I am trying to inject a Frida gadget into an Android App which is already installed on an emulated (MEmu) Android 7.1 rooted system.
When I connect to the device using adb, I can see that the files are store here:
ASUS_Z01QD:/data/app/com.turtle.foo.bar-1 # ls
base.apk lib oat split_config.armeabi_v7a.apk
The MEmu emulator uses an arm translator, if I browse into the lib folder:
ASUS_Z01QD:/data/app/com.turtle.foo.bar-1/lib/arm # ls
lib_burst_generated.so libil2cpp.so libfooservices.so libxlua.so
libgpg.so libmain.so libunity.so
I can see a bunch of native lib's, so I downloaded the libmain.so and used Python's lief module to inject the gadget like so:
>>> import lief
>>> libnative = lief.parse("libmain.so")
>>> libnative.add_library("frida-gadget-14.0.8-android-arm.so")
<lief.ELF.DynamicEntryLibrary object at 0x7fcf140d0570>
>>> libnative.write("libmain.so")
>>> exit()
When running the file command on the original libmain.so and the frida-gadget-14.0.8-android-arm.so, I get confirmation that I am using the appropriate lib's in terms of CPU architecture:
libmain.so: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=e7a78851143615daaa72ee2f6dd6b81641d0803d, stripped
frida-gadget-14.0.8-android-arm.so: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, stripped
The injection seems to work fine:
readelf -d new-libmain.so
Dynamic section at offset 0x8000 contains 30 entries:
Tag Type Name/Value
0x00000003 (PLTGOT) 0x803c
0x00000002 (PLTRELSZ) 368 (bytes)
0x00000017 (JMPREL) 0x2fd8
0x00000014 (PLTREL) REL
0x00000011 (REL) 0x2f40
0x00000012 (RELSZ) 152 (bytes)
0x00000013 (RELENT) 8 (bytes)
0x6ffffffa (RELCOUNT) 13
0x00000006 (SYMTAB) 0x21f0
0x0000000b (SYMENT) 16 (bytes)
0x00000005 (STRTAB) 0x19000
0x0000000a (STRSZ) 4096 (bytes)
0x00000004 (HASH) 0x2c08
0x00000001 (NEEDED) Shared library: [frida-gadget-14.0.8-android-arm.so]
0x00000001 (NEEDED) Shared library: [liblog.so]
0x00000001 (NEEDED) Shared library: [libstdc++.so]
0x00000001 (NEEDED) Shared library: [libm.so]
0x00000001 (NEEDED) Shared library: [libdl.so]
0x00000001 (NEEDED) Shared library: [libc.so]
0x0000000e (SONAME) Library soname: [libmain.so]
0x0000001a (FINI_ARRAY) 0x7ec4
0x0000001c (FINI_ARRAYSZ) 8 (bytes)
0x00000019 (INIT_ARRAY) 0x7eec
0x0000001b (INIT_ARRAYSZ) 4 (bytes)
0x6ffffff0 (VERSYM) 0x2e4c
0x6ffffffc (VERDEF) 0x2ee4
0x6ffffffd (VERDEFNUM) 1
0x6ffffffe (VERNEED) 0x2f00
0x6fffffff (VERNEEDNUM) 2
0x00000000 (NULL) 0x0
I then copied the new libmain.so and the frida-gadget-14.0.8-android-arm.so to the /data/app/com.turtle.foo.bar-1/lib/arm on my Android system. When I start the App it crashes. In logcat I see the following:
11-18 07:16:41.748 5759 5759 F Frida : Unsupported Android linker; please file a bug
11-18 07:16:41.748 5759 5759 F libc : Fatal signal 6 (SIGABRT), code -6 in tid 5759 (aven.adventures)
11-18 07:16:41.748 80 80 W : debuggerd: handling request: pid=5759 uid=10047 gid=10047 tid=5759
11-18 07:16:41.759 5804 5804 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
11-18 07:16:41.759 5804 5804 F DEBUG : Build fingerprint: 'Asus/Asus/ASUS_Z01QD:7.1.2/20171130.376229:user/release-keys'
11-18 07:16:41.759 5804 5804 F DEBUG : Revision: '0'
11-18 07:16:41.759 5804 5804 F DEBUG : ABI: 'x86'
11-18 07:16:41.759 5804 5804 F DEBUG : pid: 5759, tid: 5759, name: flush-8:0 >>> com.turtle.foo.bar-1 <<<
11-18 07:16:41.759 5804 5804 F DEBUG : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
11-18 07:16:41.760 5804 5804 F DEBUG : Abort message: 'Unsupported Android linker; please file a bug'
11-18 07:16:41.760 5804 5804 F DEBUG : eax 00000000 ebx 0000167f ecx 0000167f edx 00000006
11-18 07:16:41.760 5804 5804 F DEBUG : esi b778258c edi b7782534
11-18 07:16:41.760 5804 5804 F DEBUG : xcs 00000073 xds 0000007b xes 0000007b xfs 0000003b xss 0000007b
11-18 07:16:41.760 5804 5804 F DEBUG : eip b76aea90 ebp bfdc9078 esp bfdc901c flags 00000292
11-18 07:16:41.760 5804 5804 F DEBUG :
11-18 07:16:41.760 5804 5804 F DEBUG : backtrace:
11-18 07:16:41.760 5804 5804 F DEBUG : #00 pc 00000a90 [vdso:b76ae000] (__kernel_vsyscall+16)
11-18 07:16:41.760 5804 5804 F DEBUG : #01 pc 0007c04c /system/lib/libc.so (tgkill+28)
11-18 07:16:41.760 5804 5804 F DEBUG : #02 pc 00077895 /system/lib/libc.so (pthread_kill+85)
11-18 07:16:41.760 5804 5804 F DEBUG : #03 pc 00027a0a /system/lib/libc.so (raise+42)
11-18 07:16:41.760 5804 5804 F DEBUG : #04 pc 0001ef46 /system/lib/libc.so (abort+86)
11-18 07:16:41.760 5804 5804 F DEBUG : #05 pc 00222c1c /system/lib/libhoudini.so
It seems to talk about an unsupported Android linker version and the crash appears to be related to libhoudini.so which is the arm translator which run's on MEmu. Any idea's how I can get arround this. The App which I am testing is only available for arm systems and I do not have a rooted physical arm Android device to test. I am trying to remove OKHTTP SSL pinning for the App using Frida.
User contributions licensed under CC BY-SA 3.0