Frida JavaScript APIs are well described in the API documentation. If we can supply a A tag already exists with the provided branch name. * Called synchronously when about to call recvfrom. Substract that from the shown address in the function name and in Frida at runtime add the base address of the module the function belongs to. call.py with the contents: and keep a watchful eye on the terminal (still) running hello: Injecting integers is really useful, but we can also inject strings, Why are players required to record the moves in World Championship Classical games? This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. In your question on SO you wrote that the argument type is. The one loaded by frida contains the hooked function pointer and using findExportByName won't return it's address. Functions I'm interested in are not exported. bytes 0x1388, or 5000 in dec. previously I loaded the lib into ghidra and auto analyzed it and then used this python script, just to get frida hooks on functions interested. Frida cheat sheet - Home This tiny yet powerful app lets us check the iOS application for the certificates, requirements and entitlements, embedded provisioning profiles, auxiliary e June 01, 2018 frida-trace -U com.foobar.helloworld -a libfoo.so!0x1234. Browse other questions tagged, Where developers & technologists share private knowledge with coworkers, Reach developers & technologists worldwide, thanks for reply dear @Robert. this.lib = Memory.readUtf8String(args[0]); console.log("[*] dlopen called with: " + this.lib); Interceptor.attach(Module.findBaseAddress(moduleName).add(nativeFuncAddr), {, console.log("[*] hook invoked", JSON.stringify({{arguments}}, null, ', $ python3.x+ script.py --method SomeClass::someMethod --app com.company.app --module libfoo.so, :param app_id: application identifier / bundle id, :param module_id: shared object identifier / known suffix, will iterate loaded modules (@see dlopen), :return: hook native method and print arguments when invoked, # TODO extract all app's modules via `adb shell -c 'ls -lR /data/app/' + app_if + '*' | grep "\.so"`, '[+] Method not found, remove method flag to get list of methods to select from, `nm` stdout:', 'method name "SomeClass::someMethod", if empty it will print select-list'. --no-pause to tell frida not to pause the app when it first starts so we don't have to manually resume it (Optional) So as you can see, Frida injected itself into Twitter, enumerated the loaded shared libraries and hooked all the functions whose names start with either recv or read. way: Keeping a beady eye on the output of hi, you should see something along these so what I wanted is that is there in frida a way to get all non-exported functions and their addresses to hook them. such as android JNI function, and some functions not export. const f = new NativeFunction(ptr("%s"), 'void', ['int']); However, Frida's interceptor never seems to trigger. Simple deform modifier is deforming my object. At first I was thinking perhaps Frida does not hook routines that are not exported, but this thread seems to indicate that it should. Making statements based on opinion; back them up with references or personal experience. 565), Improving the copy in the close modal and post notices - 2023 edition, New blog post from our CEO Prashanth: Community is the future of AI, How can I hook structure members in frida, Calling a method of a Java object passed as argument to hooked function in Frida. Profiling C++ code with Frida - LIEF I disassembled an arm64 executable, when running the app on my iPhone, I can see a lot of classes also in the disassembled executable, but I can't reach these sub_ objects. I know the offsets of functions that I want to hook, and I've verified I'm hooking the correct addresses with hexdumps. Create the file sockaddr_in which the program spits out as part of its operation: If you are not fully familiar with the structure of a struct, there are many process. const st = Memory.allocUtf8String("TESTMEPLZ! That is the address you can hook in Frida. // First, let's give ourselves a bit of memory to put our struct in: Alternatively you can hook more methods. This is fairly standard code, and calls out to any IP address given as the ./client 127.0.0.1, you should see the message appear in netcat, and also Press ENTER key to Continue, """ Once you have started frida-trace it creates a folder named __handlers__ where all the generated hooking code is placed (one for each method). However, do not use Hook JNI by address; Hook constructor; Hook Java reflection; Trace class; Hooking Unity3d; Get Android ID; Change location; Bypass FLAG_SECURE; Shared Preferences update; Hook all method overloads; Register broadcast receiver; Increase step count; File system access hook $ frida --codeshare FrenchYeti/android-file-system-access-hook -f com . // Now we need to fill it - this is a bit blunt, but works In a similar way to before, we can create a script stringhook.py, using Frida // console.log(Log.getStackTraceString(Exception.$new())); much the source code. 565), Improving the copy in the close modal and post notices - 2023 edition, New blog post from our CEO Prashanth: Community is the future of AI. * @param {array} args - Function arguments represented as That is the common way on Stackoverflow to say Thank you. Interceptor.attach(Module.getExportByName(null, 'connect'), { CMLoot : Find Interesting Files Stored On (System Center) Configuration Manager RedditC2 : Abusing Reddit API To Host The C2 Traffic. Site design / logo 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. Frida-trace is a front-end for frida that allows automatic generation of hooking code for methods based on pattern. https://awesomeopensource.com/project/iddoeldor/frida-snippets, Categories: Interceptor.attach(ptr("%s"), { the JavaScript API but Frida also provides in the first place the frida-gum SDK 1 that exposes a C API ]. I assume you have to know the address and the new hex value of the encoded b.eq command. Setting up the experiment Create a file hello.c: What differentiates living as mere roommates from living in a marriage-like relationship? // execute original and save return value, // conditions to not print garbage packets, // 0 = // https://developer.android.com/reference/android/widget/Toast#LENGTH_LONG, // print stacktrace if return value contains specific string, // $ nm --demangle --dynamic libfoo.so | grep "Class::method(", * If an object is passed it will print as json, * -i indent: boolean; print JSON prettify, // getting stacktrace by throwing an exception, // quick&dirty fix for java.io.StringWriter char[].toString() impl because frida prints [object Object], // avoid java.lang.ClassNotFoundException, 'android.view.WindowManager$LayoutParams', 'android.app.SharedPreferencesImpl$EditorImpl', // https://developer.android.com/reference/android/hardware/SensorEvent#values, // https://developer.android.com/reference/android/hardware/SensorManager#SENSOR_STATUS_ACCURACY_HIGH, // class that implements SensorEventListener. Horizontal and vertical centering in xltabular. * to be presented to the user. Note that we need to load the script first before resuming if we need to perform early interception. }); now looks like I am getting a result, when I run the above frida script with slight modification of, Are you sure base is 00100000 and not 0x100000 (hex)? Under Settings -> Security you can install new trusted certificates. object into memory and hooking our process with Frida, and using Interceptor """, # Here's some message handling.. If you want to also see the stack trace you have to modify the generated hooking code and add the code for printing stack trace as shown in this answer. How a top-ranked engineering school reimagined CS curriculum (Ep. My work around is to hook dlsym and replace the address of the target function to the modified function in second libfoo.so. Since (spoiler) I started to implement a parser for the Dyld shared cache and The first point is easy to solve: just take it from the chat hook when we call the "!tp" command. * For full API reference, see: To profile memory consumption, valgrind --tool=massif does the job pretty well out of the box: We have successfully hijacked the raw networking by injecting our own data const Exception = Java.use("java.lang.Exception"); Dilemma: when to use Fragments vs Activities: How to get the return value of a Java method using Frida, can anyone help me how to hook java.net.Socket.connect(java.net.SocketAddress, int) with frida on an Android device. It support script for trace classes, functions, and modify the return values of methods on iOS platform. to use Codespaces. and always report 1337, until you hit Ctrl-D to detach from it. send('Injecting malicious byte array:'); const f = new NativeFunction(ptr("%s"), 'int', ['pointer']); Such methods don't have a name and thus need to be accessed using their address. #include I informe May 14, 2019 Android Hooking in Frida | Node Security This article shows the most useful code snippets for copy&paste to save time reading the lengthy documentation page. args[1] = st; onEnter(args) { The frida-trace documentation uses the term -j '*! If a hooked method calls directly or indirectly another hooked method frida will automatically indent the method names so that you get a lightweight stack trace. Connect and share knowledge within a single location that is structured and easy to search. The base address of an Android app is random (because of ASLR), so you have to do some math to convert the function address from Ghidra to the hooking address in Frida, @Robert, Thank you for putting up with my ignorance. Connect and share knowledge within a single location that is structured and easy to search. * Preventing functions from being stripped from a static library when linked into a shared library? examples that you are meant to edit to taste, and will be automatically reloaded ("The thread function address is "+ func_addr)}})} arguments, and do custom calls to functions inside a target process. wanted to get and hook those non-exported functions, tried possibilities but still no luck, for example; this stack overflow question though it looks like my problem and still get not applicable the solution mentioned there. Now, those scripts are just Binary instrumentation with Frida on Linux (Part 1) | monosource f(1911); # [ It's a little bit more meaningful to read as output :-D Why the obscure but specific description of Jane Doe II in the original complaint for Westenbroek v. Kappa Kappa Gamma Fraternity? It is easy since they are named from it, like so: loc_342964. instrument the source code through the -finstrument-functions compilation flag. may be? If the function is exported, then you can just call Module.findExportByName method with exported function name with DLL name. The frida-trace command-line argument for hooking an Java/Android method is -j. onEnter(args) { To subscribe to this RSS feed, copy and paste this URL into your RSS reader. Can I use the spell Immovable Object to create a castle which floats above the clouds? * state across function calls. This way only works for exported functions. send('Allocating memory and writing bytes'); That is the address you can hook in Frida. *certificate*/isu' which sets the options to isu: For searchinf for bark in all classes you have to start frida-trace this way: frida-trace -j "*!bark*". Supported targets are: Windows macOS GNU/Linux iOS Android QNX In Frida we can call functions located inside the binary though NativeFunction. 565), Improving the copy in the close modal and post notices - 2023 edition, New blog post from our CEO Prashanth: Community is the future of AI. On such apps frida-trace will not recognize all classes of the app when attaching to it. To reduce UI related functions I ues the following steps: Set hooks before DT_INIT_ARRAY ( source ), Example of quick&dirty iOS device properties extraction. what this script does is that it gets all functions in the lib and then generates frida hook script for them, may be technically some fallacies, didn't investigate it. This approach can be quite convenient to isolate the profiling process Why did DOS-based Windows require HIMEM.SYS to boot? then passed into functions as pointer arguments. third terminal run ./struct_mod.py. Hacking, October 02, 2019 Learn more about Stack Overflow the company, and our products. Quick-start guide | Frida A world-class dynamic instrumentation toolkit Is "I didn't think it was serious" usually a good defence against "duty to rescue"? Frida Hooking Native Functions - Medium announces itself by sending the string "Hello there!" Is it possible to hook a sub_ object in Frida ? Passing negative parameters to a wolframscript. be able to send messages back to client in return. previously I loaded the lib into ghidra and auto analyzed it and then used this python script, just to get frida hooks on functions interested. Please edit your question and add the relevant parts of the Frida code you use. * @this {object} - Object allowing you to store state for EDIT - issue identified. I'm dealing with a stripped ELF arm64 shared object that came from an APK. sign in An example for an method address calculation in the app main binary is shown here: reverseengineering.stackexchange.com/a/30881/1848, How a top-ranked engineering school reimagined CS curriculum (Ep. Has anyone been diagnosed with PTSD and been able to get a first class medical? except that it is done post-compilation. It only takes a minute to sign up. * @param {object} state - Object allowing you to keep #include so apparently the function address is a miss. You usually come across it in relation to code profiling done in order to optimize performance or find memory leaks. * It is also possible to modify arguments by assigning a Which ability is most related to insanity: Wisdom, Charisma, Constitution, or Intelligence? I'm pretty positive that the hooked functions are being called from the app through JNI native code. Regarding the code execution, we can profile it with: In the context of profiling LIEF, Im mostly interested in profiling the code at the functions level: The first step in using Frida for hooking is finding the target function. What were the most popular text editors for MS-DOS in the 1980s? Useful to show lack of secure attribute on sensitive fields allowing data copying. by the client. For example the term -j '*! Use Quick Assist to help users - Windows Client Management What positional accuracy (ie, arc seconds) is necessary to view Saturn, Uranus, beyond? A boy can regenerate, so demons eat him for years. The method visible in the Ghidra screen-shot you have posted however seems to be an internal function that do not even have a name. By clicking Accept all cookies, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy. * I'm learning and will appreciate any help. Couple this with the python ctypes library, and Making statements based on opinion; back them up with references or personal experience. Why does Acts not mention the deaths of Peter and Paul? Frida-Ios-Hook : A Tool That Helps You Easy Trace Classes, Functions, And Modify The Return Values. setup the hook engine. What differentiates living as mere roommates from living in a marriage-like relationship? If the Image base is not 0 you have to substract this values from the shown address to get the address you can use for hooking. YMMV We can also alter the entire logic of the hooked function. engineering not only for reverse-engineering :). What is this brick with a round back and a stud on the side used for? * NativePointer object to an element of this array. over the connection. Find centralized, trusted content and collaborate around the technologies you use most. How to export Unity to Android Studio with ARM v8 support? The official definition from its tutorial page explains, frida-trace is a command line tool for "dynamically tracing function calls", and is part of the Frida toolset: frida-trace -U -i "Java_*" [package_name] frida-trace -U -I "openssl_ mybank.so" co.uk.myBank. Add output example for List modules snippets, https://frida.re/docs/javascript-api/#cmodule, https://frida.re/news/2019/09/18/frida-12-7-released/, https://stackoverflow.com/a/54818023/2655092, How to remove/disable java hooks ? We can do the same by manipulating the struct Calling native functions from Android Java - alternative to JNI, Linking cross-platform library to native android application. source. Why did US v. Assange skip the court of appeal? Browse other questions tagged, Where developers & technologists share private knowledge with coworkers, Reach developers & technologists worldwide. * Called synchronously when about to return from recvfrom. OpenSSL 1.0.2 certificate pinning hook on arm64, improved pattern, possibly for different compiler version or slighlty updated OpenSSL, use if first version does not find patch location. I was not completely convinced with this solution Assign, Code is copied to system clipboard (using. The best answers are voted up and rise to the top, Start here for a quick overview of the site, Detailed answers to any questions you might have, Discuss the workings and policies of this site. and indeed, any other kind of object you would require for fuzzing/testing. (-j JAVA_METHOD, --include-java-method JAVA_METHOD include JAVA_METHOD -i FUNCTION, --include FUNCTION include [MODULE!]FUNCTION). Frida is particularly useful for dynamic analysis on Android/iOS/Windows applications. However, Frida's interceptor never seems to trigger. map: Last but not least, we might want to profile private or protected functions. By clicking Accept all cookies, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy. Connect and share knowledge within a single location that is structured and easy to search. * @this {object} - Object allowing you to access state The shown name like FUN_002d5044 is generated by Ghidra as the function has no name. * Only one JavaScript function will execute at a time, so How to avoid reverse engineering of an APK file. BEAD NEWS BEARS you can and have been able to for years with the right environment. Lets take a simple example to explain what Frida does. Hacking a game to learn FRIDA basics (Pwn Adventure 3) It appears that X86Writer / ArmWriter can do this, but I don't want to actually modify the instructions being executed, I want to inspect memory at particular locations (in particular the stackframe). execution time, the callback at the beginning of the function can initialize a std::chrono object I assume you are using frida's method Module.findExportByName. Not the answer you're looking for? does frida support hook a function by module + offset #249 - Github For example, I want to find all method that starts with "bark" and then dumps backtrace, return value, and other arguments. Module.findExportByName (dllName, name) Null address in Sslpinning bypass of flutter app by using frida Why are players required to record the moves in World Championship Classical games? less than 1 minute read. Learn more about the CLI. We will then call this use this script with frida on our target application: frida -U -f com.example.app -l webview.js --no-pause. Frida has the capability to patch memory, check Frida API documentation. Are you sure you want to create this branch? An example for intercepting libc#open & logging backtrace if specific file was opened. st.writeByteArray([0x02, 0x00, 0x13, 0x89, 0x7F, 0x00, 0x00, 0x01, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30]); Now, we can start having some fun - as we saw above, we can inject strings and What positional accuracy (ie, arc seconds) is necessary to view Saturn, Uranus, beyond? own tools using the Python API that frida-trace is built on top of. your Twitter application to trigger some network activity. Press CTRL + Windows + Q. Frida works on compiled code and provides a mechanism (hook) to insert a callback before We show how to use Frida to inspect functions as they are called, modify their Embedded hyperlinks in a thesis or research paper, User without create permission can create a custom object from Managed package using Custom Rest API. // In NativeFunction param 2 is the return value type, what this script does is that it gets all functions in the lib and then generates frida hook script for them, may be technically some fallacies, didn't investigate it. // change to null in order to disable the proxy. If we want something like weak_classdump, to list classes from executable it self only, Objective C runtime already provides such function objc_copyClassNamesForImage. Frida: spawn a Windows/Linux process with command-line arguments, get a variable value from a method at runtime with frida, "Signpost" puzzle from Tatham's collection, the Allied commanders were appalled to learn that 300 glider troops had drowned at sea. bili frida_~-CSDN For the impatient, heres how to do function tracing with Frida: So as you can see, Frida injected itself into Twitter, enumerated the loaded Await until specific DLL will load in Unity app, can implement hot swap. * """, """ Is there any known 80-bit collision attack? Find centralized, trusted content and collaborate around the technologies you use most. Once you have started frida-trace it creates a folder named __handlers__ where all the generated hooking code is placed (one for each method). Noseyparker : Find Secrets And Sensitive Information In Textual Data And MSI Dump : A Tool That Analyzes Malicious MSI Installation, Frida iOS Hook | Basic Usage | Install List devices List apps List scripts Logcat Shell, Frida iOS Hook | Basic Usage | Dump Decrypt IPA Dump Memory App Hexbyte-Scan IPA, Frida iOS Hook | Basic Usage | App Static Bypass Jailbreak Bypass SSL Intercept URL + Crypto, Dump iOS url scheme when openURL is called, Dump the current on-screen User Interface structure, Dump all methods inside classes owned by the app only, hook-all-methods-of-all-classes-app-only.js, Hook all the methods of all the classes owned by the app, Hook all the methods of a particular class, Hook a particular method of a specific class, Intercept calls to Apples NSLog logging function. Now, lets have a look at the generated recvfrom.js: Now, replace the log() line with the following: Save the file (it will be reloaded automatically) and perform some action in from the compilation process. To learn more, see our tips on writing great answers. Support staff ("helper") and the user ("sharer") can start Quick Assist in any of a few ways: Type Quick Assist in the Windows search and press ENTER. The Common Vulnerabilities and Exposures (CVE) Program has assig June 06, 2018 565), Improving the copy in the close modal and post notices - 2023 edition, New blog post from our CEO Prashanth: Community is the future of AI, Frida script returning different instruction at address compared to entering commands in repl. Github but the next section covers some tricky parts. To subscribe to this RSS feed, copy and paste this URL into your RSS reader. How to force Unity Editor/TestRunner to run at full speed when in background? How a top-ranked engineering school reimagined CS curriculum (Ep. Firstly, and as mentioned previous section, Frida takes a void* pointer on the function to hook. a large codebase. Unexpected uint64 behaviour 0xFFFF'FFFF'FFFF'FFFF - 1 = 0? Is a downhill scooter lighter than a downhill MTB with same performance? This is the general way of hooking functions in frida, but its up to you to determine which functions you think are important in the Android environment. registerNativeMethods can be used as anti reversing technique to the native .so libraries, e.g. You must call removeView() on the child's parent first when hooking, how do you solve it? * stored in onEnter. How to hook methods with specific arguments in Frida? For some reasons, frida . This DoS bug was reported to Tencent, but they decided not to fix because its not critical. Functions | Frida A world-class dynamic instrumentation toolkit Browse other questions tagged, Start here for a quick overview of the site, Detailed answers to any questions you might have, Discuss the workings and policies of this site. rev2023.5.1.43405. opaque Profile structure: Through this blog post, we have shown that Frida also has some applications in the field of software // retval.replace(0); // Use this to manipulate the return value a given function and after the execution of the function. Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. } Read value from frida hooked native method basic_string parameter Consequently, instead of using an enum we use the functions absolute address and we register its name in a Are these quarters notes or just eighth notes? */, /** Two MacBook Pro with same model number (A1286) but different year. to get the void*: Secondly, the example frida-gum-example.c uses an enum to identify the function being hooked: In our case, we dont know beforehand which functions will be hooked or profiled by the user. To setup a hook, we only have to provide a pointer to the function that aims at being hooked. It also generated some boilerplate scripts for taking care Can I use an 11 watt LED bulb in a lamp rated for 8.6 watts maximum? Extracting arguments from a list of function calls, Simple deform modifier is deforming my object, the Allied commanders were appalled to learn that 300 glider troops had drowned at sea, Embedded hyperlinks in a thesis or research paper. The trick here is to use a union resources online that will tell you whats what. Does the order of validations and MAC with clear text matter? By clicking Post Your Answer, you agree to our terms of service, privacy policy and cookie policy. By clicking Post Your Answer, you agree to our terms of service, privacy policy and cookie policy. * For example use args[0].readUtf8String() if the first Are there any canonical examples of the Prime Directive being broken that aren't shown on screen? What should I follow, if two altimeters show different altitudes? // size LSB (=1) indicates if it's a long string, // can also use `new NativeFunction(Module.findExportByName(null, 'mprotect'), 'int', ['pointer', 'uint', 'int'])(parseInt(this.context.x2), 2, 0)`, // for f in /proc/`pidof $APP`/fd/*; do echo $f': 'readlink $f; done, # print(" output: pid={}, fd={}, data={}".format(pid, fd, repr(data))), 'cat /System/Library/PrivateFrameworks/Example.framework/example', # /tmp/example: Mach-O 64-bit 64-bit architecture=12 executable, // to list exports use Module.enumerateExportsSync(m.name), "android.hardware.graphics.mapper@2.0.so", "/system/lib64/android.hardware.graphics.mapper@2.0.so", "android.hardware.graphics.mapper@2.1.so", "/system/lib64/android.hardware.graphics.mapper@2.1.so", "android.hardware.graphics.mapper@3.0.so", "/system/lib64/android.hardware.graphics.mapper@3.0.so", "android.hardware.graphics.mapper@2.0-impl-2.1.so", "/vendor/lib64/hw/android.hardware.graphics.mapper@2.0-impl-2.1.so", "/system/lib64/vndk-sp-29/android.hardware.graphics.mapper@2.0.so", "/system/lib64/vndk-sp-29/android.hardware.graphics.mapper@2.1.so", "/data/app/com.noodlecake.altosadventure-O2YLuwCOq7LbWSkRHkRLcg==/oat/arm64/base.odex", "/data/app/com.noodlecake.altosadventure-O2YLuwCOq7LbWSkRHkRLcg==/lib/arm64/libfrida-gadget.so", "/data/app/com.noodlecake.altosadventure-O2YLuwCOq7LbWSkRHkRLcg==/lib/arm64/libmain.so", "/data/app/com.noodlecake.altosadventure-O2YLuwCOq7LbWSkRHkRLcg==/lib/arm64/libunity.so", "/data/app/com.noodlecake.altosadventure-O2YLuwCOq7LbWSkRHkRLcg==/lib/arm64/libil2cpp.so", "/data/user_de/0/com.google.android.gms/app_chimera/m/00000278/oat/arm64/DynamiteLoader.odex", "/data/app/com.google.android.gms-j7RpxBsNAd3ttAYEdp2ahg==/oat/arm64/base.odex", "/data/app/com.google.android.trichromelibrary_432418133-X7Kc2Mqi-VXkY12N59kGug==/oat/arm64/base.odex", "/data/app/com.google.android.webview-w6i6OBFZ7T_wK4W4TpDAiQ==/oat/arm64/base.odex", "/data/app/com.google.android.webview-w6i6OBFZ7T_wK4W4TpDAiQ==/base.apk!/lib/arm64-v8a/libmonochrome.so", "/data/app/com.noodlecake.altosadventure-O2YLuwCOq7LbWSkRHkRLcg==/lib/arm64/libnativeNoodleNews.so", "/data/app/com.google.android.gms-j7RpxBsNAd3ttAYEdp2ahg==/base.apk!/lib/arm64-v8a/libconscrypt_gmscore_jni.so", // search "215" @ https://docs.oracle.com/javase/8/docs/technotes/guides/jni/spec/functions.html, // intercepting FindClass to populate Map, // RegisterNative(jClass*, .., JNINativeMethod *methods[nMethods], uint nMethods) // https://android.googlesource.com/platform/libnativehelper/+/master/include_jni/jni.h#977, https://android.googlesource.com/platform/libnativehelper/+/master/include_jni/jni.h#129, // https://www.frida.re/docs/javascript-api/#debugsymbol, // methodsPtr.readPointer().readCString(), // char* name, // char* signature TODO Java bytecode signature parser { Z: 'boolean', B: 'byte', C: 'char', S: 'short', I: 'int', J: 'long', F: 'float', D: 'double', L: 'fully-qualified-class;', '[': 'array' } https://github.com/skylot/jadx/blob/master/jadx-core/src/main/java/jadx/core/dex/nodes/parser/SignatureParser.java, "_ZN3art3JNI21RegisterNativeMethodsEP7_JNIEnvP7_jclassPK15JNINativeMethodib", $ c++filt "_ZN3art3JNI21RegisterNativeMethodsEP7_JNIEnvP7_jclassPK15JNINativeMethodib", art::JNI::RegisterNativeMethods(_JNIEnv*, _jclass*, JNINativeMethod const*, int, bool), // output schema: className#methodName(arguments)returnVal@address, // package & class, replacing forward slash with dot for convenience, c/c++ variable type to javascript reader switch implementation, # TODO handle other arguments, [long, longlong..], :return: javascript to read the type of variable, 'Memory.readUtf8String(Memory.readPointer(args[%d])),'.