android调试：敲牛逼的frida弥补arm架构下无法设置硬件读写断点的缺陷
本帖最后由 salala159 于 2019-1-13 22:50 编辑废话不多说，开门见山，上干货，原理请自行百度：
function set_read_write_break(addr, size, pattern)
{
//设置异常
Process.setExceptionHandler(function(details){
//打印信息，e.g. 打印堆栈，打印发生异常的地址，打印引发异常的地址
/*
type: string specifying one of:
abort
access-violation
guard-page
illegal-instruction
stack-overflow
arithmetic
breakpoint
single-step
system
address: address where the exception occurred, as a NativePointer
memory: if present, is an object containing:
operation: the kind of operation that triggered the exception, as a string specifying either read,write, or execute
address: address that was accessed when the exception occurred, as a NativePointer
context: object with the keys pc and sp, which are NativePointer objects specifying EIP/RIP/PC and ESP/RSP/SP, respectively, for ia32/x64/arm. Other processor-specific keys are also available, e.g. eax, rax, r0, x0, etc. You may also update register values by assigning to these keys.
nativeContext: address of the OS and architecture-specific CPU context struct, as a NativePointer. This is only exposed as a last resort for edge-cases where context isn’t providing enough details. We would however discourage using this and rather submit a pull-request to add the missing bits needed for your use-case.
*/
console.log(details.address)
//处理异常
Memory.protect(address, size, 'rwx')
return true;
})
//制造异常 <--> 设置读写断点
Memory.protect(address, size, pattern)
}
//举例
set_read_write_break(ptr(0x0E001250, 4 'rx')) //0x0E001250地址位于数据区，在0x0E001250设置一个4字节的写断点
set_read_write_break(ptr(0x0E001250, 4 'wx')) //0x0E001250地址位于数据区，在0x0E001250设置一个4字节的读断点
set_read_write_break(ptr(0x00c0452c, 4 'rw')) //0x00c0452c地址位于代码区，在0x00c0452c设置一个4字节的执行断点，可以代替F2软断点，可以过断点crc校验
另外，也可以开frida CLI，再开IDA调试so文件，仅使用Memory.protect(address, size, pattern)来下断点，不使用frida捕获，IDA自己捕获异常，看个人喜好了。这里要注意一定要先开frida CLI挂载到进程，然后在使用IDA挂载，顺序反了，可能挂载不上。
最后，请叫我frida小王子，下次高兴了放出利用frida制作一个类似CE内存搜索的工具的实例代码，效率绝对高。 虽然没看懂,但是感觉就很厉害 代码的注释应该是有问题的
set_read_write_break(ptr(0x0E001250, 4 'rx')) //0x0E001250地址位于数据区，在0x0E001250设置一个4字节的写断点
看看mprotect函数，改变的是PAGE_SIZE大小的内存，而不是4字节
楼主的代码实用性其实没什么实用性 感谢楼主热心分享教程 等待大侠的arm CE 内存搜索存储或显示工具！ 谢谢楼主.学习了. 这个可以有{:1_921:} 小王子小王子，开花开花 谢谢楼主分享，学习了. 感谢楼主热心分享教程 看到function，我就感觉迷了。。。自行百度去了。