https://github.com/rednaga/frida-stack

Getting better stacks and backtraces in Frida
https://github.com/rednaga/frida-stack

android frida reverse-engineering security stacks

Last synced: 3 months ago
JSON representation

Getting better stacks and backtraces in Frida

• Host: GitHub
• URL: https://github.com/rednaga/frida-stack
• Owner: rednaga
• Created: 2024-06-11T22:31:56.000Z (5 months ago)
• Default Branch: main
• Last Pushed: 2024-06-20T16:34:24.000Z (5 months ago)
• Last Synced: 2024-07-22T09:30:38.653Z (4 months ago)
• Topics: android, frida, reverse-engineering, security, stacks
• Language: TypeScript
• Homepage: https://www.npmjs.com/package/frida-stack
• Size: 23.4 KB
• Stars: 23
• Watchers: 1
• Forks: 3
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# frida-stack

Small frida module for ensuring you get the stack information you wanted.

## What?

Often when using [Frida](https://github.com/frida/frida), I would run into issues

with wanting specific stack traces. Then I realized I didn't have a specific context

window, or the stack traces didn't contain the correct shared libraries in them. This

resulted in me re-writing the same functions all the time.

In other instances, mostly when reverse engineering heavily obfuscated or packed code,

I would have discovered functions or places in memory which had been created without any

exports available. This would lead to questions like, what process/library owned this? Where

am I inside those libraries?

To answer the above questions, I wrapped some of the standard `Thread.Backtrace` functions

and added some scanning of the `Process` memory ranges.

## Installing

```sh

$ npm install frida-extended-stack

```

## Usage

```typescript

import { Stack } from 'frida-stack'

function hook_exit() {

  const _exitPtr = Module.findExportByName('libc.so', '_exit');

  if (_exitPtr) {

    const _exit = new NativeFunction(_exitPtr, 'int', ['int']);

    Interceptor.replace(

      _exitPtr,

      new NativeCallback(

        function (status) {

          console.log(`[+] _exit : ${status} from ${Stack.getModuleInfo(this.context.pc)}`);

	        console.log(Stack.native(this.context)

          return _exit(status);

        },

        'int',

        ['int'],

      ),

    );

  }

}

```

Output:

```

[Pixel 4::com.example.package ]-> [+] _exit : 0 from 0x7713d25000 libexamplesharedlib.so:0x1aae8

0x7713d25000 libexamplesharedlib.so:0x1aae8

```

Now you have a library and the exact offset into the library for reversing.

## License

```

Copyright 2020-2024 Tim 'diff' Strazzere 

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

```