将地址替换下面代码就可以

function hook_dlopen(module_name, fun) {var android_dlopen_ext = Module.findExportByName(null, "android_dlopen_ext");if (android_dlopen_ext) {Interceptor.attach(android_dlopen_ext, {onEnter: function (args) {var pathptr = args[0];if (pathptr) {this.path = (pathptr).readCString();//console.log("android_dlopen_ext:", this.path);if (this.path.indexOf(module_name) >= 0) {this.canhook = true;console.log("android_dlopen_ext:", this.path);}}},onLeave: function (retval) {if (this.canhook) {fun();}}});}var dlopen = Module.findExportByName(null, "dlopen");if (dlopen) {Interceptor.attach(dlopen, {onEnter: function (args) {var pathptr = args[0];if (pathptr) {this.path = (pathptr).readCString();if (this.path.indexOf(module_name) >= 0) {this.canhook = true;console.log("dlopen:", this.path);}}},onLeave: function (retval) {if (this.canhook) {fun();}}});}console.log("android_dlopen_ext:", android_dlopen_ext, "dlopen:", dlopen);
}function sslbypass() {console.log("sslbypass---------******------------");var sub_2E6E54 = Module.findBaseAddress("libsscronet.so").add(0x16F888+1);Interceptor.attach(sub_2E6E54, {onEnter: function (args) {console.log("sub_2E6E54");// console.log(args[0]);}, onLeave:function(ret) {// console.log("scrone:",ret);ret.replace(0x0);}})}
function main() {hook_dlopen("libsscronet.so", sslbypass);
}setImmediate(main);