Node.js Inject: How to Conduct and Why to Use

Frida Framework

• Module.findExportByName – it finds C exported function by its name. There is one little caveat – so-called “mangled names”. In short, when we are trying to investigate C++ compiled code, we could see a lot of names like ?GetCurrent@Isolate@v8@@SAPEAV12@XZ. First of our points is to find all required function names in a disassembler like IDA or OllyDbg and to get the memory address of it.
• NativeFunction(POINTER, RETURN_VALUE, ARGUMENTS) – this function is used to define in-js bindings for a native function. Here, we need to describe correct arguments count and return values to call these functions later.
• NativeCallback – a code that will be executed after a native function call.
• WeakRef.bind is used to monitor specified pointer and the callback when it gets garbage-collected or on Frida detach.
• Memory.alloc(N) – allocates N bytes in memory and returns pointer for this memory region.

Concepts and Functions Used

• Isolate represents an isolated instance of the V8 engine. V8 isolates have completely separate states. Objects from one isolate cannot be used in another isolate. When V8 is initialized, a default isolate is implicitly created and entered. The embedder can create additional isolates and use them in parallel in multiple threads. An isolate can be entered by at most one thread at any given point in time. The Locker/Unlocker API must be used to synchronize. In short, it is a kind of sandbox, which contains its own states.
• Context stands for a sandboxed execution context with its own set of built-in objects and functions.
• HandleScope is a stack-allocated class, which governs a number of local handles. After a handle scope has been created, all local handles will be allocated within that handle scope until either the handle scope is deleted or another handle scope is created. If there is already a handle scope and a new one is created, all allocations will take place in the new handle scope until it is deleted. After that, new handles will again be allocated in the original handle scope. After the handle scope of a local handle has been deleted, the garbage collector will no longer track the object stored in the handle and may deallocate it. The behavior of accessing a handle for which the handle scope has been deleted is undefined.
• Script stands for a compiled JavaScript script.
• String is a JS string value.
• Value is a superclass of all JavaScript values and objects.

• uv_async_init – initializes handle, specifies the callback that will be executed inside the event loop;
• uv_default_loop – takes default event loop;
• uv_async_send – calls the callback;
• uv_unref – destroys the object created;
• uv_close – requests handle to be closed.

• V8::Isolate::GetCurrent(v8_Isolate_GetCurrent) – takes the instance of a current Isolate.
• V8::Isolate::GetCurrentContext(v8_Isolate_GetCurrentContext) – gets context from the current Isolate.
• V8::Context::Enter(v8_Context_Enter) – enters this context. After entering a context, all code compiled and run is compiled and run in this context. If another context is already entered, this old context is saved so it can be restored when the new context is exited.
• V8::HandleScope::Init(v8_HandleScope_init) – initializes HandleScope.
• V8::String::NewFromUtf8(v8_String_NewFromUtf8) – gets JS string from const char *.
• V8::Script::Compile(v8_Script_Compile) – compiles the specified script (bound to current context).
• V8::Script::Run(v8_Script_Run) – runs the script returning the resulting value. If the script is context-independent (created using ::New), it will be run in the currently entered context. If it is context-specific (created using ::Compile), it will be run in the context in which it was compiled.
• v8::Value::Int32Value(v8_Value_Int32Value) – gets C int from JS value. Value has a lot of functions for different types.

Code Listing

try {
 const createFunc = (name, retval, args) => {
   const _ptr = Module.findExportByName(null, name);
   return new NativeFunction(_ptr, retval, args);
 }
 const uv_default_loop = createFunc('uv_default_loop', 'pointer', []);
 const uv_async_init = createFunc('uv_async_init', 'int', ['pointer', 'pointer', 'pointer']);
 const uv_async_send = createFunc('uv_async_send', 'int', ['pointer']);
 const uv_unref = createFunc('uv_unref', 'void', ['pointer']);
 const v8_Isolate_GetCurrent = createFunc('?GetCurrent@Isolate@v8@@SAPEAV12@XZ', 'pointer', []);
 const v8_Isolate_GetCurrentContext = createFunc('?GetCurrentContext@Isolate@v8@@QEAA?AV?$Local@VContext@v8@@@2@XZ', 'pointer', ['pointer', 'pointer']);
 const v8_Context_Enter = createFunc('?Enter@Context@v8@@QEAAXXZ', 'pointer', ['pointer']);
 const v8_HandleScope_init = createFunc('??0HandleScope@v8@@QEAA@PEAVIsolate@1@@Z', 'void', ['pointer', 'pointer']);
 const v8_String_NewFromUtf8 = createFunc('?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PEAVIsolate@2@PEBDW4NewStringType@2@H@Z', 'pointer', ['pointer', 'pointer', 'pointer', 'int', 'int']);
 const v8_Script_Compile = createFunc('?Compile@ScriptCompiler@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@PEAVSource@12@W4CompileOptions@12@@Z', 'pointer', ['pointer', 'pointer', 'pointer', 'pointer']);
 const v8_Script_Run = createFunc('?Run@Script@v8@@QEAA?AV?$Local@VValue@v8@@@2@XZ', 'pointer', ['pointer', 'pointer']);
 const v8_Value_Int32Value = createFunc('?Int32Value@Value@v8@@QEBAHXZ', 'int64', ['pointer']);
 const scriptToExecute = `((a, b)=>{
   console.log("Hello from Frida", a, b);
   return a+b;
 })(5, 17)`;
 const processPending = new NativeCallback(function () {
   const isolate = v8_Isolate_GetCurrent();
   const scope = Memory.alloc(128);
   v8_HandleScope_init(scope, isolate);
   const opts = Memory.alloc(128);
   const context = v8_Isolate_GetCurrentContext(isolate, opts);
   const item = scriptToExecute;
   const unkMem = Memory.alloc(128);
   const source = v8_String_NewFromUtf8(unkMem, isolate, Memory.allocUtf8String(item), 0, -1);
   const script = v8_Script_Compile(context, Memory.readPointer(context), source, NULL);
   const result = v8_Script_Run(Memory.readPointer(context), context);
   const intResult = v8_Value_Int32Value(Memory.readPointer(result));
   console.log('Result', intResult);
 }, 'void', ['pointer']);
 const onClose = new NativeCallback(function () { }, 'void', ['pointer']);
 const async = Memory.alloc(24);
 uv_async_init(uv_default_loop(), async, processPending);
 uv_async_send(async);
 uv_unref(async);
}
catch (ex) {
 console.log("Injected code execution error", ex);
}

Code Explained

The Use of Node.js Inject