "fork")); +#endif intercept_hook(fork_addr, prefetch_on_fork, NULL); } @@ -301,4 +305,3 @@ void prefetch_init(void) { iface->notify_backpatch = gum_afl_stalker_backpatcher_notify; } - diff --git a/frida_mode/src/ranges.c b/frida_mode/src/ranges.c index 1cb8ad29..b2df1930 100644 --- a/frida_mode/src/ranges.c +++ b/frida_mode/src/ranges.c @@ -116,6 +116,28 @@ static void convert_address_token(gchar *token, GumMemoryRange *range) { } +#ifdef GUM_16_6_PLUS +static gboolean convert_name_token_for_module(GumModule *module, + gpointer user_data) { + + convert_name_ctx_t *ctx = (convert_name_ctx_t *)user_data; + const GumMemoryRange *range = gum_module_get_range(module); + const gchar *path = gum_module_get_path(module); + if (path == NULL) { return true; }; + + if (!g_str_has_suffix(path, ctx->suffix)) { return true; }; + + FVERBOSE("Found module - prefix: %s, 0x%016" G_GINT64_MODIFIER + "x-0x%016" G_GINT64_MODIFIER "x %s", + ctx->suffix, range->base_address, + range->base_address + range->size, path); + + *ctx->range = *range; + ctx->done = true; + return false; + +} +#else static gboolean convert_name_token_for_module(const GumModuleDetails *details, gpointer user_data) { @@ -134,6 +156,7 @@ static gboolean convert_name_token_for_module(const GumModuleDetails *details, return false; } +#endif static void convert_name_token(gchar *token, GumMemoryRange *range) { @@ -713,4 +736,3 @@ void ranges_exclude() { } } -