I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to func.

00000000047fef1d         db         "openssl cert verify error: ", 0            ; DATA XREF=sub_342df4+412

So I'd like to obtain the XREF pointer with a Frida script, how can I do that ? Is it even possible to do ?

I found out here that it seems you can do it with IDA in python, but I use something else than IDA, and I'd like to do it dynamically from Frida JS.

How can I do it ? Is it even possible to do ? Thanks !

  • 1
    For resolving XREF you first have to analyze the whole binary, so this is more a job for IDA Pro or Ghidra. You can first analyze the binary offline in IDA/Ghidra, extract the xref and send this data to Frida for a dynamic analysis (e.g. write the value into a Frida script before loading it).
    – Robert
    Commented Nov 25, 2022 at 9:07
  • try if you can set a hardware breakpoint and catch read access check this issue and proposal github.com/frida/frida/issues/2055
    – blabb
    Commented Nov 26, 2022 at 4:42
  • Another possibility would be to hook the function and then each time generate the stack trace in frida codeshare.frida.re/@razaina/get-a-stack-trace-in-your-hook That way you would at least some of the xref functions (depending on whyt code parts are executed at run-time).
    – Robert
    Commented Apr 4, 2023 at 18:03


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.