Having issues with a Frida gadget on an emulated Android device

0

I am trying to inject a Frida gadget into an Android App which is already installed on an emulated (MEmu) Android 7.1 rooted system.

When I connect to the device using adb, I can see that the files are store here:

ASUS_Z01QD:/data/app/com.turtle.foo.bar-1 # ls
base.apk  lib  oat  split_config.armeabi_v7a.apk

The MEmu emulator uses an arm translator, if I browse into the lib folder:

ASUS_Z01QD:/data/app/com.turtle.foo.bar-1/lib/arm # ls
lib_burst_generated.so  libil2cpp.so  libfooservices.so  libxlua.so
libgpg.so               libmain.so    libunity.so

I can see a bunch of native lib's, so I downloaded the libmain.so and used Python's lief module to inject the gadget like so:

>>> import lief
>>> libnative = lief.parse("libmain.so")
>>> libnative.add_library("frida-gadget-14.0.8-android-arm.so")
<lief.ELF.DynamicEntryLibrary object at 0x7fcf140d0570>
>>> libnative.write("libmain.so")
>>> exit()

When running the file command on the original libmain.so and the frida-gadget-14.0.8-android-arm.so, I get confirmation that I am using the appropriate lib's in terms of CPU architecture:

libmain.so: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=e7a78851143615daaa72ee2f6dd6b81641d0803d, stripped

frida-gadget-14.0.8-android-arm.so: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, stripped

The injection seems to work fine:

readelf -d new-libmain.so

Dynamic section at offset 0x8000 contains 30 entries:
  Tag        Type                         Name/Value
 0x00000003 (PLTGOT)                     0x803c
 0x00000002 (PLTRELSZ)                   368 (bytes)
 0x00000017 (JMPREL)                     0x2fd8
 0x00000014 (PLTREL)                     REL
 0x00000011 (REL)                        0x2f40
 0x00000012 (RELSZ)                      152 (bytes)
 0x00000013 (RELENT)                     8 (bytes)
 0x6ffffffa (RELCOUNT)                   13
 0x00000006 (SYMTAB)                     0x21f0
 0x0000000b (SYMENT)                     16 (bytes)
 0x00000005 (STRTAB)                     0x19000
 0x0000000a (STRSZ)                      4096 (bytes)
 0x00000004 (HASH)                       0x2c08
 0x00000001 (NEEDED)                     Shared library: [frida-gadget-14.0.8-android-arm.so]
 0x00000001 (NEEDED)                     Shared library: [liblog.so]
 0x00000001 (NEEDED)                     Shared library: [libstdc++.so]
 0x00000001 (NEEDED)                     Shared library: [libm.so]
 0x00000001 (NEEDED)                     Shared library: [libdl.so]
 0x00000001 (NEEDED)                     Shared library: [libc.so]
 0x0000000e (SONAME)                     Library soname: [libmain.so]
 0x0000001a (FINI_ARRAY)                 0x7ec4
 0x0000001c (FINI_ARRAYSZ)               8 (bytes)
 0x00000019 (INIT_ARRAY)                 0x7eec
 0x0000001b (INIT_ARRAYSZ)               4 (bytes)
 0x6ffffff0 (VERSYM)                     0x2e4c
 0x6ffffffc (VERDEF)                     0x2ee4
 0x6ffffffd (VERDEFNUM)                  1
 0x6ffffffe (VERNEED)                    0x2f00
 0x6fffffff (VERNEEDNUM)                 2
 0x00000000 (NULL)                       0x0

I then copied the new libmain.so and the frida-gadget-14.0.8-android-arm.so to the /data/app/com.turtle.foo.bar-1/lib/arm on my Android system. When I start the App it crashes. In logcat I see the following:

11-18 07:16:41.748  5759  5759 F Frida   : Unsupported Android linker; please file a bug
11-18 07:16:41.748  5759  5759 F libc    : Fatal signal 6 (SIGABRT), code -6 in tid 5759 (aven.adventures)
11-18 07:16:41.748    80    80 W         : debuggerd: handling request: pid=5759 uid=10047 gid=10047 tid=5759
11-18 07:16:41.759  5804  5804 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
11-18 07:16:41.759  5804  5804 F DEBUG   : Build fingerprint: 'Asus/Asus/ASUS_Z01QD:7.1.2/20171130.376229:user/release-keys'
11-18 07:16:41.759  5804  5804 F DEBUG   : Revision: '0'
11-18 07:16:41.759  5804  5804 F DEBUG   : ABI: 'x86'
11-18 07:16:41.759  5804  5804 F DEBUG   : pid: 5759, tid: 5759, name: flush-8:0  >>> com.turtle.foo.bar-1 <<<
11-18 07:16:41.759  5804  5804 F DEBUG   : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
11-18 07:16:41.760  5804  5804 F DEBUG   : Abort message: 'Unsupported Android linker; please file a bug'
11-18 07:16:41.760  5804  5804 F DEBUG   :     eax 00000000  ebx 0000167f  ecx 0000167f  edx 00000006
11-18 07:16:41.760  5804  5804 F DEBUG   :     esi b778258c  edi b7782534
11-18 07:16:41.760  5804  5804 F DEBUG   :     xcs 00000073  xds 0000007b  xes 0000007b  xfs 0000003b  xss 0000007b
11-18 07:16:41.760  5804  5804 F DEBUG   :     eip b76aea90  ebp bfdc9078  esp bfdc901c  flags 00000292
11-18 07:16:41.760  5804  5804 F DEBUG   :
11-18 07:16:41.760  5804  5804 F DEBUG   : backtrace:
11-18 07:16:41.760  5804  5804 F DEBUG   :     #00 pc 00000a90  [vdso:b76ae000] (__kernel_vsyscall+16)
11-18 07:16:41.760  5804  5804 F DEBUG   :     #01 pc 0007c04c  /system/lib/libc.so (tgkill+28)
11-18 07:16:41.760  5804  5804 F DEBUG   :     #02 pc 00077895  /system/lib/libc.so (pthread_kill+85)
11-18 07:16:41.760  5804  5804 F DEBUG   :     #03 pc 00027a0a  /system/lib/libc.so (raise+42)
11-18 07:16:41.760  5804  5804 F DEBUG   :     #04 pc 0001ef46  /system/lib/libc.so (abort+86)
11-18 07:16:41.760  5804  5804 F DEBUG   :     #05 pc 00222c1c  /system/lib/libhoudini.so

It seems to talk about an unsupported Android linker version and the crash appears to be related to libhoudini.so which is the arm translator which run's on MEmu. Any idea's how I can get arround this. The App which I am testing is only available for arm systems and I do not have a rooted physical arm Android device to test. I am trying to remove OKHTTP SSL pinning for the App using Frida.

android
arm
apk
emulation
frida
asked on Stack Overflow Nov 18, 2020 by pussinboots1992

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0