Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Android: wa ret is not allowed in R2Frida session. error: expected a pointer #557

Closed
enovella opened this issue Feb 3, 2024 · 7 comments

Comments

@enovella
Copy link
Contributor

enovella commented Feb 3, 2024

More info & sample at: #556

Problem

We cannot perform in-memory patching

image

Old slides with right inmem patching

image

More info

[0x751067cad4]> wa ret
ERROR: error: expected a pointer
ERROR: Cannot write. Use `omf`, `io.cache` or reopen the file in rw with `oo+`
[0x751067cad4]> wx c0035fd6
ERROR: error: expected a pointer
ERROR: Cannot write. Use `omf`, `io.cache` or reopen the file in rw with `oo+`
[0x751067cad4]> wx 0xc0035fd6
ERROR: error: expected a pointer
ERROR: Cannot write. Use `omf`, `io.cache` or reopen the file in rw with `oo+`
[0x751067cad4]>

Memory permissions: :dmp failing

image

@enovella
Copy link
Contributor Author

enovella commented Feb 3, 2024

@trufae was io.cache set to false by default before?

image

@trufae
Copy link
Member

trufae commented Feb 3, 2024

if io.cache is enabled then you are not patching anything. on linux, mac and ios all these commands works fine, , wa, wx and dmp work as it should

@as0ler
Copy link
Contributor

as0ler commented Feb 3, 2024

It worked running Android 12 and Frida 16.1.10: (with io.cache=false)

image

@as0ler
Copy link
Contributor

as0ler commented Feb 3, 2024

:dmp working on Android 12 running Frida 16.1.11:

image

@enovella
Copy link
Contributor Author

enovella commented Feb 4, 2024

It doesnt work on a region that it doesnt already have rwx:

Screenshot 2024-02-04 at 11 50 04

@enovella
Copy link
Contributor Author

enovella commented Feb 4, 2024

It worked running Android 12 and Frida 16.1.10: (with io.cache=false)

image

Where is your ret written into? I cannot see the successful message as well as the opcode ret in the current offset.

[0x7b5aecbad4]> wa ret
INFO: Written 4 byte(s) (ret) = wx c0035fd6 @ 0x7b5aecbad4

image

@enovella
Copy link
Contributor Author

enovella commented Feb 6, 2024

It works on a cleaned installation, tested with @as0ler

@enovella enovella closed this as completed Feb 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants