Syntaxe error on the resolver

[Eliotsehr]

grapefruit/agent/src/modules/symbol.ts

Line 66 in 0a4c77d

const matches = new ApiResolver(type).enumerateMatches(query)

There's a syntaxe error when trying to enumerate modules and classes.

Uncaught RPC error Error: invalid query; format is: exports:!open, exports:libc.so!* or imports:notepad.exe!*
at O (frida/runtime/core.js:567)
at value (frida/runtime/core.js:549)
at resolve (src/modules/symbol.ts:66)
at invoke (src/rpc.ts:17)
at apply (native)
at (frida/runtime/message-dispatcher.js:13)
at c (frida/runtime/message-dispatcher.js:23)

According to Frida's documentation the ApiResolver.enumerateModule method cannot take a simple string as an argument.

Maybe a switch case on the type of resolver could resolve the issue.

export function resolve(type: 'objc' | 'module', query: string) {
  var matches;
  switch(type) {
  	case 'objc': 
  		matches = new ApiResolver(type).enumerateMatches("*[*" + query.toString() + "* *]")
  		break;
  	case 'module': 
  		matches = new ApiResolver(type).enumerateMatches("imports:*" + query.toString() + "!*") 
  		break;
  	default:
  		matches = new ApiResolver(type).enumerateMatches("*[*" + query.toString() + "* *]")
  		break;
  }
  return type === 'module' ? matches.map(item => {
    const [module, symbol] = item.name.split('!', 2)
    return Object.assign({}, item, { module, symbol })
  }) : matches
}

[ChiChou]

Yes. You need to input a string that matches the rule

[Eliotsehr]

Ok my bad, thanks for the reply.

[ChiChou]

They are in other panels. The second is for classes and the third is for modules