Search code examples
androidfrida

frida - How to translate native backtrace to use with addr2line tool

Frida can print out backtrace with below code:

var backtrace = Thread.backtrace(this.context, Backtracer.ACCURATE)
            .map(DebugSymbol.fromAddress)
            .join("\n\t");

The output looks like below in android:

0x72e82c2a50 libc.so!fopen64+0x50
0x72e82c2a4c libc.so!fopen64+0x4c

But when I try to use addr2line to get code line, it doesn't work:

$ addr2line -f -C -i -e symbols/apex/com.android.runtime.release/lib64/bionic/libc.so 0x72e82c2a50 
??
??:0

Sounds like that address is not the actual PC as crash stack. How can I translate this address to be used in addr2line tool?

Solution

  • Below steps (e.g. libc.so)

    1. Get library base address:

    0xac0ad000 <- Module.findBaseAddress("libc.so")

    1. Get backtrace

    Thread.backtrace(thz.context,Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n ");

    Sample output:

    0xac151ed7 libc.so!fopen64+0x2e

    3.Substract baseAddr to get PC value

    #pc 0x000a4ed7 <- 0xac151ed7 - 0xac0ad000

    1. Addr2line with PC value

    $ addr2line -f -C -i -e symbols/apex/com.android.runtime/lib/bionic/libc.so 0x000a4ed7
    open(char const*, int pass_object_size1, unsigned short)
    bionic/libc/include/bits/fortify/fcntl.h:74 fopen
    bionic/libc/stdio/stdio.cpp:256