hluwa / frida-dexdump

A frida tool to dump dex in memory to support security engineers analyzing malware.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

dump后无法找到dex

super-keys opened this issue · comments

commented

apk: https://www.wandoujia.com/apps/7868176
安装apk后修改脚本:
把get_usb_device替换为get_remote_device (win64)
测试

  1. 启动fridaServer.
  2. tcp转发
  3. python main.py
    [DEXDump]: found target [1596] com.jtjsb.xndwsq [DEXDump]: DexSize=0x6df168, SavePath=./com.jtjsb.xndwsq/0xe208f000.dex [DEXDump]: DexSize=0x23162c, SavePath=./com.jtjsb.xndwsq/0xe276f000.dex [DEXDump]: DexSize=0x11c, SavePath=./com.jtjsb.xndwsq/0xf46ce678.dex [DEXDump]: DexSize=0x1, SavePath=./com.jtjsb.xndwsq/0xf46cf0f8.dex [DEXDump]: DexSize=0x789, SavePath=./com.jtjsb.xndwsq/0xf7531000.dex
  4. 去手机对应的data/data/com.jtjsb.xndwsq或者data/app/com.jtjsb.xndwsq无法找到对应的dex
  5. 在data目录全局搜 find . -name 0xe208f000.dex 没有对应的结果.

大佬辛苦了.

dump完dex在电脑上.......

出现附加超时
Traceback (most recent call last):
File "main.py", line 19, in
session = device.attach(target.pid)
File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/frida/core.py", line 26, in wrapper
return f(*args, **kwargs)
File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/frida/core.py", line 156, in attach
return Session(self._impl.attach(self._pid_of(target)))
frida.TransportError: timeout was reached

commented

hluwa大佬辛苦哈哈