MacOS下用Frida注入目标进程的流程

1、cd /Applications/appninja.app/Contents/MacOS
DYLD_INSERT_LIBRARIES=/Users/appninja/Desktop/appninja/frida-gadget-15.2.2-macos-universal.dylib ./target

2、frida-ps -R
 PID  Name
----  ------
1609  Gadget

3、frida-trace -R 1609 -i read

4、frida -R 1609 -l inject.js --no-pause

[Remote::PID::1609 ]-> %reload 

 
 
console.log("frida inject begin....");
 
function get_rva(module, offset) {
    var base_addr = Module.findBaseAddress(module);
    if (base_addr == null)
        base_addr = enum_to_find_module(module);
    console.log(module + ' baseAddr:' + base_addr);
    var target_addr = base_addr.add(offset);
 
    return target_addr;
}
 
 
var target_addr = get_rva("app", 0x1f000);
console.log("target_addr:" + target_addr);
Interceptor.attach(ptr(target_addr), {
    onEnter: function(args) {
        console.log("Enter check()")
    },
    onLeave: function(retval) {
        console.log("return:" + retval.toInt32());
        retval.replace(ptr(0x64)); 
    },
});
 
console.log("frida inject end!");