frida-core icon indicating copy to clipboard operation
frida-core copied to clipboard

how to get Swift.String value when hooking swift function

Open netv1 opened this issue 5 years ago • 1 comments

Hi, I'm trying to hook a Swift function that looks like this: static TestLib.TestFacade.isReady(name: Swift.String, isTest: Swift.Bool) -> Swift.Bool

I'm hooking its symbol name (mangled): $s12TestLib11TestFacadeC02isC5Ready9name10isTestSbSS_SbtFZ like so:

Interceptor.attach(Module.findExportByName(null, '$s12TestLib11TestFacadeC02isC5Ready9name10isTestSbSS_SbtFZ'), { onEnter: function (args) { console.log('*** isTokenReady: 0:' + args[0] + ', 1:' + args[1]); //console.log('*** isTokenReady:' + Memory.readCString(args[0])); //console.log('*** isTokenReady:' + Memory.readCString(ptr(args[0]))); //console.log('*** isTokenReady:' + Memory.readUtf8String(ptr(args[0]))); //console.log('*** isTokenReady:' + Memory.readUtf16String(ptr(args[0]))); }, onLeave: function (retval) { } });

The problem is that I don't know how to get the actual content of the string (its value) to display it / use it. The only ideas I came up with are:

1). try something like args[0].add(OFFSET).readPointer().readUtf8String(); -- however I don't know the offset (since I don't know the internal representation of Swift's string) and also I'm not sure if it's UTF-8 or 16 (since before Swift 5 UTF-16 was used).

2). somehow (but how?) to create a NSString from the swift string object and display that instead.

How would you deal with this? I've searched and searched but couldn't find anything useful on this. Thanks

netv1 avatar Nov 18 '19 18:11 netv1

I would do #1. The Swift spec is public. While it can be terse and difficult if inexperienced with spec reading, it will explain to the layout of Swift objects and provide you with that offset.

#2 is interesting too, but I don't know off the top of my head the syntax for that and it sounds like additional computational over head, which starts to matter when you're doing things like say dumping every string on the heap.

eugenekolo avatar Jan 23 '20 13:01 eugenekolo