xiaokanghub/Frida-Android-unpack: this unpack script for Android O and Android P
2019-11-27 01:18:26 Author: github.com(查看原文) 阅读量:400 收藏

this script for Android O and Android P.After Android 7.X,we cann't get OpenMemory function in libart.so,so the old script failed.we find the OpenCommon function to replace it.we can get dex file from this func,its parameters contain the memory address and size of dex.

Runtime environment

u need a root mobile and installed Frida
ro.debuggable = true

How to use this script?

frida -U -f com.xxx.xxx.xxx -l dupDex.js --no-pause

Function

art::DexFile::OpenCommon(unsigned char const*, unsigned long, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, unsigned int, art::OatDexFile const*, bool, bool, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*, art::DexFile::VerifyResult*)

Test

Tencent
360
others


文章来源: https://github.com/xiaokanghub/Frida-Android-unpack
如有侵权请联系:admin#unsafe.sh