sensepost / objection

📱 objection - runtime mobile exploration
GNU General Public License v3.0
7.46k stars 854 forks source link

memory search:frida.core.RPCException: Error: access violation accessing 0x7f4902b000 #326

Closed liangshinian closed 4 years ago

liangshinian commented 4 years ago

Describe the bug when i was run "memory search xxxx --string" for a rooted android device, it throw an exception.

A Frida agent exception has occurred.
Error: access violation accessing 0x7f4902b000
    at /script1.js:9878
    at map (native)
    at /script1.js:9885
    at frida/runtime/message-dispatcher.js:15
    at c (frida/runtime/message-dispatcher.js:25)

Python stack trace: Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/objection/console/repl.py", line 371, in start_repl
    self.run_command(document)
  File "/usr/local/lib/python3.7/site-packages/objection/console/repl.py", line 185, in run_command
    exec_method(arguments)
  File "/usr/local/lib/python3.7/site-packages/objection/commands/memory.py", line 247, in find_pattern
    data = api.memory_search(pattern, _should_only_dump_offsets(args))
  File "/usr/local/lib/python3.7/site-packages/frida/core.py", line 401, in method
    return script._rpc_request('call', js_name, args, **kwargs)
  File "/usr/local/lib/python3.7/site-packages/frida/core.py", line 26, in wrapper
    return f(*args, **kwargs)
  File "/usr/local/lib/python3.7/site-packages/frida/core.py", line 333, in _rpc_request
    raise result[2]
frida.core.RPCException: Error: access violation accessing 0x7f4902b000
    at /script1.js:9878
    at map (native)
    at /script1.js:9885
    at frida/runtime/message-dispatcher.js:15
    at c (frida/runtime/message-dispatcher.js:25)

To Reproduce Steps to reproduce the behavior:

  1. objection --gadget "xxxxx" explore
  2. memory search xxxx --string

Environment (please complete the following information):

leonjza commented 4 years ago

Unfortunately this command can be a little racy where the address when enumerated has since been remapped when trying to access it, resulting in errors such as these.