1

I need to debug .so of my.apk, I'm working on a phone with android 5.0, using ida 6.8's android_server. It seems ok for attaching ida to the process, but when clicking something on the apk there is message box that shows an exception(see the image), and breaks at this line:

system@framework@boot.oat:7314709E DCB    8

And the 'call stack' window is empty.

boot.oat exception

The problem happens with android 5.x + ida 6.8, or android 7.0 + ida 6.8 but it works fine on android 4.x + ida 6.5

But I tried another apk, there is no such problem. Any idea?

Update 1 According to comments from @ws, it's something wrong with segment type: ARM(0) and THUMB(1), here's what I tried:

  • Press Alt+G at that line, a window popups and shows the segment register value is 1, I modified it to 0, run.
  • Then it breaks at another place with same exception. I did that again.
  • Then it goes to boot.oat, but this time is different. Even after modified it to 0(ARM), it breaks at this line about 6~7 times enter image description here
  • And finally it breaks at some random code with same exception, such as memset in the image below. Then program crashes if continue run. enter image description here
  • Is your target little or big endian ? – w s Oct 10 '16 at 8:28
  • @ws It's little endian, the variables in hexdump are in reverse order. For example integer 1 looks like "01 00 00 00" – aj3423 Oct 10 '16 at 9:10
  • 1
    Did you try to change this code from THUMB to ARM (now it shows "CODE16" mark which is probably used by debugger) ? All other threads staring from address aligned by 4, and the problematic thread start address is aligned by 2, which is strange. – w s Oct 10 '16 at 9:16
  • @ws It seems exactly the problem, but I still cannot make it work, I've updated the post, please refer to the UPDATE section. – aj3423 Oct 10 '16 at 14:04
  • 1
    I'd try to review all CODE16 and CODE32 marks. As far as I know IDA sets it automatically after auto-analysis and, unfortunately, sometimes misses. In addition I'd compare such marks from ida 6.5 with the ida 6.8. – w s Oct 10 '16 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.