Skip to main content
Reverse Engineering

Return to Question

added 4 characters in body
Source Link
NirIzr
NirIzr
  • 11.9k
  • 1
  • 39
  • 87

Watch calculate memory in fridaaddress from IdaIDA to use with Frida

In Ida I saw an interesting value in IDA at address 0xf8766 that0xf8766; I want to watchview the value thereat that address.

I debug an Android application with Frida, how can I put this address in Frida to watch this value.?

I know that I need to use Memory.readByteArray(ptr(0xXXXXX), 8)  , but what will be the correct address?

Should I watch intoread /proc/PID/maps to see the first address and then add this address to the address that I want to see? The first address is anon:dalvik-main space (region space)

Watch memory in frida from Ida

In Ida I saw interesting value in address 0xf8766 that I want to watch the value there.

I debug an Android application with Frida, how can I put this address in Frida to watch this value.

I know that I need to use Memory.readByteArray(ptr(0xXXXXX),8)  , but what will be the correct address?

Should I watch into /proc/PID/maps to see the first address and then add this address to the address that I want to see? The first address is anon:dalvik-main space (region space)

calculate memory address from IDA to use with Frida

I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address.

I debug an Android application with Frida, how can I put this address in Frida to watch this value?

I know that I need to use Memory.readByteArray(ptr(0xXXXXX), 8), but what will be the correct address?

Should I read /proc/PID/maps to see the first address and then add this address to the address that I want to see? The first address is anon:dalvik-main space (region space)

Source Link
frida
frida
  • 41
  • 1
  • 3

Watch memory in frida from Ida

In Ida I saw interesting value in address 0xf8766 that I want to watch the value there.

I debug an Android application with Frida, how can I put this address in Frida to watch this value.

I know that I need to use Memory.readByteArray(ptr(0xXXXXX),8) , but what will be the correct address?

Should I watch into /proc/PID/maps to see the first address and then add this address to the address that I want to see? The first address is anon:dalvik-main space (region space)