0

I am analyzing an Arm64 Android shared library and I am trying to find a pointer to dlopen. I have successfully manually achieved this in IDA64 and Ghidra, however I want to automate the process with python and radare2 seemed the quickest.

I go and find all XREFs to dlopen

[0x0000cdd0]> axt @sym.imp.dlopen
fcn.0001a1f0 0x1a258 [CALL:--x] bl sym.imp.dlopen
fcn.0001a1f0 0x1a26c [CALL:--x] bl sym.imp.dlopen
(nofunc) 0x204b8 [CODE:--x] b sym.imp.dlopen

I want the third result

[0x0000cdd0]> s 0x204b8 -8
[0x000204b0]> pd 3
        :   ;-- aav.0x000204b0:
        :   ; NULL XREFS from aav.0x00006588 @ +0x4ca8(r), +0x4e58(r), +0x5008(r), +0x51b8(r)
        :   0x000204b0      e00301aa       mov x0, x1
        :   0x000204b4      41208052       mov w1, 0x102
        `=< 0x000204b8      8eb1ff17       b sym.imp.dlopen

The XREF to this address

[0x000204b0]> axt 0x000204b0
(nofunc) 0xb230 [NULL:r--] invalid
(nofunc) 0xb3e0 [NULL:r--] invalid
(nofunc) 0xb590 [NULL:r--] invalid
(nofunc) 0xb740 [NULL:r--] invalid

The address 0xc0da0 should be in the results.

Any idea why this isn't working?

1 Answer 1

0

For some reason 16 bytes prior to the returned xref I found my pointer. Python code:

def get_pointer_to_dlopen(r2):
    hits = r2.cmdj('axtj @sym.imp.dlopen')
    for hit in hits:
        xrefs = r2.cmdj(f'axtj {hit["from"] - 8}')
        # :   0x000204b0      e00301aa       mov x0, x1
        # :   0x000204b4      41208052       mov w1, 0x102
        # `=< 0x000204b8      8eb1ff17       b sym.imp.dlopen
        if xrefs:
            for xref in xrefs:
                hit_address = xref.get('from')
                data = r2.cmdj(f'pxqj 8 @ {xref["from"] - 16}')
                if data:
                    return data[0]
    print("No pointer found.")

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.