Frida:使用命令行参数生成Windows/Linux进程

问题似乎是争论始于 - 。对于不以 - 使用frida选项 -f 作品:

frida -l myscript.js -f process_to_spawn.exe argForProcess

但我需要这个论点 --argForProcess 我找到的唯一方法是挂接main方法,该方法处理命令行参数并在调用main之前修改参数。

以下代码适用于Windows 10,它似乎以wchar/“Unicode”/UTF-16字符串的形式传递参数。它改变了 argc 和 argv 的参数 main 从一个参数(可执行文件本身)到两个参数(可以执行文件加一个参数)。

let mainPointer = DebugSymbol.fromName("main").address;
Interceptor.attach(mainPointer, {
    onEnter(args) {
        // args[0] = int argc
        // args[1] = wchar *argv[]

        let myarg1 = Memory.allocUtf16String("Myexecutable.exe");
        let myarg2 = Memory.allocUtf16String("--argumentX");
        let newArgv = Memory.alloc(2 * Process.pointerSize); // allocate space for the two argument pointers
        newArgv.writePointer(myarg1);
        newArgv.add(Process.pointerSize).writePointer(myarg2);

        // save all created memory blocks so they don't get garbage collected before main method is completed
        this.myarg1 = myarg1; 
        this.myarg2 = myarg2;
        this.newArgs = newArgv;
        
        // Overwrite the argument counter and the argument char**
        args[0] = ptr(2);
        args[1] = newArgs;
        
        console.log("main(" + args[0] + ", " + args[1].readPointer().readUtf16String() + ", " + args[1].add(Process.pointerSize).readPointer().readUtf16String() + ")");
    }
});