Skip to content

Memory dump all error (session detach message) process-terminated #269

@cpholguera

Description

@cpholguera

Describe the bug
Cannot dump a whole Android app.

To Reproduce
Steps to reproduce the behavior:

https://github.com/OWASP/owasp-mstg/raw/master/Samples/Android/01_HelloWorld-JNI/HelloWord-JNI.apk

sg.vantagepoint.helloworldjni on (google: 8.1.0) [usb] # memory dump all /Users/Me/Desktop/memory_android_verbose                                                               

Will dump 719 rw- images, totalling 1.7 GiB
Dumping 1003.0 MiB from base: 0x14100000  [------------------------------------]    0%  00:12:57- [incoming message] ------------------
"process-terminated"
- [./incoming message] ----------------
(session detach message) process-terminated
Dumping 8.0 MiB from base: 0x7fc753e000  [####################################]  100%             
Memory dumped to file: /Users/Me/Desktop/memory_android_verbose
sg.vantagepoint.helloworldjni on (google: 8.1.0) [usb] # exit 

The app quickly crashes once the dump is started.

Expected behavior
Even with memory access violation errors for some regions, one should expect that at least all readable memory is dumped.

Evidence / Logs / Screenshots
See above.

Environment

  • Device: Nexus 5X
  • OS: Android 8.1.0
  • Frida Version: 12.6.16
  • Objection Version: 1.7.4

Additional context

For the sake of having a reference to help debugging I've run Fridump: python3 fridump.py -v -U sg.vantagepoint.helloworldjni. objection dumps a total of 31,5 MB while Fridump dumps 985,7 MB. Also in this case, the app does not crash so quickly, but after all those MBs were dumped (and probably due to memory access violations?).

Thanks in advance and please let me know if I can assist you on further testing.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions