├── AndroidBreakpoint.py ├── README.md └── pic ├── 1.png └── a.txt /AndroidBreakpoint.py: -------------------------------------------------------------------------------- 1 | import idaapi 2 | import idc 3 | import struct 4 | 5 | def get_ushort(file,offset): 6 | file.seek(offset) 7 | return struct.unpack("H",file.read(2))[0] 8 | 9 | def get_ulong(file,offset): 10 | file.seek(offset) 11 | return struct.unpack("L",file.read(4))[0] 12 | 13 | 14 | def static_breakpoint(target_type): 15 | try: 16 | base = idc.FirstSeg() 17 | if base == idc.BADADDR: 18 | print("can't find first seg") 19 | return 20 | filepath = idaapi.get_input_file_path() 21 | print("filename:", filepath) 22 | idbFile = open(filepath, "rb") 23 | e_phoff = get_ushort(idbFile, 0x1C) 24 | e_phentsize = get_ushort(idbFile, 0x2A) 25 | e_phnum = get_ushort(idbFile, 0x2C) 26 | print(e_phoff, e_phentsize, e_phnum) 27 | dynamic = -1 28 | for i in xrange(e_phnum): 29 | idbFile.seek(e_phoff + e_phentsize * i) 30 | p_type = get_ulong(idbFile, e_phoff + e_phentsize * i) 31 | # define PT_DYNAMIC 2 32 | if p_type == 2: 33 | dynamic = get_ulong(idbFile, e_phoff + e_phentsize * i + 4) 34 | break 35 | if dynamic == -1: 36 | print("\tcan't find dynamic") 37 | return 38 | dynamic_type = get_ulong(idbFile, dynamic) 39 | init = -1 40 | 41 | while dynamic_type != 0: 42 | 43 | dynamic += 8 44 | dynamic_type = get_ulong(idbFile, dynamic) 45 | 46 | if dynamic_type == target_type: 47 | init = get_ulong(idbFile, dynamic + 4) 48 | break 49 | if init == -1: 50 | print("\tcan't find init") 51 | return 52 | idc.AddBpt(base + init) 53 | print('\tbp the init on the %x' % (base + init)) 54 | print("\nbp init finished") 55 | except BaseException, e: 56 | print(e) 57 | 58 | 59 | #linker call init and init_array functions 60 | # .text:00002924 14 49 LDR R1, =(aLinker - 0x2930) 61 | # .text:00002926 04 20 MOVS R0, #4 62 | # .text:00002928 23 46 MOV R3, R4 63 | # .text:0000292A 14 4A LDR R2, =(aSCallingCons_0 - 0x2932) 64 | # .text:0000292C 79 44 ADD R1, PC ; "linker" 65 | # .text:0000292E 7A 44 ADD R2, PC ; "\"%s\": calling constructors" 66 | # .text:00002930 01 F0 E6 FE BL sub_4700 67 | # .text:00002934 68 | # .text:00002934 loc_2934 ; CODE XREF: sub_2884+52j 69 | # .text:00002934 12 49 LDR R1, =(aDt_init - 0x2940) 70 | # .text:00002936 20 46 MOV R0, R4 71 | # .text:00002938 D4 F8 F0 20 LDR.W R2, [R4,#0xF0] 72 | # .text:0000293C 79 44 ADD R1, PC ; "DT_INIT" 73 | # .text:0000293E FF F7 DF FE BL sub_2700 74 | # .text:00002942 10 49 LDR R1, =(aDt_init_array - 0x2956) 75 | # .text:00002944 00 20 MOVS R0, #0 76 | # .text:00002946 00 90 STR R0, [SP,#0x28+var_28] 77 | # .text:00002948 20 46 MOV R0, R4 78 | # .text:0000294A D4 F8 E0 20 LDR.W R2, [R4,#0xE0] 79 | # .text:0000294E D4 F8 E4 30 LDR.W R3, [R4,#0xE4] 80 | # .text:00002952 79 44 ADD R1, PC ; "DT_INIT_ARRAY" 81 | # .text:00002954 FF F7 0E FF BL sub_2774 82 | # .text:00002958 83 | # .text:00002958 locret_2958 ; CODE XREF: sub_2884+Cj 84 | # .text:00002958 BD E8 FE 83 POP.W {R1-R9,PC} 85 | def dynamic_breakpoint(targe_type): 86 | has_linker = False 87 | module_base = idc.GetFirstModule() 88 | while module_base != None: 89 | module_name = idc.GetModuleName(module_base) 90 | if module_name.find('linker') >= 0: 91 | has_linker = True 92 | break 93 | 94 | module_base = idc.GetNextModule(module_base) 95 | 96 | if has_linker == False: 97 | print '[*]unable to find linker module base' 98 | return 99 | 100 | module_size = idc.GetModuleSize(module_base) 101 | print '[*]found linker base=>0x%08X, Size=0x%08X' % (module_base, module_size) 102 | 103 | print("\t[-]begin to search DT_INIT") 104 | init_func_ea = 0 105 | init_array_ea = 0 106 | # bytecode=b'\x53\x1e\x73\xb5\x03\x33\x06\x46\x0d\x46\x14\x46\x24\xd8\x13\x48\x78\x44\x01\x68\x01\x29' 107 | bytecode =[0x14,0x49,0x04,0x20,0x23,0x46,0x14,0x4A,0x79,0x44,0x7A,0x44] 108 | findcode=True 109 | for ea_offset in range(module_base, module_base + module_size): 110 | findcode = True 111 | for i in xrange(len(bytecode)): 112 | if idaapi.get_byte(ea_offset+i)!=bytecode[i]: 113 | findcode=False 114 | break 115 | if(findcode==True): 116 | init_func_ea=ea_offset+0x1A 117 | init_array_ea=ea_offset+0x30 118 | break 119 | if(findcode==False): 120 | print("can't find bytecode") 121 | return 122 | print "\t[-]found INIT=>0x%08X INIT_ARRAY=>0x%08X" % (init_func_ea, init_array_ea) 123 | print("\t[-]try set breakpoint there") 124 | if targe_type==12: 125 | idc.AddBpt(init_func_ea) 126 | if targe_type==25: 127 | idc.AddBpt(init_array_ea) 128 | print("[*]script finish") 129 | 130 | class bpInit(idaapi.action_handler_t): 131 | name = "bpInit" 132 | lable = "bpInit" 133 | hotkey = None 134 | 135 | def __init__(self): 136 | idaapi.action_handler_t.__init__(self) 137 | 138 | def activate(self, ctx): 139 | print("\n.init handler activate") 140 | idainfo = idaapi.get_inf_structure() 141 | if idainfo.filetype != idaapi.f_ELF: 142 | print("\tidb isn't elf,skip") 143 | return 144 | if idaapi.is_debugger_on(): 145 | print("\tdebugger is on,prepare to bp by linker.") 146 | dynamic_breakpoint(12) 147 | else: 148 | print("\tdebugger isn't on ,prepare to bp by search the elf program header") 149 | # define DT_INIT 12 150 | static_breakpoint(12) 151 | 152 | def update(self, ctx): 153 | print(".init handler update") 154 | return idaapi.AST_ENABLE_ALWAYS 155 | 156 | class bpInitArray(idaapi.action_handler_t): 157 | name = "bpInitArray" 158 | lable = "bpInitArray" 159 | hotkey = None 160 | def __init__(self): 161 | idaapi.action_handler_t.__init__(self) 162 | 163 | def activate(self, ctx): 164 | print("init array handler activate") 165 | idainfo = idaapi.get_inf_structure() 166 | if idainfo.filetype != idaapi.f_ELF: 167 | print("\tidb isn't elf,skip") 168 | return 169 | if idaapi.is_debugger_on(): 170 | print("\tdebugger is on,prepare to bp by linker.") 171 | dynamic_breakpoint(25) 172 | else: 173 | print("\tdebugger isn't on ,prepare to bp by search the elf program header") 174 | # define DT_INIT_ARRAY 25 175 | static_breakpoint(25) 176 | 177 | def update(self, ctx): 178 | print("init array handler update") 179 | return idaapi.AST_ENABLE_ALWAYS 180 | 181 | def register(action,*args): 182 | idaapi.register_action( 183 | idaapi.action_desc_t( 184 | action.name, 185 | action.lable, 186 | action(*args), 187 | action.hotkey, 188 | "set breakpoint on the .init function", 189 | ) 190 | ) 191 | 192 | class myIdaPlugin(idaapi.plugin_t): 193 | flags = idaapi.PLUGIN_KEEP 194 | wanted_name = "AndroidBreakpoint" 195 | wanted_hotkey = "Alt-F9" 196 | comment = "usual bp in android" 197 | help = "Something helpful" 198 | 199 | def init(self): 200 | print("init func") 201 | try: 202 | # result=idaapi.register_and_attach_to_menu("Options/path","name","label","",0,self.run(0),None) 203 | register(bpInit) 204 | register(bpInitArray) 205 | idaapi.attach_action_to_menu("Edit/AndroidBreakpoint/",bpInit.name,idaapi.SETMENU_APP) 206 | idaapi.attach_action_to_menu("Edit/AndroidBreakpoint/", bpInitArray.name, idaapi.SETMENU_APP) 207 | except BaseException, e: 208 | print(e) 209 | 210 | idainfo=idaapi.get_inf_structure() 211 | if idainfo.filetype!=idaapi.f_ELF: 212 | print("idb isn't elf,skip") 213 | return idaapi.PLUGIN_SKIP 214 | return idaapi.PLUGIN_KEEP 215 | 216 | def term(self): 217 | pass 218 | 219 | def run(self, arg): 220 | try: 221 | print("AndroidBreakpoint run") 222 | except BaseException, e: 223 | print e 224 | 225 | def PLUGIN_ENTRY(): 226 | 227 | return myIdaPlugin() 228 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # IDAAndroidBreakpoint 2 | IDA plugin aid to set android so breakpoint 3 | # Install 4 | 1. Be sure your IDA Pro has installed the IDAPython plugin 5 | 2. Put AndroidBreakpoint.py into plugins folder under your IDA Pro installation path. 6 | # Usage 7 | Click the Edit->AndroidBreakpoint->bpInit to set breakpoint on init function 8 | 9 | Click the Edit->AndroidBreakpoint->bpInitArray to set breakpoint on InitArray function 10 | 11 | ![](pic/1.png) 12 | 13 | # Tips 14 | - The plugin will find the init or initArray by the input file ELF program header while your debugger is not on. 15 | - If your debugger is on,the plugin will set the breakpoint on the linker module where the init or initarray function is called. 16 | - The linker's bytecode may be different due to the Android version,so if you can't find the bytecode in debug mode,please get the bytecode from your device,then replace the bytecode in AndroidBreakpoint.py . 17 | -------------------------------------------------------------------------------- /pic/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lj94093/IDAAndroidBreakpoint/2234343b48b3ff0bfcda96253d419bf4c8064303/pic/1.png -------------------------------------------------------------------------------- /pic/a.txt: -------------------------------------------------------------------------------- 1 | 2 | aa 3 | --------------------------------------------------------------------------------