No secrets or Frida for Windows

OTUS expert - Alexander Kolesnikov shared with us a useful article, which he wrote specifically for students of the Reverse-Engineering course . Basic .







We invite you to sign up for a demo day course , in which our teachers will tell you in detail about the course program, as well as answer your questions.






! , JavaScript reverse engineering, , Linux, Windows, Android iOS.





Frida

, , Android iOS. , . ? :









? , V8, - , , . , Frida 3- :





  • Injected - V8 ;





  • Embedded - , . Frida - «frida-gadget», ;





  • Preloaded - Linux - .





    , .







Windows 

Windows. . 5 . , :





, , , . . , . , 5. radare2.





. , . , , :





: WinAPI , 1 . . , , .





Frida-Trace

, , . , , . WinAPI . . , , , . , «WriteFile»:





, frida-trace js, WinAPI «__handlers__». , :





2 , , «WriteFile». , , , , . , , , . . :





5 . log send. :





:





, , WinAPI, , , ? , frida-trace , . , , - frida.





Frida

, . , . :





, , , . «help» , . .





Frida :





  • Process - , ;





  • Memory - , ;





  • Interceptor - , .





«Your flag is at [address]». , :





radare2 - 5 , . , . «Your flag is at [address]». , .





, 0x574 . , . :





frida :





- 3 , . 1 . 2 frida.





Native call





, , 4 ( ). Frida . NativeFunction. , , . 1 . . :





:





, , . . . , . , , .





frida , . , frida , .






.













All Articles