#!/usr/bin/env python3

Author: Juan Manuel Fernandez (@TheXC3LL)

import sys import r2pipe import binascii

Edit with your needs

targets = ["sym.__GI___close_nocancel", "sym.__read_nocancel", "sym.__open_nocancel", "sym.__mmap", "sym.__GI___fstat64"]

def usage(): print("python3 hookity.py <ld.so-with-symbols>") exit();

def location(r2, symbol): refs = r2.cmdj("axtj " + symbol) return refs

def verify(r2, sig): test = binascii.hexlify(bytes(sig)).decode("ascii") hits = r2.cmdj("/xj " + test) if len(hits) == 1: return test else: return -1

def signature(r2, addr): for i in range(6,30): potential = r2.cmdj("pxj " + str(i) + " @ " + str(addr - i + 1)) sig = verify(r2, potential) return sig

if name == "main": print("\t\t-=[ Hookity - @TheXC3LL ]=-\n\n") if len(sys.argv) != 2: usage() print("[] Opening " + sys.argv[1]) r2 = r2pipe.open(sys.argv[1]) print("[] Analyzing file...") r2.cmd("aa") print("-------[ Signatures ]-------") for x in targets: addrs = location(r2, x) for addr in addrs: found = signature(r2, addr["from"]) if found != -1: print(x + ":" + found + ":" + str(int(len(found) / 2))) break