radare2 cross reference problem

Question

I am analyzing an Arm64 Android shared library and I am trying to find a pointer to dlopen. I have successfully manually achieved this in IDA64 and Ghidra, however I want to automate the process with python and radare2 seemed the quickest.

I go and find all XREFs to dlopen

[0x0000cdd0]> axt @sym.imp.dlopen
fcn.0001a1f0 0x1a258 [CALL:--x] bl sym.imp.dlopen
fcn.0001a1f0 0x1a26c [CALL:--x] bl sym.imp.dlopen
(nofunc) 0x204b8 [CODE:--x] b sym.imp.dlopen

I want the third result

[0x0000cdd0]> s 0x204b8 -8
[0x000204b0]> pd 3
        :   ;-- aav.0x000204b0:
        :   ; NULL XREFS from aav.0x00006588 @ +0x4ca8(r), +0x4e58(r), +0x5008(r), +0x51b8(r)
        :   0x000204b0      e00301aa       mov x0, x1
        :   0x000204b4      41208052       mov w1, 0x102
        `=< 0x000204b8      8eb1ff17       b sym.imp.dlopen

The XREF to this address

[0x000204b0]> axt 0x000204b0
(nofunc) 0xb230 [NULL:r--] invalid
(nofunc) 0xb3e0 [NULL:r--] invalid
(nofunc) 0xb590 [NULL:r--] invalid
(nofunc) 0xb740 [NULL:r--] invalid

The address 0xc0da0 should be in the results.

Any idea why this isn't working?

Answer 1

For some reason 16 bytes prior to the returned xref I found my pointer. Python code:

def get_pointer_to_dlopen(r2):
    hits = r2.cmdj('axtj @sym.imp.dlopen')
    for hit in hits:
        xrefs = r2.cmdj(f'axtj {hit["from"] - 8}')
        # :   0x000204b0      e00301aa       mov x0, x1
        # :   0x000204b4      41208052       mov w1, 0x102
        # `=< 0x000204b8      8eb1ff17       b sym.imp.dlopen
        if xrefs:
            for xref in xrefs:
                hit_address = xref.get('from')
                data = r2.cmdj(f'pxqj 8 @ {xref["from"] - 16}')
                if data:
                    return data[0]
    print("No pointer found.")