{"id":17172723,"url":"https://github.com/enovella/r2frida-wiki","last_synced_at":"2026-02-28T08:36:25.716Z","repository":{"id":78275485,"uuid":"153009971","full_name":"enovella/r2frida-wiki","owner":"enovella","description":"This repo aims at providing practical examples on how to use r2frida","archived":false,"fork":false,"pushed_at":"2020-12-11T12:21:08.000Z","size":549,"stargazers_count":199,"open_issues_count":2,"forks_count":20,"subscribers_count":14,"default_branch":"master","last_synced_at":"2025-04-10T23:41:52.789Z","etag":null,"topics":["dynamic-analysis","frida","r2frida","radare2","static-analysis"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/enovella.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2018-10-14T19:18:42.000Z","updated_at":"2025-03-04T22:17:00.000Z","dependencies_parsed_at":null,"dependency_job_id":"ea08fcbd-9580-4d7d-9dd6-9789af6eabdd","html_url":"https://github.com/enovella/r2frida-wiki","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/enovella/r2frida-wiki","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enovella%2Fr2frida-wiki","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enovella%2Fr2frida-wiki/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enovella%2Fr2frida-wiki/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enovella%2Fr2frida-wiki/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/enovella","download_url":"https://codeload.github.com/enovella/r2frida-wiki/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enovella%2Fr2frida-wiki/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29928996,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-27T19:37:42.220Z","status":"online","status_checked_at":"2026-02-28T02:00:07.010Z","response_time":90,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dynamic-analysis","frida","r2frida","radare2","static-analysis"],"created_at":"2024-10-14T23:47:03.917Z","updated_at":"2026-02-28T08:36:25.652Z","avatar_url":"https://github.com/enovella.png","language":null,"funding_links":[],"categories":["Tools","Powered by Frida"],"sub_categories":["Conferences"],"readme":"THIS WIKI IS NOW MAINTAINED AT https://github.com/nowsecure/r2frida/wiki\n==========================================================================\n\n# r2frida-wiki\n\nBefore reading this tutorial, it's highly recommended that you first take a look at the official website of [r2frida](https://github.com/nowsecure/r2frida) to install the tool as well as understand the capabilities of this one.\n\n\nAndroid \u0026 iOS Connection\n========================\nRetrieve the device id using `frida-ls-devices` and the name of the app using `frida-ps`. The package name may be preferable if the display name contains spaces.\n\n### Attach\n\nAttach to a running app using the display name.\n\n```bash\nr2 frida://device-id/Snapchat\n```\n\nAttach to the Frida Gadget:\n```bash\nr2 frida://attach/usb//Gadget\n```\n\n### Spawn\n\nSpawn an app using two `//` and the package name.\n\n```bash\nr2 frida://device-id//com.snapchat.android\n```\nOr explicitly using the word `spawn`:\n```bash\nr2 frida://spawn/usb/device-id/com.android.app\n```\nOr without entering the `device-id`:\n```bash\nr2 frida://spawn/usb//com.android.app\n```\n\nCommands (`\\?`)\n===============\nIn order to get the list of commands, you might want to type: `\\?`. Remember that all r2frida commands must start with `\\` or `=!`.\n\n![imaing](https://github.com/enovella/r2frida-wiki/blob/master/img/r2frida-android.jpg)\n\n## Version commands\n\n- `\\?V`: Show target Frida version\n\nTo display the r2 version:\n```java\n[0x00000000]\u003e ?V\n3.6.0-git aka 3.5.0-27-g2bba203eb commit 21781\n```\n\nTo display the Frida version:\n```java\n[0x00000000]\u003e \\?V\n{\"version\":\"12.5.3\"}\n[0x00000000]\u003e =!?V\n{\"version\":\"12.5.3\"}\n```\n\n## Informative commands (`\\i`)\n```java\n[0x00000000]\u003e \\?~^i\ni                          Show target information\nii[*]                      List imports\nil                         List libraries\nis[*] \u003clib\u003e                List symbols of lib (local and global ones)\niE[*] \u003clib\u003e                Same as is, but only for the export global ones\niEa[*] (\u003clib\u003e) \u003csym\u003e       Show address of export symbol\nisa[*] (\u003clib\u003e) \u003csym\u003e       Show address of symbol\nic \u003cclass\u003e                 List Objective-C classes or methods of \u003cclass\u003e\nip \u003cprotocol\u003e              List Objective-C protocols or methods of \u003cprotocol\u003e\n```\n- `\\i`: Shows target information\n```java\n[0x00000000]\u003e \\i\narch  arm\nbits  64\nos  linux\npid  14473\nuid  10127\nobjc  false\njava  true\ncylang  false\n```\n- `\\i*`: Shows target information in `r2` form\n```java\n[0x00000000]\u003e \\i*\ne asm.arch=arm\ne asm.bits=64\ne asm.os=linux\n```\n\n- `.\\i*`: Radare2 imports all the dynamic binary data from Frida. E.g: which architecture, endianness, pointer size, etc...\n![imaing](https://github.com/enovella/r2frida-wiki/blob/master/img/arm_thumb.png)\n\n- `.\\iE*`: Radare2 imports all the dynamic `export` data from Frida for all the dynamic libraries.\n\n- `.\\iE* \u003clib\u003e`: Radare2 imports all the dynamic `export` data from Frida for only one specific library.\n\n- `.\\ii*`: Radare2 imports all the dynamic `import` data from Frida.\n\n- `\\ii \u003clib\u003e`: List imports. Commonly used with the symbol `~`, which is the internal grep of `r2`.\n```java\n[0x00000000]\u003e \\ii libssl.so~+aes\n0x7f9419f510 f EVP_aes_128_cbc /system/lib64/libcrypto.so\n0x7f941a2740 f EVP_aead_aes_128_cbc_sha1_ssl3 /system/lib64/libcrypto.so\n0x7f941a3314 f EVP_aead_aes_128_cbc_sha1_tls /system/lib64/libcrypto.so\n0x7f941a3320 f EVP_aead_aes_128_cbc_sha1_tls_implicit_iv /system/lib64/libcrypto.so\n0x7f941a332c f EVP_aead_aes_128_cbc_sha256_tls /system/lib64/libcrypto.so\n0x7f9419f5b8 f EVP_aead_aes_128_gcm /system/lib64/libcrypto.so\n0x7f941a274c f EVP_aead_aes_256_cbc_sha1_ssl3 /system/lib64/libcrypto.so\n0x7f941a3338 f EVP_aead_aes_256_cbc_sha1_tls /system/lib64/libcrypto.so\n0x7f941a3344 f EVP_aead_aes_256_cbc_sha1_tls_implicit_iv /system/lib64/libcrypto.so\n0x7f941a3350 f EVP_aead_aes_256_cbc_sha256_tls /system/lib64/libcrypto.so\n0x7f941a335c f EVP_aead_aes_256_cbc_sha384_tls /system/lib64/libcrypto.so\n0x7f9419f5c4 f EVP_aead_aes_256_gcm /system/lib64/libcrypto.so\n0x7f9419f600 f EVP_has_aes_hardware /system/lib64/libcrypto.so\n```\n\n- `\\ii* \u003clib\u003e`: List imports in `r2` form.\n```java\n[0x00000000]\u003e \\ii* libssl.so~+aes\nf sym.imp.EVP_aes_128_cbc = 0x7f9419f510\nf sym.imp.EVP_aead_aes_128_cbc_sha1_ssl3 = 0x7f941a2740\nf sym.imp.EVP_aead_aes_128_cbc_sha1_tls = 0x7f941a3314\nf sym.imp.EVP_aead_aes_128_cbc_sha1_tls_implicit_iv = 0x7f941a3320\nf sym.imp.EVP_aead_aes_128_cbc_sha256_tls = 0x7f941a332c\nf sym.imp.EVP_aead_aes_128_gcm = 0x7f9419f5b8\nf sym.imp.EVP_aead_aes_256_cbc_sha1_ssl3 = 0x7f941a274c\nf sym.imp.EVP_aead_aes_256_cbc_sha1_tls = 0x7f941a3338\nf sym.imp.EVP_aead_aes_256_cbc_sha1_tls_implicit_iv = 0x7f941a3344\nf sym.imp.EVP_aead_aes_256_cbc_sha256_tls = 0x7f941a3350\nf sym.imp.EVP_aead_aes_256_cbc_sha384_tls = 0x7f941a335c\nf sym.imp.EVP_aead_aes_256_gcm = 0x7f9419f5c4\nf sym.imp.EVP_has_aes_hardware = 0x7f9419f600\n```\n\n- `\\il`: List libraries. Commonly used with the symbol `~`, which is the internal grep of `r2`.\n```java\n[0x00000000]\u003e \\il~+keystore,ssl,crypto\n0x0000007f94133000 libcrypto.so\n0x0000007f93059000 libssl.so\n0x0000007f879d8000 libjavacrypto.so\n0x0000007f879d3000 libkeystore-engine.so\n0x0000007f87985000 libkeystore_binder.so\n0x0000007f5c491000 libvisacrypto.so\n```\n- `\\iE \u003clib\u003e`: List exports of library(ies)\n```java\n[0x00000000]\u003e \\iE\nDo you want to print 111759 lines? (y/N) n\n```\nFiltering by library name:\n```java\n[0x00000000]\u003e \\iE libssl.so~AES\n0x7f9307afb4 f SSL_CIPHER_is_AES256CBC\n0x7f9307af64 f SSL_CIPHER_is_AES\n0x7f9307af8c f SSL_CIPHER_is_AESGCM\n0x7f9307af9c f SSL_CIPHER_is_AES128GCM\n0x7f9307afa8 f SSL_CIPHER_is_AES128CBC\n```\nFiltering by library name in `r2` form: (notice the `*`)\n```java\n[0x00000000]\u003e \\iE* libssl.so~AES\nf sym.fun.SSL_CIPHER_is_AES256CBC = 0x7f9307afb4\nf sym.fun.SSL_CIPHER_is_AES = 0x7f9307af64\nf sym.fun.SSL_CIPHER_is_AESGCM = 0x7f9307af8c\nf sym.fun.SSL_CIPHER_is_AES128GCM = 0x7f9307af9c\nf sym.fun.SSL_CIPHER_is_AES128CBC = 0x7f9307afa8\n```\n\n- `\\iEa (\u003clib\u003e) \u003csym\u003e`: Show address of export symbol\n\n```java\n[0x00000000]\u003e \\iEa libDexHelper.so JNI_OnLoad\n0xd1c2b859\n```\n\n- `\\iEa* (\u003clib\u003e) \u003csym\u003e`: Show address of export symbol in `r2` format\n\n```java\n[0x00000000]\u003e \\iEa* libDexHelper.so JNI_OnLoad\nf sym.JNI_OnLoad = 0xd1c2b859\n```\n- `\\isa[*] (\u003clib\u003e) \u003csym\u003e`:  Show address of symbol\n\n```java\n[0xd5d26859]\u003e \\is libc.so~sprintf\n0x0 f bionic/libc/upstream-openbsd/lib/libc/stdio/asprintf.c\n0x0 f bionic/libc/upstream-openbsd/lib/libc/stdio/vasprintf.c\n0x0 f bionic/libc/upstream-openbsd/lib/libc/stdio/vsprintf.c\n0x0 f bionic/libc/bionic/__vsprintf_chk.cpp\n0x0 f bionic/libc/stdio/sprintf.c\n0xf5140be5 f asprintf\n0xf5142dbd f vasprintf\n0xf5148da9 f vsprintf\n0xf5153c01 f __vsprintf_chk\n0xf5153c29 f __sprintf_chk\n0xf5155885 f sprintf\n\n[0xd5d26859]\u003e \\isa sprintf\n0xf5155885\n```\n- `\\ic`: List classes\n\n```java\n[0x00000000]\u003e \\ic\nDo you want to print 5769 lines? (y/N) n\n```\nFiltering by keyword (e.g package name):\n\n```java\n[0x00000000]\u003e \\ic~+security\nandroid.security.net.config.TrustAnchor\nandroid.security.net.config.UserCertificateSource\nandroid.security.net.config.CertificatesEntryRef\nandroid.security.net.config.DirectoryCertificateSource$CertSelector\nandroid.security.net.config.RootTrustManager\nandroid.security.net.config.PinSet\nandroid.security.net.config.CertificateSource\nandroid.security.keystore.AndroidKeyStoreProvider\nandroid.security.net.config.NetworkSecurityConfig$Builder\nandroid.security.net.config.ApplicationConfig\nandroid.security.NetworkSecurityPolicy\n```\n\n## Search commands (`\\/`)\n```java\n[0x00000000]\u003e \\?~^/\n/[x][j] \u003cstring|hexpairs\u003e  Search hex/string pattern in memory ranges (see search.in=?)\n/w[j] string               Search wide string\n/v[1248][j] value          Search for a value honoring `e cfg.bigendian` of given width\n```\n- `\\/ keyword`: Search hex/string pattern in memory ranges (see search.in=?)\n```java\n[0x00000000]\u003e \\/ rooted\n...\nSearching 6 bytes in [0x0000007f95e1a000-0x0000007f95ebb000]\n...\nSearching 6 bytes in [0x0000007fc74a5000-0x0000007fc7ca4000]\nhits: 9\n0x7f595ec8e7 hit1_0 rootediso8601DateFormatissuerAccessCodeissuerActionCod\n0x7f5e8aceb5 hit1_1 rooted devices for data security reasons.:Operation excepti\n0x7f69566fa9 hit1_2 rooted?EECan not capture your card details, NFC feature is\n0x7f6956f976 hit1_3 rooted or jailbroken. This is an added security measure to p\n0x7f695763ac hit1_4 rooted to keep your details safe AndroidPay utilizes the m\n0x7f69583dca hit1_5 rooted).T\n0x7f6958dc30 hit1_6 rooted or jailbroken.Z\n0x7f6958e011 hit1_7 rooted).\n0x7f6991d8e7 hit1_8 rootediso8601DateFormatissuerAccessCodeissuerActionCod\n```\n\nSearch string `keyword` and output in JSON format:\n```java\n[0x00000000]\u003e \\/j rooted\nSearching 6 bytes in [0x0000007f95ebe000-0x0000007f95ebf000]\n...\nSearching 6 bytes in [0x0000007fc74a5000-0x0000007fc7ca4000]\nhits: 9\n[{\"address\":\"0x7f595ec8e7\",\"size\":6,\"flag\":\"hit2_0\",\"content\":\"rootediso8601DateFormatissuerAccessCodeissuerActionCod\"},{\"address\":\"0x7f5e8aceb5\",\"size\":6,\"flag\":\"hit2_1\",\"content\":\"rooted devices for data security reasons.:Operation excepti\"},{\"address\":\"0x7f69566fa9\",\"size\":6,\"flag\":\"hit2_2\",\"content\":\"rooted?EECan not capture your card details, NFC feature is \"},{\"address\":\"0x7f6956f976\",\"size\":6,\"flag\":\"hit2_3\",\"content\":\"rooted or jailbroken. This is an added security measure to p\"},{\"address\":\"0x7f695763ac\",\"size\":6,\"flag\":\"hit2_4\",\"content\":\"rooted to keep your details safe AndroidPay utilizes the m\"},{\"address\":\"0x7f69583dca\",\"size\":6,\"flag\":\"hit2_5\",\"content\":\"rooted).T      \"},{\"address\":\"0x7f6958dc30\",\"size\":6,\"flag\":\"hit2_6\",\"content\":\"rooted or jailbroken.Z    \"},{\"address\":\"0x7f6958e011\",\"size\":6,\"flag\":\"hit2_7\",\"content\":\"rooted).      \"},{\"address\":\"0x7f6991d8e7\",\"size\":6,\"flag\":\"hit2_8\",\"content\":\"rootediso8601DateFormatissuerAccessCodeissuerActionCod\"}]\n```\n\nAnother example searching for potential whitebox cryptography implementations:\n```java\n[0x00000000]\u003e \\/ whitebox\nSearching 8 bytes in [0x0000007fa558c000-0x0000007fa558f000]\nSearching 8 bytes in [0x0000007feee1a000-0x0000007fef619000]\nhits: 7\n0x7f6cf4481d hit1_0 whitebox_damagePKhPhi_Z15whitebox_repairPhS_i_Z16CryptoPP_\n0x7f6cf44837 hit1_1 whitebox_repairPhS_i_Z16CryptoPP_GenKeysSs_Z16gen_random_b\n0x7f6f27c81d hit1_2 whitebox_damagePKhPhi_Z15whitebox_repairPhS_i_Z16CryptoPP_\n0x7f6f27c837 hit1_3 whitebox_repairPhS_i_Z16CryptoPP_GenKeysSs_Z16gen_random_b\n0x7f6f8fd4f9 hit1_4 whiteboxed_key_gen.cG[fzM~=)j-#wTOL$C9\n0x7f6fa185f0 hit1_5 whiteboxed_key_gen.c=j;h58Z\\^X).ln|\n0x7f7dcb7552 hit1_6 whitebox\n```\n\nSearch hex string:\n```java\n[0x00000000]\u003e \\/x c0ffee\nSearching 3 bytes in [0x0000007f95ebf000-0x0000007f95ec2000]\n...\nSearching 3 bytes in [0x0000007fc74a5000-0x0000007fc7ca4000]\nhits: 7\n0x71100090 hit3_0 c0ffee\n0x719a104c hit3_1 c0ffee\n0x7f59df54ec hit3_2 c0ffee\n0x7f5bfaf4ec hit3_3 c0ffee\n0x7f6141bb52 hit3_4 c0ffee\n0x7f61e7de68 hit3_5 c0ffee\n0x7f87c07623 hit3_6 c0ffee\n```\nSearch hex string and outputs in JSON format:\n```java\n[0x00000000]\u003e \\/xj c0ffee\nSearching 3 bytes in [0x0000007f95ebe000-0x0000007f95ebf000]\n...\nSearching 3 bytes in [0x0000007fc74a5000-0x0000007fc7ca4000]\nhits: 7\n[{\"address\":\"0x71100090\",\"size\":3,\"flag\":\"hit4_0\",\"content\":\"c0ffee\"},{\"address\":\"0x719a104c\",\"size\":3,\"flag\":\"hit4_1\",\"content\":\"c0ffee\"},{\"address\":\"0x7f59df54ec\",\"size\":3,\"flag\":\"hit4_2\",\"content\":\"c0ffee\"},{\"address\":\"0x7f5bfaf4ec\",\"size\":3,\"flag\":\"hit4_3\",\"content\":\"c0ffee\"},{\"address\":\"0x7f6141bb52\",\"size\":3,\"flag\":\"hit4_4\",\"content\":\"c0ffee\"},{\"address\":\"0x7f61e7de68\",\"size\":3,\"flag\":\"hit4_5\",\"content\":\"c0ffee\"},{\"address\":\"0x7f87c07623\",\"size\":3,\"flag\":\"hit4_6\",\"content\":\"c0ffee\"}]\n```\nSearch value `v` from a given width in bytes `[1248]`:\n```java\n[0x00000000]\u003e ? 1234\nhex     0x4d2\nstring  \"\\xd2\\x04\"\n[0x00000000]\u003e \\/v4 1234\nSearching 3 bytes in [0x0000007f95ebe000-0x0000007f95ebf000]\n...\nSearching 3 bytes in [0x0000007fc74a5000-0x0000007fc7ca4000]\nhits: 1076\n0x7f95acfb23 hit2_1071 d2040000\n0x7f95ad01d3 hit2_1072 d2040000\n0x7f95e96a2b hit2_1073 d2040000\n0x7f95e96b17 hit2_1074 d2040000\n0x7f95e96f1f hit2_1075 d2040000\n0x7f95e96fb3 hit2_1076 d2040000\n```\n\n## Dynamic/Debugging commands (`\\d`)\n```java\n[0x00000000]\u003e \\?~^d\ndb (\u003caddr\u003e|\u003csym\u003e)          List or place breakpoint\ndb- (\u003caddr\u003e|\u003csym\u003e)|*       Remove breakpoint(s)\ndc                         Continue breakpoints or resume a spawned process\ndd[-][fd] ([newfd])        List, dup2 or close filedescriptors\ndm[.|j|*]                  Show memory regions\ndma \u003csize\u003e                 Allocate \u003csize\u003e bytes on the heap, address is returned\ndmas \u003cstring\u003e              Allocate a string inited with \u003cstring\u003e on the heap\ndmad \u003caddr\u003e \u003csize\u003e         Allocate \u003csize\u003e bytes on the heap, copy contents from \u003caddr\u003e\ndmal                       List live heap allocations created with dma[s]\ndma- (\u003caddr\u003e...)           Kill the allocations at \u003caddr\u003e (or all of them without param)\ndmp \u003caddr\u003e \u003csize\u003e \u003cperms\u003e  Change page at \u003caddress\u003e with \u003csize\u003e, protection \u003cperms\u003e (rwx)\ndmm                        List all named squashed maps\ndmh                        List all heap allocated chunks\ndmhj                       List all heap allocated chunks in JSON\ndmh*                       Export heap chunks and regions as r2 flags\ndmhm                       Show which maps are used to allocate heap chunks\ndp                         Show current pid\ndpt                        Show threads\ndr                         Show thread registers (see dpt)\ndl libname                 Dlopen a library\ndl2 libname [main]         Inject library using Frida's \u003e= 8.2 new API\ndt (\u003caddr\u003e|\u003csym\u003e) ...      Trace list of addresses or symbols\ndth (\u003caddr\u003e|\u003csym\u003e) (x y..) Define function header (z=str,i=int,v=hex barray,s=barray)\ndt-                        Clear all tracing\ndtr \u003caddr\u003e (\u003cregs\u003e...)     Trace register values\ndtf \u003caddr\u003e [fmt]           Trace address with format (^ixzO) (see dtf?)\ndtSf[*j] [sym|addr]        Trace address or symbol using the stalker (Frida \u003e= 10.3.13)\ndtS[*j] seconds            Trace all threads for given seconds using the stalker\ndi[0,1,-1] [addr]          Intercept and replace return value of address\ndx [hexpairs]              Inject code and execute it (TODO)\ndxc [sym|addr] [args..]    Call the target symbol with given args\n```\n\n- `db (\u003caddr\u003e|\u003csym\u003e)`: List or place breakpoint\n\nSet a dynamic breakpoint: (notice the field `\"stopped\":false`)\n```java\n[0x00000000]\u003e \\db `\\ii libtarget.so~dlsym[0]`\n{\n  \"0x7f95e19548\": {\n    \"name\": \"0x7f95e19548\",\n    \"stopped\": false,\n    \"address\": \"0x7f95e19548\",\n    \"continue\": false,\n    \"handler\": {}\n  }\n}\n```\n\nOnce the breakpoint is hit, we can tamper with memory at will (notice the field `\"stopped\":true`)\n```java\n[0x00000000]\u003e \\db\n{\n  \"0x7f95e19548\": {\n    \"name\": \"0x7f95e19548\",\n    \"stopped\": true,\n    \"address\": \"0x7f95e19548\",\n    \"continue\": false,\n    \"handler\": {}\n  }\n}\n```\n\nList all breakpoints:\n```java\n[0x00000000]\u003e \\db\n{\n  \"0x7f95e19548\": {\n    \"name\": \"0x7f95e19548\",\n    \"stopped\": true,\n    \"address\": \"0x7f95e19548\",\n    \"continue\": false,\n    \"handler\": {}\n  },\n  \"0x7f942bf1e8\": {\n    \"name\": \"0x7f942bf1e8\",\n    \"stopped\": false,\n    \"address\": \"0x7f942bf1e8\",\n    \"continue\": false,\n    \"handler\": {}\n  }\n}\n```\n\nAfter inspecting memory, we continue the execution:\n```java\n[0x00000000]\u003e \\dc\nContinue 1 thread(s).\n```\n\nWhen breakpoints are no longer needed, they can be removed:\n```java\n[0x00000000]\u003e \\db- *\nAll breakpoints removed\n[0x00000000]\u003e \\db\n{}\n```\n\n- `\\dm`: Show memory regions (equivalent to `cat /proc/$PID/maps`)\n\nList of memory regions (JSON output in the second command)\n```java\n[0x7f93059000]\u003e \\dm\nDo you want to print 1708 lines? (y/N) n\n[0x7f93059000]\u003e \\dmj\nDo you want to print 1 lines? (y/N) n\n```\nFilter by library name:\n```java\n[0x00000000]\u003e \\dm~ssl\n0x0000007f618ee000 - 0x0000007f61929000 r-- /system/lib64/libssl.so\n0x0000007f93059000 - 0x0000007f93091000 r-x /system/lib64/libssl.so\n0x0000007f93092000 - 0x0000007f93094000 r-- /system/lib64/libssl.so\n0x0000007f93094000 - 0x0000007f93095000 rw- /system/lib64/libssl.so\n```\nFilter by library name, enable the output to be in `r2` format:\n```java\n[0x7f93059000]\u003e \\dm*~ssl\nf map.0x0000007f618ee000 = 0x7f618ee000 # r-- /system/lib64/libssl.so\nf map.0x0000007f93059000 = 0x7f93059000 # r-x /system/lib64/libssl.so\nf map.0x0000007f93092000 = 0x7f93092000 # r-- /system/lib64/libssl.so\nf map.0x0000007f93094000 = 0x7f93094000 # rw- /system/lib64/libssl.so\n```\n\nFind out the memory region of the current offset:\n```java\n[0x00000000]\u003e s 0x0000007f93059000\n[0x7f93059000]\u003e \\dm.\n0x0000007f93059000 - 0x0000007f93091000 r-x /system/lib64/libssl.so\n```\n\nWithout seeking into an offset:\n```java\n[0x00000000]\u003e \\dm. @ 0x7f6f8fd4f9\n0x0000007f6f8fd000 - 0x0000007f6fa56000 rw- /data/app/com.target.pay-1/lib/arm64/libvisacrypto.so\n```\n\n- `\\dma \u003csize\u003e`: Allocate \u003csize\u003e bytes on the heap, address is returned\n\n```java\n[0x00000000]\u003e \\dma 512\n0xcb1777f0\n[0x00000000]\u003e x 512 @ 0xcb1777f0\n- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF\n0xcb1777f0  0000 0000 0000 0000 0000 0000 0000 0000  ................\n0xcb177800  0000 0000 0000 0000 0000 0000 0000 0000  ................\n```\n- `\\dmas \u003cstring\u003e`: Allocate a string inited with \u003cstring\u003e on the heap\n\n```java\n0x00000000]\u003e \\dmas r2fridaiscool\n0xf3d7ee10\n[0x00000000]\u003e ps @ 0xf3d7ee10\nr2fridaiscool\n[0x00000000]\u003e x @ 0xf3d7ee10\n- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF\n0xf3d7ee10  7232 6672 6964 6169 7363 6f6f 6c00 f2ff  r2fridaiscool...\n0xf3d7ee20  1800 0000 1300 0000 01a3 57de 0000 0000  ..........W.....\n0xf3d7ee30  0000 0000 2300 0000 7265 2e66 7269 6461  ....#...re.frida\n0xf3d7ee40  2e41 6765 6e74 436f 6e74 726f 6c6c 6572  .AgentController\n0xf3d7ee50  3132 0000 1b00 0000 c050 d7f3 0300 0000  12.......P......\n```\n- `\\dmal` : List live heap allocations created with dma[s]\n\n```java\n[0x00000000]\u003e \\dmal\n0xf3d7ee10\t\"r2fridaiscoolW#re.frida.AgentContro\"\n```\n\n- `\\dt (\u003caddr\u003e|\u003csym\u003e) ...`: Trace list of addresses or symbols. Similar to `frida-trace`\n\nDynamic tracing (`\\dt`) `fopen`:\n```java\n[0x00000000]\u003e \\dt fopen; \\dth fopen z; \\dc\n[TRACE] 0x7f942bf1e8 ( fopen ) [\"/proc/self/maps\"]\n - 0x7f5bf72d98 libtarget.so!scan_executable+0xf0\n - 0x7f5bf72d94 libtarget.so!scan_executable+0xec\n - 0x7f5bf721b4 libtarget.so!secchecks+0x90\n - 0x7f5bf6cdb8 libtarget.so!Java_com_super_secure_App+0x1710\n - 0x7f69e6a7e0 base.odex!oatexec+0x4e7e0\n```\nDynamic tracing (`\\dt`) `strcmp`:\n```java\n -- Insert coin to continue ...\n[0x00000000]\u003e \\dt strcmp; \\dth strcmp z z; \\. agent.js ;\\dc\nundefined\n[TRACE] 0x7f94267adc ( strcmp ) [\"Landroid/app/ActivityThread;\",\"Landroid/app/ActivityThread;\"]\n - 0x7f91abdeac libart.so!0x11ceac\n - 0x7f91abdea8 libart.so!0x11cea8\n - 0x7f91ace8b0 libart.so!_ZN3art10ClassTable6LookupEPKcm+0x100\n - 0x7f91aa0b9c libart.so!_ZN3art11ClassLinker11LookupClassEPNS_6ThreadEPKcmPNS_6mirror11ClassLoaderE+0xc4\n - 0x7f91aa0de8 libart.so!_ZN3art11ClassLinker26FindClassInPathClassLoaderERNS_33ScopedObjectAccessAlreadyRunnableEPNS_6ThreadEPKcmNS_6HandleINS_6mirror11ClassLoaderEEEPPNS8_5ClassE+0xfc\n - 0x7f91aa0e7c libart.so!_ZN3art11ClassLinker26FindClassInPathClassLoaderERNS_33ScopedObjectAccessAlreadyRunnableEPNS_6ThreadEPKcmNS_6HandleINS_6mirror11ClassLoaderEEEPPNS8_5ClassE+0x190\n - 0x7f91aa2234 libart.so!_ZN3art11ClassLinker9FindClassEPNS_6ThreadEPKcNS_6HandleINS_6mirror11ClassLoaderEEE+0x3b0\n - 0x7f91ca1e24 libart.so!0x300e24\n - 0x7f7b356884 frida-agent-64.so!0x177884\n[TRACE] 0x7f94267adc ( strcmp ) [\"Landroid/hardware/radio/RadioManager$ModuleProperties;\",\"Landroid/hardware/radio/RadioManager$ModuleProperties;\"]\n - 0x7f91abdeac libart.so!0x11ceac\n - 0x7f91abdea8 libart.so!0x11cea8\n - 0x7f91ace8b0 libart.so!_ZN3art10ClassTable6LookupEPKcm+0x100\n - 0x7f91aa0b9c libart.so!_ZN3art11ClassLinker11LookupClassEPNS_6ThreadEPKcmPNS_6mirror11ClassLoaderE+0xc4\n - 0x7f91aa0de8 libart.so!_ZN3art11ClassLinker26FindClassInPathClassLoaderERNS_33ScopedObjectAccessAlreadyRunnableEPNS_6ThreadEPKcmNS_6HandleINS_6mirror11ClassLoaderEEEPPNS8_5ClassE+0xfc\n - 0x7f91aa0e7c libart.so!_ZN3art11ClassLinker26FindClassInPathClassLoaderERNS_33ScopedObjectAccessAlreadyRunnableEPNS_6ThreadEPKcmNS_6HandleINS_6mirror11ClassLoaderEEEPPNS8_5ClassE+0x190\n - 0x7f91aa2234 libart.so!_ZN3art11ClassLinker9FindClassEPNS_6ThreadEPKcNS_6HandleINS_6mirror11ClassLoaderEEE+0x3b0\n - 0x7f91ca1e24 libart.so!0x300e24\n - 0x7f7b356884 frida-agent-64.so!0x177884\n```\n\nDynamic tracing (`\\dt`) `unlink`:\n```java\n[0x00000000]\u003e \\dt unlink; \\dth unlink z; \\. agent.js ;\\dc\n[TRACE] 0x7f94274fe0 ( unlink ) [\"/data/data/com.target.app/.   ​\"]\n - 0x7f942a5824 libc.so!remove+0x58\n - 0x7f942a5820 libc.so!remove+0x54\n - 0x7f8c39f724 libopenjdk.so!Java_java_io_UnixFileSystem_delete0+0x5c\n - 0x720157dc boot.oat!oatexec+0x647dc\n[TRACE] 0x7f94274fe0 ( unlink ) [\"/data/data/com.target.app/.   \"]\n - 0x7f942a5824 libc.so!remove+0x58\n - 0x7f942a5820 libc.so!remove+0x54\n - 0x7f8c39f724 libopenjdk.so!Java_java_io_UnixFileSystem_delete0+0x5c\n - 0x720157dc boot.oat!oatexec+0x647dc\n ```\n\n- `dtf \u003caddr\u003e [fmt]`: Trace address with format (^ixzO) (see dtf?)\n\nExtra help:\n```java\n[0x00000000]\u003e \\dtf?\nUsage: dtf [format] || dtf [addr] [fmt]\n  ^  = trace onEnter instead of onExit\n  +  = show backtrace on trace\n p/x = show pointer in hexadecimal\n  c  = show value as a string (char)\n  i  = show decimal argument\n  z  = show pointer to string\n  s  = show string in place\n  O  = show pointer to ObjC object\nUndocumented: Z, S\n dtf\ttrace format\n```\n\nTracing native wrappers with format (`z`= pointer to string) and adding backtracing (`^`):\n```java\n[0x00000000]\u003e \\dtf fopen z^; \\dtf dlopen z^;\n[0x00000000]\u003e \\dc\nresumed spawned process.\n[TRACE] dtf\tdlopen\t(0: \"libc.so\")\t0x7f908b4668\tlibshella-2.9.0.5.so\t0xfffffffff9d91668\n\t0x7f908b4664\tlibshella-2.9.0.5.so\t0xfffffffff9d91664\n\t0x7f908b4b1c\tlibshella-2.9.0.5.so\tJNI_OnLoad+0x124\n\t0x7f96b24bac\tlibshella-2.9.0.5.so\t0x1bac\n\t0x7f97ecf650\tlibart.so\t_ZN3art9JavaVMExt17LoadNativeLibrary\u003cREDACTED\u003e...9_+0x858\n[TRACE] dtf     fopen   (0: \"/proc/self/stat\")  0x7f99409550    libc.so pthread_getattr_np+0xc4\n\t0x7f9940954c\tlibc.so\tpthread_getattr_np+0xc0\n\t0x7f9744aedc\tlibBugly.so\tjavaStaticCall_Thread_CurrentThread+0x80\n\t0x7f9744b40c\tlibBugly.so\tjavaTheadDump+0x44\n\t0x7f9744be40\tlibBugly.so\tgetBuglyClassPathPrefix+0x48\n\t0x7f9744fd3c\tlibBugly.so\tJNI_OnLoad+0x90\n\t0x7f97ecf650\tlibart.so\t_ZN3art9JavaVMExt17LoadNativeLibrary\u003cREDACTED\u003e...9_+0x858\n\t0x7f9bdcb27c\tlibopenjdkjvm.so\tJVM_NativeLoad+0x118\n\t0x7204cdd0\tboot.oat\toatexec+0x9bdd0\n```\n\n- `\\dkr`: Print the crash report (if the app has crashed)\n```java\nerror: Script is destroyed\nerror: Script is destroyed\n[0xc3374000]\u003e \\dkr\n*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\nBuild fingerprint: 'OnePlus/OnePlus5/OnePlus5:7.0/NRD90M/0131337:user/release-keys'\nRevision: '0'\nABI: 'arm'\npid: 9207, tid: 9229, name: gum-js-loop  \u003e\u003e\u003e com.target.application \u003c\u003c\u003c\nsignal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------\nAbort message: '../../../glib/glib/gmem.c:106: failed to allocate 1037852 bytes'\n    r0 00000000  r1 0000240d  r2 00000006  r3 00000008\n    r4 ce47f978  r5 00000006  r6 ce47f920  r7 0000010c\n    r8 00000000  r9 00000007  sl 0000e98d  fp 0000e98c\n    ip 0000000c  sp ce47f268  lr e8d944b7  pc e8d96d38  cpsr 200f0010\n\nbacktrace:\n    #00 pc 00000d38  /system/lib/libc.so (offset 0x49000)\n    #01 pc 000264b3  /system/lib/libc.so (offset 0x21000)\n```\n\n- `\\dxc [sym|addr] [args..]`: Call the target symbol with given args\n\nFind a function to call to: (e.g. we search for an import in the Gadget)\n```java\n[0x00000000]\u003e \\ii frida-gadget.so~gettimeofday\n0xf40d8590 f gettimeofday /system/lib/libc.so\n```\n\nAs we want to call the function `int gettimeofday(struct timeval *tv, struct timezone *tz);` we would need two new structs. For doing so, we can allocate some memory in the heap of the process and get two pointers.\n```java\n[0x00000000]\u003e \\dma 16\n0xebaf6f18\n[0x00000000]\u003e \\dma 16\n0xebaf70d8\n```\nFinally we can call the function using the aforementioned pointers. The `dxc` command returns the return value of the function called.\n```java\n[0x00000000]\u003e \\dxc 0xf40d8590 0xebaf6f18 0xebaf70d8\n\"0x0\"\n```\nFor this specific example, we can use the r2 command `pt` (print timestamp) to verify that the pointer got indeed populated with the timestamp. Hence, we have arbitrarily executed code within the process.\n```java\n[0x00000000]\u003e x 16 @ 0xebaf6f18\n- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF\n0xebaf6f18  301e ae5c 0b6c 0200 0000 0000 0000 0000  0..\\.l..........\n[0x00000000]\u003e pt 4 @ 0xebaf6f18\nWed Apr 10 17:47:44 2019\n```\n\n## Evaluable Variables (`\\e`)\n- `e[?] [a[=b]]`: List/get/set config evaluable vars\n```java\n[0x00000000]\u003e \\e\ne patch.code=true\ne search.in=perm:r--\ne search.quiet=false\ne stalker.event=compile\ne stalker.timeout=300\ne stalker.in=raw\n```\n## Environment variables (`\\env`)\n- `\\env`: Get/set environment variable\n\nSet env variable:\n```java\n[0x00000000]\u003e \\env LD_PRELOAD=/data/local/tmp/libhook.so\nLD_PRELOAD=/data/local/tmp/libhook.so\n```\n\nGet env variable:\n```java\n[0x00000000]\u003e \\env LD_PRELOAD\nLD_PRELOAD=/data/local/tmp/libhook.so\n```\n\nList all variables:\n```java\n[0x00000000]\u003e \\env\nPATH=/su/bin:/sbin:/vendor/bin:/system/sbin:/system/bin:/su/xbin:/system/xbin\nANDROID_BOOTLOGO=1\nANDROID_ROOT=/system\nANDROID_ASSETS=/system/app\nANDROID_DATA=/data\nANDROID_STORAGE=/storage\nEXTERNAL_STORAGE=/sdcard\nASEC_MOUNTPOINT=/mnt/asec\nANDROID_SOCKET_zygote=9\nANDROID_LOG_TAGS=*:s\n```\n\n## Frida Scripts (`\\. script.js`)\n\nJS code to be run in the target can be loaded with `\\. script.js`. A common practice is always to call this script `agent.js` to remember that's the code to be run inside the target.\n\n```java\n[0x00000000]\u003e \\. agent.js\n[0x00000000]\u003e \\dc\nresumed spawned process.\n```\n\n\n### iOS\n\n- `ic`: List classes\n\n(This will have a large output.)\n\n```java\n[0x00000000]\u003e \\ic\nOS_dispatch_queue_attr\nOS_dispatch_group\nOS_dispatch_semaphore\nOS_dispatch_mach\nOS_dispatch_source\nOS_dispatch_queue\nOS_dispatch_queue_mgr\nOS_dispatch_queue_network_event\nOS_dispatch_queue_root\nOS_dispatch_queue_main\nOS_dispatch_queue_concurrent\nOS_dispatch_queue_serial\nOS_dispatch_queue_runloop\n[0x00000000]\u003e\n```\n\nList classes with a filter or keyword:\n\n```java\n[0x00000000]\u003e \\ic ~UITouch\n_UITouchObservation\n_UITouchForceMessage\n_UITouchForceObservationMessageReader\n_DUITouchRoutingPolicy\nUITouch\n_UITouchForwardingRecipient\n_UITouchPredictionManager\nUITouchData\n_UITouchForceInteractionProgress\n_UITouchForceObservable\nUITouchForceGestureRecognizer\n_UITouchesObservingGestureRecognizer\nUITouchesEvent\n[0x00000000]\u003e\n```\n\nList fields in one class:\n\n```java\n[0x00000000]\u003e \\ic UITouch\n0x000000018df1bf38 + _createTouchesWithGSEvent:phase:view:\n0x0000000197826758 - pu_locationInPresentationLayerOfView:\n0x000000019b18ab74 - locationInNode:\n0x000000019b18acd0 - previousLocationInNode:\n0x000000018db33858 - window\n0x000000018db34794 - locationInView:\n0x000000018db339f0 - phase\n0x000000018db41d0c - .cxx_destruct\n0x000000018db41cb8 - dealloc\n0x000000018df1c170 - description\n0x000000018db33ee0 - view\n0x000000018db34da0 - timestamp\n0x000000018db32924 - setWindow:\n0x000000018dd230f4 - _setEaten:\n0x000000018db33540 - _isEaten\n[0x00000000]\u003e\n```\n\n- `ip \u003cprotocol\u003e`: List protocols\n\n(This will have a large output.)\n\n```java\n[0x00000000]\u003e \\ip\nGVRenderer\nCADSyncInterface\nVKMapModelDelegate\nSCNPhysicsBehaviorJSExport\nGEOMapServiceProblemReportTicket\nPXWidgetUnlockDelegate\nICMusicSubscriptionLeaseSessionDelegate\nIKJSDOMCharacterData\nACDAccountAuthenticationPlugin\nTUIDSLookup\nFCOrderedCollectionAdditions\nMSSubscribeStreamsProtocolDelegate\n_DKEventStatsCounterInternalProperty\nFBInterstitialAdNativeViewDelegate\n[0x00000000]\u003e\n```\n\nList protocols with a filter or keyword:\n\n```java\n[0x00000000]\u003e \\ip ~Touch\nGADNTouchHandling\nUIScrollViewDelayedTouchesBeganGestureRecognizerClient\n_UITouchPhaseChangeDelegate\n_UIKBRTTouchDriftingDelegate\nUIDebuggingInformationTouchObserver\nWBSTouchIconObserver\nBKSTouchDeliveryPolicyServerInterface\n_UITouchForceObservationMessageReading\n_UITouchable\n_UIFocusEnginePanGestureTouchObserver\nUIWebTouchEventsGestureRecognizerDelegate\n_MKUserInteractionGestureRecognizerTouchObserver\nFBAdTouchGestureRecognizerDelegate\n_UIPreviewInteractionTouchForceProviding\n[0x00000000]\u003e\n```\n\nList methods of one protocol:\n\n```java\n[0x00000000]\u003e \\ip GADNTouchHandling\n- handleUserTouchMovedByVector:\n[0x00000000]\u003e\n```\n\n- `dpt`: List threads\n\n```java\n[0x00000000]\u003e \\dpt\n1027\n18947\n26375\n39687\n37895\n37635\n36875\n36359\n34843\n29187\n33543\n43527\n86531\n77827\n63499\n67347\n68651\n62491\n```\n\n- `dr`: List thread registers (see `dpt`)\n\n```java\n[0x00000000]\u003e \\dr\ntid 1027 waiting\n fp : 0x000000016eb66bb0\t lr : 0x0000000180c873e0\t pc : 0x0000000180c87568\n sp : 0x000000016eb66b60\t x0 : 0x000000016eb66cb8\t x1 : 0x0000000007000806\n x2 : 0x0000000000000000\t x3 : 0x0000000000000c00\t x4 : 0x0000000000004c03\n x5 : 0x00000000ffffffff\t x6 : 0x0000000000000000\t x7 : 0x00000000000003d0\n x8 : 0x00000000fffffbbf\t x9 : 0x0000000007000000\tx10 : 0x0000000007000100\nx11 : 0x0000000000000040\tx12 : 0xffffffffffffffff\tx13 : 0x0000000000000001\nx14 : 0x0071180000711800\tx15 : 0x0000000000000000\tx16 : 0xffffffffffffffe1\nx17 : 0x00000000ffffffff\tx18 : 0xfffffff00fe9925c\tx19 : 0x0000000000000000\nx20 : 0x00000000ffffffff\tx21 : 0x0000000000004c03\tx22 : 0x0000000000000c00\nx23 : 0x000000016eb66cb8\tx24 : 0x0000000007000806\tx25 : 0x0000000000000000\nx26 : 0x0000000007000806\tx27 : 0x0000000000000c00\tx28 : 0x0000000000000001\n\ntid 18947 waiting\n fp : 0x000000016f165d80\t lr : 0x0000000180c873e0\t pc : 0x0000000180c87568\n sp : 0x000000016f165d30\t x0 : 0x000000016f165e88\t x1 : 0x0000000007000806\n x2 : 0x0000000000000000\t x3 : 0x0000000000000c00\t x4 : 0x0000000000003203\n x5 : 0x00000000ffffffff\t x6 : 0x0000000000000000\t x7 : 0x0000000000000000\n x8 : 0x00000000fffffbbf\t x9 : 0x0000000007000000\tx10 : 0x0000000007000100\nx11 : 0x0000000000000040\tx12 : 0xffffffffffffffff\tx13 : 0x0000000000000001\nx14 : 0x00019e0000019e00\tx15 : 0x0000000000000000\tx16 : 0xffffffffffffffe1\nx17 : 0x00000000ffffffff\tx18 : 0xfffffff00fe9925c\tx19 : 0x0000000000000000\nx20 : 0x00000000ffffffff\tx21 : 0x0000000000003203\tx22 : 0x0000000000000c00\nx23 : 0x000000016f165e88\tx24 : 0x0000000007000806\tx25 : 0x0000000000000000\nx26 : 0x0000000007000806\tx27 : 0x0000000000000c00\tx28 : 0x0000000000000001\n\n...\u003cREDACTED\u003e...\n\ntid 62499 waiting\n fp : 0x000000017199aaf0\t lr : 0x0000000180dbaeec\t pc : 0x0000000180ca8d80\n sp : 0x000000017199aa60\t x0 : 0x0000000000000040\t x1 : 0x000000017199ab80\n x2 : 0x0000000000000001\t x3 : 0x0000000000000000\t x4 : 0x000000000000001e\n x5 : 0x0000000000000020\t x6 : 0x0000000000000001\t x7 : 0x0000043fa8245c34\n x8 : 0x0000000000000001\t x9 : 0x0000000000000000\tx10 : 0xffbffe0000000000\nx11 : 0x0000001000000000\tx12 : 0x0000000000000000\tx13 : 0x00000000af75b1b0\nx14 : 0x0000000000000000\tx15 : 0x0000000000000000\tx16 : 0x0000000000000170\nx17 : 0x00000000ffffffe2\tx18 : 0xfffffff00fe9925c\tx19 : 0x000000017199b000\nx20 : 0x00000000003c0021\tx21 : 0x0000000000000021\tx22 : 0x0000000000000001\nx23 : 0x00000001b238e000\tx24 : 0x0000000000002000\tx25 : 0x0000000000080000\nx26 : 0x0000000000000007\tx27 : 0x00000001b238e000\tx28 : 0x0000000000000000\n```\n\n- `dtr \u003caddr\u003e (\u003cregs\u003e...)`: Trace register values\n\nTrace register(`x1`) at address `0x102d2e3f4`\n```java\n[0x00000000]\u003e \\dtr 0x102d2e3f4 x1\n```\n\nOnce the address is hit, the register value is shown:\n```\nTrace probe hit at 0x102d2e3f4  (0x102d2e3f4) 0x19fd3e4\n\tx1 = 0x111243c80 ( user=eduardo;passwd=novella )\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fenovella%2Fr2frida-wiki","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fenovella%2Fr2frida-wiki","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fenovella%2Fr2frida-wiki/lists"}