i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator and only has arm JNI Libs, so emulation is used for the ARM Libs.
import frida, sys
ss = """
Java.perform(function() {
const System = Java.use('java.lang.System');
const Runtime = Java.use('java.lang.Runtime');
const VMStack = Java.use('dalvik.system.VMStack');
System.loadLibrary.implementation = function(library) {
try {
console.log('System.loadLibrary("' + library + '")');
const loaded = Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), library);
return loaded;
} catch(ex) {
console.log(ex);
}
};
System.load.implementation = function(library) {
try {
console.log('System.load("' + library + '")');
const loaded = Runtime.getRuntime().load0(VMStack.getCallingClassLoader(), library);
return loaded;
} catch(ex) {
console.log(ex);
}
};
});
"""
device = frida.get_device_manager().add_remote_device('127.0.0.1:27042')
pid = device.spawn(["com.testapp"])
session = device.attach(pid)
script = session.create_script(ss)
script.load()
device.resume(pid)
sys.stdin.read()
this code list all libraries loaded when the app starts, but when i do
Module.findBaseAddress('libtest.so');
it always returns null, in the end of the day i just want to log all the instructions being executed by the process so i can get the faulty instruction and search it up in the ida to patch it. if there's any other tool i can achieve the same than please suggest me also, process don't support attaching a debugger!
.so
. I would trylibtest
ortest
as module name.