frida-jemalloc
v0.0.5
Published
Android jemalloc parser module based on shadow
Downloads
1
Readme
frida-jemalloc
Module that parse jemalloc state to be used along with frida to inspect pointers. The whole thing has been based on shadow (https://github.com/CENSUS/shadow) where the code has been ported to typescript to be used with frida.
Usage
npm install frida-jemalloc
import { Jemalloc } from "frida-jemalloc";
import { getAndroidConfig } from "frida-jemalloc";
const jemalloc = new Jemalloc(getAndroidConfig());
// After 200 times getting info of pointers it will parse again the whole thing
jemalloc.setThreshold(200);
const base = Module.findBaseAddress("...");
// parse only handle chunks and run
// parseAll will include arenas and tcaches
jemalloc.parse();
console.log("[*] Base of module " + base);
Interceptor.attach(base.add(...), {
onEnter(args) {
var ctx = this.context as Arm64CpuContext;
let info = jemalloc.getInfo(ctx.x0);
if (info.region === null) {
// Force the parsing because it should have been found
jemalloc.parse();
info = jemalloc.getInfo(ctx.x0);
}
info.dump();
}
});
[*] Jemalloc info of 0x7f5d8a5c00
Chunk:
Address : 0x7f5d800000
Size : 0x200000
Run:
Address : 0x7f5d8a5000
Size : 0x3000
Region:
Address : 0x7f5d8a5c00
Size : 0x600
[*] Jemalloc info of 0x7f539eb400
Chunk:
Address : 0x7f53800000
Size : 0x200000
Run:
Address : 0x7f539e9000
Size : 0x3000
Region:
Address : 0x7f539eb400
Size : 0x600
TODO
The only configuration available is Android8 64 bits as is the main device of testing I have, but more configurations can be added. I am open to PR, comments or other improvements over the code.