frida - How to translate native backtrace to use with addr2line tool

user_1914781 0
Viewed 1146

Frida can print out backtrace with below code:

var backtrace = Thread.backtrace(this.context, Backtracer.ACCURATE)
            .map(DebugSymbol.fromAddress)
            .join("\n\t");

The output looks like below in android:

0x72e82c2a50 libc.so!fopen64+0x50
0x72e82c2a4c libc.so!fopen64+0x4c

But when I try to use addr2line to get code line, it doesn't work:

$ addr2line -f -C -i -e symbols/apex/com.android.runtime.release/lib64/bionic/libc.so 0x72e82c2a50 
??
??:0

Sounds like that address is not the actual PC as crash stack. How can I translate this address to be used in addr2line tool?

frida android
1 Answers

Below steps (e.g. libc.so)

  1. Get library base address:

0xac0ad000 <- Module.findBaseAddress("libc.so")

  1. Get backtrace

Thread.backtrace(thz.context,Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n ");

Sample output:

0xac151ed7 libc.so!fopen64+0x2e

3.Substract baseAddr to get PC value

#pc 0x000a4ed7 <- 0xac151ed7 - 0xac0ad000

  1. Addr2line with PC value

$ addr2line -f -C -i -e symbols/apex/com.android.runtime/lib/bionic/libc.so 0x000a4ed7
open(char const*, int pass_object_size1, unsigned short)
bionic/libc/include/bits/fortify/fcntl.h:74 fopen
bionic/libc/stdio/stdio.cpp:256

user_60186510
Related