Support Anbox Android Linker #543
Comments
|
Sounds like your issue is that the binaries are built for Ubuntu 20.04, but you’re running on Ubuntu 18.04. OS suggest you try following the instructions for compiling from source. https://frida.re/docs/building/ Frida-server is built as part of Frida core. The example uses mips, but I suspect you’ll want to use armhf. Make sure you build the SDKs from source too, the build system may try to download the prebuilt versions if you don’t manually build it before building Frida itself. |
|
/me already aware of that. See frida/frida-ci/issues/2 |
|
Anbox Cloud runs LXD containers in an LXD cluster. In our case the cluster is comprised strictly of arm64 hosts running arm64 containers. Each of these containers runs Ubuntu 18:04 that provides a runtime environment around Anbox that you can customize for streaming, automation, instrumentation, etc. Anbox in turn abstracts hardware access and creates an LXD container nested inside where Android (standard AOSP Android 10) is actually running.
Yes, that is the first problem at the surface. Myself I tried a 20.04 chroot (within the 18.04 container) from which to install At this point all the Frida stuff is running in a 20.04 chroot with the expected library dependencies. I can at least invoke the frida CLI tools and look around a bit. However, when tracing or attaching to an Android process (still within the 20.04 chroot) I get problems I guess chaining libc dependencies like that (tree view below) doesn't make sense
We also tried that for a while but also had difficulty along the way, at which point we thought to outsource help for this task. |
|
In order for the 20.04 chroot to work, you will need to make sure it bind mounts the /proc file system. Also the Frida tools and target will need to both be running in the chroot (well with the same file and path for libc). Frida will use /proc/pid/maps on itself and the target to find the base address of libc. Then calculate the relative virtual address of various functions in its own process and add it to the base of libc in the target process to find where the same functions reside in memory in the target. This will obviously need libc in each to be binary identical. Hope this helps. |
As per our internal convo, @oleavr, we need
frida-gumto assist us in spawning afrida-serverfor Anbox Android linker 🙌Environment
So, anbox is like a proprietary/partly-open-sourced "gennymotion", but they still support emulation on more native layer through LXD containers. These containers run in cloud, based on Ubuntu Bionic (18.04) for aarch64. The android emulation (or
anbox, really) is visible on "host" machine (host machine = Ubuntu aarch64). Therefore, processes from Android are visible in Ubuntu via e.g.ps aux.So we can either:
root@ams-c1gd8hhde9pihc932u0g]adb, or simplyanbox-shellfrom withing Linux [tty::/ #]Linux FS
Process system hierarchy (nesting) - host can see childs (android) processes:
Android FS
getprop ro.build.version.sdk=>29modalias config
Linker config from /proc/$PID/maps:
Experiments
full getprop gist
When running frida-server (aarch64) on Ubuntu aarch64
conclusion at the end...
Ugly fix:
Some more experiments with
frida-toolsvia pip3:Conclusion:
firda-serveris indeed somehow spawned on Ubuntu 18.04 aarch64 by fooling the lib checks. For some reason tho, it does not work as expected. Frida server should be running, and it should accept remote connections. Instead, app just stays in process environment and waits...When running frida-server (arm64-v8a) on Android shell
conclusion at the end...
Next I tried running arm64-v8a version of
frida-serverfrom with-in Android shell:Conclusion:
firda-serverdoes not work inside Androids emulator. Although, printingfrida-server --versionworks fine, trying to bring host/server up does not work due to Androids Linker bug (as indicated by adb logcat).Resources:
BTW. I may be able to provide ssh pivot to the container(s).
The text was updated successfully, but these errors were encountered: