1

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator and only has arm JNI Libs, so emulation is used for the ARM Libs.

import frida, sys
ss = """
Java.perform(function() {
    const System = Java.use('java.lang.System');
    const Runtime = Java.use('java.lang.Runtime');
    const VMStack = Java.use('dalvik.system.VMStack');

    System.loadLibrary.implementation = function(library) {
        try {
            console.log('System.loadLibrary("' + library + '")');
            const loaded = Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), library);
            return loaded;
        } catch(ex) {
            console.log(ex);
        }
    };
    
    System.load.implementation = function(library) {
        try {
            console.log('System.load("' + library + '")');
            const loaded = Runtime.getRuntime().load0(VMStack.getCallingClassLoader(), library);
            return loaded;
        } catch(ex) {
            console.log(ex);
        }
    };
});
"""
device = frida.get_device_manager().add_remote_device('127.0.0.1:27042')
pid = device.spawn(["com.testapp"])
session = device.attach(pid)
script = session.create_script(ss)
script.load()
device.resume(pid)
sys.stdin.read()

this code list all libraries loaded when the app starts, but when i do

Module.findBaseAddress('libtest.so');

it always returns null, in the end of the day i just want to log all the instructions being executed by the process so i can get the faulty instruction and search it up in the ida to patch it. if there's any other tool i can achieve the same than please suggest me also, process don't support attaching a debugger!

  • Usually module names don't end with .so. I would try libtest or test as module name. – Robert Jul 9 at 14:36
  • hi, the frida dev told that it doesn't seeks for emulated process – Ronny Jul 9 at 14:46
  • can u suggest me some other tool with which i can get logs of all the instructions executed by the process until it crashes finally ? i cant attach a debugger but i can hook – Ronny Jul 9 at 14:47
  • Why not simply using a rooted Android device? – Robert Jul 9 at 14:54
  • its rooted by default – Ronny Jul 10 at 2:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.