Frida：DebugSymbol.fromAddress 生成具有空字段的对象

Question

我使用 Frida 在 iPhone 7 (iOS 14.4) 上运行此命令：

frida-trace -U -S lib.js -m "-[NSMutableURLRequest setValue*]" --decorate -f com.apple. AppStore

lib.js 包含这个简单的辅助函数：

function backtrace() {
    return '\tBacktrace:\n\t' +
            Thread.backtrace(this.context, Backtracer.ACCURATE)
                .map(item => {
                    var symbol = DebugSymbol.fromAddress(item);
                    return JSON.stringify(symbol);
                })
                .join('\n\t');
}

然后在生成的处理程序的 onEnter 中执行以下操作：

log(backtrace());

我在终端中看到的是：

  1400 ms       Backtrace:
        {"address":"0x1069bb294","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x1069f92c4","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x106a02024","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x106a02f2c","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x106a02ddc","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x106a01d2c","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x1069f92c4","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x106a02024","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x106a02f2c","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x106a02f2c","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x106a01d2c","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x1069afaf8","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x1069afbf4","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x1069c0770","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x10695eca0","name":null,"moduleName":null,"fileName":null,"lineNumber":null}
        {"address":"0x104cd407c","name":null,"moduleName":null,"fileName":null,"lineNumber":null}

为什么会发生这种情况以及如何获取调用堆栈项的模块和方法名称？

Answer 1

根据我的经验，DebugSymbol.fromAddress() 在某些 iOS 应用程序上效果不佳。我什至遇到过在堆栈跟踪上应用此方法会导致应用程序崩溃。不知道为什么它不起作用，可能是一个错误，或者应用程序二进制文件只是错过了调试符号。

或者，为了了解堆栈跟踪，您可以使用 Frida 的 ModuleMap< 将每个地址映射到它所属的模块/a>

var moduleMap = new ModuleMap();
var backtrace = Thread.backtrace(this.context, Backtracer.ACCURATE); 
return backtrace.map(addr => return moduleMap.get(addr).name).join('\n\t');

那么你仍然错过了方法名称，我不知道在这种情况下如何获取它。