D
D
densaface2016-06-28 13:06:48
Android
densaface, 2016-06-28 13:06:48

How to run android_server from IDA Pro?

It is required to analyze the so library of an android application. It is easy to pull it out of apk, find the place of interest to me, where the target variable undergoes some changes. But I would like to see in Ida in the debugger how this variable is formed step by step.
IDA pro has remote debuggers and in particular for debugging on android devices.
1st way. immediately upon starting IDA pro, download the apk, and run it on the nox emulator with a dalwick debugger. The application runs successfully on the emulator, I can do something step by step with the debugger, but how do I get to the so library I need? Moreover, the application constantly creates / terminates new parallel processes
2nd method The method is to recognize the offset of the target library through a connection to the android server. And then debug it in gdbserver by setting the desired offset there. the source is here forum.xda-developers.com/show...0393&nocache=1 or here in the Russian article https://habrahabr.ru/post/232531/ , which refers to the first link as the source.
Actually the problem and my question is how to run an android server on an android device? In IDA Pro, in the IDA 6.8\dbgsrv\ folder, there are two android servers android_server and android_server_nonpie. The first one on startup gives
android_server: not executable: magic 7F45
The second one starts successfully, I do a port forward, but IDA cannot connect correctly: it connects, sees a list of running processes on the android, and when trying to connect to the selected process, it gets a thump:
----------------- ----------
Warning
---------------------------
The debugger could not attach to the selected process. This can perhaps indicate the process was just terminated, or that you don't have the necessary privileges.
----------------------------
OK
---------------------- -----
And the thrashing most likely does not come from the android_server side, which in the console shows that it was successfully connected to it
========================= =========
[1] Accepting connection from 127.0.0.1...
and only after pressing the OK button on the warning (strange why the warning), it shows the lines:
[1] Closing connection from 127.0.0.1...
=================== ===============
What kind of privileges does the ide lack?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question