1

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator and only has arm JNI Libs, so emulation is used for the ARM Libs.

import frida, sys
ss = """
Java.perform(function() {
    const System = Java.use('java.lang.System');
    const Runtime = Java.use('java.lang.Runtime');
    const VMStack = Java.use('dalvik.system.VMStack');

    System.loadLibrary.implementation = function(library) {
        try {
            console.log('System.loadLibrary("' + library + '")');
            const loaded = Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), library);
            return loaded;
        } catch(ex) {
            console.log(ex);
        }
    };
    
    System.load.implementation = function(library) {
        try {
            console.log('System.load("' + library + '")');
            const loaded = Runtime.getRuntime().load0(VMStack.getCallingClassLoader(), library);
            return loaded;
        } catch(ex) {
            console.log(ex);
        }
    };
});
"""
device = frida.get_device_manager().add_remote_device('127.0.0.1:27042')
pid = device.spawn(["com.testapp"])
session = device.attach(pid)
script = session.create_script(ss)
script.load()
device.resume(pid)
sys.stdin.read()

this code list all libraries loaded when the app starts, but when i do

Module.findBaseAddress('libtest.so');

it always returns null, in the end of the day i just want to log all the instructions being executed by the process so i can get the faulty instruction and search it up in the ida to patch it. if there's any other tool i can achieve the same than please suggest me also, process don't support attaching a debugger!

11
  • Usually module names don't end with .so. I would try libtest or test as module name.
    – Robert
    Commented Jul 9, 2020 at 14:36
  • hi, the frida dev told that it doesn't seeks for emulated process
    – Ronny
    Commented Jul 9, 2020 at 14:46
  • can u suggest me some other tool with which i can get logs of all the instructions executed by the process until it crashes finally ? i cant attach a debugger but i can hook
    – Ronny
    Commented Jul 9, 2020 at 14:47
  • Why not simply using a rooted Android device?
    – Robert
    Commented Jul 9, 2020 at 14:54
  • its rooted by default
    – Ronny
    Commented Jul 10, 2020 at 2:04

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.