-
-
Notifications
You must be signed in to change notification settings - Fork 2.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[0x06c] Add section Loaded Native Libraries #1948
Conversation
@@ -334,6 +334,10 @@ iOweApp 2828 mobile txt REG 1,2 664848 234595 /usr/lib/dyld | |||
... | |||
``` | |||
|
|||
#### Loaded Native Libraries | |||
|
|||
The file `/proc/<pid>/maps` contains the currently mapped memory regions and their access permissions. Using this file we can get the list of the libraries loaded in the process. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
According to the MSTG:
On Android, verifying this is pretty straightforward as you can simply grep for the string "frida" in the memory maps of the process ID in the proc directory (/proc/<pid>/maps). However, on iOS the proc directory is not available, but you can list the loaded dynamic libraries in an app with the function _dyld_image_count.
Is this still true? @sushi2k
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe it refers to the app trying to get /proc/<pid>/maps
, but as the (tester) root user we should be able to call that from the CLI. Please confirm using a device :)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@cpholguera No /proc
on iOS. Therefore we can close this PR!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
one minor change! Thank you Carlos
Co-authored-by: Sven <sven@bsddaemon.org>
done, and included the link to the tool's chapter. Thanks for the suggestion! |
Closes #1370.
Now we're consistent with Android.