4

My apologies if this question is very basic. I have found this string in my Android application Binary that was built using the flutter framework. This is a 32 bit ARM library. I found the location of a url string at "00c88fa0" located below. I want to find the assembly code that loads and uses this string. I used Ghidra's "show call trees" and "Show references to address" functionality, but they have been unable to help me. I assume the string is being referenced by a base address + offset calculation. Is there an easy way for me to find this section of the code? Or is it not easily possible because there are too many base + offset calculations that could arrive at my String?

Thank you.

M

Updated image:

enter image description here

Improve this question
5
  • 1
    Have you made sure the whole .text section has been disassembled? If not the xref would not have been created.
    – mumbel
    Commented Jul 5, 2021 at 2:11
  • I did another run of the autoanalyzer changing a few settings. I think it has disassembled more of the text section and added functions to the symbol tree. However, I don't see any xref links to this string. I am sure this string is used as well.
    – Ebay89
    Commented Jul 5, 2021 at 5:05
  • Have you looked a little before the actual string? Suppose it is a counted string, you'd expect something like "maximum" and "current length" before the string (or, if there is no flat version of the counted strings, such record could point to the string you have identified).
    – 0xC0000022L ♦
    Commented Jul 5, 2021 at 6:48
  • I edited my post with more bytes. Actually a bit of background what I am doing is that this url was originally a https url. As part of a pen test I am conducting I wanted to intercept the traffic and needed to downgrade the connection to http instead of https. In the past I achieved this by removing the "s" in the url and padding the end of the string with a null byte thinking that it would terminate 1 byte early. This time the null byte gets added to the url. So long story short I do believe that this is a counted string. I wanted to find the counting code so that I could fix it and learn.
    – Ebay89
    Commented Jul 5, 2021 at 20:34
  • I'd be surprised if there were many servers not automatically redirecting http->https these days... it would be quicker to check for redirection in a browser first rather than modify the app.
    – Mega Tonnage
    Commented Nov 23, 2022 at 22:52

2 Answers 2

Reset to default
1

In Ghidra, it is possible to view the references to a given address in memory as shown in the picture: How to see references to a string in memory

Improve this answer
1

It is best to use reFlutter or blutter to create a snapshot. Jeb also does a reasonably good job but as of now Ghidra, Binary Ninja, and radare2 are lagging behind the challenge to create a consistently accurate snapshot. This challenge is made all the more difficult by the dart language consistently being updated by Google.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.