Hook libc.so readdir

[lyf-is-coding]

Here is my code that hook readdir function from libc.so.
I'm trying to read the char d_name[256] array by adding offsets but my script always gave me read access violation error.
How can I fix that?

function hookReadDir()
{
	Interceptor.attach(Module.findExportByName("libc.so", "readdir") ,
	{
		onEnter: function(args)
		{
			let pointer = args[0];
			let d_name = pointer.readPointer().add(8).add(8).add(add2).add(1);
			console.log(`opendir: ${d_name.readCString(256)}`);
		}
	})
}

[Rablidad]

if on x86, ino_t and off_t represents 32 bit data offset, also, you don't need to put the string length as an argument to readCString as c strings ends in null terminator characters. which gives:

// x86 => 4 (ino_t) + 4 (off_t) + 2 (unsigned short) + 1 (unsigned char) = 11
let d_name = pointer.add(11).readCString();

// x64 => 8 (ino_t) + 8 (off_t) + 2 (unsigned short) + 1 (unsigned char) = 19
let d_name = pointer.add(19).readCString()

[lyf-is-coding]

ty 🙂