Releases · IR0NBYTE/Jadart

Jadart 1.2.0: addresses you can paste into IDA, Ghidra, radare2 and Frida, and two new commands to take you there.

New

jadart symbols exports every function's name, virtual address and recorded bounds as a table, JSON, or a script for radare2, Ghidra or IDA. The script checks it is running against the right binary before naming anything. On the clean fixture, radare2 alone finds 6,707 of 8,194 function starts and runs 652 functions past their end; with the script it finds all 8,194 and runs none past their end.
jadart hook writes an observation-only Frida script for one Android arm64 function. It hooks the right entry address and reads arguments from where that Dart release and function kind put them.
xrefs FILE KIND PATTERN with string, pool or function, plus --exact and --class. The 1.1.0 form still works.

Changed output: read before upgrading scripts

Every printed address is a virtual address (_kDartIsolateSnapshotInstructions + pc_offset), not .text+0x... A bare number you pass in is read as a virtual address when it falls inside the image; .text+, isolate+ and + keep the old reading.
A function with no name is labelled sub_0x<va>, and every command that takes a function accepts that label.
A bug in jadart exits 3, with "internal": true under -j. Bad input still exits 1 or 2.
verify prints two lines on a pass; -v prints every gate.
xrefs on a string lists only pool entries some code loads directly. 1.1.0 also listed matches with no direct load, so counts drop (1,444 to 1,113 for e on the clean fixture) and a pattern that only such entries match now exits 1. #62 tracks reporting how many were left out.
From Python, a missing path raises jadart.InputError (a JadartError) instead of FileNotFoundError.
The --json shape is unchanged and only gains fields (va, target_va, anchor, address_rule).

arm32 fixes

Tier 2 ends a block where a function returns (pop {fp, pc}, bx lr and the conditional forms), so decompile -t 2 no longer shows code running after a return.
Conditional calls (blls, bleq, blne) are in the call graph and named in tier 2, and every branch and call target prints as an address.

Also

Faster: functions is about twice as fast, and xrefs on a pool entry reads instruction words instead of disassembling the whole image.
Hardened: a crafted file always raises a typed error, never an untyped exception. Its readers are bounded, and export keeps every path inside its output directory on Windows too. A bad --sigs file is an input error.
Fully stripped .so files parse, and output is UTF-8 on any console.
An agent skill installs from skills/flutter-reverse-engineering/.

Install from source:

git clone https://github.com/IR0NBYTE/Jadart.git
pip install './Jadart/framework[disasm]'

Every change, with the measurements, is in CHANGELOG.md.

Navigation Menu