fridaghidra

Any way to read function parameters addresses instead of values?


I'm using frida with javascript API in conjuction with ghidra to analysea shared object file.

I'm using these line of codes related to my question:

                    console.log("param_1 == ", args[0]);
                    console.log("param_1 hexdump == ", hexdump(args[0]));
                    console.log("param_2 == ", args[1]);
                    console.log("param_3 == ", args[2]);
                    console.log("param_4 == ", args[3]);
                    console.log("param_5 == ", args[4]);
                    console.log("param_6 == ", args[5]);
                    console.log("param_7 == ", args[6]);
                    console.log("param_8 == ", args[7]);
                    console.log("param_9 == ", args[8]);
                    console.log("param_10 == ", args[9]);
                    console.log("param_11 == ", args[10]);

And what i get in the console is:

param_1 ==  0x8e5f7598
param_1 hexdump == 
          0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
8e5f7598  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f75a8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f75b8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f75c8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f75d8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f75e8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f75f8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f7608  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f7618  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f7628  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f7638  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f7648  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f7658  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f7668  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f7678  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
8e5f7688  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
param_2 ==  0x21
param_3 ==  0x5876ff9d
param_4 ==  0x989aeaa7
param_5 ==  0x13e7b5a6
param_6 ==  0xf9514024
param_7 ==  0x1ab971cc
param_8 ==  0xed814090
param_9 ==  0x64c7bcff
param_10 ==  0xd9012030
param_11 ==  0x9a4cf4b

As you can see the values in parameters param_2 to param_11 are static values, is there any way to get their addresses instead?

I did try using console.log("param_5 Address == ", Memory.readPointer(args[4]));, but or it returns 0 or game a access violation error.

The reason why i wanted these addresses is because some of the functions variables in ghidra are in the stack, for example:

  uint in_stack_00000f98;
  uint in_stack_00000f9c;

And for that i need to get the stack0 address which is the param_5 in this case.


Solution

  • I was able to read the stack using this.context.sp, and this solved my issue.