search

radareorg / esilsolve

A python symbolic execution framework using radare2's ESIL (Evaluable String Intermediate Language)
MIT License
159 stars 14 forks source link

Unable to analyze escrackme.apk #2

Open as0ler opened 3 years ago

as0ler commented 3 years ago

I've tried to replicate the Android analysis of the application escrackme.apk as it's described here: https://www.nowsecure.com/blog/2021/03/10/how-to-perform-symbolic-execution-of-mobile-apps-with-r2frida-esilsolve/

However, after install the application and force the odex generation, it is not possible to find the symbols as it's shown in the example.

Screenshot 2021-04-06 at 17 37 15

I've tested it in a Google Pixel 4a physical device and I confirm the props are set correcly:

Any idea of what I'm missing?

aemmitt-ns commented 3 years ago

Hmm it looks like the -g option must not be working. What android version are you on? (I have also tested on pixel 4a)

as0ler commented 3 years ago

I'm using Android 11.

GanbaruTobi commented 2 years ago

I am facing the same problem on an POCO X3 NFC, having Lineage OS 11. Was there any solution?

GanbaruTobi commented 2 years ago

So in the video in the article Android 9 was used. I will try to do it with that one time. If anybody on a newer OS managed to get symbols let me know pls.

GanbaruTobi commented 2 years ago

By reviewing the source of Android 11 (Lineage OS 18.1), it seems that the compiler filter "everything" is not being honored, even though it can be available. This is inline with the statement found here: https://source.android.com/devices/tech/dalvik/configure#compilation_options

With setting the flag to "speed" the methods where available.

Using the -g option without --debuggable, is "best-effort only", so i guess it makes sense to use both. My setup in the end was:

setprop dalvik.vm.dex2oat-flags "--debuggable -g -inline-max-code-units=0 --compiler-filter=speed" adb shell compile pm -m speed com.nowsecure.escrackme