output not saved to file when remote?

maceip commented 3 years ago

$jnitrace -l libEncryptor.so -l libsscronet.so -l libttcrypto.so -l libttmain.so com.zhiliaoapp.musically -R 192.168.86.65:6666 --output jnitrace.log -b accurate --ignore-vm

$cat jnitrace.log []%

However, the trace data is printing to stdout. Am I doing something wrong?

device: arm64-v8a, android 8.1.0 frida: 14.2.13 jnitrace: 3.2.0

chame1eon commented 3 years ago

Good spot, this was a bug with the latest version of jnitrace. Thank you very much for reporting.

I have pushed a new version (3.2.1), please let me know if updating does not work. You can also try rolling back to 3.1.0 as that version should work too.

maceip commented 3 years ago

I upgraded to 3.2.1 (on mac osx big sur 11.0.1 x86) and it's still not writing to output file.

Also i'm unable to get the tracer to do much other than what looks like trace everything.

i'm looking only for traces in libttboringssl.so, but check the output below. for context libkeva.so is what looks like an obfuscator lib/anti-trace/anti-debug lib.

$jnitrace -l 'libttboringssl.so' com.zhiliaoapp.musically -R 192.168.86.65:6666
Tracing. Press any key to quit...
           /* TID 19007 */
   1019 ms [+] JavaVM->GetEnv
   1019 ms |- JavaVM*          : 0x78258a8200
   1019 ms |- void**           : 0x7fee618be0
   1019 ms |:     0x78258cb1c0
   1019 ms |- jint             : 65542
   1019 ms |= jint             : 0

   1019 ms ----------------------------Backtrace----------------------------
   1019 ms |->       0x78075cfd18: JNI_OnLoad+0x44 (libkeva.so:0x78075c2000)
   1019 ms |->       0x78075cfd18: JNI_OnLoad+0x44 (libkeva.so:0x78075c2000)

           /* TID 19007 */
   1333 ms [+] JNIEnv->FindClass
   1333 ms |- JNIEnv*          : 0x78258cb1c0
   1333 ms |- char*            : 0x78075e0e24
   1333 ms |:     com/bytedance/keva/KevaImpl
   1333 ms |= jclass           : 0x81    { com/bytedance/keva/KevaImpl }

   1333 ms ----------------------------Backtrace----------------------------
   1333 ms |->       0x78075cfd3c: JNI_OnLoad+0x68 (libkeva.so:0x78075c2000)
   1333 ms |->       0x78075cfd3c: JNI_OnLoad+0x68 (libkeva.so:0x78075c2000)

           /* TID 19007 */
   1340 ms [+] JNIEnv->GetMethodID
   1340 ms |- JNIEnv*          : 0x78258cb1c0
   1340 ms |- jclass           : 0x81    { com/bytedance/keva/KevaImpl }
   1340 ms |- char*            : 0x78075e0e40
   1340 ms |:     addMapIntWhenLoading
   1340 ms |- char*            : 0x78075e0e55
   1340 ms |:     (Ljava/lang/String;IJ)V
   1340 ms |= jmethodID        : 0x9bbc2778    { addMapIntWhenLoading(Ljava/lang/String;IJ)V }

   1340 ms ----------------------------Backtrace----------------------------
   1340 ms |->       0x78075cfd68: JNI_OnLoad+0x94 (libkeva.so:0x78075c2000)
   1340 ms |->       0x78075cfd68: JNI_OnLoad+0x94 (libkeva.so:0x78075c2000)

maceip commented 3 years ago

ah scratch that, i was tailing the log file, which was empty. However, jnitrace does write to it when it exits. So the log output thing is fixed.

Tracing specified native libs is still not working for me.

chame1eon commented 3 years ago

Glad that solved the problem. I'll take a look and see if I can work out why the lib in your command args is not being traced.

maceip commented 3 years ago

It is tracing it (I think), but the problem is that it's also tracing everything else

On Sun, Feb 28, 2021, 4:02 PM chame1eon notifications@github.com wrote:

Glad that solved the problem. I'll take a look and see if I can work out why the lib in your command args is not being traced.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/chame1eon/jnitrace/issues/29#issuecomment-787513057, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAGEMEAGK7MO5IXFWSVPBKDTBKOPFANCNFSM4YIXY24A .

maceip commented 3 years ago

gonna close this and open a new issue

chame1eon / jnitrace

output not saved to file when remote? #29