I'm using frida with javascript API in conjuction with ghidra to analysea shared object file.
I'm using these line of codes related to my question:
console.log("param_1 == ", args[0]);
console.log("param_1 hexdump == ", hexdump(args[0]));
console.log("param_2 == ", args[1]);
console.log("param_3 == ", args[2]);
console.log("param_4 == ", args[3]);
console.log("param_5 == ", args[4]);
console.log("param_6 == ", args[5]);
console.log("param_7 == ", args[6]);
console.log("param_8 == ", args[7]);
console.log("param_9 == ", args[8]);
console.log("param_10 == ", args[9]);
console.log("param_11 == ", args[10]);
And what i get in the console is:
param_1 == 0x8e5f7598
param_1 hexdump ==
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
8e5f7598 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f75a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f75b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f75c8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f75d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f75e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f75f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f7608 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f7618 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f7628 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f7638 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f7648 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f7658 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f7668 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f7678 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8e5f7688 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
param_2 == 0x21
param_3 == 0x5876ff9d
param_4 == 0x989aeaa7
param_5 == 0x13e7b5a6
param_6 == 0xf9514024
param_7 == 0x1ab971cc
param_8 == 0xed814090
param_9 == 0x64c7bcff
param_10 == 0xd9012030
param_11 == 0x9a4cf4b
As you can see the values in parameters param_2 to param_11 are static values, is there any way to get their addresses instead?
I did try using console.log("param_5 Address == ", Memory.readPointer(args[4]));, but or it returns 0 or game a access violation error.
The reason why i wanted these addresses is because some of the functions variables in ghidra are in the stack, for example:
uint in_stack_00000f98;
uint in_stack_00000f9c;
And for that i need to get the stack0 address which is the param_5 in this case.
I was able to read the stack using this.context.sp, and this solved my issue.