nowsecure / r2frida

Radare2 and Frida better together.
MIT License
1.18k stars 121 forks source link

Android: `:dt` could not trace the java:method #459

Closed kin9-0rz closed 1 year ago

kin9-0rz commented 1 year ago
[0x7bda756000]> :dt java:sg.vantagepoint.uncrackable2.CodeCheck
Tracing class constructors
[0x7bda756000]> :dt java:sg.vantagepoint.uncrackable2.CodeCheck.a
ERROR: error: java.lang.ClassNotFoundException: Didn't find class "sg.vantagepoint.uncrackable2.CodeCheck.a" on path: DexPathList[[zip file "/data/app/owasp.mstg.uncrackable2-j-HrucIc_Uh-bI3SVGpLYA==/base.apk"],nativeLibraryDirectories=[/data/app/owasp.mstg.uncrackable2-j-HrucIc_Uh-bI3SVGpLYA==/lib/arm64, /data/app/owasp.mstg.uncrackable2-j-HrucIc_Uh-bI3SVGpLYA==/base.apk!/lib/arm64-v8a, /system/lib64, /vendor/lib64]]
enovella commented 1 year ago

Hi @kin9-0rz,

Can you describe your setup? Frida, r2frida and r2 versions?

Also, it seems that your class is not yet loaded when you're inserting the trace. Can you check if this class exists with the command :ic~+classname?

kin9-0rz commented 1 year ago
radare2 5.8.2 0 @ darwin-x86-64 git.5.8.2
frida 16.0.10
r2frida@master

https://github.com/nowsecure/r2frida/blob/master/src/agent/lib/debug/trace.ts#L316

    if (name.startsWith('java:')) {
        const javaName = name.substring(5);
        if (java.javaUse(javaName)) { // raise Err
            console.error('Tracing class constructors');
            java.traceJavaConstructors(javaName);
        } else { // This part of the code cannot be reached
            const dot = javaName.lastIndexOf('.');
            if (dot !== -1) {
                const klass = javaName.substring(0, dot);
                const methd = javaName.substring(dot + 1);
                java.traceJava(klass, methd);
            } else {
                console.log('Invalid java method name. Use :dt java:package.class.method');
            }
        }
        return;
    }

If java.javaUse(javaName) could not find the class, will raise an exception, and the code for the else part is not executed.