notiMessage/reverse/frida/trace_tng_diag_exit.js

/**
 * Diagnostic: only LOG exit-related calls, do not block.
 */
"use strict";
function log(msg) { send("[TNG-diag] " + msg); }
function findExport(mod, name) {
  try {
    var m = Process.findModuleByName(mod);
    if (m) { var a = m.findExportByName(name); if (a) return a; }
  } catch (e) {}
  try { return Module.getGlobalExportByName(name); } catch (e2) { return null; }
}
function bt(ctx) {
  try {
    return Thread.backtrace(ctx, Backtracer.FUZZY).map(DebugSymbol.fromAddress).slice(0, 8).join(" <- ");
  } catch (e) { return "?"; }
}

["_exit", "exit", "abort", "quick_exit"].forEach(function (n) {
  var a = findExport("libc.so", n);
  if (!a) return;
  Interceptor.attach(a, {
    onEnter: function (args) {
      log("CALL " + n + "(" + args[0] + ") " + bt(this.context));
    }
  });
  log("watch " + n + " @ " + a);
});

["kill", "tgkill", "raise"].forEach(function (n) {
  var a = findExport("libc.so", n);
  if (!a) return;
  Interceptor.attach(a, {
    onEnter: function (args) {
      log("CALL " + n + "(" + args[0] + "," + args[1] + ") " + bt(this.context));
    }
  });
});

var sys = findExport("libc.so", "syscall");
if (sys) {
  Interceptor.attach(sys, {
    onEnter: function (args) {
      var nr = args[0].toInt32();
      if (nr === 93 || nr === 94 || nr === 129 || nr === 131) {
        log("CALL syscall(" + nr + ") " + bt(this.context));
      }
    }
  });
}

// count mprotect EXEC
var mp = findExport("libc.so", "mprotect");
if (mp) {
  Interceptor.attach(mp, {
    onEnter: function (args) {
      if (args[2].toInt32() & 4) {
        log("mprotect EXEC " + args[0] + " len=" + args[1]);
      }
    }
  });
}

log("diag ready pid=" + Process.id);
setTimeout(function () {
  var n = 0;
  Process.enumerateRanges("r-x").forEach(function (r) {
    var file = r.file ? r.file.path : "anon";
    if (file.indexOf("/system") === 0 || file.indexOf("/apex") === 0) return;
    n++;
    log("RX " + file + " " + r.base + " +" + r.size);
  });
  log("app RX ranges=" + n);
}, 800);