[0x06c] Add section Loaded Native Libraries #1948
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cpholguera
commented
Oct 23, 2021
cpholguera
commented
Oct 29, 2021
| @@ -334,6 +334,10 @@ iOweApp 2828 mobile txt REG 1,2 664848 234595 /usr/lib/dyld | |||
| ... | |||
| ``` | |||
|
|
|||
| #### Loaded Native Libraries | |||
|
|
|||
| The file `/proc/<pid>/maps` contains the currently mapped memory regions and their access permissions. Using this file we can get the list of the libraries loaded in the process. | |||
There was a problem hiding this comment.
According to the MSTG:
On Android, verifying this is pretty straightforward as you can simply grep for the string "frida" in the memory maps of the process ID in the proc directory (/proc/<pid>/maps). However, on iOS the proc directory is not available, but you can list the loaded dynamic libraries in an app with the function _dyld_image_count.
Is this still true? @sushi2k
There was a problem hiding this comment.
Maybe it refers to the app trying to get /proc/<pid>/maps, but as the (tester) root user we should be able to call that from the CLI. Please confirm using a device :)
There was a problem hiding this comment.
@cpholguera No /proc on iOS. Therefore we can close this PR!
cpholguera
commented
Oct 29, 2021
sushi2k
reviewed
Oct 29, 2021
Co-authored-by: Sven <[email protected]>
|
done, and included the link to the tool's chapter. Thanks for the suggestion! |
sushi2k
approved these changes
Oct 30, 2021
cpholguera
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #1370.
Now we're consistent with Android.