search

chame1eon / jnitrace

A Frida based tool that traces usage of the JNI API in Android apps.
MIT License
1.62k stars 260 forks source link

filters not working? #30

Closed maceip closed 3 years ago

maceip commented 3 years ago

host: macosx big sur 11.0.1 remote device: arm64-v8a, android 8.1.0 frida: 14.2.13 jnitrace: 3.2.1

i'm looking to trace one method, yet it looks like it's tracing all of them. Perhaps this native code has inserted it's own hooks you are following?

output: 

$jnitrace -l '*' -R 192.168.86.65:6666 -i http_verify_sign com.zhiliaoapp.musically
Tracing. Press any key to quit...
           /* TID 18776 */
    568 ms [+] JavaVM->GetEnv
    568 ms |- JavaVM*          : 0x78258a8200
    568 ms |- void**           : 0x7fee618be0
    568 ms |:     0x78258cb1c0
    568 ms |- jint             : 65542
    568 ms |= jint             : 0

    568 ms ----------------------------Backtrace----------------------------
    568 ms |->       0x78075d8d18: JNI_OnLoad+0x44 (libkeva.so:0x78075cb000)
    568 ms |->       0x78075d8d18: JNI_OnLoad+0x44 (libkeva.so:0x78075cb000)

           /* TID 18776 */
    696 ms [+] JNIEnv->FindClass
    696 ms |- JNIEnv*          : 0x78258cb1c0
    696 ms |- char*            : 0x78075e9e24
    696 ms |:     com/bytedance/keva/KevaImpl
    696 ms |= jclass           : 0x89    { com/bytedance/keva/KevaImpl }

    696 ms ----------------------------Backtrace----------------------------
    696 ms |->       0x78075d8d3c: JNI_OnLoad+0x68 (libkeva.so:0x78075cb000)
    696 ms |->       0x78075d8d3c: JNI_OnLoad+0x68 (libkeva.so:0x78075cb000)

           /* TID 18776 */
    699 ms [+] JNIEnv->GetMethodID
    699 ms |- JNIEnv*          : 0x78258cb1c0
    699 ms |- jclass           : 0x89    { com/bytedance/keva/KevaImpl }
    699 ms |- char*            : 0x78075e9e40
    699 ms |:     addMapIntWhenLoading
    699 ms |- char*            : 0x78075e9e55
    699 ms |:     (Ljava/lang/String;IJ)V
    699 ms |= jmethodID        : 0x9bbc2778    { addMapIntWhenLoading(Ljava/lang/String;IJ)V }

    699 ms ----------------------------Backtrace----------------------------
    699 ms |->       0x78075d8d68: JNI_OnLoad+0x94 (libkeva.so:0x78075cb000)
    699 ms |->       0x78075d8d68: JNI_OnLoad+0x94 (libkeva.so:0x78075cb000)

           /* TID 18776 */
    703 ms [+] JNIEnv->GetMethodID
    703 ms |- JNIEnv*          : 0x78258cb1c0
    703 ms |- jclass           : 0x89    { com/bytedance/keva/KevaImpl }
    703 ms |- char*            : 0x78075e9e6d
    703 ms |:     addMapBoolWhenLoading
    703 ms |- char*            : 0x78075e9e83
    703 ms |:     (Ljava/lang/String;ZJ)V
    703 ms |= jmethodID        : 0x9bbc26e8    { addMapBoolWhenLoading(Ljava/lang/String;ZJ)V }

    703 ms ----------------------------Backtrace----------------------------
    703 ms |->       0x78075d8d9c: JNI_OnLoad+0xc8 (libkeva.so:0x78075cb000)
    703 ms |->       0x78075d8d9c: JNI_OnLoad+0xc8 (libkeva.so:0x78075cb000)

           /* TID 18776 */
    706 ms [+] JNIEnv->GetMethodID
    706 ms |- JNIEnv*          : 0x78258cb1c0
    706 ms |- jclass           : 0x89    { com/bytedance/keva/KevaImpl }
    706 ms |- char*            : 0x78075e9e9b
    706 ms |:     addMapFloatWhenLoading
    706 ms |- char*            : 0x78075e9eb2
    706 ms |:     (Ljava/lang/String;FJ)V
    706 ms |= jmethodID        : 0x9bbc2748    { addMapFloatWhenLoading(Ljava/lang/String;FJ)V }

    706 ms ----------------------------Backtrace----------------------------
    706 ms |->       0x78075d8dc8: JNI_OnLoad+0xf4 (libkeva.so:0x78075cb000)
    706 ms |->       0x78075d8dc8: JNI_OnLoad+0xf4 (libkeva.so:0x78075cb000)

           /* TID 18776 */
    709 ms [+] JNIEnv->GetMethodID
    709 ms |- JNIEnv*          : 0x78258cb1c0
    709 ms |- jclass           : 0x89    { com/bytedance/keva/KevaImpl }
    709 ms |- char*            : 0x78075e9eca
    709 ms |:     addMapDoubleWhenLoading
    709 ms |- char*            : 0x78075e9ee2
    709 ms |:     (Ljava/lang/String;DJ)V
    709 ms |= jmethodID        : 0x9bbc2718    { addMapDoubleWhenLoading(Ljava/lang/String;DJ)V }

    709 ms -----------------------------Backtrace-----------------------------
    709 ms |->       0x78075d8df4: JNI_OnLoad+0x120 (libkeva.so:0x78075cb000)
    709 ms |->       0x78075d8df4: JNI_OnLoad+0x120 (libkeva.so:0x78075cb000)

           /* TID 18776 */
    713 ms [+] JNIEnv->GetMethodID
    713 ms |- JNIEnv*          : 0x78258cb1c0
    713 ms |- jclass           : 0x89    { com/bytedance/keva/KevaImpl }
    713 ms |- char*            : 0x78075e9efa
    713 ms |:     addMapLongWhenLoading
    713 ms |- char*            : 0x78075e9f10
    713 ms |:     (Ljava/lang/String;JJ)V
    713 ms |= jmethodID        : 0x9bbc27a8    { addMapLongWhenLoading(Ljava/lang/String;JJ)V }

    713 ms -----------------------------Backtrace-----------------------------
    713 ms |->       0x78075d8e20: JNI_OnLoad+0x14c (libkeva.so:0x78075cb000)
    713 ms |->       0x78075d8e20: JNI_OnLoad+0x14c (libkeva.so:0x78075cb000)

           /* TID 18776 */
    716 ms [+] JNIEnv->GetMethodID
    716 ms |- JNIEnv*          : 0x78258cb1c0
    716 ms |- jclass           : 0x89    { com/bytedance/keva/KevaImpl }
    716 ms |- char*            : 0x78075e9f28
    716 ms |:     addMapOffsetWhenLoading
    716 ms |- char*            : 0x78075e9f40
    716 ms |:     (Ljava/lang/String;JI)V
    716 ms |= jmethodID        : 0x9bbc27d8    { addMapOffsetWhenLoading(Ljava/lang/String;JI)V }

    716 ms -----------------------------Backtrace-----------------------------
    716 ms |->       0x78075d8e4c: JNI_OnLoad+0x178 (libkeva.so:0x78075cb000)
    716 ms |->       0x78075d8e4c: JNI_OnLoad+0x178 (libkeva.so:0x78075cb000)

           /* TID 18776 */
    719 ms [+] JNIEnv->FindClass
    719 ms |- JNIEnv*          : 0x78258cb1c0
    719 ms |- char*            : 0x78075e9f58
    719 ms |:     java/lang/RuntimeException
    719 ms |= jclass           : 0x91    { java/lang/RuntimeException }

    719 ms -----------------------------Backtrace-----------------------------
    719 ms |->       0x78075d8e6c: JNI_OnLoad+0x198 (libkeva.so:0x78075cb000)
    719 ms |->       0x78075d8e6c: JNI_OnLoad+0x198 (libkeva.so:0x78075cb000)

           /* TID 18776 */
    723 ms [+] JNIEnv->NewGlobalRef
    723 ms |- JNIEnv*          : 0x78258cb1c0
    723 ms |- jobject          : 0x91    { java/lang/RuntimeException }
    723 ms |= jobject          : 0x1e12    { java/lang/RuntimeException }

    723 ms -----------------------------Backtrace-----------------------------
    723 ms |->       0x78075d8e80: JNI_OnLoad+0x1ac (libkeva.so:0x78075cb000)
    723 ms |->       0x78075d8e80: JNI_OnLoad+0x1ac (libkeva.so:0x78075cb000)

           /* TID 18776 */
    728 ms [+] JNIEnv->RegisterNatives
    728 ms |- JNIEnv*          : 0x78258cb1c0
    728 ms |- jclass           : 0x89    { com/bytedance/keva/KevaImpl }
    728 ms |- JNINativeMethod* : 0x78075f2000
    728 ms |:     0x78075d8ee0 - loadRepo(Ljava/lang/String;IZ)J
    728 ms |:     0x78075d9088 - initialize(Ljava/lang/String;)V
    728 ms |:     0x78075d91a0 - delete(Ljava/lang/String;)Z
    728 ms |:     0x78075d9300 - clear(J)V
    728 ms |:     0x78075d93c4 - dump(J)V
    728 ms |:     0x78075d93d4 - checkReportException(J)V
    728 ms |:     0x78075d9488 - storeInt(JLjava/lang/String;JI)J
    728 ms |:     0x78075d9684 - storeBoolean(JLjava/lang/String;JZ)J
    728 ms |:     0x78075d9884 - storeString(JLjava/lang/String;JLjava/lang/String;)J
    728 ms |:     0x78075d9b78 - storeFloat(JLjava/lang/String;JF)J
    728 ms |:     0x78075d9d7c - storeLong(JLjava/lang/String;JJ)J
    728 ms |:     0x78075d9f78 - storeDouble(JLjava/lang/String;JD)J
    728 ms |:     0x78075da17c - storeBytes(JLjava/lang/String;J[BI)J
    728 ms |:     0x78075da40c - storeStringArray(JLjava/lang/String;J[Ljava/lang/String;I)J
    728 ms |:     0x78075da818 - fetchInt(JLjava/lang/String;JI)I
    728 ms |:     0x78075daa5c - fetchBoolean(JLjava/lang/String;JZ)Z
    728 ms |:     0x78075daca0 - fetchLong(JLjava/lang/String;JJ)J
    728 ms |:     0x78075daee4 - fetchFloat(JLjava/lang/String;JF)F
    728 ms |:     0x78075db128 - fetchDouble(JLjava/lang/String;JD)D
    728 ms |:     0x78075db36c - fetchString(JLjava/lang/String;JLjava/lang/String;)Ljava/lang/String;
    728 ms |:     0x78075db65c - fetchBytes(JLjava/lang/String;J[BI)[B
    728 ms |:     0x78075db90c - fetchStringArray(JLjava/lang/String;J[Ljava/lang/String;I)[Ljava/lang/String;
    728 ms |:     0x78075dbdfc - erase(JLjava/lang/String;J)V
    728 ms |:     0x78075dbfe0 - rebuildValueMap(J)V
    728 ms |:     0x78075dc0c4 - contains(JLjava/lang/String;J)Z
    728 ms |:     0x78075dc2bc - eraseUnusedChunk(JJ)V
    728 ms |:     0x78075dc2d0 - protectPortingInterProcess(Ljava/lang/String;ZI)I
    728 ms |- jint             : 27
    728 ms |= jint             : 0

    728 ms -----------------------------Backtrace-----------------------------
    728 ms |->       0x78075d8eac: JNI_OnLoad+0x1d8 (libkeva.so:0x78075cb000)
    728 ms |->       0x78075d8eac: JNI_OnLoad+0x1d8 (libkeva.so:0x78075cb000)

           /* TID 18776 */
   1099 ms [+] JNIEnv->GetStringUTFChars
   1099 ms |- JNIEnv*          : 0x78258cb1c0
   1099 ms |- jstring          : 0x7fee619098
   1099 ms |- jboolean*        : 0x0
   1099 ms |= char*            : 0x781a6c5640

   1099 ms ------------------------------Backtrace------------------------------
   1099 ms |->       0x78075d90cc: libkeva.so!0xe0cc (libkeva.so:0x78075cb000)
   1099 ms |->       0x78075d90cc: libkeva.so!0xe0cc (libkeva.so:0x78075cb000)

           /* TID 18776 */
   1122 ms [+] JNIEnv->ReleaseStringUTFChars
   1122 ms |- JNIEnv*          : 0x78258cb1c0
   1122 ms |- jstring          : 0x781a6c5640
   1122 ms |- char*            : 0x781a6c5640
   1122 ms |:     /data/user/0/com.zhiliaoapp.musically/files/keva

   1122 ms ------------------------------Backtrace------------------------------
   1122 ms |->       0x78075d916c: libkeva.so!0xe16c (libkeva.so:0x78075cb000)
   1122 ms |->       0x78075d916c: libkeva.so!0xe16c (libkeva.so:0x78075cb000)

           /* TID 18776 */
   1144 ms [+] JNIEnv->GetStringUTFChars
   1144 ms |- JNIEnv*          : 0x78258cb1c0
   1144 ms |- jstring          : 0x7fee619b88
   1144 ms |- jboolean*        : 0x0
   1144 ms |= char*            : 0x781a66a520

   1144 ms ------------------------------Backtrace------------------------------
   1144 ms |->       0x78075d8f3c: libkeva.so!0xdf3c (libkeva.so:0x78075cb000)
   1144 ms |->       0x78075d8f3c: libkeva.so!0xdf3c (libkeva.so:0x78075cb000)
...
detunized commented 3 years ago

I see the same behavior. It dumps all methods no matter what I specify in the filters. I tried many different combinations of -i, -e, -I and -E. I seem to get the same result no matter what I specify.

chame1eon commented 3 years ago

Hi Both, sorry for taking so long to look into this but I have now got to the bottom of it. It ended up being a very simple fix. There was a flag set that meant most of the command line arguments were being ignored. I have toggled that flag, tested it, and all the options (-i, -e, -I, -E) are now working again. The fixed version is available with pip as version 3.2.2.

Please let me know if this fixes your issues or if you are still seeing similar problems.

NikitinWork commented 3 years ago

I had the same problem, after upgrading to 3.2.2 everything works fine.

detunized commented 3 years ago

Thanks for the fix.

chame1eon commented 3 years ago

Thanks both for confirming it is working. Closing the ticket.