How to debug android so with r2

[allen2015555]

No description provided.

[allen2015555]

What android type you do have? Is this a Cylon? Or a Terminator? We don't support Replicants yet. And Data plugin was removed because nobody was willing to maintain it.

sorry, my englist is poor. I mean how to debug android so with r2 like ida pro. R2 can't debug the android so in the real android phone?

[radare]

I dont know how ida does that, but r2 can debug android shared libraries (if this is what u mean by so). In the same way that gdb do. Just attach to the process and put breakpoints or whatever. You can also use r2frida for that purpose

…

On 20 Aug 2019, at 09:49, allen2015555 ***@***.***> wrote: What android type you do have? Is this a Cylon? Or a Terminator? We don't support Replicants yet. And Data plugin was removed because nobody was willing to maintain it. sorry, my englist is poor. I mean how to debug android so with r2 like ida pro. R2 can't debug the android so in the real android phone? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[XVilka]

I will move the issue to r2book, ok?

[allen2015555]

I will move the issue to r2book, ok?

Thank you! I hope find the the tutorial for debug android shared library in r2book.

[allen2015555]

I dont know how ida does that, but r2 can debug android shared libraries (if this is what u mean by so). In the same way that gdb do. Just attach to the process and put breakpoints or whatever. You can also use r2frida for that purpose
…
On 20 Aug 2019, at 09:49, allen2015555 @.***> wrote: What android type you do have? Is this a Cylon? Or a Terminator? We don't support Replicants yet. And Data plugin was removed because nobody was willing to maintain it. sorry, my englist is poor. I mean how to debug android so with r2 like ida pro. R2 can't debug the android so in the real android phone? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

Thandks for your reply. I will try it.

[gogo2464]

With radare2 you can set breakpoint on compiled part of binaries such as arm and in .dex files. In pratice I personally just use radare2 for the binary because it is more convenient to debug the smali with real files disassembled than dex binaries. Apk has the particularity to be full repackaged. So I find it better like that.

I have a command to debug remotely an apk from a virtual machine with radare2 on the binary. I will find it and post it here when I will have found it.

[gogo2464]

The first part is to attach the pid from the android VM with:

gdbserver --attach localhost:12345 18190

where 18190 is the pid of the process.

[trufae]

just r2 -d 18190

[trufae]

Note for my future self: reference the r2frida book when ready for consumption

[gogo2464]

just r2 -d 18190

Yes but after you will need to select what you debug like dex file or .so.

[gogo2464]

I imagine something like:

gdbserver --attach localhost:1234 <PID>;
radare2 -d gdb://localhost:1234/ -e dbg.exe.path=library.so;

Inspired by https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05c-reverse-engineering-and-tampering#debugging-native-code.

[trufae]

cc @apkunpacker

[gogo2464]

@trufae if you want I can show my commands to @apkunpacker ?

[trufae]

Sharing is caring :)