1

I have an instruction that looks like this in Ghidra:

       100168ff0 e9 13 00 32     orr        w9,wzr,#0x1f

Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what value it is storing and modify it if needs be.

I am trying to do something similar with Frida with the following script:

var t_module = 'testApp';
var loadAddress = Module.getBaseAddress(t_module);
var instructionOffset = ptr(0x168ff4);

var toAtt = loadAddress.add(instructionOffset);

Interceptor.attach(toAtt, {
    onEnter: function(args) {
        console.log("[+] Module base address found at " + loadAddress)
        console.log("[+] Found instruction at " + toAtt)
        console.log("[+] Attempting to read w9: " + this.context.w9)
    }
});

however trying to read w9 just returns undefined. It is defined here so is not that Frida is calling it something else.

I can confirm the right address is being reached using:

Memory.readByteArray(ptr("0x102ab4ff0"),4)

where 0x102ab4ff0 is the address printed by the script, and comparing it to the instruction at the beginning from Ghidra.

I'm not sure if I've misunderstood something about Frida or where I should attach. This is the closest question I could find and that just says to use this.context.eax.

2
  • 1
    did you see any of your logs from onEnter? ( also, you don't need to .add a ptr, you can just add the offset using .add(0x11). there is no eax in arm64 ) to answer your question please print console.log(JSON.stringify(this.context))
    – whoopdedoo
    Aug 22 at 12:45
  • 1
    Thank you very much @whoopdedoo! This suggestion helped me work out the problem. The comment about eax was more to illustrate that that was what I understood to be the correct way to address a register as opposed to eax being used by arm64, I am a complete RE n00b though so it was a fair assumption to make.
    – Jon
    Sep 10 at 15:02
0

The issue was that w9 is a 32-bit register and I was using a 64 bit device. By calling this.context.x9 for the 64 bit register the Frida script worked perfectly. Many thanks to @whoopdedoo, their suggestion to log this.context was what led me to search more about ARM registers and realise my mistake.

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .