GG memory dump so and repair

GG memory dump so and repair

Find so memory address

Start the phonefrida-server

execute in cmdfrida-ps -U

image-20230611162501822

Enter adb shellthe switch suto view the target APP process information

Use catcommands to output information to a file

cat /proc/{
    
    pid}/maps > /sdcard/ddd.txt

image-20230611164223393

Pull the file to the computer for viewing

adb pull /sdcard/ddd.txt

image-20230611164255110

Find the so memory address in the file

image-20230611164649664

Open the GG modifier

Open the GG modifier and return to the target APP, in case the APP is killed by the system

open menu

image-20230611165054331

Select export memory

image-20230611165123669

Output the so memory address found above, input the start position to the end position

image-20230611165247467

click save

image-20230611165342265

Open the MT manager (any one is fine, just know the location, the location is the dump folder under the path to open the software), find the path of the dump and pull the file to the computer for repair

image-20230611165703960

image-20230611170054143

use SoFixerfix

.\SoFixer64.exe -s {导出的bin文件/或者so文件} -o {修复文件} -m {起始位置} -d

The modified so can be opened with IDA

Guess you like

Origin blog.csdn.net/qq_49619863/article/details/131155604