How to find function address in radare2 with r2frida plugin?

Question

reverse engineering

Let's say I know the address of the function when I run radare2 in normal mode and in the debugger, it is the same and has a value of 0x0009F170. When I launch radare2 with the r2drida plugin, this function has a different address, how can I find it?

Answer 1

To do this, you need to find out the address of the module through frida, then add the address of the function to the address of the module and subtract the offset of the module.

var offset = 0x00001000;
var base = Module.findBaseAddress('some_app');

Interceptor.attach(base.add(0x0009F170 - offset), { 

});