211 lines
9.3 KiB
JavaScript
211 lines
9.3 KiB
JavaScript
console.log("Starting libusb_submit_transfer hook script...");
|
||
|
||
// libusb_transfer结构体定义 (根据libusb源码)
|
||
/*
|
||
struct libusb_transfer {
|
||
libusb_device_handle *dev_handle; // 0x00
|
||
uint8_t flags; // 0x08 (64位) / 0x04 (32位)
|
||
unsigned char endpoint; // 0x09 / 0x05
|
||
unsigned char type; // 0x0A / 0x06
|
||
unsigned int timeout; // 0x0C / 0x08
|
||
enum libusb_transfer_status status; // 0x10 / 0x0C
|
||
int length; // 0x14 / 0x10
|
||
int actual_length; // 0x18 / 0x14
|
||
libusb_transfer_cb_fn callback; // 0x20 / 0x18
|
||
void *user_data; // 0x28 / 0x1C
|
||
unsigned char *buffer; // 0x30 / 0x20
|
||
int num_iso_packets; // 0x38 / 0x24
|
||
struct libusb_iso_packet_descriptor iso_packet_desc[0]; // 0x40 / 0x28
|
||
};
|
||
*/
|
||
|
||
// 传输类型枚举
|
||
const LIBUSB_TRANSFER_TYPE = {
|
||
0: "LIBUSB_TRANSFER_TYPE_CONTROL",
|
||
1: "LIBUSB_TRANSFER_TYPE_ISOCHRONOUS",
|
||
2: "LIBUSB_TRANSFER_TYPE_BULK",
|
||
3: "LIBUSB_TRANSFER_TYPE_INTERRUPT"
|
||
};
|
||
|
||
// 传输状态枚举
|
||
const LIBUSB_TRANSFER_STATUS = {
|
||
0: "LIBUSB_TRANSFER_COMPLETED",
|
||
1: "LIBUSB_TRANSFER_ERROR",
|
||
2: "LIBUSB_TRANSFER_TIMED_OUT",
|
||
3: "LIBUSB_TRANSFER_CANCELLED",
|
||
4: "LIBUSB_TRANSFER_STALL",
|
||
5: "LIBUSB_TRANSFER_NO_DEVICE",
|
||
6: "LIBUSB_TRANSFER_OVERFLOW"
|
||
};
|
||
|
||
// 传输标志
|
||
const LIBUSB_TRANSFER_FLAGS = {
|
||
1: "LIBUSB_TRANSFER_SHORT_NOT_OK",
|
||
2: "LIBUSB_TRANSFER_FREE_BUFFER",
|
||
4: "LIBUSB_TRANSFER_FREE_TRANSFER",
|
||
8: "LIBUSB_TRANSFER_ADD_ZERO_PACKET"
|
||
};
|
||
|
||
function parseTransferFlags(flags) {
|
||
var flagStrings = [];
|
||
for (var flag in LIBUSB_TRANSFER_FLAGS) {
|
||
if (flags & parseInt(flag)) {
|
||
flagStrings.push(LIBUSB_TRANSFER_FLAGS[flag]);
|
||
}
|
||
}
|
||
return flagStrings.length > 0 ? flagStrings.join(" | ") : "None";
|
||
}
|
||
|
||
function dumpBuffer(buffer, length, maxBytes = 64) {
|
||
if (!buffer || buffer.isNull()) {
|
||
console.log("Buffer is NULL");
|
||
return;
|
||
}
|
||
|
||
try {
|
||
var nLen = length.toInt32 ? length.toInt32() : parseInt(length);
|
||
var bytesToPrint = Math.min(nLen, maxBytes);
|
||
|
||
if (buffer && nLen > 0) {
|
||
console.log("数据十六进制输出（前" + bytesToPrint + "字节）:");
|
||
|
||
// 最原始的读取方法
|
||
var hexOutput = "";
|
||
for (var i = 0; i < bytesToPrint; i++) {
|
||
try {
|
||
// 尝试使用ptr对象的属性
|
||
var byteValue = buffer.add(i).readU8();
|
||
var hexByte = byteValue.toString(16).padStart(2, "0");
|
||
hexOutput += hexByte + " ";
|
||
if ((i + 1) % 16 === 0) {
|
||
hexOutput += "\n";
|
||
}
|
||
} catch (readErr) {
|
||
console.log("读取字节" + i + "时出错:", readErr);
|
||
break;
|
||
}
|
||
}
|
||
console.log(hexOutput);
|
||
|
||
if (nLen > maxBytes) {
|
||
console.log("... (truncated, showing " + bytesToPrint + " of " + nLen + " bytes)");
|
||
}
|
||
} else {
|
||
console.log('buffer 指针无效 或 length <= 0');
|
||
}
|
||
} catch (e) {
|
||
console.log('读取buffer时出错:', e);
|
||
console.log('错误详情:', e.stack || e.toString());
|
||
}
|
||
}
|
||
|
||
// Hook libusb_submit_transfer
|
||
const submit_transfer_symbol = DebugSymbol.fromName("libusb_submit_transfer");
|
||
console.log("libusb_submit_transfer symbol info:", submit_transfer_symbol);
|
||
|
||
if (submit_transfer_symbol && submit_transfer_symbol.address && !submit_transfer_symbol.address.isNull()) {
|
||
Interceptor.attach(submit_transfer_symbol.address, {
|
||
onEnter: function(args) {
|
||
console.log("\n================================");
|
||
console.log("[LIBUSB] libusb_submit_transfer called");
|
||
console.log("================================");
|
||
|
||
var transfer = args[0];
|
||
if (!transfer || transfer.isNull()) {
|
||
console.log("Transfer structure is NULL!");
|
||
return;
|
||
}
|
||
|
||
try {
|
||
// 检测系统架构
|
||
var ptrSize = Process.pointerSize;
|
||
var is64bit = (ptrSize === 8);
|
||
|
||
// 根据实际的libusb_transfer结构体布局调整偏移量
|
||
// 64位系统的正确偏移量
|
||
if (is64bit) {
|
||
var dev_handle = transfer.readPointer(); // 0x00
|
||
var flags = transfer.add(8).readU8(); // 0x08
|
||
var endpoint = transfer.add(9).readU8(); // 0x09
|
||
var type = transfer.add(10).readU8(); // 0x0A
|
||
var timeout = transfer.add(12).readU32(); // 0x0C
|
||
var status = transfer.add(16).readU32(); // 0x10
|
||
var length = transfer.add(20).readU32(); // 0x14
|
||
var actual_length = transfer.add(24).readU32(); // 0x18
|
||
var callback = transfer.add(32).readPointer(); // 0x20
|
||
var user_data = transfer.add(40).readPointer(); // 0x28
|
||
var buffer = transfer.add(48).readPointer(); // 0x30
|
||
var num_iso_packets = transfer.add(56).readU32(); // 0x38
|
||
} else {
|
||
// 32位系统的偏移量
|
||
var dev_handle = transfer.readPointer(); // 0x00
|
||
var flags = transfer.add(4).readU8(); // 0x04
|
||
var endpoint = transfer.add(5).readU8(); // 0x05
|
||
var type = transfer.add(6).readU8(); // 0x06
|
||
var timeout = transfer.add(8).readU32(); // 0x08
|
||
var status = transfer.add(12).readU32(); // 0x0C
|
||
var length = transfer.add(16).readU32(); // 0x10
|
||
var actual_length = transfer.add(20).readU32(); // 0x14
|
||
var callback = transfer.add(24).readPointer(); // 0x18
|
||
var user_data = transfer.add(28).readPointer(); // 0x1C
|
||
var buffer = transfer.add(32).readPointer(); // 0x20
|
||
var num_iso_packets = transfer.add(36).readU32(); // 0x24
|
||
}
|
||
|
||
console.log("Transfer Structure Details:");
|
||
console.log(" - Architecture: " + (is64bit ? "64-bit" : "32-bit"));
|
||
console.log(" - Transfer Address: " + transfer);
|
||
console.log(" - Device Handle: " + dev_handle);
|
||
console.log(" - Flags: 0x" + flags.toString(16) + " (" + parseTransferFlags(flags) + ")");
|
||
console.log(" - Endpoint: 0x" + endpoint.toString(16) + " (" +
|
||
(endpoint & 0x80 ? "IN" : "OUT") + ", EP" + (endpoint & 0x7F) + ")");
|
||
console.log(" - Type: " + type + " (" + (LIBUSB_TRANSFER_TYPE[type] || "Unknown") + ")");
|
||
console.log(" - Timeout: " + timeout + " ms");
|
||
console.log(" - Status: " + status + " (" + (LIBUSB_TRANSFER_STATUS[status] || "Unknown") + ")");
|
||
console.log(" - Length: " + length + " bytes");
|
||
console.log(" - Actual Length: " + actual_length + " bytes");
|
||
console.log(" - Callback: " + callback);
|
||
console.log(" - User Data: " + user_data);
|
||
console.log(" - Buffer: " + buffer);
|
||
console.log(" - Num ISO Packets: " + num_iso_packets);
|
||
|
||
// 调试：打印buffer指针的具体值
|
||
console.log(" - Buffer pointer value: " + buffer.toString());
|
||
console.log(" - Buffer is null: " + buffer.isNull());
|
||
|
||
// 如果有数据缓冲区，打印前64字节
|
||
if (!buffer.isNull() && length > 0) {
|
||
console.log("\nBuffer Data:");
|
||
dumpBuffer(buffer, length);
|
||
} else {
|
||
console.log("\nBuffer is null or length is 0");
|
||
console.log(" - Buffer null check: " + buffer.isNull());
|
||
console.log(" - Length: " + length);
|
||
}
|
||
|
||
// 对于同步传输，打印更多详细信息
|
||
if (num_iso_packets > 0) {
|
||
console.log("\nIsochronous Transfer - Packet Count: " + num_iso_packets);
|
||
// 可以进一步解析ISO包描述符
|
||
}
|
||
|
||
} catch (e) {
|
||
console.log("Error reading transfer structure: " + e.message);
|
||
console.log('错误详情:', e.stack || e.toString());
|
||
}
|
||
},
|
||
|
||
onLeave: function(retval) {
|
||
console.log("\n[LIBUSB] libusb_submit_transfer returned: " + retval);
|
||
if (retval.toInt32() !== 0) {
|
||
console.log(" - Error occurred during transfer submission");
|
||
}
|
||
console.log("================================\n");
|
||
}
|
||
});
|
||
console.log("Successfully hooked libusb_submit_transfer");
|
||
} else {
|
||
console.log("libusb_submit_transfer not found");
|
||
}
|
||
|
||
console.log("libusb_submit_transfer hook script loaded successfully!"); |