function hook_mmap() 
{
    console.log("start hook mmap")
    console.log("libmsaoaidsec.so :" + Module.getBaseAddress("libmsaoaidsec.so"));
    var interceptor = Interceptor.attach(Module.findExportByName("libc.so", "mmap"),
            {
                onEnter: function (args) 
                { 
                    //var module = Process.findModuleByAddress(ptr(this.returnAddress))
                    // if (module != null) {
                    //     console.log("[mmap] called from", module.name)
                    // }
                    // else {
                    //     console.log("[mmap] called from", ptr(this.returnAddress))
                    // }
                    console.log("[mmap] called from", ptr(this.returnAddress))
                },
            }
    )
}
function hook_exit() //failed
{
    console.log("start hook exit")
    var interceptor = Interceptor.attach(Module.findExportByName("libc.so", "exit"),
            {
                onEnter: function (args) 
                { 
                    console.log("[exit] called from", ptr(this.returnAddress))
                },
            }
    )
}
function hook_exit_group_syscall() //failed
{
    console.log("start hook syscall(exit_group)");
}
function hook_dl__ZN6soinfo17call_constructorsEv(){
    //int __fastcall _dl__ZN6soinfo17call_constructorsEv(int a1)
    console.log("=== HOOKING dl__ZN6soinfo17call_constructorsEv ===");
    //local_env android10 x86
    var linker_base = Module.findBaseAddress("linker").add(0x0003185C + 1);
    
    var interceptor = Interceptor.attach(linker_base, {
        onEnter: function (args) {
            console.log("call_constructors enter")
            hook_mmap();
            //hook_exit_group();
            //hook_exit();
            interceptor.detach();
        }
    })
}

function hook_dlopen2(soName = '') {
    console.log("=== HOOKING android_dlopen_ext ===")
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    if (path.indexOf(soName) >= 0) {
                        console.log(`${path} is loaded`)
                        //hook_mmap();
                        hook_dl__ZN6soinfo17call_constructorsEv();
                    }
                }
            }
        }
    );
}
function hook_dlopen() {
    console.log("=== HOOKING android_dlopen_ext ===")
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    console.log(`${path} is loaded`);
                    //hook_dl__ZN6soinfo17call_constructorsEv();
                }
            }
        }
    );
}
console.log("\nHi, I am frida!\n");
//hook_dlopen();
hook_dlopen2("libmsaoaidsec.so");
/*
λ frida -U -f com.qiyi.video -l asset\f3.js
     ____
    / _  |   Frida 16.3.3 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to PBCM10 (id=1d518c72)
Spawning `com.qiyi.video`...

Hi, I am frida!

=== HOOKING android_dlopen_ext ===
Spawned `com.qiyi.video`. Resuming main thread!
[PBCM10::com.qiyi.video ]-> /data/app/com.qiyi.video-lJqQFY---WMn8DLowc8W5g==/lib/arm/libmsaoaidsec.so is loaded
=== HOOKING dl__ZN6soinfo17call_constructorsEv ===
call_constructors enter
start hook mmap
libmsaoaidsec.so :0xb6609000
start hook exit
[mmap] called from 0xef69ceff
[mmap] called from 0xb6618feb
[mmap] called from 0xef6e918b
[mmap] called from 0xef6e918b
[mmap] called from 0xee1aafa9
[mmap] called from 0xef6e918b
[mmap] called from 0xef6e8fb9
[mmap] called from 0xef6e8fb9
[mmap] called from 0xef6e8fb9
[mmap] called from 0xee1aafa9
[mmap] called from 0xee1aafa9
[mmap] called from 0xef6e918b
[mmap] called from 0xef68f5bd
[mmap] called from 0xef68f5bd
[mmap] called from 0xef6e8fb9
Process terminated
[PBCM10::com.qiyi.video ]->
*/

function hook_SUB_FF9C() 
{
    console.log("start hook int __fastcall SUB_FF9C(void **a1, const char *a2)")   ; 
    var interceptor = Interceptor.attach(Module.getBaseAddress("libmsaoaidsec.so").add(0x0000FF9C + 1),
            {
                onEnter: function (args) 
                { 
                    console.log('backtrace');
                    console.log(Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n') + '\n');
                },
            }
    )
}
function hook_dl__ZN6soinfo17call_constructorsEv(){
    //int __fastcall _dl__ZN6soinfo17call_constructorsEv(int a1)
    console.log("=== HOOKING dl__ZN6soinfo17call_constructorsEv ===");
    //local_env android10 x86
    var linker_base = Module.findBaseAddress("linker").add(0x0003185C + 1);
    
    var interceptor = Interceptor.attach(linker_base, {
        onEnter: function (args) {
            console.log("call_constructors enter")
            hook_SUB_FF9C();
            //hook_exit_group();
            interceptor.detach();
        }
    })
}

function hook_dlopen2(soName = '') {
    console.log("=== HOOKING android_dlopen_ext ===")
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    if (path.indexOf(soName) >= 0) {
                        console.log(`${path} is loaded`)
                        hook_dl__ZN6soinfo17call_constructorsEv();
                    }
                }
            }
        }
    );
}
function hook_dlopen() {
    console.log("=== HOOKING android_dlopen_ext ===")
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    console.log(`${path} is loaded`);
                    //hook_dl__ZN6soinfo17call_constructorsEv();
                }
            }
        }
    );
}
console.log("\nHi, I am frida!\n");
//hook_dlopen();
hook_dlopen2("libmsaoaidsec.so");
/*
λ frida -U -f com.qiyi.video -l asset\f3.js
     ____
    / _  |   Frida 16.3.3 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to PBCM10 (id=1d518c72)
Spawning `com.qiyi.video`...

Hi, I am frida!

=== HOOKING android_dlopen_ext ===
Spawned `com.qiyi.video`. Resuming main thread!
[PBCM10::com.qiyi.video ]-> /data/app/com.qiyi.video-lJqQFY---WMn8DLowc8W5g==/lib/arm/libmsaoaidsec.so is loaded
=== HOOKING dl__ZN6soinfo17call_constructorsEv ===
call_constructors enter
start hook int __fastcall SUB_FF9C(void **a1, const char *a2)
backtrace
0xb65d3423 libmsaoaidsec.so!0x10423
0xb65d5c01 libmsaoaidsec.so!0x12c01
0xb65d5109 libmsaoaidsec.so!0x12109
0xb65d5289 libmsaoaidsec.so!0x12289
0xb65d0259 libmsaoaidsec.so!_init+0x19c
0xf2c47a23
0xf2c37a55
*/

function hook_sub_11E60() 
{
    console.log("=== HOOKING sub_11E60 ===")
    Interceptor.replace(Module.findBaseAddress("libmsaoaidsec.so").add(0x11E60 + 1), new NativeCallback(function () {
        console.log(`hook_sub_11E60 >>>>>>>>>>>>>>>>> replace`)
    }, 'void', []));
}
function whatch_sub_11E60() 
{
    
    var tar_ptr = Module.findBaseAddress("libmsaoaidsec.so").add(0x11E60+1);
    console.log("=== whatch sub_11E60 ===: " + tar_ptr);
    Interceptor.attach(tar_ptr, {
        onEnter: function (args) {
            console.log(`whatch_sub_11E60 >>>>>>>>>>>>>>>>> onEnter`)
        },
        onLeave: function (retval) {
            console.log(`whatch_sub_11E60 >>>>>>>>>>>>>>>>> onLeave`)
        }
    });
}

function hook_dl__ZN6soinfo17call_constructorsEv(){
    //int __fastcall _dl__ZN6soinfo17call_constructorsEv(int a1)
    console.log("=== HOOKING dl__ZN6soinfo17call_constructorsEv ===");
    //local_env oppor15 android10 x86
    var linker_base = Module.findBaseAddress("linker").add(0x0003185C + 1);//要不要+1
    
    var interceptor = Interceptor.attach(linker_base, {
        onEnter: function (args) {
            console.log("call_constructors enter")
            hook_sub_11E60();
           // whatch_sub_11E60() ;
            interceptor.detach();
        }
    })
}

function hook_dlopen2(soName = '') {
    
    
    console.log("=== HOOKING android_dlopen_ext ===");
    var tar_ptr = Module.findExportByName(null, "android_dlopen_ext");
    var interceptor = Interceptor.attach(tar_ptr,
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    if (path.indexOf(soName) >= 0) {
                        console.log(`${path} is loaded`)
                        hook_dl__ZN6soinfo17call_constructorsEv();
                        interceptor.detach();
                    }
                }
            }
        }
    );
}
console.log("\nHi, I am frida!\n");
//hook_dlopen();
hook_dlopen2("libmsaoaidsec.so");
/*
λ frida -U -f com.qiyi.video -l asset\f3.js
     ____
    / _  |   Frida 16.3.3 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to PBCM10 (id=1d518c72)
Spawning `com.qiyi.video`...

Hi, I am frida!

=== HOOKING android_dlopen_ext ===
Spawned `com.qiyi.video`. Resuming main thread!
[PBCM10::com.qiyi.video ]-> /data/app/com.qiyi.video-lJqQFY---WMn8DLowc8W5g==/lib/arm/libmsaoaidsec.so is loaded
=== HOOKING dl__ZN6soinfo17call_constructorsEv ===
call_constructors enter
=== HOOKING sub_11E60 ===
hook_sub_11E60 >>>>>>>>>>>>>>>>> replace
*/

function create_fake_pthread_create() {
    const fake_pthread_create = Memory.alloc(4096)
    Memory.protect(fake_pthread_create, 4096, "rwx")
    Memory.patchCode(fake_pthread_create, 4096, code => {
        const cw = new ArmWriter(code, { pc: ptr(fake_pthread_create) })
        cw.putRet()
    })
    return fake_pthread_create
}
function hook_dlsym() {
    var count = 0
    console.log("=== HOOKING dlsym ===")
    var fake_pthread_create = create_fake_pthread_create()
    var interceptor = Interceptor.attach(Module.findExportByName(null, "dlsym"),
        {
            onEnter: function (args) {
                const name = ptr(args[1]).readCString()
                console.log("[dlsym]", name)
                if (name == "pthread_create") {
                    count++
                }
            },
            onLeave: function(retval) {
                if (count == 1) {
                    retval.replace(fake_pthread_create)
                }
                else if (count == 2) {
                    retval.replace(fake_pthread_create)
                    // 完成2次替换, 停止hook dlsym
                    interceptor.detach()
                }
                console.log("replace dlsym(\"pthread_create\")")
            }
        }
    )
    return Interceptor
}
function hook_dlopen2(soName = '') {
    console.log("=== HOOKING android_dlopen_ext ===")
    var interceptor = Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    if (path.indexOf(soName) >= 0) {
                        console.log(`${path} is loaded`)
                        hook_dlsym();
                    }
                }
            }
        }
    );
    return interceptor
}

console.log("\nHi, I am frida!\n");
// Java.perform(function(){
//     var dlopen_interceptor = hook_dlopen2("libmsaoaidsec.so");
// })
var dlopen_interceptor = hook_dlopen2("libmsaoaidsec.so");
/*
λ frida -U -f com.qiyi.video -l asset\f1.js
     ____
    / _  |   Frida 16.3.3 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to PBCM10 (id=1d518c72)
Spawning `com.qiyi.video`...

Hi, I am frida!

=== HOOKING android_dlopen_ext ===
Spawned `com.qiyi.video`. Resuming main thread!
[PBCM10::com.qiyi.video ]-> /data/app/com.qiyi.video-lJqQFY---WMn8DLowc8W5g==/lib/arm/libmsaoaidsec.so is loaded
=== HOOKING dlsym ===
[dlsym] pthread_create
replace dlsym("pthread_create")
[dlsym] pthread_create
replace dlsym("pthread_create")
*/