Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Android: Improve :dm to find DEX files mapped in memory #443

Open
enovella opened this issue Dec 5, 2022 · 1 comment
Open

Android: Improve :dm to find DEX files mapped in memory #443

enovella opened this issue Dec 5, 2022 · 1 comment

Comments

@enovella
Copy link
Contributor

enovella commented Dec 5, 2022

image

image

R2Frida memory maps listing doesn't show up the filetype

[0x00000000]> :dm~0x7baa1dd000
[0x00000000]> :dm~7baa1dd000
0x0000007baa1bd000 - 0x0000007baa1dd000 rw-
0x0000007baa1dd000 - 0x0000007baa1fe000 r--
[0x00000000]> x 16 @ 0x7baa1dd000
- offset -     0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x7baa1dd000  6465 780a 3033 3700 4283 41de bc18 0649  dex.037.B.A....I
[0x00000000]> x 16 @ 0x7c2cc71000
- offset -     0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x7c2cc71000  6465 780a 3033 3700 66ce 2964 f478 4193  dex.037.f.)d.xA.
[0x00000000]> :dm~7c2cc71000
0x0000007c2cc70000 - 0x0000007c2cc71000 r-- /apex/com.android.art/lib64/libopenjdkjvm.so
0x0000007c2cc71000 - 0x0000007c2cc75000 r--

DEX files in memory maps

$ adb shell
$ grep dalvik-DEX /proc/25943/maps
7b8cf77000-7b8cf89000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7bab48e000-7bab4af000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c1cfb0000-7c1cfc0000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c1d203000-7c1d21c000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c1d220000-7c1d224000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c23d19000-7c23d21000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c24a73000-7c24a79000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c24fa3000-7c24fa7000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c2c566000-7c2c56a000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c2c998000-7c2c99c000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c2cc3a000-7c2cc3e000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c2cc71000-7c2cc75000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c2e4fe000-7c2e502000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c2e531000-7c2e535000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c2e6c0000-7c2e6c4000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]
7c2e71c000-7c2e720000 r--p 00000000 00:00 0                              [anon:dalvik-DEX data]

Workaround

image

@trufae
Copy link
Member

trufae commented May 29, 2024

This required changes in Frida iirc @oleavr

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants