目录

前言 1.1

Android逆向动态调试概览 1.2

调试的总体思路 1.2.1

AndroidStudio调试Smali 1.3

详细步骤 1.3.1

确保安卓已root 1.3.1.1

调试工具选择 1.3.1.2

反编译出smali 1.3.1.3

app可调试 1.3.1.4

调试方式启动app 1.3.1.5

AS中导入smali代码 1.3.1.6

给smali加断点 1.3.1.7

配置AS项目 1.3.1.8

adb可获取进程列表 1.3.1.9

AS调试app进程 1.3.1.10

调试Smali实例 1.3.2

调试安卓Youtube的smali 1.3.2.1

调试Smali心得 1.3.3

LLDB调试安卓 1.4

下载安卓版lldb-server 1.4.1

lldb-server传输到手机 1.4.2

运行lldb-server 1.4.3

lldb连接lldb-server 1.4.4

用lldb调试安卓app进程 1.4.5

Frida调试安卓 1.5

初始化Frida开发环境 1.5.1

Frida调试安卓app 1.5.2

示例 1.5.3

LiftFileManager 1.5.3.1

DisplayDemo 1.5.3.2

常见问题 1.5.4

心得 1.5.5

模拟代码运行 1.6

Unidbg 1.6.1

Hook框架 1.7

Xposed框架 1.7.1

CydiaSubstrate 1.7.2

Android-OpenDebug 1.7.2.1

Introspy-Android 1.7.2.2

adb辅助调试 1.8

查看内存映射 1.8.1

其他工具 1.9

AndBug 1.9.1

redexer 1.9.2

Fino 1.9.3

附录 1.10

参考资料 1.10.1

前言

Android逆向：动态调试

最新版本：v1.4.3

更新时间：20231004

简介

介绍Android逆向开发期间，如何动态调试安卓程序。包括用AndroidStudio调试apk的smali代码、用LLDB调试安卓程序、用Frida调试安卓程序、编写Xposed模块去调试安卓程序。对于AndroidStudio调试安卓Smali代码，此处以YouTube为例，介绍主要步骤：确保安卓已root、调试工具选择、反编译出smali代码、确保app可调试、调试方式启动app、Android Studio中导入smali代码、给smali加断点、配置Android Studio项目、确保adb可获取进程列表、Android Studio调试app进程；对于LLDB调试安卓，包括下载安卓版lldb-server到电脑、把lldb-server传输下载到安卓手机中、电脑中运行lldb、用lldb连接安卓手机中的lldb-server、最后是开始用lldb调试安卓app进程。对于Firda调试安卓，包括初始化Frida调试环境、Frida调试安卓app，以及贴出几个实例包括LiftFileManager、DisplayDemo等。以及Frida方面的常见的问题和心得。然后是动态调试方面的一些常见问题和心得。以及其他一些分析调试工具，包括Unidbg、AndBug、redexer、Fino等；以及用于辅助调试的adb，比如用adb查看内存映射；最后加上心得和实例和附录的参考资料。

源码+浏览+下载

本书的各种源码、在线浏览地址、多种格式文件下载如下：

HonKit源码

crifan/android_re_dynamic_debug: Android逆向：动态调试

如何使用此HonKit源码去生成发布为电子书

详见：crifan/honkit_template: demo how to use crifan honkit template and demo

在线浏览

Android逆向：动态调试 book.crifan.org

Android逆向：动态调试 crifan.github.io

离线下载阅读

Android逆向：动态调试 PDF

Android逆向：动态调试 ePub

Android逆向：动态调试 Mobi

版权和用途说明

此电子书教程的全部内容，如无特别说明，均为本人原创。其中部分内容参考自网络，均已备注了出处。如发现有侵权，请通过邮箱联系我 admin 艾特 crifan.com，我会尽快删除。谢谢合作。

各种技术类教程，仅作为学习和研究使用。请勿用于任何非法用途。如有非法用途，均与本人无关。

鸣谢

感谢我的老婆陈雪的包容理解和悉心照料，才使得我crifan有更多精力去专注技术专研和整理归纳出这些电子书和技术教程，特此鸣谢。

其他

作者的其他电子书

本人crifan还写了其他150+本电子书教程，感兴趣可移步至：

crifan/crifan_ebook_readme: Crifan的电子书的使用说明

关于作者

关于作者更多介绍，详见：

关于CrifanLi李茂 – 在路上

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-04 16:09:05

Android逆向动态调试概览

Android逆向动态调试概览

关于安卓逆向，之前已通过安卓应用的安全和破解进行了一定的介绍。

而安卓逆向期间，除了静态分析去研究反编译的代码外，想要了解安卓app的底层机制和逻辑，需要通过动态调试。

而目前安卓的动态调试的一些主要方法有：

用Android Studio去调试（apk反编译得到的）smali代码

用LLDB调试安卓app

用Frida调试安卓app

给安卓app编写XPosed插件，去调试hook逻辑

详见：Xposed插件开发 · 安卓逆向调试：XPosed框架

此教程主要就是介绍这方面的详细内容。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-14 20:37:18

调试的总体思路

安卓逆向动态调试的总体思路

TODO：

【未解决】Android的YouTube逆向：研究request请求api和protobuf相关部分代码

此处介绍安卓逆向的总体思路：

找到要hook的点 = 找到核心代码的入口点

对于Android来说，往往是java中相关的基础的类，内置的类

比如

网络请求类

url相关的类

比如

new URL

字符串相关的类

可能会用到URL拼接，其内部涉及到字符串的拼接

比如

append

getBytes

String builder

再去动态调试逻辑，hook代码逻辑

相关工具：Xposed、frida、LLDB、AS等

期间配合抓包

先要抓包找相关url

后续才知道要过滤哪些url

找到要hook的点

其中关于找到要hook的点，值得就是：

java层：找到对应的，实现你要的功能的类

其中切入点，可以从Java基础的类去入手

详见下面的解释

Native层=C/C++代码=so库文件：找到C/C++的函数

Java基础的内置的类

URL

URL myURL = new URL("http://example.com/pages/");
URL page1URL = new URL(myURL, "page1.html");
URL page2URL = new URL(myURL, "page2.html");

或：

new URL("http", "example.com", "/pages/page1.html");

或：

//URLDemo.java
import java.net.*;

public class URLDemo {

  public static void main(String[] args) {
    try {
      URL url = new URL("http://www.javatpoint.com/java-tutorial");

      System.out.println("Protocol: " + url.getProtocol());
      System.out.println("Host Name: " + url.getHost());
      System.out.println("Port Number: " + url.getPort());
      System.out.println("File Name: " + url.getFile());
    } catch (Exception e) {
      System.out.println(e);
    }
  }
}

或：

import java.net.*;

URL url = new URL("/a-guide-to-java-sockets");

URL home = new URL("http://baeldung.com");
URL url = new URL(home, "a-guide-to-java-sockets");

或：

@Test
public void givenBaseUrl_whenCreatesRelativeUrl_thenCorrect() {
    URL baseUrl = new URL("http://baeldung.com");
    URL relativeUrl = new URL(baseUrl, "a-guide-to-java-sockets");

    assertEquals("http://baeldung.com/a-guide-to-java-sockets",
      relativeUrl.toString());
}

或：

URL url = new URL(yourUrl, "/api/v1/status.xml");

或：

URL domain = new URL("http://example.com");
URL url = new URL(domain + "/files/resource.xml");

hook插件与开发

TODO：

把如何用XPosed写Android的hook插件的帖子整理过来

【已解决】Android 11的Magisk中安装EdXposed 0.5.2.2结果失败：请先从Magisk Manager中安装Riru Installation failed

【已解决】在Android 11中安装EdXposed框架

Android的Hook插件开发框架

XPosed

Cydia Substrate

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-14 20:37:08

AndroidStudio调试Smali

用AndroidStudio调试smali详细步骤

TODO：

Smalise

【记录】试用VSCode的smali插件：Smalise

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 22:11:16

详细步骤

详细步骤

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 21:52:45

确保安卓已root

确保安卓已root

确保安卓设备已root：

此处之前买的二手的Google Pixel 3，已root：

自带安装了：

Magisk Manager

图

升级后是：Magisk

内部包含：

Magisk（的框架）

App=Manager：管理配置界面的app

且已给相关app授权了root权限：

（对应着）adb shell中首次su后，即可申请root权限，允许后，此处就会出现：

Shell = com.android.shell

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 21:54:18

调试工具选择

调试工具选择

调试安卓apk 的工具/环境

Android Studio + smalidea插件：调试smali

JDB：调试Smali

IDA：调试dex

Qtrace

此处选择，相对易用的：

Android Studio + smalidea插件：调试smali

Android Studio中安装smali插件smalidea

安装AS插件：Smalidea

AS中搜索并点击安装Smalidea

手动下载zip从再手动安装

从JesusFreke / smalidea / Downloads — Bitbucket下载插件压缩包文件

https://bitbucket.org/JesusFreke/smalidea/downloads/smalidea-0.06.zip

然后AS中Install Plugin from Disk

-> 安装后的Smalidea插件：

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 22:11:04

反编译出smali

反编译出smali

反编译apk，得到smali源码

常见反编译工具：

Apktool

直接1步：apk to smali

baksmali

要2步：先 apk to dex，再 dex to smali

此处用apktool去反编译YouTube的apk：

去反编译得到包含smali源码的目录：

apktool d --use-aapt2 ../../apk/16.29.36/com.google.android.youtube_16.29.36.apk

如果要指定输出目录，也可以加上-o

apktool d --use-aapt2 ../../apk/16.29.36/com.google.android.youtube_16.29.36.apk -o com.google.android.youtube_16.29.36_aapt2

输出的目录的内容：

一个或多个smali目录

注：每个smali目录，对应着apk内部的dex文件

AndroidManifest.xml

文本模式的，有apk核心的配置和参数

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 21:54:25

app可调试

app可调试

TODO：

【已解决】安卓逆向：如何让YouTube的apk可以被调试

【已解决】安卓让apk可调试：修改全局系统属性ro.debuggable

【已解决】安卓逆向：用MagiskHide Props Config实现全局apk可调试

【未解决】安卓逆向：让apk可调试之通过XPosed插件

【未解决】尝试用BDOpener修改ro.debuggable使得apk可调试

【已解决】用Magisk插件MagiskHide Props Config去设置ro.debuggable实现全局app可调试

【已解决】Google Pixel3安卓手机中MagiskHide Props Config中没有ro.debuggable属性可设置

【未解决】安卓逆向：用mprop修改属性ro.debuggable让apk可调试

【未解决】安卓逆向：用rootadb的setpropex修改属性ro.debuggable让apk可调试

【未解决】mprop提示报错：inject position not found, may be already patched

确保app可调试=debuggable：

让app可调试，有多种方式：

针对特定app可调试

app代码中AndroidManifest.xml加上android:debuggable="true"

思路：往往是（apktool等）反编译得到源码，修改后，再重新打包回去

缺点：对于稍微复杂点的apk，往往重新打包的过程中会出错，会很麻烦

全局可调：安卓系统中所有app进程都可调试

实现思路：修改系统全局属性ro.debuggable

具体方法

修改boot.img，重新刷入

说明：比较折腾的一种。不推荐，虽然也可以一劳永逸，但是比较折腾，刷机操作失误还容易变砖

mprop

已基本失效，放弃

XPosed插件

xinstaller

Xdebuggable

BuildProp Enhancer

XDebug

Magisk

Magisk

命令行：magisk resetprop ro.debuggable 1

缺点：重启后失效

Magisk插件

MagiskHide Props Config

用props去修改ro.debuggable=1

此处选择，相对方便操作和效果更好的：

MagiskHide Props Config

Magisk的插件

MagiskHide Props Config

安装后，去安卓设备端的命令行（adb shell进去）运行：

props

根据提示，去（先新增再）修改为：ro.debuggable=1

核心的选择是：

5 - Add/edit custom props

n - New custom prop

ro.debuggable

y - Yes

1

y

最后查看属性，确保修改成功：

> adb shell getprop ro.debuggable
1

AndroidManifest.xml加debuggable属性

顺带介绍另外一种，虽然不推荐，但是大家常提到的方式：

app代码中AndroidManifest.xml加上android:debuggable="true"

思路：

把apktool反编译后的代码中的

AndroidManifest.xml

去修改，加上：

android:debuggable="true"

然后再用apktool重新打包出apk（有失败的风险）

安装到安卓手机中，成为可调试的app

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 21:54:29

调试方式启动app

调试方式启动app

以调试方式启动app：

目的：这样启动的app，才可以被调试，方便被调试

此处以调试方式启动YouTube的app：

adb shell am start -D -n com.google.android.youtube/com.google.android.apps.youtube.app.application.Shell_HomeActivity

说明：

-D：表示debug模式

com.google.android.youtube/com.google.android.apps.youtube.app.application.Shell_HomeActivity

com.google.android.youtube

app包名=package

com.google.android.apps.youtube.app.application.Shell_HomeActivity

app的主页面=MainActivity

以调试模式启动后的效果：

启动后，app没有立刻正常运行，而是显示 Waiting For Debugger

并且：此界面不会消失，直到对应的debugger调试器连接上，开始调试，此界面才消失，才继续开始运行app

说明：

如何获取app的包名

Youtube包名：com.google.android.youtube

方式1：pm

举例：

~  adb shell pm list packages -f | grep youtube
package:/data/app/com.google.android.youtube-9Nw_99XIz2jZh7Lyor2SKQ==/base.apk=com.google.android.youtube

方式2：aapt

 aapt dump badging com.google.android.youtube_16.29.36.apk | grep package
package: name='com.google.android.youtube' versionCode='1522263488' versionName='16.29.36' compileSdkVersion='31' compileSdkVersionCodename='12'

如何获取app的MainActivity

app的首页的activity，一般被叫做MainActivity

一般情况是：apktool逆向导出的xml格式的AndroidManifest.xml中，找到android.intent.action.MAIN所属于的activity，就是MainActivity

-》此处YouTube的情况稍微特殊点：

AndroidManifest.xml

        <activity android:exported="true" android:name="com.google.android.apps.youtube.app.application.Shell_HomeActivity" android:theme="@style/Theme.YouTube.Launcher"/>
        <activity-alias android:exported="true" android:name="com.google.android.youtube.HomeActivity" android:targetActivity="com.google.android.apps.youtube.app.application.Shell_HomeActivity"/>
        <activity-alias android:exported="true" android:name="com.google.android.youtube.app.application.Shell$HomeActivity" android:targetActivity="com.google.android.apps.youtube.app.application.Shell_HomeActivity"/>
        <activity-alias android:exported="true" android:name="com.google.android.youtube.app.honeycomb.Shell$HomeActivity" android:targetActivity="com.google.android.apps.youtube.app.application.Shell_HomeActivity">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.DEFAULT"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>

找到：

android.intent.action.MAIN

所属的activity是：

com.google.android.youtube.app.honeycomb.Shell$HomeActivity

其是个别名alias，对应着真正的activity=MainActivity是：

com.google.android.apps.youtube.app.application.Shell_HomeActivity

TODO：

【已解决】获取安卓apk应用的app的主界面activity即MainActivity

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 21:54:33

AS中导入smali代码

AS中导入smali代码

导入带smali源码的目录到Android Studio作为新项目：

导入smali的源码：

新版Android Studio的Welcome to Android Studio欢迎对话框中，点击：

Open

去选择对应的，Apktool反编译后的输出的目录：

导入后，即可：

然后把根目录设置为源代码根目录：

Mark Directory as Source Root

注：其实不需要像别人说的：

一定要：

只导入smali代码到项目中

只能把smali代码所在目录去mark as source root

而是：

只要当前项目中包含了smali代码

即可。

TODO：

【已解决】安卓AS调试apk的smali：导入apktool反编译的源码作为项目代码

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 21:54:37

给smali加断点

给smali加断点

给Smali代码加断点：

先(重点)是：找到要加断点的地方

再去加断点

如何找到要加断点的位置？

要在哪里加断点？

才能实现，app运行时触发到断点而停下来，供自己调试

一般逻辑是：

找到最有可能运行到的代码的逻辑对应的地方

入口的MainActivity

前面的：如何获取app的MainActivity，已经解释过

此处YouTube就是：com.google.android.apps.youtube.app.application.Shell_HomeActivity

或者是你调试时的看到的顶层页面

获取顶层页面的activity

 adb shell dumpsys activity top | grep --color=always ACTIVITY
...
  ACTIVITY com.google.android.youtube/com.google.android.apps.youtube.app.watchwhile.WatchWhileActivity 781cc07 pid=20720

-》

此处YouTube的顶层页面是：

com.google.android.apps.youtube.app.watchwhile.WatchWhileActivity

然后就可以去，此处Apktool反编译后的，smali的源码所在位置了：

com.google.android.youtube_16.29.36

smali_classes2/com/google/android/apps/youtube/app/application/Shell_HomeActivity.smali

smali_classes2/com/google/android/apps/youtube/app/watchwhile/WatchWhileActivity.smali

找到了smali文件位置

给哪些函数打断点？

再说说：具体给哪些函数打断点

-》代码运行才能，才容易触发到断点停下来（我们才好调试）

这部分涉及到安卓的正向开发知识

概述是：

onResume

onStart

getLifecycle

等等

如此，去找：

com.google.android.youtube_16.29.36

smali_classes2/com/google/android/apps/youtube/app/application/Shell_HomeActivity.smali

smali_classes2/com/google/android/apps/youtube/app/watchwhile/WatchWhileActivity.smali

的

onResume

onStart

getLifecycle

等函数，去打断点：

TODO：

【已解决】Android Studio调试Smali：给YouTube的smali代码加断点

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 21:54:41

配置AS项目

配置AS项目

Android Studio项目初始化配置

主要是：

File->Project Structure->Project Settings->Project SDK：

设置为和安卓设备的Android API Level=sdkVersion一致的值：

此处：Android设备是Google Pixe 3，API是Android 9=Android API 28

所以设置为：

Android API 28 Platform

TODO：

【基本解决】安卓AS调试apk的smali：新建和设置远程调试配置

【已解决】安卓AS调试apk的smali：初始化配置AS调试环境

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 21:54:45

adb可获取进程列表

adb可获取进程列表

确保adb可以获取到安卓设备的进程列表

确保：

adb shell ps

可以获取到：

安卓设备中的进程的列表

目的：防止后续无法看到进程，无法调试

比如，我此处的遇到的特殊情况：

adb shell的子命令，包括ps，无法直接运行（要么报错，要么没权限，要么没返回结果）

则意味着后续Android Studio中Attach Debugger to Android Process的Choose Process中，无法看到设备的进程列表，就无法继续调试。

TODO：

【已解决】Android Studio和DDMS中看不到安卓设备中的所有进程

【已解决】Mac中运行adb shell无需su超级用户即可正常运行输出结果

【未解决】Android Studio调试报错：Unable to open debugger port localhost handshake failed connection prematurally closed

【未解决】Android Studio中smali断点不生效无法触发断点

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2022-10-27 21:30:26

AS调试app进程

AS调试app进程

TODO：

查看参数变量值

【已解决】Android Studio调试Smali代码：如何查看函数的局部变量临时变量的值

【已解决】Android Studio调试Smali代码：如何查看函数的全部参数的值

【已解决】Android 11的Google Pixel3中AS调试YouTube的Smali代码

【已解决】Android Studio调试smali代码：查看变量值出错internal error

Android Studio中调试设备端的app进程

Attach Debugger to Android Process

进入Choose Process弹框页面

正常会显示出安卓设备，且会列出设备中可调试的众多进程

选择对应的要调试（此处是YouTube）的进程：

即可顺利启动调试

并触发之前加的断点了：

如果没启动或断点没生效，则重新点击调试

有时候，至少此处经常发生：点击了一次 Attach Debugger to Android Process+OK，虽然启动了YouTube，但是无法调试进程

所以经常需要再去重新点击一次 Attach Debugger to Android Process+OK，然后就可以正常调试，触发断点了

但是其实感觉是：没有真正挂上安卓手机中YouTube的进程，因为此时YouTube的app端还在正常运行

感觉是此处调试环境还是有点问题的，有空再去深究原因。

TODO：

【基本解决】安卓AS调试apk的smali：新建和设置远程调试配置

【已解决】安卓AS调试apk的smali：初始化配置AS调试环境

【未解决】用Android Studio调试YouTube的smali代码：request请求发送相关的位置

【未解决】用root的安卓手机OPPO R11s去配合Android Studio调试YouTube的Smali代码

【已解决】安卓YouTube逆向：搭建安卓apk动态调试环境

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 21:54:53

调试Smali实例

调试Smali实例

此处介绍安卓AndroidStudio去调试Smali代码的实例。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-25 21:37:08

调试安卓Youtube的smali

调试安卓Youtube的smali

此处贴出，Android Studio动态调试YouTube的Smali的完整的项目代码：

crifan/AndroidYouTubeDynamicDebug: 安卓逆向动态调试YouTube (github.com)

供参考。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-25 21:35:09

调试Smali心得

调试Smali心得

AndroidStudio调试Smali代码

TODO：

smali断点不生效

【未解决】再次出现AS调试Google Pixel3中的YouTube的问题：Smali断点不生效

【记录】Android 11的Google Pixel3中确认adb shell是否工作正常

【未解决】尝试解决Android Studio中smali断点不生效：调试相关设置

【未解决】尝试解决Android Studio中smali断点不生效：smali文件类型File type

【未解决】尝试解决Android Studio中smali断点不生效：卸载重装smalidea插件

【未解决】尝试解决Android Studio中smali断点不生效：故意打开ADM的DDMS有冲突多试试

【未解决】尝试解决Android Studio中smali断点不生效：Android Studio中adb相关设置

【未解决】尝试解决Android Studio中smali断点不生效：用DDMS和monitor配合试试

【未解决】尝试解决Android Studio中smali断点不生效：USB数据线和端口相关

【未解决】Android Studio调试Smali：通过Remote JVM Debug的attach to remote VM的调试按钮去调试

【已解决】Android Device Monitor的DDMS中看不到app包名进程的名称都是问号

【未解决】尝试解决Android Studio中smali断点不生效：JDWP进程相关

【未解决】尝试解决Android Studio中smali断点不生效：Smali插件相关

安卓逆向期间，折腾Android Studio去调试smali代码，其实更麻烦的不在于搞懂本身的流程，而在于：

找到一个好用的调试设备：已root好的，可以顺利调试的安卓手机

因为期间遇到Google Pixel 3的adb异常，导致adb shell各种命令无法正常运行，包括adb的ps无法正常获取进程列表

从而导致后续调试时AS中看不到进程，折腾了很长时间，才确认，就是adb方面的问题导致的。

解决了该问题了，AS中能attach到进程，后续就顺利多了。

并且另外Google Pixel 3本身不稳定，导致虽然开始能调试，但是后来出现开发者选项崩溃的问题，无法进入设置了。对于正常安卓逆向开发，也有很大影响。

总之：还是要找个靠谱的root后的安卓手机，才能保证后续安卓逆向的顺利。

如何调试Smali代码逻辑

TODO：

【记录】用Android Studio调试YouTube的smali代码：smali/anwu.smali

【记录】用Android Studio调试YouTube的smali代码：smali_classes2/azfv.smali

【记录】用Android Studio调试YouTube的smali代码：smali/anuh.smali

【记录】用Android Studio调试YouTube的smali代码：smali_classes2的WatchWhileActivity.smali

【记录】用AS调试YouTube的Smali代码：调试相关业务逻辑

【未解决】给AS调试YouTube的Smali代码：加url过滤

【已解决】Xposed如何hook混淆后的安卓应用中的类名和函数名

调试Smali常见问题

用AS去调试Smali期间，时不时的遇到一些错误，整理如下：

IDE error occurred See details and submit report

现象：AS中用Smalidea插件调试smali代码期间，突然的出现报错

IDE error occurred
See details and submit report

点击See details and submit report，看到详情：

Exception in plugin Smalidea

java.lang.Throwable: Assertion failed: Should be invoked in manager thread, use DebuggerManagerThreadImpl.getInstance(..).invoke...
    at com.intellij.openapi.diagnostic.Logger.assertTrue(Logger.java:218)
    at com.intellij.debugger.engine.DebuggerManagerThreadImpl.assertIsManagerThread(DebuggerManagerThreadImpl.java:58)
    at com.intellij.debugger.engine.DebugProcessImpl.getVirtualMachineProxy(DebugProcessImpl.java:849)
    at org.jf.smalidea.debugging.value.LazyValue.virtualMachine(LazyValue.java:152)
    at com.intellij.debugger.memory.action.ShowInstancesByClassAction.isEnabled(ShowInstancesByClassAction.java:39)
    at com.intellij.xdebugger.impl.ui.tree.actions.XDebuggerTreeActionBase.update(XDebuggerTreeActionBase.java:49)
    at com.intellij.openapi.actionSystem.ex.ActionUtil.lambda$performDumbAwareUpdate$0(ActionUtil.java:130)
    at com.intellij.openapi.actionSystem.ex.ActionUtil.performDumbAwareUpdate(ActionUtil.java:144)
    at com.intellij.openapi.actionSystem.impl.ActionUpdater.doUpdate(ActionUpdater.java:606)
    at com.intellij.openapi.actionSystem.impl.ActionUpdater.lambda$updateActionReal$7(ActionUpdater.java:133)
    at com.intellij.openapi.actionSystem.impl.ActionUpdater.lambda$callAction$9(ActionUpdater.java:188)
    at com.intellij.openapi.progress.ProgressManager.lambda$runProcess$0(ProgressManager.java:57)
    at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$runProcess$2(CoreProgressManager.java:183)
    at com.intellij.openapi.progress.impl.CoreProgressManager.registerIndicatorAndRun(CoreProgressManager.java:705)
    at com.intellij.openapi.progress.impl.CoreProgressManager.executeProcessUnderProgress(CoreProgressManager.java:647)
    at com.intellij.openapi.progress.impl.ProgressManagerImpl.executeProcessUnderProgress(ProgressManagerImpl.java:63)
    at com.intellij.openapi.progress.impl.CoreProgressManager.runProcess(CoreProgressManager.java:170)
    at com.intellij.openapi.progress.ProgressManager.runProcess(ProgressManager.java:57)
    at com.intellij.openapi.actionSystem.impl.ActionUpdater.lambda$callAction$10(ActionUpdater.java:186)
    at com.intellij.openapi.actionSystem.impl.ActionUpdateEdtExecutor.lambda$computeOnEdt$0(ActionUpdateEdtExecutor.java:45)
    at com.intellij.openapi.application.TransactionGuardImpl$2.run(TransactionGuardImpl.java:199)
    at com.intellij.openapi.application.impl.ApplicationImpl.runIntendedWriteActionOnCurrentThread(ApplicationImpl.java:794)
    at com.intellij.openapi.application.impl.ApplicationImpl.lambda$invokeLater$4(ApplicationImpl.java:350)
    at com.intellij.openapi.application.impl.FlushQueue.doRun(FlushQueue.java:84)
    at com.intellij.openapi.application.impl.FlushQueue.runNextEvent(FlushQueue.java:133)
    at com.intellij.openapi.application.impl.FlushQueue.flushNow(FlushQueue.java:46)
    at com.intellij.openapi.application.impl.FlushQueue$FlushNow.run(FlushQueue.java:189)
    at java.desktop/java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:313)
    at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:776)
    at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:727)
    at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:721)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85)
    at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:746)
    at com.intellij.ide.IdeEventQueue.defaultDispatchEvent(IdeEventQueue.java:885)
    at com.intellij.ide.IdeEventQueue._dispatchEvent(IdeEventQueue.java:754)
    at com.intellij.ide.IdeEventQueue.lambda$dispatchEvent$6(IdeEventQueue.java:441)
    at com.intellij.openapi.progress.impl.CoreProgressManager.computePrioritized(CoreProgressManager.java:825)
    at com.intellij.ide.IdeEventQueue.lambda$dispatchEvent$7(IdeEventQueue.java:440)
    at com.intellij.openapi.application.impl.ApplicationImpl.runIntendedWriteActionOnCurrentThread(ApplicationImpl.java:794)
    at com.intellij.ide.IdeEventQueue.dispatchEvent(IdeEventQueue.java:486)
    at com.intellij.openapi.actionSystem.impl.Utils.lambda$expandActionGroupImpl$1(Utils.java:166)
    at com.intellij.openapi.actionSystem.impl.Utils.runLoopAndWaitForFuture(Utils.java:530)
    at com.intellij.openapi.actionSystem.impl.Utils.expandActionGroupImpl(Utils.java:159)
    at com.intellij.openapi.actionSystem.impl.Utils.fillMenu(Utils.java:244)
    at com.intellij.openapi.actionSystem.impl.ActionPopupMenuImpl$MyMenu.lambda$updateChildren$1(ActionPopupMenuImpl.java:180)
    at com.intellij.util.TimeoutUtil.run(TimeoutUtil.java:104)
    at com.intellij.openapi.actionSystem.impl.ActionPopupMenuImpl$MyMenu.lambda$updateChildren$3(ActionPopupMenuImpl.java:179)
    at com.intellij.openapi.actionSystem.impl.Utils.performWithRetries(Utils.java:570)
    at com.intellij.openapi.actionSystem.impl.ActionPopupMenuImpl$MyMenu.updateChildren(ActionPopupMenuImpl.java:178)
    at com.intellij.openapi.actionSystem.impl.ActionPopupMenuImpl$MyMenu.show(ActionPopupMenuImpl.java:138)
    at com.intellij.ui.PopupHandler$2.invokePopup(PopupHandler.java:130)
    at com.intellij.ui.PopupHandler.mousePressed(PopupHandler.java:48)
    at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:288)
    at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
    at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
    at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
    at java.desktop/java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:287)
    at java.desktop/java.awt.Component.processMouseEvent(Component.java:6649)
    at java.desktop/javax.swing.JComponent.processMouseEvent(JComponent.java:3345)
    at com.intellij.ui.treeStructure.Tree.processMouseEvent(Tree.java:394)
    at com.intellij.ide.dnd.aware.DnDAwareTree.processMouseEvent(DnDAwareTree.java:44)
    at java.desktop/java.awt.Component.processEvent(Component.java:6417)
    at java.desktop/java.awt.Container.processEvent(Container.java:2263)
    at java.desktop/java.awt.Component.dispatchEventImpl(Component.java:5027)
    at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2321)
    at java.desktop/java.awt.Component.dispatchEvent(Component.java:4859)
    at java.desktop/java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4918)
    at java.desktop/java.awt.LightweightDispatcher.processMouseEvent(Container.java:4544)
    at java.desktop/java.awt.LightweightDispatcher.dispatchEvent(Container.java:4488)
    at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2307)
    at java.desktop/java.awt.Window.dispatchEventImpl(Window.java:2784)
    at java.desktop/java.awt.Component.dispatchEvent(Component.java:4859)
    at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:778)
    at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:727)
    at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:721)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85)
    at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:95)
    at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:751)
    at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:749)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85)
    at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:748)
    at com.intellij.ide.IdeEventQueue.defaultDispatchEvent(IdeEventQueue.java:885)
    at com.intellij.ide.IdeEventQueue.dispatchMouseEvent(IdeEventQueue.java:814)
    at com.intellij.ide.IdeEventQueue._dispatchEvent(IdeEventQueue.java:751)
    at com.intellij.ide.IdeEventQueue.lambda$dispatchEvent$6(IdeEventQueue.java:441)
    at com.intellij.openapi.progress.impl.CoreProgressManager.computePrioritized(CoreProgressManager.java:825)
    at com.intellij.ide.IdeEventQueue.lambda$dispatchEvent$7(IdeEventQueue.java:440)
    at com.intellij.openapi.application.impl.ApplicationImpl.runIntendedWriteActionOnCurrentThread(ApplicationImpl.java:794)
    at com.intellij.ide.IdeEventQueue.dispatchEvent(IdeEventQueue.java:492)
    at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)
    at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)
    at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)
    at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)
    at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
    at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)

原因：Smalidea插件的bug

解决办法：暂无

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 22:09:56

LLDB调试安卓

lldb调试安卓

此处介绍如何用LLDB去调试安卓app（进程）。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-12 22:19:53

下载安卓版lldb-server

Mac中：下载安卓版lldb-server

从网上下载lldb-server到Mac

Android SDK Offline: Android NDK LLDB Direct Download

->

https://dl.google.com/android/repository/lldb-3.1.4508709-darwin-x86_64.zip

下载得到lldb-3.1.4508709-darwin-x86_64.zip，解压后得到：

lldb-3.1.4508709-linux-x86_64/android/arm64-v8a/lldb-server

确认文件类型是ARM64的：

➜  arm64-v8a ll
total 16568
-rwxr-xr-x@ 1 crifan  staff   8.1M 12 18  2017 lldb-server

➜  arm64-v8a file lldb-server
lldb-server: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /system/bin/linker64, BuildID[sha1]=16479c73b494c432c5f171db2bb68f29e033f157, stripped

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-12 22:00:28

lldb-server传输到手机

Mac中：把lldb-server下载到安卓手机中

从Mac下载lldb-server到此处安卓手机Pixel5中：

adb push lldb-3.1.4508709-linux-x86_64/android/arm64-v8a/lldb-server /data/local/tmp

注：

此处安卓手机正常默认情况下，已有路径：/data/local/tmp

专门供开发相关用途使用

adb shell中可以确认

blueline:/data/local/tmp/ # ls -lh
total 4.0M
-rwxrwxrwx 1 shell shell 8.0M 2017-12-18 21:03 lldb-server

此处确保有可执行权限=x

如果没有，则要去加上

chmod +x lldb-server

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-12 22:35:24

运行lldb-server

安卓手机中：运行lldb-server

./lldb-server platform --server --listen unix-abstract:///data/local/tmp/dev/lldb_debug.sock &

注：

此处可以通过ps查看到进程的确在运行

blueline:/data/local/tmp/dev/lldb # ps -A | grep lldb
root          27860   7054 10779208  4628 __skb_wait_for_more_packets 0 S lldb-server

参数含义

概述

COMMANDS

v[ersion]

Prints lldb-server version and exits

g[dbserver]

Runs the server using the gdb-remote protocol. LLDB can afterwards connect to the server using gdb-remote command

p[latform]

Runs the platform server. LLDB can afterwards connect to the server using platform select, followed by platform connect

PLATFORM COMMAND

语法

lldb-server p[latform] [options] –server –listen [[host]:port]

CONNECTION

--server

Run in server mode, handling multiple connections. If this is not specified, lldb-server will accept only one connection and exit when it is finished

--listen <host>:<port>

Hostname and port to listen on. Obligatory. If port is zero, a random port will be used

--socket-file <path>

Write the listening socket port number to the specified file

详解

lldb-server – Server for LLDB Debugging Sessions — The LLDB Debugger

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-12 22:02:04

lldb连接lldb-server

Mac中：用lldb客户端去连接lldb-server

进入=启动=运行 lldb

lldb

设置要连接的类型是：远端的安卓手机

platform select remote-android

输出举例

(lldb) platform select remote-android
  Platform: remote-android
Connected: no

连接安卓（中的lldb-server）

platform connect unix-abstract-connect:///data/local/tmp/dev/lldb_debug.sock

输出举例

(lldb) platform connect unix-abstract-connect:///data/local/tmp/dev/lldb_debug.sock
  Platform: remote-android
    Triple: aarch64-unknown-linux-android
OS Version: 30 (4.9.248-gc4689af91bc5-ab7425221)
  Hostname: localhost
Connected: yes
WorkingDir: /data/local/tmp/dev/lldb
    Kernel: #0 SMP PREEMPT Fri Jun 4 06:01:28 UTC 2021

注：

可以用platform list查看全部的支持的类型有哪些

(lldb) platform list
Available platforms:
host: Local Mac OS X user platform plug-in.
remote-linux: Remote Linux user platform plug-in.
remote-android: Remote Android user platform plug-in.
remote-freebsd: Remote FreeBSD user platform plug-in.
remote-gdb-server: A platform that uses the GDB remote protocol as the communication transport.
darwin: Darwin platform plug-in.
remote-ios: Remote iOS platform plug-in.
remote-macosx: Remote Mac OS X user platform plug-in.
ios-simulator: iPhone simulator platform plug-in.
tvos-simulator: tvOS simulator platform plug-in.
watchos-simulator: Apple Watch simulator platform plug-in.
darwin-kernel: Darwin Kernel platform plug-in.
remote-tvos: Remote Apple TV platform plug-in.
remote-watchos: Remote Apple Watch platform plug-in.
remote-bridgeos: Remote BridgeOS platform plug-in.
host: Local Mac OS X user platform plug-in.
remote-netbsd: Remote NetBSD user platform plug-in.
remote-openbsd: Remote OpenBSD user platform plug-in.
qemu-user: Platform for debugging binaries under user mode qemu
remote-windows: Remote Windows user platform plug-in.

连接前后，都可以去查看和验证实际状态（是否是希望的已连接）

platform status

举例

连接前

(lldb) platform status
  Platform: remote-android
Connected: no

连接后

(lldb) platform status
  Platform: remote-android
    Triple: aarch64-unknown-linux-android
OS Version: 30 (4.9.248-gc4689af91bc5-ab7425221)
  Hostname: localhost
Connected: yes
WorkingDir: /data/local/tmp/dev/lldb
    Kernel: #0 SMP PREEMPT Fri Jun 4 06:01:28 UTC 2021

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-12 22:38:46

用lldb调试安卓app进程

Mac中：用lldb调试安卓app进程

背景

被测安卓的app

app名称：Lift File Manager

包名：com.lift.filemanager.android

主页面

然后可以用lldb去调试安卓app（进程）了：

process attach -p 24058

说明

attach：当前用挂载模式（而不是spawn模式）

-p 24058

-p == --pid：进程的PID

24058：当前安卓app的（主）进程的PID

输出举例

命令行输出：

(lldb) process attach -p 24058
warning: (aarch64) /Users/crifan/.lldb/module_cache/remote-android/.cache/8B041FC2-79D5-1089-00E4-8324BAFA5142/app_process64 No LZMA support found for reading .gnu_debugdata section
warning: (aarch64) /Users/crifan/.lldb/module_cache/remote-android/.cache/1DEC5134-A095-22F9-C83C-48DAE0AEC3BE/libandroid_runtime.so No LZMA support found for reading .gnu_debugdata section
warning: (aarch64) /Users/crifan/.lldb/module_cache/remote-android/.cache/52A96623-E462-0961-84C4-425671CC1C5D/libbinder.so No LZMA support found for reading .gnu_debugdata section
warning: (aarch64) /Users/crifan/.lldb/module_cache/remote-android/.cache/ED5D3D46-2F5F-F1ED-D424-A588996F33C8/libcutils.so No LZMA support found for reading .gnu_debugdata section
...
...
...
warning: (aarch64) /Users/crifan/.lldb/module_cache/remote-android/.cache/68482D47-6551-C4A4-AE65-B2B4FC4E6ABA/libGLESv2_adreno.so No LZMA support found for reading .gnu_debugdata section
warning: (aarch64) /Users/crifan/.lldb/module_cache/remote-android/.cache/7A027C1B-6689-FB13-BC4C-DDF60D309D9F/libllvm-glnext.so No LZMA support found for reading .gnu_debugdata section
warning: (aarch64) /Users/crifan/.lldb/module_cache/remote-android/.cache/28A702E7-CF8C-5CCC-2481-D2DD8B341E1B/libcompiler_rt.so No LZMA support found for reading .gnu_debugdata section
warning: (aarch64) /Users/crifan/.lldb/module_cache/remote-android/.cache/11A028BE-C11F-BD95-B235-8593B25A1887/libwebviewchromium_loader.so No LZMA support found for reading .gnu_debugdata section
Process 24058 stopped
* thread #1, name = 'er.android:sist', stop reason = signal SIGSTOP
    frame #0: 0x000000707075bf38 libc.so`__epoll_pwait + 8
libc.so`__epoll_pwait:
->  0x707075bf38 <+8>:  cmn    x0, #0x1, lsl #12         ; =0x1000
    0x707075bf3c <+12>: cneg   x0, x0, hi
    0x707075bf40 <+16>: b.hi   0x707075a820              ; __set_errno_internal
    0x707075bf44 <+20>: ret
  thread #2, name = 'Signal Catcher', stop reason = signal SIGSTOP
    frame #0: 0x000000707075b978 libc.so`__rt_sigtimedwait + 8
libc.so`__rt_sigtimedwait:
->  0x707075b978 <+8>:  cmn    x0, #0x1, lsl #12         ; =0x1000
    0x707075b97c <+12>: cneg   x0, x0, hi
    0x707075b980 <+16>: b.hi   0x707075a820              ; __set_errno_internal
    0x707075b984 <+20>: ret
  thread #3, name = 'perfetto_hprof_', stop reason = signal SIGSTOP
    frame #0: 0x000000707075acf4 libc.so`read + 4
libc.so`read:
->  0x707075acf4 <+4>:  svc    #0
    0x707075acf8 <+8>:  cmn    x0, #0x1, lsl #12         ; =0x1000
    0x707075acfc <+12>: cneg   x0, x0, hi
    0x707075ad00 <+16>: b.hi   0x707075a820              ; __set_errno_internal
...
...
...
  thread #21, name = 'queued-work-loo', stop reason = signal SIGSTOP
    frame #0: 0x000000707075bf38 libc.so`__epoll_pwait + 8
libc.so`__epoll_pwait:
->  0x707075bf38 <+8>:  cmn    x0, #0x1, lsl #12         ; =0x1000
    0x707075bf3c <+12>: cneg   x0, x0, hi
    0x707075bf40 <+16>: b.hi   0x707075a820              ; __set_errno_internal
    0x707075bf44 <+20>: ret
Target 0: (app_process64) stopped.
Executable module set to "/Users/crifan/.lldb/module_cache/remote-android/.cache/8B041FC2-79D5-1089-00E4-8324BAFA5142/app_process64".
Architecture set to: aarch64-unknown-linux-android.
(lldb)

截图

常见问题

error Connection shut down by remote side while waiting for reply to initial handshake packet

现象：lldb去连接安卓中lldb-server时报错：

(lldb) platform connect unix-abstract-connect:///data/local/tmp/dev/lldb/lldb_debug.sock
error: Connection shut down by remote side while waiting for reply to initial handshake packet

原因：此处Android 13已开启了SELinux，导致无法连接

解决办法：去关于SELinux

有2种方式

永久关闭：需要修改Android源码，重新编译ROM或boot.img

此处暂时没条件，暂时放弃此路

临时关闭：通过参数设置关闭

具体命令

adb shell setenforce 0

或：

先adb shell进入shell，再su切换成root用户，再用setenforce 0去关闭SELinux

（之前和之后都可以）用getenforce去确认=查看当前SELinux状态

Enforcing：SELinux已开启

1redfin:/data/local/tmp/dev/lldb # getenforce
Enforcing

Permissive：SELinux已关闭

redfin:/data/local/tmp/dev/lldb # getenforce
Permissive

心得

如何查看安卓app的进程的PID

有多种方式查看到，（当前正在运行的）安卓app的进程的PID：

Mac中

frida-ps -Uai

其中可以看到自己已安装的安卓的app的详情：进程PID、app名称、包名

举例

➜  LiftFileManager_jadx_AlarmManager frida-ps -Uai | grep lift
24058   Lift File Manager  com.lift.filemanager.android

可以看到要测试的app的：

进程PID：24058

app名称：Lift File Manager

包名：com.lift.filemanager.android

（安卓手机的）adb的shell中

ps -A | grep yourAndroidAppName

举例

redfin:/ # ps -A | grep lift
u0_a243       24058 1008 33543564 207388 do_epoll_wait      0 S com.lift.filemanager.android
u0_a243       xxxx  1008 14793148 119908 do_epoll_wait      0 S com.lift.filemanager.android:sist
u0_a243       xxxx  1008 14754236 139864 do_epoll_wait      0 S com.lift.filemanager.android:dae
u0_a243       xxxx  1008 14734752 109496 do_epoll_wait      0 S com.lift.filemanager.android:lift

LiftFileManager的主进程PID是：24058

如何用lldb调试程序

之后就是，如何用lldb调试的具体效果了。

举例：

去看看加载的image：

(lldb) image list -o -f
(lldb) image list -o -f
[  0] 0x0000006524034000 /Users/crifan/.lldb/module_cache/remote-android/.cache/8B041FC2-79D5-1089-00E4-8324BAFA5142/app_process64
[  1] 0x0000007075ae9000 [vdso](0x0000007075ae9000)
[  2] 0x0000007075aea000 /Users/crifan/.lldb/module_cache/remote-android/.cache/0714FD90-1698-1186-FE9E-FC2187186124/linker64
[  3] 0x00000070728d6000 /Users/crifan/.lldb/module_cache/remote-android/.cache/1DEC5134-A095-22F9-C83C-48DAE0AEC3BE/libandroid_runtime.so
[  4] 0x000000706fe94000 /Users/crifan/.lldb/module_cache/remote-android/.cache/52A96623-E462-0961-84C4-425671CC1C5D/libbinder.so
[  5] 0x000000707044c000 /Users/crifan/.lldb/module_cache/remote-android/.cache/ED5D3D46-2F5F-F1ED-D424-A588996F33C8/libcutils.so
[  6] 0x0000007070e09000 /Users/crifan/.lldb/module_cache/remote-android/.cache/CE1E7F5F-3909-217B-2745-8673575C5CBE/libhidlbase.so
[  7] 0x0000007070f9e000 /Users/crifan/.lldb/module_cache/remote-android/.cache/661D4366-5D5E-C814-EC19-1E5D951FE16A/liblog.so
[  8] 0x0000007073549000 /Users/crifan/.lldb/module_cache/remote-android/.cache/5D6AF741-2421-1886-D954-D61C96514A46/libutils.so
[  9] 0x000000706f681000 /Users/crifan/.lldb/module_cache/remote-android/.cache/584DB189-C827-EFEF-DD92-857A7E567C38/libwilhelm.so
[ 10] 0x0000007072800000 /Users/crifan/.lldb/module_cache/remote-android/.cache/0258740B-928B-138C-E564-C516FD6B9141/libc++.so
[ 11] 0x00000070706c0000 /Users/crifan/.lldb/module_cache/remote-android/.cache/49090AE5-9E6A-E37F-8BEA-E53C551820AD/libc.so
[ 12] 0x000000706f703000 /Users/crifan/.lldb/module_cache/remote-android/.cache/1B99BAD0-6575-7949-B4B5-3A0C1FD55A0D/libm.so
[ 13] 0x000000706f956000 /Users/crifan/.lldb/module_cache/remote-android/.cache/316B3120-5B8A-84EF-BC6D-1492C06AEEB8/libdl.so
[ 14] 0x0000007072482000 /Users/crifan/.lldb/module_cache/remote-android/.cache/01A12DD5-2243-73ED-CC3A-74506F64A9C9/libbase.so
...
[265] 0x0000006dc2241000 /Users/crifan/.lldb/module_cache/remote-android/.cache/7A027C1B-6689-FB13-BC4C-DDF60D309D9F/libllvm-glnext.so
[266] 0x0000006dc1e86000 /Users/crifan/.lldb/module_cache/remote-android/.cache/EF219156-ADF1-D883-C02F-44E4C1FC04B2/libGLESv1_CM_adreno.so
[267] 0x0000006dc1e69000 /Users/crifan/.lldb/module_cache/remote-android/.cache/FFCCE965-AAA2-1D95-77F2-CF1708C764B7/eglSubDriverAndroid.so
[268] 0x0000006dc1d8b000 /Users/crifan/.lldb/module_cache/remote-android/.cache/28A702E7-CF8C-5CCC-2481-D2DD8B341E1B/libcompiler_rt.so
[269] 0x0000006dc1d42000 /Users/crifan/.lldb/module_cache/remote-android/.cache/11A028BE-C11F-BD95-B235-8593B25A1887/libwebviewchromium_loader.so
[270]                    JIT(0x99dda8b0)(0x0000000099dda8b0)
[271]                    JIT(0x99dda350)(0x0000000099dda350)
[272]                    JIT(0x99dda010)(0x0000000099dda010)
...
[338]                    JIT(0x95dd2cd0)(0x0000000095dd2cd0)
[339]                    JIT(0x95dd28d0)(0x0000000095dd28d0)
[340]                    JIT(0x95dd2450)(0x0000000095dd2450)
(lldb)

截图

其他更多关于LLDB的用法，详见独立子教程：

主流调试器：LLDB

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-12 22:30:13

Frida调试安卓

Frida调试安卓

Frida

概述

iOS逆向和Android逆向中常用的动态调试工具之一

用于动态调试程序逻辑，实现各种调试功能

核心使用逻辑是frida+js脚本，或frida-trace追踪函数执行过程

以及高级的Frida的Stalker追踪函数实际运行过程等等

主页

官网

https://frida.re/

Github

https://github.com/frida/frida

截图

Windows

Mac

详解

独立子教程

逆向调试利器：Frida

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-15 21:22:03

初始化Frida开发环境

初始化Frida开发环境

电脑端安装Frida

概述

Mac

安装frida（和frida-tools）

pip3 install frida
pip3 install frida-tools

或：已有frida，去升级到最新版

pip install --upgrade frida
pip install --upgrade frida-tools

详解

安装Frida · 逆向调试利器：Frida

此处已安装的（最新）Frida版本是：16.1.3

➜  ~ frida --version
16.1.3

安卓手机中安装frida-server

由于之前手动从下载frida-server并放到安卓手机Pixel3中，结果后续会报错Failed to enumerate processes connection closed，而无法使用

最后解决办法是：安装Magisk的插件：

ViRb3/magisk-frida: 🔐 Run frida-server on boot with Magisk, always up-to-date

具体步骤：

下载到此处最新版的：

https://github.com/ViRb3/magisk-frida/releases/download/16.1.3-1/MagiskFrida-16.1.3-1.zip

得到：MagiskFrida-16.1.3-1.zip

（用adb push）传输到安卓手机中（的下载目录）

然后去：

Magisk->模块->从本地安装->找到并点击MagiskFrida-16.1.3-1.zip->开始自动安装->重启

（以后）每次重启安卓手机后：

可以看到Magisk中的插件：MagiskFrida

都会自动运行frida-server

blueline:/ # ps -A | grep frida
root           4408   1321 10877092  3696 do_sys_poll         0 S frida-server

后续即可正常使用Frida：

Mac中用确认frida工具可用

可用的

frida-ps

frida-ps -U
frida-ps -Uai

frida

frida -U -F com.example.displaydemo

frida-trace

frida-trace -U -F com.example.displaydemo -i open

不可用

frida-ls

➜  frida frida-ls -U
Failed to retrieve listing: Error: Invalid mode: 0x0
    at I (agent.ts:274)
    at L (agent.ts:274)
    at ls (agent.ts:274)
    at apply (native)
    at <anonymous> (frida/runtime/message-dispatcher.js:13)
    at c (frida/runtime/message-dispatcher.js:23)

暂时无法解决

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-15 21:25:00

Frida调试安卓app

Frida调试安卓app

用frida或frida-trace等工具去调试安卓应用：

找到安卓应用的包名或PID

frida-ps -Uai

找到此处的要调试的应用：

19384 DisplayDemo com.example.displaydemo

=>

app名：DisplayDemo

包名：com.example.displaydemo

PID：19384

用frida或frida-trace去调试

此处手动点击DisplayDemo这个app，确保在前台运行，然后去hook调试：

frida

frida -U -F com.example.displaydemo

效果

frida-trace

frida-trace -U -F com.example.displaydemo -i open
frida-trace -U -f com.example.displaydemo -i JIN_OnLoad -i RegisterNatives -i open -i openat

效果

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-02 17:21:15

示例

示例

此处贴出一些，用Frida去调试安卓应用的，相关实例演示。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-15 21:45:49

LiftFileManager

LiftFileManager

用frida加js脚本去调试com.lift.filemanager.android=LiftFileManager：

命令

frida -U -f com.lift.filemanager.android -l hook_LiftFileManager.js

js脚本代码

hook_LiftFileManager.js

/**
 * Update: 20230808
 * Usage:
 *  frida -U -f com.lift.filemanager.android -l hook_LiftFileManager.js
 */

function processJniOnLoad(libraryName) {
  const funcSym = "JNI_OnLoad";
  const funcPtr = Module.findExportByName(libraryName, funcSym);
  console.log("funcSym=" + funcSym + ", funcPtr=" + funcPtr);

  console.log("[+] Hooking " + funcSym + "() @ " + funcPtr + "...");
  // jint JNI_OnLoad(JavaVM *vm, void *reserved);
  var funcHook = Interceptor.attach(funcPtr, {
      onEnter: function (args) {
          const vm = args[0];
          const reserved = args[1];
          console.log("[+] " + funcSym + "(" + vm + ", " + reserved + ") called");
      },
      onLeave: function (retval) {
        console.log("[+]\t= " + retval);
      }
  });
}

function processNativeFunc(libraryName, nativeFuncName) {
  const nativeFuncPtr = Module.findExportByName(libraryName, nativeFuncName);
  console.log("nativeFuncName=" + nativeFuncName + ", nativeFuncPtr=" + nativeFuncPtr);
  var nativeFuncHook = Interceptor.attach(nativeFuncPtr, {
    onEnter: function (args) {
      const args0 = args[0];
      console.log(nativeFuncName + " [+] args0=" + args0);
    },
    onLeave: function (retval) {
      console.log("[+]\t= " + retval);
    }
  });
}

// hook normal C function
function hookCFunc(){

  // int execlp(const char *path, const char *arg0, ..., NULL);
  Interceptor.attach(Module.findExportByName(null, "execlp"), {
    onEnter: function (args) {
      var path = Memory.readCString(args[0]);
      var arg0 = Memory.readCString(args[1]);
      var arg1 = Memory.readCString(args[2]);
      console.log("execlp: path=" + path + ", arg0=" + arg0 + ", arg1=" + arg1);
    },
    onLeave: function (args) {
    }
  });

  // int execv(const char *pathname, char *const argv[]);
  Interceptor.attach(Module.findExportByName(null, "execv"), {
    onEnter: function (args) {
      var pathname = Memory.readCString(args[0]);
      var argv = args[1];
      console.log("execv: pathname=" + pathname + ", argv=" + argv);
    },
    onLeave: function (args) {
    }
  });

  // int pthread_create(pthread_t *thread, const pthread_attr_t *attr, void *(*start_routine)(void*), void *arg);
  Interceptor.attach(Module.findExportByName(null, "pthread_create"), {
    onEnter: function (args) {
      var thread = args[0];
      var attr = args[1];
      var start_routine = args[2];
      var arg = args[3];
      console.log("pthread_create: thread=" + thread + ", attr=" + attr + ", start_routine=" + start_routine + ", arg=" + arg);
    },
    onLeave: function (retNewPid) {
      console.log("\t pthread_create retNewPid= " + retNewPid);
    }
  });

  // int clone(int (*fn)(void *_Nullable), void *stack, int flags, void *_Nullable arg, ...  /* pid_t *_Nullable parent_tid, void *_Nullable tls, pid_t *_Nullable child_tid */ );
  Interceptor.attach(Module.findExportByName(null, "clone"), {
    onEnter: function (args) {
      var fn = args[0];
      var stack = args[1];
      var flags = args[2];
      var arg = args[3];
      console.log("clone: fn=" + fn + ", stack=" + stack + ", flags=" + flags + ", arg=" + arg);
    },
    onLeave: function (retval) {
    }
  });

  // pid_t fork(void);
  Interceptor.attach(Module.findExportByName(null, "fork"), {
    onEnter: function (args) {
      console.log("fork called");
    },
    onLeave: function (retval) {
      console.log("\t fork retval= " + retval);
    }
  });

  // int posix_spawn(pid_t *pid, const char *path, const posix_spawn_file_actions_t *file_actions, const posix_spawnattr_t *attrp, char *const argv[], char *const envp[]);
  Interceptor.attach(Module.findExportByName(null, "posix_spawn"), {
    onEnter: function (args) {
      var pid = args[0];
      var path = Memory.readCString(args[1]);
      var file_actions = args[2];
      var attrp = args[3];
      var argv = args[4];
      var envp = args[5];
      console.log("posix_spawn: pid=" + pid + ", path=" + path + ", file_actions=" + file_actions + ", attrp=" + attrp + ", argv=" + argv + ", envp=" + envp);
    },
    onLeave: function (retval) {
    }
  });

  // int posix_spawnp(pid_t *pid, const char *file, const posix_spawn_file_actions_t *file_actions, const posix_spawnattr_t *attrp, char *const argv[], char *const envp[]);
  Interceptor.attach(Module.findExportByName(null, "posix_spawnp"), {
    onEnter: function (args) {
      var pid = args[0];
      var file = Memory.readCString(args[1]);
      var file_actions = args[2];
      var attrp = args[3];
      var argv = args[4];
      var envp = args[5];
      console.log("posix_spawnp: pid=" + pid + ", file=" + file + ", file_actions=" + file_actions + ", attrp=" + attrp + ", argv=" + argv + ", envp=" + envp);
    },
    onLeave: function (retval) {
    }
  });

  // int sigaction(int signum, const struct sigaction *_Nullable restrict act, struct sigaction *_Nullable restrict oldact);
  Interceptor.attach(Module.findExportByName(null, "sigaction"), {
    onEnter: function (args) {
      var signum = args[0];
      var actP = args[1];
      var oldactP = args[2];
      console.log("sigaction: signum=" + signum + ", actP=" + actP + ", oldactP=" + oldactP);
    },
    onLeave: function (args) {
    }
  });

  // int remove(const char *path);
  Interceptor.attach(Module.findExportByName(null, "remove"), {
    onEnter: function (args) {
      var path = Memory.readCString(args[0]);
      console.log("remove: path=" + path);
    },
    onLeave: function (args) {
    }
  });

  // FILE *fopen(const char *restrict pathname, const char *restrict mode);
  Interceptor.attach(Module.findExportByName(null, "fopen"), {
    onEnter: function (args) {
      var pathname = Memory.readCString(args[0]);
      var mode = Memory.readCString(args[1]);
      console.log("fopen: pathname=" + pathname + ", mode=" + mode);
    },
    onLeave: function (args) {
    }
  });

  // int open(const char *pathname, int flags, mode_t mode);
  Interceptor.attach(Module.findExportByName(null, "open"), {
    onEnter: function (args) {
      var path = Memory.readCString(args[0]);
      var oflags = args[1];
      console.log("open: path=" + path + ", oflags=" + oflags);
    },
    onLeave: function (retFd) {
      console.log("\t open retFd=" + retFd);
    }
  });

  // int flock(int fd, int operation);
  Interceptor.attach(Module.findExportByName(null, "flock"), {
    onEnter: function (args) {
      var fd = args[0];
      var operation = args[1];
      console.log("flock: fd=" + fd + ", operation=" + operation);
    },
    onLeave: function (retval) {
    }
  });

  // int killpg(int pgrp, int sig);
  Interceptor.attach(Module.findExportByName(null, "killpg"), {
    onEnter: function (args) {
      var pgrp = args[0];
      var sig = args[1];
      console.log("killpg: pgrp=" + pgrp + ", sig=" + sig);
    },
    onLeave: function (args) {
    }
  });

  // // ssize_t read(int fd, void buf[.count], size_t count);
  // Interceptor.attach(Module.findExportByName(null, "read"), {
  //   onEnter: function (args) {
  //     var fd = args[0];
  //     var buf = args[1];
  //     var count = args[2];
  //     console.log("read: fd=" + fd + ", buf=" + buf + ", count=" + count);
  //   },
  //   onLeave: function (args) {
  //   }
  // });

  // ssize_t pread(int fildes, void *buf, size_t nbyte, off_t offset);
  Interceptor.attach(Module.findExportByName(null, "pread"), {
    onEnter: function (args) {
      var fildes = args[0];
      var buf = args[1];
      var nbyte = args[2];
      var offset = args[3];
      console.log("pread: fildes=" + fildes + ", buf=" + buf + ", nbyte=" + nbyte + ", offset=" + offset);
    },
    onLeave: function (args) {
    }
  });

  // // ssize_t write(int fildes, const void *buf, size_t nbyte);
  // Interceptor.attach(Module.findExportByName(null, "write"), {
  //   onEnter: function (args) {
  //     var fildes = args[0];
  //     var buf = args[1];
  //     var nbyte = args[2];
  //     console.log("write: fildes=" + fildes + ", buf=" + buf + ", nbyte=" + nbyte);
  //   },
  //   onLeave: function (args) {
  //   }
  // });

  // ssize_t pwrite(int fildes, const void *buf, size_t nbyte, off_t offset);
  Interceptor.attach(Module.findExportByName(null, "pwrite"), {
    onEnter: function (args) {
      var fildes = args[0];
      var buf = args[1];
      var nbyte = args[2];
      var offset = args[3];
      console.log("pwrite: fildes=" + fildes + ", buf=" + buf + ", nbyte=" + nbyte + ", offset=" + offset);
    },
    onLeave: function (args) {
    }
  });

  // int close(int fd);
  Interceptor.attach(Module.findExportByName(null, "close"), {
    onEnter: function (args) {
      var fd = args[0];
      console.log("close: fd=" + fd);
    },
    onLeave: function (retval) {
    }
  });

  // int pipe(int pipefd[2]);
  Interceptor.attach(Module.findExportByName(null, "pipe"), {
    onEnter: function (args) {
      var pipefdArray = args[0];
      console.log("pipe: pipefdArray=" + pipefdArray);
    },
    onLeave: function (retval) {
    }
  });

  const KnownStrLis = [
    "",
    "CurrencyMap/US/0/",
    "CurrencyMap/CN/0/",
    "CurrencyMap/CN/",
    "CurrencyMap/",
    "CurrencyMap",
    "CN",
    "US",
    "/",
    "0",
    "id",
    "zh_CN_#HANS",
    "zh_Hans_CN",
    "zh",
    "Hans",
    "HANS",
  ]

  // char *strcpy(char *restrict dst, const char *restrict src);
  Interceptor.attach(Module.findExportByName(null, "strcpy"), {
    onEnter: function (args) {
      var dst = Memory.readCString(args[0]);
      var src = Memory.readCString(args[1]);
      if (!KnownStrLis.includes(src)) {
        console.log("strcpy: dst=" + dst + ", src=" + src);
      }
    },
    onLeave: function (args) {
    }
  });

  // char *strncpy(char *dest, const char *src, size_t count);
  Interceptor.attach(Module.findExportByName(null, "strncpy"), {
    onEnter: function (args) {
      var dest = Memory.readCString(args[0]);
      var src = Memory.readCString(args[1]);
      var count = args[2];
      console.log("strncpy: dest=" + dest + ", src=" + src + ", count=" + count);
    },
    onLeave: function (args) {
    }
  });

  // char *strcat(char *restrict dst, const char *restrict src);
  Interceptor.attach(Module.findExportByName(null, "strcat"), {
    onEnter: function (args) {
      var dst = Memory.readCString(args[0]);
      var src = Memory.readCString(args[1]);
      console.log("strcat: dst=" + dst + ", src=" + src);
    },
    onLeave: function (args) {
    }
  });

  // // pid_t getpid(void);
  // Interceptor.attach(Module.findExportByName(null, "getpid"), {
  //   onEnter: function (args) {
  //     // console.log("getpid called");
  //   },
  //   onLeave: function (retPid) {
  //     console.log("\t getpid retPid=" + retPid);
  //   }
  // });

  // pid_t getppid(void);
  Interceptor.attach(Module.findExportByName(null, "getppid"), {
    onEnter: function (args) {
      console.log("getppid called");
    },
    onLeave: function (retval) {
      console.log("\t getppid retval=" + retval);
    }
  });

  // pid_t setsid(void);
  Interceptor.attach(Module.findExportByName(null, "setsid"), {
    onEnter: function (args) {
      console.log("setsid called");
    },
    onLeave: function (retval) {
      console.log("\t setsid retval=" + retval);
    }
  });

  // void *dlopen(const char *filename, int flags);
  Interceptor.attach(Module.findExportByName(null, "dlopen"), {
    onEnter: function (args) {
      var filename = Memory.readCString(args[0]);
      var flags = args[1];
      console.log("dlopen: filename=" + filename + ", flags=" + flags);
    },
    onLeave: function (args) {
    }
  });

}

function waitForLibLoading(libraryName) {
  var isLibLoaded = false;

  hookCFunc();

  Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"), {
      onEnter: function (args) {
          var libPath = Memory.readCString(args[0]);
          var flags = args[1];
          var info = args[2];
          console.log("android_dlopen_ext: libPath=" + libPath + ", flags=" + flags + ", info=" + info);
          if (libPath.includes(libraryName)) {
            console.log("[+] Loading library " + libPath + "...");
            isLibLoaded = true;
          }
      },
      onLeave: function (args) {
          if (isLibLoaded) {
            processJniOnLoad(libraryName);

            // public static native void display(Application application);
            const nativeFuncName = "Java_com_aSIIoEMUzSX_fukjRx_Nzilsxr_DYphTcg"
            processNativeFunc(libraryName, nativeFuncName);

            isLibLoaded = false;
          }
      }
  });
}

Java.perform(function() {
  const libraryName = "libRehADGd.so";
  waitForLibLoading(libraryName);
});

输出

截图

（之前某次的）截图

log日志

➜  frida frida -U -f com.lift.filemanager.android -l hook_LiftFileManager.js
     ____
    / _  |   Frida 16.1.3 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Pixel 3 (id=91BX1VSA3)
Spawned `com.lift.filemanager.android`. Resuming main thread!
[Pixel 3::com.lift.filemanager.android ]-> open: path=/data/app/~~gJRGEMcdzVg-RT9VfCj4AA==/com.lift.filemanager.android-viAUZmvMdgKc2Zy2M8FibQ==/base.apk, oflags=0x80000
open: path=/data/misc/edxp_A2NLrKZb3PtmBqrf/cache/EdHooker_d80f73e34da17c301b40feab7995d5a6a0b56621.jar, oflags=0x0
open: path=/data/misc/edxp_A2NLrKZb3PtmBqrf/cache/EdHooker_d80f73e34da17c301b40feab7995d5a6a0b56621.jar, oflags=0x0
open: path=/proc/self/cmdline, oflags=0x80000
open: path=/data/app/~~gJRGEMcdzVg-RT9VfCj4AA==/com.lift.filemanager.android-viAUZmvMdgKc2Zy2M8FibQ==/base.apk, oflags=0x80000
open: path=/product/overlay/NavigationBarMode2Button/NavigationBarMode2ButtonOverlay.apk, oflags=0x80000
pthread_create: thread=0x7fe513f228, attr=0x7fe513f260, start_routine=0x6ddf1e6b3c, arg=0x6f4f35ffc0
clone: fn=0x707076fd0c, stack=0x6d6daf4cc0, flags=0x3d0f00, arg=0x6d6daf4cc0
pthread_create: thread=0x7fe513f258, attr=0x7fe513f290, start_routine=0x6ddf1e6b3c, arg=0x6f4f35ffc0
clone: fn=0x707076fd0c, stack=0x6d6daf4cc0, flags=0x3d0f00, arg=0x6d6daf4cc0
pthread_create: thread=0x7fe513f2a8, attr=0x7fe513f2e0, start_routine=0x6ddf1e6b3c, arg=0x6f4f35c820
clone: fn=0x707076fd0c, stack=0x6d6c9eacc0, flags=0x3d0f00, arg=0x6d6c9eacc0
pthread_create: thread=0x6d6c9ea3c8, attr=0x6d6c9ea400, start_routine=0x6ddf1e6b3c, arg=0x6f4f361b90
clone: fn=0x707076fd0c, stack=0x6d6b8e0cc0, flags=0x3d0f00, arg=0x6d6b8e0cc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/frc_1:565703110738:android:37ec4862ed1c78d044af8b_firebase_settings.xml, oflags=0x0
pthread_create: thread=0x7fe513f1e8, attr=0x7fe513f220, start_routine=0x6ddf1e6b3c, arg=0x6f4f365330
clone: fn=0x707076fd0c, stack=0x6d6a7d6cc0, flags=0x3d0f00, arg=0x6d6a7d6cc0
pthread_create: thread=0x6d6c9ea388, attr=0x6d6c9ea3c0, start_routine=0x6ddf1e6b3c, arg=0x6f4f366f00
clone: fn=0x707076fd0c, stack=0x6d6a8e0cc0, flags=0x3d0f00, arg=0x6d6a8e0cc0
pthread_create: thread=0x6d6c9ea388, attr=0x6d6c9ea3c0, start_routine=0x6ddf1e6b3c, arg=0x6f4f363760
clone: fn=0x707076fd0c, stack=0x6d6a6cccc0, flags=0x3d0f00, arg=0x6d6a6cccc0
pthread_create: thread=0x6d6c9ea388, attr=0x6d6c9ea3c0, start_routine=0x6ddf1e6b3c, arg=0x6f4f36c270
clone: fn=0x707076fd0c, stack=0x6d6a5c2cc0, flags=0x3d0f00, arg=0x6d6a5c2cc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.google.firebase.crashlytics.xml, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/frc_1:565703110738:android:37ec4862ed1c78d044af8b_firebase_defaults.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/frc_1:565703110738:android:37ec4862ed1c78d044af8b_firebase_fetch.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/frc_1:565703110738:android:37ec4862ed1c78d044af8b_firebase_activate.json, oflags=0x0
pthread_create: thread=0x7fe513f258, attr=0x7fe513f290, start_routine=0x6ddf1e6b3c, arg=0x6f4f36de40
pthread_create: thread=0x6d6daf4348, attr=0x6d6daf4380, start_routine=0x6ddf1e6b3c, arg=0x6f4f361b90
clone: fn=0x707076fd0c, stack=0x6d6b6e0cc0, flags=0x3d0f00, arg=0x6d6b6e0cc0
clone: fn=0x707076fd0c, stack=0x6d6b5d6cc0, flags=0x3d0f00, arg=0x6d6b5d6cc0
open: path=/proc/6929/timerslack_ns, oflags=0x88241
android_dlopen_ext: libPath=/data/user_de/0/com.google.android.gms/app_chimera/m/00000047/oat/arm64/DynamiteLoader.odex, flags=0x2, info=0x6d6daf3b58
open: path=/proc/6930/timerslack_ns, oflags=0x88241
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/00000047/oat/arm64/DynamiteLoader.vdex, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/.com.google.firebase.crashlytics.files.v2:com.lift.filemanager.android/com.crashlytics.settings.json, oflags=0x0
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/00000047/DynamiteLoader.apk, oflags=0x0
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/00000047/DynamiteLoader.apk, oflags=0x0
open: path=/apex/com.android.art/javalib/arm64/boot.art, oflags=0x0
open: path=/system/framework/arm64/boot-framework.art, oflags=0x0
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/00000047/oat/arm64/DynamiteLoader.art, oflags=0x0
pthread_create: thread=0x7fe513f1e8, attr=0x7fe513f220, start_routine=0x6ddf1e6b3c, arg=0x6f4f36a6a0
clone: fn=0x707076fd0c, stack=0x6d6b3bccc0, flags=0x3d0f00, arg=0x6d6b3bccc0
open: path=/proc/6931/timerslack_ns, oflags=0x88241
pthread_create: thread=0x7fe513f1f8, attr=0x7fe513f230, start_routine=0x6ddf1e6b3c, arg=0x6f4f368ad0
clone: fn=0x707076fd0c, stack=0x6d6b2b2cc0, flags=0x3d0f00, arg=0x6d6b2b2cc0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
pthread_create: thread=0x6d6b2b2408, attr=0x6d6b2b2440, start_routine=0x6ddf1e6b3c, arg=0x6f4f3715e0
clone: fn=0x707076fd0c, stack=0x6d6b1a8cc0, flags=0x3d0f00, arg=0x6d6b1a8cc0
pthread_create: thread=0x6d6b2b2598, attr=0x6d6b2b25d0, start_routine=0x6ddf1e6b3c, arg=0x6f4f36fa10
clone: fn=0x707076fd0c, stack=0x6d6b09ecc0, flags=0x3d0f00, arg=0x6d6b09ecc0
open: path=/proc/6933/timerslack_ns, oflags=0x88241
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
pthread_create: thread=0x7fe513f0f8, attr=0x7fe513f130, start_routine=0x6ddf1e6b3c, arg=0x6f4f374d80
clone: fn=0x707076fd0c, stack=0x6d6af94cc0, flags=0x3d0f00, arg=0x6d6af94cc0
pthread_create: thread=0x7fe513f508, attr=0x7fe513f540, start_routine=0x6ddf1e6b3c, arg=0x6f4f3731b0
clone: fn=0x707076fd0c, stack=0x6d6ae8acc0, flags=0x3d0f00, arg=0x6d6ae8acc0
open: path=/proc/meminfo, oflags=0x0
pthread_create: thread=0x6d6ae8a3b8, attr=0x6d6ae8a3f0, start_routine=0x6ddf1e6b3c, arg=0x6f4f376950
clone: fn=0x707076fd0c, stack=0x6d6ad80cc0, flags=0x3d0f00, arg=0x6d6ad80cc0
open: path=/data/app/~~H9XVwTH8sAvVL5p5cBHHzw==/com.google.android.gms-EalbGkD7CDLYvLNBylKTSQ==/base.apk, oflags=0x80000
pthread_create: thread=0x7fe513f808, attr=0x7fe513f840, start_routine=0x6ddf1e6b3c, arg=0x6f4f378520
clone: fn=0x707076fd0c, stack=0x6d6ac76cc0, flags=0x3d0f00, arg=0x6d6ac76cc0
open: path=/data/user/0/com.lift.filemanager.android/databases/com.google.android.datatransport.events, oflags=0xa0042
open: path=/data/app/~~H9XVwTH8sAvVL5p5cBHHzw==/com.google.android.gms-EalbGkD7CDLYvLNBylKTSQ==/split_config.xxhdpi.apk, oflags=0x80000
open: path=/data/app/~~H9XVwTH8sAvVL5p5cBHHzw==/com.google.android.gms-EalbGkD7CDLYvLNBylKTSQ==/split_config.zh.apk, oflags=0x80000
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.xml, oflags=0x0
pthread_create: thread=0x7fe513f3a8, attr=0x7fe513f3e0, start_routine=0x6ddf1e6b3c, arg=0x6f4f37a0f0
clone: fn=0x707076fd0c, stack=0x6d6ad80cc0, flags=0x3d0f00, arg=0x6d6ad80cc0
open: path=/data/user/0/com.lift.filemanager.android/files/.com.google.firebase.crashlytics.files.v2:com.lift.filemanager.android/open-sessions/64D0B857022700011AB6F3CB35D4C192/report, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/files/.com.google.firebase.crashlytics.files.v2:com.lift.filemanager.android/open-sessions/64D0B857022700011AB6F3CB35D4C192/start-time, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/files/.com.google.firebase.crashlytics.files.v2:com.lift.filemanager.android/initialization_marker, oflags=0xc2
android_dlopen_ext: libPath=/system/framework/oat/arm64/org.apache.http.legacy.odex, flags=0x2, info=0x6d6ac749a8
open: path=/data/user/0/com.lift.filemanager.android/no_backup/androidx.work.workdb, oflags=0xa0042
pthread_create: thread=0x7fe513f558, attr=0x7fe513f590, start_routine=0x6ddf1e6b3c, arg=0x6f4f376950
clone: fn=0x707076fd0c, stack=0x6d6a7d6cc0, flags=0x3d0f00, arg=0x6d6a7d6cc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.facebook.sdk.appEventPreferences.xml, oflags=0x0
android_dlopen_ext: libPath=/data/user_de/0/com.google.android.gms/app_chimera/m/0000004c/oat/arm64/MeasurementDynamite.odex, flags=0x2, info=0x6d6daf3838
open: path=/system/framework/oat/arm64/org.apache.http.legacy.vdex, oflags=0x0
open: path=/system/framework/org.apache.http.legacy.jar, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/no_backup/androidx.work.workdb-wal, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/no_backup/androidx.work.workdb-shm, oflags=0x80042
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/0000004c/oat/arm64/MeasurementDynamite.vdex, oflags=0x0
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/0000004c/MeasurementDynamite.apk, oflags=0x0
open: path=/system/framework/org.apache.http.legacy.jar, oflags=0x0
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/0000004c/MeasurementDynamite.apk, oflags=0x0
open: path=/apex/com.android.art/javalib/arm64/boot.art, oflags=0x0
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/0000004c/MeasurementDynamite.apk, oflags=0x80000
open: path=/system/framework/arm64/boot-framework.art, oflags=0x0
open: path=/system/framework/oat/arm64/org.apache.http.legacy.art, oflags=0x0
pthread_create: thread=0x7fe513f558, attr=0x7fe513f590, start_routine=0x6ddf1e6b3c, arg=0x6f4f376950
clone: fn=0x707076fd0c, stack=0x6d6a7d6cc0, flags=0x3d0f00, arg=0x6d6a7d6cc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.facebook.sdk.USER_SETTINGS.xml, oflags=0x0
android_dlopen_ext: libPath=/system/framework/oat/arm64/com.android.media.remotedisplay.odex, flags=0x2, info=0x6d6ac749a8
open: path=/data/user/0/com.lift.filemanager.android/no_backup/androidx.work.workdb, oflags=0xa0042
pthread_create: thread=0x7fe513f5f8, attr=0x7fe513f630, start_routine=0x6ddf1e6b3c, arg=0x6f4f376950
clone: fn=0x707076fd0c, stack=0x6d6b8e0cc0, flags=0x3d0f00, arg=0x6d6b8e0cc0
open: path=/data/user/0/com.lift.filemanager.android/no_backup/androidx.work.workdb-wal, oflags=0xa0042
open: path=/system/framework/oat/arm64/com.android.media.remotedisplay.vdex, oflags=0x0
open: path=/system/framework/com.android.media.remotedisplay.jar, oflags=0x0
open: path=/system/framework/com.android.media.remotedisplay.jar, oflags=0x0
open: path=/apex/com.android.art/javalib/arm64/boot.art, oflags=0x0
open: path=/system/framework/arm64/boot-framework.art, oflags=0x0
open: path=/system/framework/oat/arm64/com.android.media.remotedisplay.art, oflags=0x0
pthread_create: thread=0x6d6b8e01c8, attr=0x6d6b8e0200, start_routine=0x6ddf1e6b3c, arg=0x6f4f37bcc0
clone: fn=0x707076fd0c, stack=0x6d6a7d6cc0, flags=0x3d0f00, arg=0x6d6a7d6cc0
pthread_create: thread=0x7fe513f508, attr=0x7fe513f540, start_routine=0x6ddf1e6b3c, arg=0x6f4f381030
clone: fn=0x707076fd0c, stack=0x6d5ccb2cc0, flags=0x3d0f00, arg=0x6d5ccb2cc0
open: path=/dev/urandom, oflags=0x80000
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.facebook.internal.preferences.APP_GATEKEEPERS.xml, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/no_backup/androidx.work.workdb-wal, oflags=0xa0042
android_dlopen_ext: libPath=/system/framework/oat/arm64/com.android.location.provider.odex, flags=0x2, info=0x6d6ac749a8
pthread_create: thread=0x7fe513f5f8, attr=0x7fe513f630, start_routine=0x6ddf1e6b3c, arg=0x6f4f381030
clone: fn=0x707076fd0c, stack=0x6d6a7d6cc0, flags=0x3d0f00, arg=0x6d6a7d6cc0
pthread_create: thread=0x7fe513f658, attr=0x7fe513f690, start_routine=0x6ddf1e6b3c, arg=0x6f4f37bcc0
clone: fn=0x707076fd0c, stack=0x6d5ccb2cc0, flags=0x3d0f00, arg=0x6d5ccb2cc0
pthread_create: thread=0x7fe513f678, attr=0x7fe513f6b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f37d890
clone: fn=0x707076fd0c, stack=0x6d5aac4cc0, flags=0x3d0f00, arg=0x6d5aac4cc0
pthread_create: thread=0x6d5ccb24d8, attr=0x6d5ccb2510, start_routine=0x6ddf1e6b3c, arg=0x6f4f382c00
pthread_create: thread=0x7fe513f678, attr=0x7fe513f6b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f387f70
clone: fn=0x707076fd0c, stack=0x6d597bacc0, flags=0x3d0f00, arg=0x6d597bacc0
clone: fn=0x707076fd0c, stack=0x6d598c4cc0, flags=0x3d0f00, arg=0x6d598c4cc0
pthread_create: thread=0x7fe513f6b8, attr=0x7fe513f6f0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3863a0
clone: fn=0x707076fd0c, stack=0x6d566b0cc0, flags=0x3d0f00, arg=0x6d566b0cc0
open: path=/system/framework/oat/arm64/com.android.location.provider.vdex, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml, oflags=0x0
open: path=/system/framework/com.android.location.provider.jar, oflags=0x0
pthread_create: thread=0x6d566b03b8, attr=0x6d566b03f0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3847d0
open: path=/system/framework/com.android.location.provider.jar, oflags=0x0
clone: fn=0x707076fd0c, stack=0x6d555a6cc0, flags=0x3d0f00, arg=0x6d555a6cc0
pthread_create: thread=0x6d6ad805b8, attr=0x6d6ad805f0, start_routine=0x6ddf1e6b3c, arg=0x6f4f38d2e0
pthread_create: thread=0x7fe513f758, attr=0x7fe513f790, start_routine=0x6ddf1e6b3c, arg=0x6f4f38eeb0
open: path=/apex/com.android.art/javalib/arm64/boot.art, oflags=0x0
open: path=/system/framework/arm64/boot-framework.art, oflags=0x0
open: path=/system/framework/oat/arm64/com.android.location.provider.art, oflags=0x0
clone: fn=0x707076fd0c, stack=0x6d54392cc0, flags=0x3d0f00, arg=0x6d54392cc0
clone: fn=0x707076fd0c, stack=0x6d5449ccc0, flags=0x3d0f00, arg=0x6d5449ccc0
pthread_create: thread=0x6d566b0418, attr=0x6d566b0450, start_routine=0x6ddf1e6b3c, arg=0x6f4f390a80
clone: fn=0x707076fd0c, stack=0x6d598c4cc0, flags=0x3d0f00, arg=0x6d598c4cc0
open: path=/data/user/0/com.lift.filemanager.android/files/AppEventsLogger.persistedevents, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/LifeSharedPrefers.xml, oflags=0x0
android_dlopen_ext: libPath=/data/app/~~H9XVwTH8sAvVL5p5cBHHzw==/com.google.android.gms-EalbGkD7CDLYvLNBylKTSQ==/oat/arm64/base.odex, flags=0x2, info=0x6d6ac74b18
open: path=/data/app/~~H9XVwTH8sAvVL5p5cBHHzw==/com.google.android.gms-EalbGkD7CDLYvLNBylKTSQ==/oat/arm64/base.vdex, oflags=0x0
open: path=/data/app/~~H9XVwTH8sAvVL5p5cBHHzw==/com.google.android.gms-EalbGkD7CDLYvLNBylKTSQ==/base.apk, oflags=0x0
open: path=/data/app/~~H9XVwTH8sAvVL5p5cBHHzw==/com.google.android.gms-EalbGkD7CDLYvLNBylKTSQ==/base.apk, oflags=0x0
open: path=/apex/com.android.art/javalib/arm64/boot.art, oflags=0x0
open: path=/system/framework/arm64/boot-framework.art, oflags=0x0
open: path=/data/app/~~H9XVwTH8sAvVL5p5cBHHzw==/com.google.android.gms-EalbGkD7CDLYvLNBylKTSQ==/oat/arm64/base.art, oflags=0x0
pthread_create: thread=0x6d6ac764c8, attr=0x6d6ac76500, start_routine=0x6ddf1e6b3c, arg=0x6f4f38eeb0
clone: fn=0x707076fd0c, stack=0x6d533d0cc0, flags=0x3d0f00, arg=0x6d533d0cc0
open: path=/data/user/0/com.google.android.gms/shared_prefs/google_ads_flags.xml, oflags=0x0
open: path=/data/app/~~RbAu5LfZALdcOdiK1xs1uA==/com.google.android.trichromelibrary_579016631-9HB7aC3CI8mFFZlcY5ZSvA==/base.apk, oflags=0x0
pthread_create: thread=0x6d6daf3148, attr=0x6d6daf3180, start_routine=0x6ddf1e6b3c, arg=0x6f4f389b40
android_dlopen_ext: libPath=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/oat/arm64/base.odex, flags=0x2, info=0x7fe513d088
clone: fn=0x707076fd0c, stack=0x6d457b6cc0, flags=0x3d0f00, arg=0x6d457b6cc0
open: path=/proc/6959/timerslack_ns, oflags=0x88241
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/oat/arm64/base.vdex, oflags=0x0
pthread_create: thread=0x6d6b8e0048, attr=0x6d6b8e0080, start_routine=0x6ddf1e6b3c, arg=0x6f4f38b710
clone: fn=0x707076fd0c, stack=0x6d533d0cc0, flags=0x3d0f00, arg=0x6d533d0cc0
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/base.apk, oflags=0x0
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/base.apk, oflags=0x0
open: path=/apex/com.android.art/javalib/arm64/boot.art, oflags=0x0
open: path=/system/framework/arm64/boot-framework.art, oflags=0x0
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/oat/arm64/base.art, oflags=0x0
android_dlopen_ext: libPath=/data/user_de/0/com.google.android.gms/app_chimera/m/00000032/oat/arm64/dl-AdsFdrDynamite.integ_232400000100000.odex, flags=0x2, info=0x6d6ac75908
pthread_create: thread=0x6d457b5398, attr=0x6d457b53d0, start_routine=0x6ddf1e6b3c, arg=0x6f4f38eeb0
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/00000032/oat/arm64/dl-AdsFdrDynamite.integ_232400000100000.vdex, oflags=0x0
clone: fn=0x707076fd0c, stack=0x6d435c7cc0, flags=0x3d0f00, arg=0x6d435c7cc0
open: path=/proc/6961/timerslack_ns, oflags=0x88241
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.google.android.gms.measurement.prefs.xml, oflags=0x0
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/base.apk, oflags=0x80000
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/00000032/dl-AdsFdrDynamite.integ_232400000100000.apk, oflags=0x0
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/split_config.zh.apk, oflags=0x80000
open: path=/data/app/~~RbAu5LfZALdcOdiK1xs1uA==/com.google.android.trichromelibrary_579016631-9HB7aC3CI8mFFZlcY5ZSvA==/base.apk, oflags=0x80000
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/00000032/dl-AdsFdrDynamite.integ_232400000100000.apk, oflags=0x0
open: path=/apex/com.android.art/javalib/arm64/boot.art, oflags=0x0
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/base.apk, oflags=0x80000
open: path=/system/framework/arm64/boot-framework.art, oflags=0x0
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/00000032/oat/arm64/dl-AdsFdrDynamite.integ_232400000100000.art, oflags=0x0
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/split_config.zh.apk, oflags=0x80000
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/split_weblayer.apk, oflags=0x80000
open: path=/data/app/~~RbAu5LfZALdcOdiK1xs1uA==/com.google.android.trichromelibrary_579016631-9HB7aC3CI8mFFZlcY5ZSvA==/base.apk, oflags=0x80000
android_dlopen_ext: libPath=libmonochrome.so, flags=0x2, info=0x7fe513ec70
open: path=/data/user_de/0/com.google.android.gms/app_chimera/m/00000032/dl-AdsFdrDynamite.integ_232400000100000.apk, oflags=0x80000
pthread_create: thread=0x6d457b5718, attr=0x6d457b5750, start_routine=0x6ddf1e6b3c, arg=0x6f4f392650
clone: fn=0x707076fd0c, stack=0x6d4308fcc0, flags=0x3d0f00, arg=0x6d4308fcc0
open: path=/proc/6962/timerslack_ns, oflags=0x88241
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
pthread_create: thread=0x7fe513ddb8, attr=0x7fe513ddf0, start_routine=0x6ddf1e6b3c, arg=0x6f4f382c00
clone: fn=0x707076fd0c, stack=0x6d6ac76cc0, flags=0x3d0f00, arg=0x6d6ac76cc0
pthread_create: thread=0x7fe513dac8, attr=0x7fe513db00, start_routine=0x6ddf1e6b3c, arg=0x6f4f38eeb0
clone: fn=0x707076fd0c, stack=0x6d6ac76cc0, flags=0x3d0f00, arg=0x6d6ac76cc0
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/lib/arm64/libmonochrome.so, oflags=0x0
open: path=/proc/6964/timerslack_ns, oflags=0x88241
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/base.apk, oflags=0x80000
android_dlopen_ext: libPath=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/base.apk!/lib/arm64-v8a/libmonochrome.so, flags=0x2, info=0x7fe513d860
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/lib/arm64/libwebviewchromium_plat_support.so, oflags=0x0
open: path=/data/app/~~RbAu5LfZALdcOdiK1xs1uA==/com.google.android.trichromelibrary_579016631-9HB7aC3CI8mFFZlcY5ZSvA==/base.apk, oflags=0x80000
open: path=/system/lib64/libwebviewchromium_plat_support.so, oflags=0x0
android_dlopen_ext: libPath=/system/lib64/libwebviewchromium_plat_support.so, flags=0x2, info=0x7fe513d9b0
pthread_create: thread=0x7fe513dbd8, attr=0x7fe513dc10, start_routine=0x6ddf1e6b3c, arg=0x6f4f382c00
clone: fn=0x707076fd0c, stack=0x6d43e7ecc0, flags=0x3d0f00, arg=0x6d43e7ecc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/WebViewChromiumPrefs.xml, oflags=0x0
pthread_create: thread=0x7fe513ddf8, attr=0x7fe513de30, start_routine=0x6ddf1e6b3c, arg=0x6f4f382c00
clone: fn=0x707076fd0c, stack=0x6d43e7ecc0, flags=0x3d0f00, arg=0x6d43e7ecc0
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/base.apk, oflags=0x80000
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/split_config.zh.apk, oflags=0x80000
open: path=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/split_weblayer.apk, oflags=0x80000
open: path=/product/overlay/NavigationBarMode2Button/NavigationBarMode2ButtonOverlay.apk, oflags=0x80000
open: path=/proc/meminfo, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/app_webview/webview_data.lock, oflags=0x42
pthread_create: thread=0x7fe513e008, attr=0x7fe513e040, start_routine=0x6ddf1e6b3c, arg=0x6f4f378520
clone: fn=0x707076fd0c, stack=0x6d43e7ecc0, flags=0x3d0f00, arg=0x6d43e7ecc0
pthread_create: thread=0x7fe513e988, attr=0x7fe513e9c0, start_routine=0x6ddf1e6b3c, arg=0x6f4f394220
clone: fn=0x707076fd0c, stack=0x6d43d74cc0, flags=0x3d0f00, arg=0x6d43d74cc0
open: path=/proc/6968/timerslack_ns, oflags=0x88241
pthread_create: thread=0x6d43d744f8, attr=0x6d43d74530, start_routine=0x6ddf1e6b3c, arg=0x6f4f382c00
clone: fn=0x707076fd0c, stack=0x6d416fbcc0, flags=0x3d0f00, arg=0x6d416fbcc0
open: path=/proc/self/stat, oflags=0x80000
open: path=/proc/6969/timerslack_ns, oflags=0x88241
open: path=/proc/cpuinfo, oflags=0x80000
dlopen: filename=/data/app/~~ebf6Ooj8iz0WmmF2AEomWw==/com.google.android.webview-bGRQSGrklU6ssg_JAwBwSQ==/base.apk!/lib/arm64-v8a/libmonochrome.so, flags=0x5
sigaction: signum=0x6, actP=0x7fe513e408, oldactP=0x2002c40a8
sigaction: signum=0x7, actP=0x7fe513e408, oldactP=0x2002c40c8
sigaction: signum=0x8, actP=0x7fe513e408, oldactP=0x2002c40e8
sigaction: signum=0x4, actP=0x7fe513e408, oldactP=0x2002c4068
sigaction: signum=0xb, actP=0x7fe513e408, oldactP=0x2002c4148
sigaction: signum=0x1f, actP=0x7fe513e408, oldactP=0x2002c43c8
sigaction: signum=0x5, actP=0x7fe513e408, oldactP=0x2002c4088
open: path=/data/user/0/com.lift.filemanager.android/app_webview/pref_store, oflags=0x80000
open: path=/proc/cpuinfo, oflags=0x0
open: path=/proc/cpuinfo, oflags=0x0
open: path=/sys/devices/system/cpu/present, oflags=0x0
open: path=/sys/devices/system/cpu/possible, oflags=0x0
dlopen: filename=libc.so, flags=0x2
open: path=/data/user/0/com.lift.filemanager.android/app_webview/BrowserMetrics/BrowserMetrics-64D0B857-1AB6.pma, oflags=0x2
pthread_create: thread=0x7fe513e598, attr=0x7fe513e6e0, start_routine=0x6d83f30904, arg=0x2003b7ea0
clone: fn=0x707076fd0c, stack=0x6d41187cc0, flags=0x3d0f00, arg=0x6d41187cc0
pthread_create: thread=0x7fe513e408, attr=0x7fe513e550, start_routine=0x6d83f30904, arg=0x2003b7da0
clone: fn=0x707076fd0c, stack=0x6d41089cc0, flags=0x3d0f00, arg=0x6d41089cc0
pthread_create: thread=0x6d41089758, attr=0x6d410898a0, start_routine=0x6d83f30904, arg=0x2003b7a60
clone: fn=0x707076fd0c, stack=0x6d3be70cc0, flags=0x3d0f00, arg=0x6d3be70cc0
open: path=/proc/6838/stat, oflags=0x80000
pthread_create: thread=0x6d3be70758, attr=0x6d3be708a0, start_routine=0x6d83f30904, arg=0x2003b77a0
clone: fn=0x707076fd0c, stack=0x6d3ad42cc0, flags=0x3d0f00, arg=0x6d3ad42cc0
open: path=/proc/6838/stat, oflags=0x80000
open: path=/proc/6838/task/6838/stat, oflags=0x80000
open: path=/proc/6838/task/6848/stat, oflags=0x80000
open: path=/proc/6838/task/6849/stat, oflags=0x80000
open: path=/proc/6838/task/6851/stat, oflags=0x80000
open: path=/proc/6838/task/6852/stat, oflags=0x80000
open: path=/proc/6838/task/6853/stat, oflags=0x80000
open: path=/proc/6838/task/6854/stat, oflags=0x80000
pthread_create: thread=0x6d3ad42758, attr=0x6d3ad428a0, start_routine=0x6d83f30904, arg=0x2003b7620
open: path=/proc/6838/task/6855/stat, oflags=0x80000
clone: fn=0x707076fd0c, stack=0x6d39c14cc0, flags=0x3d0f00, arg=0x6d39c14cc0
open: path=/proc/6838/task/6892/stat, oflags=0x80000
open: path=/proc/6838/task/6893/stat, oflags=0x80000
open: path=/proc/6838/task/6894/stat, oflags=0x80000
open: path=/proc/6838/task/6895/stat, oflags=0x80000
open: path=/proc/6838/task/6896/stat, oflags=0x80000
open: path=/proc/6838/task/6897/stat, oflags=0x80000
open: path=/proc/6838/task/6898/stat, oflags=0x80000
open: path=/proc/6838/task/6899/stat, oflags=0x80000
open: path=/proc/6838/task/6900/stat, oflags=0x80000
open: path=/proc/6838/task/6901/stat, oflags=0x80000
open: path=/proc/6838/task/6917/stat, oflags=0x80000
open: path=/proc/6838/task/6918/stat, oflags=0x80000
open: path=/proc/6838/task/6919/stat, oflags=0x80000
open: path=/proc/6838/task/6920/stat, oflags=0x80000
open: path=/proc/6838/task/6922/stat, oflags=0x80000
open: path=/proc/6838/task/6923/stat, oflags=0x80000
open: path=/proc/6838/task/6926/stat, oflags=0x80000
open: path=/proc/6838/task/6927/stat, oflags=0x80000
open: path=/proc/6838/task/6928/stat, oflags=0x80000
open: path=/proc/6838/task/6929/stat, oflags=0x80000
open: path=/proc/6838/task/6930/stat, oflags=0x80000
open: path=/proc/6838/task/6931/stat, oflags=0x80000
open: path=/proc/6838/task/6932/stat, oflags=0x80000
open: path=/proc/6838/task/6933/stat, oflags=0x80000
pthread_create: thread=0x7fe513e558, attr=0x7fe513e6a0, start_routine=0x6d83f30904, arg=0x2003b7600
clone: fn=0x707076fd0c, stack=0x6d38b0dcc0, flags=0x3d0f00, arg=0x6d38b0dcc0
open: path=/proc/6838/task/6934/stat, oflags=0x80000
open: path=/proc/6838/task/6935/stat, oflags=0x80000
open: path=/proc/6838/task/6936/stat, oflags=0x80000
open: path=/proc/6838/task/6939/stat, oflags=0x80000
open: path=/proc/6838/task/6942/stat, oflags=0x80000
open: path=/proc/6838/task/6945/stat, oflags=0x80000
open: path=/proc/6838/task/6946/stat, oflags=0x80000
open: path=/proc/6838/task/6947/stat, oflags=0x80000
open: path=/proc/6838/task/6948/stat, oflags=0x80000
pthread_create: thread=0x7fe513e578, attr=0x7fe513e6c0, start_routine=0x6d83f30904, arg=0x2003b72e0
open: path=/proc/6838/task/6950/stat, oflags=0x80000
clone: fn=0x707076fd0c, stack=0x6d37a06cc0, flags=0x3d0f00, arg=0x6d37a06cc0
open: path=/proc/6838/task/6951/stat, oflags=0x80000
open: path=/proc/6838/task/6953/stat, oflags=0x80000
open: path=/proc/6838/task/6954/stat, oflags=0x80000
open: path=/proc/6838/task/6959/stat, oflags=0x80000
open: path=/proc/6838/task/6960/stat, oflags=0x80000
open: path=/proc/6838/task/6962/stat, oflags=0x80000
open: path=/proc/6838/task/6964/stat, oflags=0x80000
open: path=/proc/6838/task/6967/stat, oflags=0x80000
open: path=/proc/6838/task/6968/stat, oflags=0x80000
open: path=/proc/6838/task/6969/stat, oflags=0x80000
open: path=/proc/6838/task/6990/stat, oflags=0x80000
open: path=/proc/6838/task/6991/stat, oflags=0x80000
open: path=/proc/6838/task/6992/stat, oflags=0x80000
open: path=/sys/devices/system/cpu/cpu0/regs/identification/midr_el1, oflags=0x0
open: path=/proc/6838/task/6993/stat, oflags=0x80000
open: path=/proc/6838/task/6994/stat, oflags=0x80000
open: path=/proc/6838/task/6995/stat, oflags=0x80000
open: path=/proc/6838/task/6996/stat, oflags=0x80000
open: path=/sys/devices/system/cpu/cpu1/regs/identification/midr_el1, oflags=0x0
open: path=/sys/devices/system/cpu/cpu2/regs/identification/midr_el1, oflags=0x0
open: path=/sys/devices/system/cpu/cpu3/regs/identification/midr_el1, oflags=0x0
open: path=/sys/devices/system/cpu/cpu4/regs/identification/midr_el1, oflags=0x0
open: path=/sys/devices/system/cpu/cpu5/regs/identification/midr_el1, oflags=0x0
open: path=/sys/devices/system/cpu/cpu6/regs/identification/midr_el1, oflags=0x0
open: path=/sys/devices/system/cpu/cpu7/regs/identification/midr_el1, oflags=0x0
open: path=/sys/devices/system/cpu/cpu8/regs/identification/midr_el1, oflags=0x0
dlopen: filename=libandroid.so, flags=0x2
dlopen: filename=libmediandk.so, flags=0x2
dlopen: filename=libandroid.so, flags=0x2
pthread_create: thread=0x7fe513e988, attr=0x7fe513ead0, start_routine=0x6d83f30904, arg=0x6a0001ce40
clone: fn=0x707076fd0c, stack=0x6d368ffcc0, flags=0x3d0f00, arg=0x6d368ffcc0
open: path=/system/etc/hosts, oflags=0x80000
pthread_create: thread=0x7fe513e958, attr=0x7fe513eaa0, start_routine=0x6d83f30904, arg=0x6a0001cdc0
clone: fn=0x707076fd0c, stack=0x6d357f8cc0, flags=0x3d0f00, arg=0x6d357f8cc0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/font_unique_name_table.pb, oflags=0x0
dlopen: filename=libandroid.so, flags=0x2
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Preferences, oflags=0x80000
pthread_create: thread=0x7fe513e748, attr=0x7fe513e890, start_routine=0x6d83f30904, arg=0x6a0001d8a0
clone: fn=0x707076fd0c, stack=0x6d34698cc0, flags=0x3d0f00, arg=0x6d34698cc0
open: path=/data/data/com.lift.filemanager.android/app_webview/Default/Web Data, oflags=0xa8042
pthread_create: thread=0x7fe513dc68, attr=0x7fe513ddb0, start_routine=0x6d83f30904, arg=0x6a0001f680
clone: fn=0x707076fd0c, stack=0x6d33561cc0, flags=0x3d0f00, arg=0x6d33561cc0
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Local Storage/leveldb/LOG, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Local Storage/leveldb/LOCK, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Local Storage/leveldb/CURRENT, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Local Storage/leveldb/MANIFEST-000001, oflags=0x0
pthread_create: thread=0x7fe513e0b8, attr=0x7fe513e200, start_routine=0x6d83f30904, arg=0x6a0013fae0
clone: fn=0x707076fd0c, stack=0x6d32442cc0, flags=0x3d0f00, arg=0x6d32442cc0
pthread_create: thread=0x7fe513e0b8, attr=0x7fe513e200, start_routine=0x6d83f30904, arg=0x6a0013fb60
clone: fn=0x707076fd0c, stack=0x6d3133bcc0, flags=0x3d0f00, arg=0x6d3133bcc0
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Local Storage/leveldb/MANIFEST-000001, oflags=0x401
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Local Storage/leveldb/000003.log, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Local Storage/leveldb/000003.log, oflags=0x401
pthread_create: thread=0x7fe513e478, attr=0x7fe513e5c0, start_routine=0x6d83f30904, arg=0x6a0013eb40
clone: fn=0x707076fd0c, stack=0x6d30234cc0, flags=0x3d0f00, arg=0x6d30234cc0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Code Cache/js/index, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index, oflags=0xc1
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Code Cache/js/index, oflags=0xc1
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/the-real-index, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/the-real-index, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index, oflags=0x241
pthread_create: thread=0x7fe513ed08, attr=0x7fe513ed40, start_routine=0x6ddf1e6b3c, arg=0x6f4f39e900
clone: fn=0x707076fd0c, stack=0x6d2f12dcc0, flags=0x3d0f00, arg=0x6d2f12dcc0
pthread_create: thread=0x7fe513e618, attr=0x7fe513e650, start_routine=0x6ddf1e6b3c, arg=0x6f4f399590
clone: fn=0x707076fd0c, stack=0x6d2dfeacc0, flags=0x3d0f00, arg=0x6d2dfeacc0
pthread_create: thread=0x7fe513e848, attr=0x7fe513e990, start_routine=0x6d83f30904, arg=0x6a0013d820
clone: fn=0x707076fd0c, stack=0x6d2dfcacc0, flags=0x3d0f00, arg=0x6d2dfcacc0
pthread_create: thread=0x7fe513e048, attr=0x7fe513e080, start_routine=0x6ddf1e6b3c, arg=0x6f4f39cd30
clone: fn=0x707076fd0c, stack=0x6d2dec3cc0, flags=0x3d0f00, arg=0x6d2dec3cc0
open: path=/data/user/0/com.lift.filemanager.android/files/frc_1:565703110738:android:37ec4862ed1c78d044af8b_firebase_defaults.json, oflags=0x241
pthread_create: thread=0x6d6a6cc4c8, attr=0x6d6a6cc500, start_routine=0x6ddf1e6b3c, arg=0x6f4f3a04d0
clone: fn=0x707076fd0c, stack=0x6d2dd80cc0, flags=0x3d0f00, arg=0x6d2dd80cc0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
pthread_create: thread=0x7fe513f678, attr=0x7fe513f6b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3a20a0
clone: fn=0x707076fd0c, stack=0x6d2dc6dcc0, flags=0x3d0f00, arg=0x6d2dc6dcc0
pthread_create: thread=0x7fe513f678, attr=0x7fe513f6b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3a3c70
clone: fn=0x707076fd0c, stack=0x6d2db63cc0, flags=0x3d0f00, arg=0x6d2db63cc0
pthread_create: thread=0x7fe513f678, attr=0x7fe513f6b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3a7410
clone: fn=0x707076fd0c, stack=0x6d2da59cc0, flags=0x3d0f00, arg=0x6d2da59cc0
pthread_create: thread=0x7fe513f678, attr=0x7fe513f6b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3a8fe0
clone: fn=0x707076fd0c, stack=0x6d2d94fcc0, flags=0x3d0f00, arg=0x6d2d94fcc0
pthread_create: thread=0x7fe513f678, attr=0x7fe513f6b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3aabb0
clone: fn=0x707076fd0c, stack=0x6d2d833cc0, flags=0x3d0f00, arg=0x6d2d833cc0
pthread_create: thread=0x7fe513f678, attr=0x7fe513f6b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3ac780
clone: fn=0x707076fd0c, stack=0x6d2d729cc0, flags=0x3d0f00, arg=0x6d2d729cc0
pthread_create: thread=0x6d2db63448, attr=0x6d2db63480, start_routine=0x6ddf1e6b3c, arg=0x6f4f399590
open: path=/data/app/~~gJRGEMcdzVg-RT9VfCj4AA==/com.lift.filemanager.android-viAUZmvMdgKc2Zy2M8FibQ==/lib/arm64/libobjectbox-jni.so, oflags=0x0
android_dlopen_ext: libPath=/data/app/~~gJRGEMcdzVg-RT9VfCj4AA==/com.lift.filemanager.android-viAUZmvMdgKc2Zy2M8FibQ==/lib/arm64/libobjectbox-jni.so, flags=0x2, info=0x7fe513e700
clone: fn=0x707076fd0c, stack=0x6d2d5cbcc0, flags=0x3d0f00, arg=0x6d2d5cbcc0
open: path=/data/data/com.lift.filemanager.android/files/objectbox/objectbox/lock.mdb, oflags=0x80042
open: path=/data/data/com.lift.filemanager.android/files/objectbox/objectbox/data.mdb, oflags=0x42
open: path=/data/data/com.lift.filemanager.android/files/objectbox/objectbox/data.mdb, oflags=0x81001
open: path=/data/data/com.lift.filemanager.android/files/objectbox/objectbox/lock.mdb, oflags=0x80042
open: path=/data/data/com.lift.filemanager.android/files/objectbox/objectbox/data.mdb, oflags=0x42
open: path=/data/data/com.lift.filemanager.android/files/objectbox/objectbox/data.mdb, oflags=0x81001
pthread_create: thread=0x6d39c14758, attr=0x6d39c148a0, start_routine=0x6d83f30904, arg=0x6a0013d0a0
pthread_create: thread=0x7fe5143d18, attr=0x7fe5143e60, start_routine=0x6d83f30904, arg=0x6a0013eb20
clone: fn=0x707076fd0c, stack=0x6ce2ca4cc0, flags=0x3d0f00, arg=0x6ce2ca4cc0
clone: fn=0x707076fd0c, stack=0x6d2d045cc0, flags=0x3d0f00, arg=0x6d2d045cc0
pthread_create: thread=0x7fe5144dd8, attr=0x7fe5144de0, start_routine=0x707355dbf8, arg=0x6dff42da20
clone: fn=0x707076fd0c, stack=0x6ce0ba6cc0, flags=0x3d0f00, arg=0x6ce0ba6cc0
pthread_create: thread=0x7fe5144f40, attr=0x0, start_routine=0x706f43972c, arg=0x6def34cd10
clone: fn=0x707076fd0c, stack=0x6ce0aa8cc0, flags=0x3d0f00, arg=0x6ce0aa8cc0
pthread_create: thread=0x6ce0ba6ab8, attr=0x0, start_routine=0x7071af09a0, arg=0x6def347190
clone: fn=0x707076fd0c, stack=0x6ce0aa8cc0, flags=0x3d0f00, arg=0x6ce0aa8cc0
open: path=/data/vendor/gpu/esx_config_com.lift.filemanager.android.txt, oflags=0x0
open: path=/data/vendor/gpu/esx_config.txt, oflags=0x0
open: path=/data/misc/gpu/esx_config_com.lift.filemanager.android.txt, oflags=0x0
open: path=/data/misc/gpu/esx_config.txt, oflags=0x0
pthread_create: thread=0x7fe51448a8, attr=0x7fe51448e0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3aff20
clone: fn=0x707076fd0c, stack=0x6ce0aa8cc0, flags=0x3d0f00, arg=0x6ce0aa8cc0
pthread_create: thread=0x6ce0aa83a8, attr=0x6ce0aa83e0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3ae350
clone: fn=0x707076fd0c, stack=0x6ce099ecc0, flags=0x3d0f00, arg=0x6ce099ecc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.lift.filemanager.android_preferences.xml, oflags=0x0
pthread_create: thread=0x7fe51443c8, attr=0x7fe5144400, start_routine=0x6ddf1e6b3c, arg=0x6f4f3ae350
clone: fn=0x707076fd0c, stack=0x6cdffcdcc0, flags=0x3d0f00, arg=0x6cdffcdcc0
pthread_create: thread=0x6cdffcd3f8, attr=0x6cdffcd430, start_routine=0x6ddf1e6b3c, arg=0x6f4f3b1af0
clone: fn=0x707076fd0c, stack=0x6cdfec3cc0, flags=0x3d0f00, arg=0x6cdfec3cc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/admob.xml, oflags=0x0
pthread_create: thread=0x7fe5143858, attr=0x7fe5143890, start_routine=0x6ddf1e6b3c, arg=0x6f4f3b1af0
clone: fn=0x707076fd0c, stack=0x6cdfec3cc0, flags=0x3d0f00, arg=0x6cdfec3cc0
pthread_create: thread=0x6cdffcd488, attr=0x6cdffcd4c0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3b5290
clone: fn=0x707076fd0c, stack=0x6cdfdb9cc0, flags=0x3d0f00, arg=0x6cdfdb9cc0
pthread_create: thread=0x7fe51442e8, attr=0x7fe5144320, start_routine=0x6ddf1e6b3c, arg=0x6f4f3b8a30
clone: fn=0x707076fd0c, stack=0x6cdfcafcc0, flags=0x3d0f00, arg=0x6cdfcafcc0
open: path=/data/user/0/com.google.android.gms/shared_prefs/admob_user_agent.xml, oflags=0x0
pthread_create: thread=0x7fe5144368, attr=0x7fe51443a0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3b8a30
clone: fn=0x707076fd0c, stack=0x6cdfcafcc0, flags=0x3d0f00, arg=0x6cdfcafcc0
pthread_create: thread=0x7fe5144768, attr=0x7fe51447a0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3ba600
clone: fn=0x707076fd0c, stack=0x6cdfcafcc0, flags=0x3d0f00, arg=0x6cdfcafcc0
pthread_create: thread=0x7fe5144898, attr=0x7fe51448d0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3b6e60
clone: fn=0x707076fd0c, stack=0x6cdfba5cc0, flags=0x3d0f00, arg=0x6cdfba5cc0
pthread_create: thread=0x6cdffcd578, attr=0x6cdffcd5b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3bc1d0
clone: fn=0x707076fd0c, stack=0x6cd99aacc0, flags=0x3d0f00, arg=0x6cd99aacc0
pthread_create: thread=0x7fe5144898, attr=0x7fe51448d0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3bf970
clone: fn=0x707076fd0c, stack=0x6cd98a0cc0, flags=0x3d0f00, arg=0x6cd98a0cc0
pthread_create: thread=0x6cdffcd4f8, attr=0x6cdffcd530, start_routine=0x6ddf1e6b3c, arg=0x6f4f3bdda0
clone: fn=0x707076fd0c, stack=0x6cd6796cc0, flags=0x3d0f00, arg=0x6cd6796cc0
pthread_create: thread=0x6cdffcd3b8, attr=0x6cdffcd3f0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3c3110
clone: fn=0x707076fd0c, stack=0x6cd568ccc0, flags=0x3d0f00, arg=0x6cd568ccc0
pthread_create: thread=0x6cd568c3b8, attr=0x6cd568c3f0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3c1540
clone: fn=0x707076fd0c, stack=0x6cd4582cc0, flags=0x3d0f00, arg=0x6cd4582cc0
pthread_create: thread=0x7fe5142008, attr=0x7fe5142150, start_routine=0x6d83f30904, arg=0x6a0012bca0
clone: fn=0x707076fd0c, stack=0x6cd4542cc0, flags=0x3d0f00, arg=0x6cd4542cc0
pthread_create: thread=0x6cd45428b8, attr=0x6cd4542a00, start_routine=0x6d83f30904, arg=0x6a0012afe0
clone: fn=0x707076fd0c, stack=0x6cd4444cc0, flags=0x3d0f00, arg=0x6cd4444cc0
dlopen: filename=libGLESv2.so, flags=0x1
dlopen: filename=libEGL.so, flags=0x1
dlopen: filename=libEGL_adreno.so, flags=0x2
pthread_create: thread=0x7fe51449b8, attr=0x7fe51449f0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3c8480
clone: fn=0x707076fd0c, stack=0x6cd42bdcc0, flags=0x3d0f00, arg=0x6cd42bdcc0
open: path=/data/user/0/com.lift.filemanager.android/files/frc_1:565703110738:android:37ec4862ed1c78d044af8b_firebase_defaults.json, oflags=0x241
android_dlopen_ext: libPath=/vendor/lib64/hw/gralloc.sdm845.so, flags=0x2, info=0x6cd453e048
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/vendor/gpu/esx_config_com.lift.filemanager.android.txt, oflags=0x0
open: path=/data/vendor/gpu/esx_config.txt, oflags=0x0
open: path=/data/misc/gpu/esx_config_com.lift.filemanager.android.txt, oflags=0x0
open: path=/data/misc/gpu/esx_config.txt, oflags=0x0
pthread_create: thread=0x7fe5144c58, attr=0x7fe5144c90, start_routine=0x6ddf1e6b3c, arg=0x6f4f3ca050
clone: fn=0x707076fd0c, stack=0x6cd40fccc0, flags=0x3d0f00, arg=0x6cd40fccc0
open: path=./adreno_config.txt, oflags=0x0
open: path=/data/vendor/gpu//adreno_config.txt, oflags=0x0
open: path=/data/misc/gpu//adreno_config.txt, oflags=0x0
pthread_create: thread=0x6ce0aa7b08, attr=0x6ce0aa7b40, start_routine=0x6ddf1e6b3c, arg=0x6f4f3cd7f0
clone: fn=0x707076fd0c, stack=0x6cd3ff2cc0, flags=0x3d0f00, arg=0x6cd3ff2cc0
open: path=./yamato_panel.txt, oflags=0x0
open: path=/data/vendor/gpu//yamato_panel.txt, oflags=0x0
open: path=/data/misc/gpu//yamato_panel.txt, oflags=0x0
open: path=/data/vendor/gpu/esx_config_com.lift.filemanager.android.txt, oflags=0x0
open: path=/data/vendor/gpu/esx_config.txt, oflags=0x0
open: path=/data/misc/gpu/esx_config_com.lift.filemanager.android.txt, oflags=0x0
open: path=/data/misc/gpu/esx_config.txt, oflags=0x0
open: path=/data/vendor/gpu/esx_config_com.lift.filemanager.android.txt, oflags=0x0
open: path=/data/vendor/gpu/esx_config.txt, oflags=0x0
open: path=/data/misc/gpu/esx_config_com.lift.filemanager.android.txt, oflags=0x0
open: path=/data/misc/gpu/esx_config.txt, oflags=0x0
open: path=/sys/devices/system/cpu/present, oflags=0x0
open: path=/sys/devices/system/cpu/cpu0/cpu_capacity, oflags=0x0
open: path=/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq, oflags=0x0
open: path=/sys/devices/system/cpu/cpu1/cpufreq/cpuinfo_max_freq, oflags=0x0
open: path=/sys/devices/system/cpu/cpu2/cpufreq/cpuinfo_max_freq, oflags=0x0
open: path=/sys/devices/system/cpu/cpu3/cpufreq/cpuinfo_max_freq, oflags=0x0
open: path=/sys/devices/system/cpu/cpu4/cpufreq/cpuinfo_max_freq, oflags=0x0
open: path=/sys/devices/system/cpu/cpu5/cpufreq/cpuinfo_max_freq, oflags=0x0
open: path=/sys/devices/system/cpu/cpu6/cpufreq/cpuinfo_max_freq, oflags=0x0
open: path=/sys/devices/system/cpu/cpu7/cpufreq/cpuinfo_max_freq, oflags=0x0
open: path=/sys/class/kgsl/kgsl-3d0/gpu_model, oflags=0x0
dlopen: filename=libGLESv2_adreno.so, flags=0x2
dlopen: filename=libGLESv1_CM_adreno.so, flags=0x2
open: path=/data/data/com.lift.filemanager.android/app_webview/Default/Cookies, oflags=0xa8042
open: path=/data/data/com.lift.filemanager.android/app_webview/Default/Cookies, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/index, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/index-dir/the-real-index, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/3804ac0efe04121c_0, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/3804ac0efe04121c_1, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/3804ac0efe04121c_s, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/LOCK, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/LOG, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/LOCK, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/LOCK, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/MANIFEST-000001, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage, oflags=0x0
open: path=/data/user_de/0/com.lift.filemanager.android/code_cache/com.android.skia.shaders_cache, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/000001.dbtmp, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/CURRENT, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/MANIFEST-000001, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/MANIFEST-000001, oflags=0x401
open: path=/data/user/0/com.lift.filemanager.android/app_webview/Default/Session Storage/000003.log, oflags=0x241
android_dlopen_ext: libPath=/vendor/lib64/hw/android.hardware.graphics.mapper@2.0-impl-qti-display.so, flags=0x1, info=0x6ce0ba5fc8
dlopen: filename=libadreno_utils.so, flags=0x2
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/.com.google.Chrome.syx3nP, oflags=0xc2
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/.com.google.Chrome.syx3nP, oflags=0x242
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.lift.filemanager.android_preferences.xml, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.google.android.gms.measurement.prefs.xml, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/app_webview/.com.google.Chrome.glOOwN, oflags=0xc2
open: path=/data/user/0/com.lift.filemanager.android/files/AppEventsLogger.persistedevents, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/.com.google.firebase.crashlytics.files.v2:com.lift.filemanager.android/open-sessions/64D0B857022700011AB6F3CB35D4C192/userlog.tmp, oflags=0x42
pthread_create: thread=0x6d3be6fbe8, attr=0x6d3be6fc20, start_routine=0x6ddf1e6b3c, arg=0x6f4f3cbc20
clone: fn=0x707076fd0c, stack=0x6cd3ae1cc0, flags=0x3d0f00, arg=0x6cd3ae1cc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/AwOriginVisitLoggerPrefs.xml, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/.com.google.firebase.crashlytics.files.v2:com.lift.filemanager.android/open-sessions/64D0B857022700011AB6F3CB35D4C192/userlog, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
pthread_create: thread=0x6d598c3368, attr=0x6d598c33a0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3cbc20
clone: fn=0x707076fd0c, stack=0x6cd3997cc0, flags=0x3d0f00, arg=0x6cd3997cc0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
pthread_create: thread=0x6d38b0c3b8, attr=0x6d38b0c3f0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3cbc20
clone: fn=0x707076fd0c, stack=0x6cd3957cc0, flags=0x3d0f00, arg=0x6cd3957cc0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/fbf7ad96532b1f6f_0, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/fbf7ad96532b1f6f_1, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/fbf7ad96532b1f6f_s, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
pthread_create: thread=0x7fe5144238, attr=0x7fe5144270, start_routine=0x6ddf1e6b3c, arg=0x6f4f3d6300
clone: fn=0x707076fd0c, stack=0x6cd37edcc0, flags=0x3d0f00, arg=0x6cd37edcc0
pthread_create: thread=0x6d2f12d308, attr=0x6d2f12d340, start_routine=0x6ddf1e6b3c, arg=0x6f4f3d7ed0
clone: fn=0x707076fd0c, stack=0x6cd36e3cc0, flags=0x3d0f00, arg=0x6cd36e3cc0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/47dd006ca3dbb334_0, oflags=0xc2
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/misc/keychain/pubkey_blacklist.txt, oflags=0x0
open: path=/data/misc/keychain/serial_blacklist.txt, oflags=0x0
open: path=/system/etc/security/cacerts/f013ecaf.0, oflags=0x0
open: path=/system/etc/security/cacerts/f013ecaf.0, oflags=0x0
pthread_create: thread=0x7fe5144f08, attr=0x7fe5144f40, start_routine=0x6ddf1e6b3c, arg=0x6f4f3d2b60
clone: fn=0x707076fd0c, stack=0x6cd35a0cc0, flags=0x3d0f00, arg=0x6cd35a0cc0
pthread_create: thread=0x6dcb829768, attr=0x6dcb829770, start_routine=0x707355dbf8, arg=0x6dff40a9b0
clone: fn=0x707076fd0c, stack=0x6d435c7cc0, flags=0x3d0f00, arg=0x6d435c7cc0
open: path=/data/user/0/com.lift.filemanager.android/app_webview/BrowserMetrics-spare.pma.tmp, oflags=0x242
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/app_webview/.com.google.Chrome.XGSwvA, oflags=0xc2
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
pthread_create: thread=0x6ce0ba6ab8, attr=0x0, start_routine=0x7071af09a0, arg=0x6def33c0b0
clone: fn=0x707076fd0c, stack=0x6dcf04bcc0, flags=0x3d0f00, arg=0x6dcf04bcc0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
pthread_create: thread=0x7fe5143638, attr=0x7fe5143670, start_routine=0x6ddf1e6b3c, arg=0x6f4f3b6e60
clone: fn=0x707076fd0c, stack=0x6dcee9fcc0, flags=0x3d0f00, arg=0x6dcee9fcc0
pthread_create: thread=0x6cdfdb9428, attr=0x6cdfdb9460, start_routine=0x6ddf1e6b3c, arg=0x6f4f33ef50
clone: fn=0x707076fd0c, stack=0x6dcdd95cc0, flags=0x3d0f00, arg=0x6dcdd95cc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/pcvmspf.xml, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.lift.filemanager.android_preferences.xml, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/com.google.android.gms.measurement.prefs.xml, oflags=0x241
pthread_create: thread=0x6cdfdb9438, attr=0x6cdfdb9470, start_routine=0x6ddf1e6b3c, arg=0x6f4f3ca050
clone: fn=0x707076fd0c, stack=0x6dcdd95cc0, flags=0x3d0f00, arg=0x6dcdd95cc0
pthread_create: thread=0x6dcdd955c8, attr=0x6dcdd95600, start_routine=0x6ddf1e6b3c, arg=0x6f4f3bf970
clone: fn=0x707076fd0c, stack=0x6dccc8bcc0, flags=0x3d0f00, arg=0x6dccc8bcc0
pthread_create: thread=0x6cdfdb9278, attr=0x6cdfdb92b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3bc1d0
clone: fn=0x707076fd0c, stack=0x6dccb81cc0, flags=0x3d0f00, arg=0x6dccb81cc0
pthread_create: thread=0x7fe5143418, attr=0x7fe5143450, start_routine=0x6ddf1e6b3c, arg=0x6f4f33ef50
clone: fn=0x707076fd0c, stack=0x6dcca77cc0, flags=0x3d0f00, arg=0x6dcca77cc0
pthread_create: thread=0x6cdfdb9278, attr=0x6cdfdb92b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f33b7b0
clone: fn=0x707076fd0c, stack=0x6dcc96dcc0, flags=0x3d0f00, arg=0x6dcc96dcc0
open: path=/data/user/0/com.lift.filemanager.android/app_pccache/5/AC7BC3562A445BE6E17CD85D775DF427D4C01AD8/pcam.jar, oflags=0x0
pthread_create: thread=0x7fe5143318, attr=0x7fe5143350, start_routine=0x6ddf1e6b3c, arg=0x6f4f3b8a30
clone: fn=0x707076fd0c, stack=0x6dcc7cccc0, flags=0x3d0f00, arg=0x6dcc7cccc0
pthread_create: thread=0x7fe5143318, attr=0x7fe5143350, start_routine=0x6ddf1e6b3c, arg=0x6f4f340b20
open: path=/proc/7411/timerslack_ns, oflags=0x88241
open: path=/data/user/0/com.lift.filemanager.android/app_pccache/5/AC7BC3562A445BE6E17CD85D775DF427D4C01AD8/pcam.jar, oflags=0x0
clone: fn=0x707076fd0c, stack=0x6dcc6c2cc0, flags=0x3d0f00, arg=0x6dcc6c2cc0
pthread_create: thread=0x7fe5143318, attr=0x7fe5143350, start_routine=0x6ddf1e6b3c, arg=0x6f4f338010
clone: fn=0x707076fd0c, stack=0x6dcc5afcc0, flags=0x3d0f00, arg=0x6dcc5afcc0
open: path=/proc/7412/timerslack_ns, oflags=0x88241
pthread_create: thread=0x7fe5143318, attr=0x7fe5143350, start_routine=0x6ddf1e6b3c, arg=0x6f4f3863a0
open: path=/data/user/0/com.lift.filemanager.android/app_pccache/5/AC7BC3562A445BE6E17CD85D775DF427D4C01AD8/pcam.jar, oflags=0x0
open: path=/proc/7413/timerslack_ns, oflags=0x88241
clone: fn=0x707076fd0c, stack=0x6dcc46ccc0, flags=0x3d0f00, arg=0x6dcc46ccc0
pthread_create: thread=0x7fe5143318, attr=0x7fe5143350, start_routine=0x6ddf1e6b3c, arg=0x6f4f37d890
open: path=/data/user/0/com.lift.filemanager.android/cache/volley/-1207530946-547165462, oflags=0x0
clone: fn=0x707076fd0c, stack=0x6d5aac4cc0, flags=0x3d0f00, arg=0x6d5aac4cc0
open: path=/proc/7415/timerslack_ns, oflags=0x88241
open: path=/proc/7414/timerslack_ns, oflags=0x88241
pthread_create: thread=0x7fe5143728, attr=0x7fe5143760, start_routine=0x6ddf1e6b3c, arg=0x6f4f3dd240
open: path=/data/user/0/com.lift.filemanager.android/cache/volley/715414548-394311354, oflags=0x0
clone: fn=0x707076fd0c, stack=0x6d587bacc0, flags=0x3d0f00, arg=0x6d587bacc0
open: path=/data/user/0/com.lift.filemanager.android/app_pccache/5/AC7BC3562A445BE6E17CD85D775DF427D4C01AD8/oat/pcam.jar.cur.prof, oflags=0xc2
open: path=/data/user/0/com.lift.filemanager.android/cache/volley/-1727183717-967741021, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/app_pccache/5/AC7BC3562A445BE6E17CD85D775DF427D4C01AD8/pcbc, oflags=0x0
pthread_create: thread=0x7fe5143668, attr=0x7fe51436a0, start_routine=0x6ddf1e6b3c, arg=0x6f4f387f70
clone: fn=0x707076fd0c, stack=0x6d556b0cc0, flags=0x3d0f00, arg=0x6d556b0cc0
pthread_create: thread=0x7fe5143668, attr=0x7fe51436a0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3d2b60
clone: fn=0x707076fd0c, stack=0x6d431a4cc0, flags=0x3d0f00, arg=0x6d431a4cc0
pthread_create: thread=0x7fe5143608, attr=0x7fe5143640, start_routine=0x6ddf1e6b3c, arg=0x6f4f3dee10
clone: fn=0x707076fd0c, stack=0x6cd99aacc0, flags=0x3d0f00, arg=0x6cd99aacc0
open: path=/data/app/~~gJRGEMcdzVg-RT9VfCj4AA==/com.lift.filemanager.android-viAUZmvMdgKc2Zy2M8FibQ==/base.apk, oflags=0x80000
pthread_create: thread=0x7fe5143668, attr=0x7fe51436a0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3db670
clone: fn=0x707076fd0c, stack=0x6cd98a0cc0, flags=0x3d0f00, arg=0x6cd98a0cc0
open: path=/data/user/0/com.lift.filemanager.android/app_pccache/5/AC7BC3562A445BE6E17CD85D775DF427D4C01AD8/pcam.jar, oflags=0x80000
pthread_create: thread=0x7fe51436a8, attr=0x7fe51436e0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3e25b0
clone: fn=0x707076fd0c, stack=0x6cd40fccc0, flags=0x3d0f00, arg=0x6cd40fccc0
pthread_create: thread=0x6cd98a02b8, attr=0x6cd98a02f0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3e5d50
clone: fn=0x707076fd0c, stack=0x6cc4000cc0, flags=0x3d0f00, arg=0x6cc4000cc0
pthread_create: thread=0x6cd40fc348, attr=0x6cd40fc380, start_routine=0x6ddf1e6b3c, arg=0x6f4f3e09e0
clone: fn=0x707076fd0c, stack=0x6cc2ef6cc0, flags=0x3d0f00, arg=0x6cc2ef6cc0
pthread_create: thread=0x7fe5143668, attr=0x7fe51436a0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3e4180
clone: fn=0x707076fd0c, stack=0x6cc1deccc0, flags=0x3d0f00, arg=0x6cc1deccc0
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/paid_storage_sp.xml, oflags=0x0
pthread_create: thread=0x7fe51435d8, attr=0x7fe5143610, start_routine=0x6ddf1e6b3c, arg=0x6f4f3eb0c0
clone: fn=0x707076fd0c, stack=0x6cc0ce2cc0, flags=0x3d0f00, arg=0x6cc0ce2cc0
android_dlopen_ext: libPath=/data/user/0/com.lift.filemanager.android/app_pccache/5/AC7BC3562A445BE6E17CD85D775DF427D4C01AD8/pcam.jar!/libd36668F50D9B1.so, flags=0x2, info=0x6cdfdb8030
pthread_create: thread=0x7fe5143738, attr=0x7fe5143770, start_routine=0x6ddf1e6b3c, arg=0x6f4f3e7920
clone: fn=0x707076fd0c, stack=0x6cc0bd8cc0, flags=0x3d0f00, arg=0x6cc0bd8cc0
pthread_create: thread=0x6cc0ce2418, attr=0x6cc0ce2450, start_routine=0x6ddf1e6b3c, arg=0x6f4f3ecc90
clone: fn=0x707076fd0c, stack=0x6cbfacecc0, flags=0x3d0f00, arg=0x6cbfacecc0
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/fb0a44f3e240ce58_0, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/fb0a44f3e240ce58_1, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/fb0a44f3e240ce58_s, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/shared_prefs/admob.xml, oflags=0x241
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/fbf7ad96532b1f6f_0, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/fbf7ad96532b1f6f_1, oflags=0x2
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/fbf7ad96532b1f6f_s, oflags=0x2
open: path=/proc/self/cmdline, oflags=0x80000
open: path=/proc/self/cmdline, oflags=0x80000
open: path=/proc/self/cmdline, oflags=0x80000
pthread_create: thread=0x6cc0ce1ec8, attr=0x6cc0ce1f00, start_routine=0x6ddf1e6b3c, arg=0x6f4f3ee860
clone: fn=0x707076fd0c, stack=0x6d81d3dcc0, flags=0x3d0f00, arg=0x6d81d3dcc0
pthread_create: thread=0x6cc1dec478, attr=0x6cc1dec4b0, start_routine=0x6ddf1e6b3c, arg=0x6f4f3f2000
clone: fn=0x707076fd0c, stack=0x6d81c33cc0, flags=0x3d0f00, arg=0x6d81c33cc0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
pthread_create: thread=0x7fe5143408, attr=0x7fe5143440, start_routine=0x6ddf1e6b3c, arg=0x6f4f3f3bd0
clone: fn=0x707076fd0c, stack=0x6d81929cc0, flags=0x3d0f00, arg=0x6d81929cc0
pthread_create: thread=0x6d556b0348, attr=0x6d556b0380, start_routine=0x6ddf1e6b3c, arg=0x6f4f3f0430
pthread_create: thread=0x7fe5143328, attr=0x7fe5143360, start_routine=0x6ddf1e6b3c, arg=0x6f4f3f57a0
clone: fn=0x707076fd0c, stack=0x6d8181fcc0, flags=0x3d0f00, arg=0x6d8181fcc0
clone: fn=0x707076fd0c, stack=0x6d81715cc0, flags=0x3d0f00, arg=0x6d81715cc0
pthread_create: thread=0x7fe51432c8, attr=0x7fe5143300, start_routine=0x6ddf1e6b3c, arg=0x6f4f3f7370
clone: fn=0x707076fd0c, stack=0x6d81b29cc0, flags=0x3d0f00, arg=0x6d81b29cc0
pthread_create: thread=0x6cd99aa418, attr=0x6cd99aa450, start_routine=0x6ddf1e6b3c, arg=0x6f4f3fc6e0
clone: fn=0x707076fd0c, stack=0x6d8160bcc0, flags=0x3d0f00, arg=0x6d8160bcc0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
pthread_create: thread=0x6d8181f418, attr=0x6d8181f450, start_routine=0x6ddf1e6b3c, arg=0x6f4f3f8f40
clone: fn=0x707076fd0c, stack=0x6d81501cc0, flags=0x3d0f00, arg=0x6d81501cc0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
pthread_create: thread=0x6cd99aa418, attr=0x6cd99aa450, start_routine=0x6ddf1e6b3c, arg=0x6f4f403620
clone: fn=0x707076fd0c, stack=0x6d813f7cc0, flags=0x3d0f00, arg=0x6d813f7cc0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
pthread_create: thread=0x6cdffcd418, attr=0x6cdffcd450, start_routine=0x6ddf1e6b3c, arg=0x6f4f3fe2b0
clone: fn=0x707076fd0c, stack=0x6d810edcc0, flags=0x3d0f00, arg=0x6d810edcc0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
pthread_create: thread=0x6d435c7768, attr=0x6d435c7770, start_routine=0x707355dbf8, arg=0x6dff43b5e0
clone: fn=0x707076fd0c, stack=0x6d812edcc0, flags=0x3d0f00, arg=0x6d812edcc0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/files/generatefid.lock, oflags=0x42
open: path=/data/user/0/com.lift.filemanager.android/files/PersistedInstallation.W0RFRkFVTFRd+MTo1NjU3MDMxMTA3Mzg6YW5kcm9pZDozN2VjNDg2MmVkMWM3OGQwNDRhZjhi.json, oflags=0x0
open: path=/data/user/0/com.lift.filemanager.android/databases/google_app_measurement_local.db, oflags=0xa0042
open: path=/data/user/0/com.lift.filemanager.android/app_webview/.com.google.Chrome.AIYA7r, oflags=0xc2
open: path=/dev/urandom, oflags=0x80000
open: path=/data/user/0/com.lift.filemanager.android/cache/WebView/Default/HTTP Cache/Cache_Data/index-dir/temp-index, oflags=0x241
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]-> pthread_create: thread=0x6dcb829768, attr=0x6dcb829770, start_routine=0x707355dbf8, arg=0x6dff411640
clone: fn=0x707076fd0c, stack=0x6d81b29cc0, flags=0x3d0f00, arg=0x6d81b29cc0
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]-> open: path=/data/misc/profiles/cur/0/com.lift.filemanager.android/primary.prof, oflags=0x88002
open: path=/data/user/0/com.lift.filemanager.android/app_pccache/5/AC7BC3562A445BE6E17CD85D775DF427D4C01AD8/oat/pcam.jar.cur.prof, oflags=0x88002
[Pixel 3::com.lift.filemanager.android ]->
[Pixel 3::com.lift.filemanager.android ]-> open: path=/data/user/0/com.lift.filemanager.android/files/AppEventsLogger.persistedevents, oflags=0x0

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-15 21:49:45

DisplayDemo

DisplayDemo

用frida-trace调试安卓app：com.example.displaydemo

命令

frida-trace -U -f com.example.displaydemo -I libdl.so -I liblog.so -I libtacker.so -i open -i openat -i dlopen

输出

截图

log日志

frida-trace -U -f com.example.displaydemo -I libdl.so -I liblog.so -I libtacker.so -i open -i openat -i dlopen

...

__android_log_buf_write: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/popupSDK_libtacker/dynamicDebug/frida/frida-trace/__handlers__/liblog.so/__android_log_buf_write.js"
__android_log_is_debuggable: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/popupSDK_libtacker/dynamicDebug/frida/frida-trace/__handlers__/liblog.so/__android_log_is_debuggable.js"
android_openEventTagMap: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/popupSDK_libtacker/dynamicDebug/frida/frida-trace/__handlers__/liblog.so/android_openEventTagMap.js"
open: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/popupSDK_libtacker/dynamicDebug/frida/frida-trace/__handlers__/libc.so/open.js"
openat: Loaded handler at "/Users/crifan/dev/dev_root/androidReverse/popupSDK_libtacker/dynamicDebug/frida/frida-trace/__handlers__/libc.so/openat.js"
Started tracing 82 functions. Press Ctrl+C to stop.
           /* TID 0x73a5 */
   628 ms  dlsym(handle=0x28d2598c92f4b5bd, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0")
   641 ms  dlsym(handle=0x28d2598c92f4b5bd, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0__JI")
   642 ms  dlsym(handle=0x18091f93b592f005, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0")
   642 ms  dlsym(handle=0x18091f93b592f005, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0__JI")
   642 ms  dlsym(handle=0xf61d9d184f5bd255, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0")
   642 ms  dlsym(handle=0xf61d9d184f5bd255, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0__JI")
   642 ms  dlsym(handle=0xf93963b9819f875f, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0")
   642 ms  dlsym(handle=0xf93963b9819f875f, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0__JI")
   642 ms  dlsym(handle=0xb6965c803b1ea0bf, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0")
   642 ms  dlsym(handle=0xb6965c803b1ea0bf, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0__JI")
   642 ms  dlsym(handle=0xf33483d7107b39b5, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0")
   642 ms  dlsym(handle=0xf33483d7107b39b5, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0__JI")
   642 ms  dlsym(handle=0x49a6c69ccf1943e5, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0")
   642 ms  dlsym(handle=0x49a6c69ccf1943e5, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0__JI")
   643 ms  dlsym(handle=0x12b477e61386e20d, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0")
   643 ms  dlsym(handle=0x12b477e61386e20d, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0__JI")
   643 ms  dlsym(handle=0x3cb81b9cf29f00eb, symbol="Java_sun_nio_fs_UnixNativeDispatcher_access0")
   646 ms  __android_log_buf_write()
   646 ms     | __android_log_is_loggable()
   646 ms     |    | __android_log_get_minimum_priority()
   646 ms     | __android_log_write_log_message()
   646 ms     |    | __android_log_logd_logger()
   646 ms     |    |    | __android_log_is_debuggable()
   647 ms  __android_log_buf_write()
   647 ms     | __android_log_is_loggable()
   647 ms     |    | __android_log_get_minimum_priority()
   647 ms     | __android_log_write_log_message()
   647 ms     |    | __android_log_logd_logger()
   647 ms     |    |    | __android_log_is_debuggable()
。。。
1 ms     |    |    | __android_log_is_debuggable()
   651 ms  open(path="/data/app/~~OyO-UMCLSaECmfJvvRSy1w==/com.example.displaydemo-EXz8U1Y8uB9h_Modc1C__Q==/base.apk", oflag=0x80000)
   657 ms  __android_log_buf_write()
。。。
   676 ms  open(path="/proc/self/cmdline", oflag=0x80000)
   679 ms  dl_iterate_phdr()
   679 ms  android_dlopen_ext()
   681 ms  dlsym(handle=0x6c3b15dbd25a16d1, symbol="oatdata")
   681 ms  dlsym(handle=0x6c3b15dbd25a16d1, symbol="oatlastword")
   681 ms  dlsym(handle=0x6c3b15dbd25a16d1, symbol="oatdatabimgrelro")
   681 ms  dlerror()
   681 ms  dlsym(handle=0x6c3b15dbd25a16d1, symbol="oatbss")
   681 ms  dlerror()
   681 ms  dlsym(handle=0x6c3b15dbd25a16d1, symbol="oatdex")
   681 ms  dlsym(handle=0x6c3b15dbd25a16d1, symbol="oatdexlastword")
   681 ms  dl_iterate_phdr()
   681 ms  open(path="/data/app/~~OyO-UMCLSaECmfJvvRSy1w==/com.example.displaydemo-EXz8U1Y8uB9h_Modc1C__Q==/oat/arm64/base.vdex", oflag=0x0)
   683 ms  open(path="/data/app/~~OyO-UMCLSaECmfJvvRSy1w==/com.example.displaydemo-EXz8U1Y8uB9h_Modc1C__Q==/base.apk", oflag=0x0)
   684 ms  open(path="/apex/com.android.art/javalib/arm64/boot.art", oflag=0x0)
   684 ms  open(path="/system/framework/arm64/boot-framework.art", oflag=0x0)
   684 ms  open(path="/data/app/~~OyO-UMCLSaECmfJvvRSy1w==/com.example.displaydemo-EXz8U1Y8uB9h_Modc1C__Q==/oat/arm64/base.art", oflag=0x0)
   702 ms  __android_log_buf_write()
   702 ms     | __android_log_is_loggable()
   702 ms     |    | __android_log_get_minimum_priority()
   702 ms     | __android_log_write_log_message()
   702 ms     |    | __android_log_logd_logger()
   702 ms     |    |    | __android_log_is_debuggable()
   703 ms  __android_log_buf_write()
   703 ms     | __android_log_is_loggable()
   703 ms     |    | __android_log_get_minimum_priority()
   703 ms     | __android_log_write_log_message()
   703 ms     |    | __android_log_logd_logger()
   703 ms     |    |    | __android_log_is_debuggable()
   704 ms  open(path="/data/app/~~OyO-UMCLSaECmfJvvRSy1w==/com.example.displaydemo-EXz8U1Y8uB9h_Modc1C__Q==/base.apk", oflag=0x80000)
   705 ms  open(path="/product/overlay/NavigationBarMode2Button/NavigationBarMode2ButtonOverlay.apk", oflag=0x80000)
   712 ms  __android_log_buf_write()
   712 ms     | __android_log_is_loggable()
   712 ms     |    | __android_log_get_minimum_priority()
   712 ms     | __android_log_write_log_message()
   712 ms     |    | __android_log_logd_logger()
   712 ms     |    |    | __android_log_is_debuggable()
   713 ms  __android_log_buf_write()
   713 ms     | __android_log_is_loggable()
   713 ms     |    | __android_log_get_minimum_priority()
   713 ms     | __android_log_write_log_message()
   713 ms     |    | __android_log_logd_logger()
   713 ms     |    |    | __android_log_is_debuggable()
   718 ms  __android_log_is_loggable()
   718 ms     | __android_log_get_minimum_priority()
           /* TID 0x73cb */
   739 ms  dlsym(handle=0x8473cc9900a85ecd, symbol="InitEsxProfile")
   739 ms  open(path="/data/vendor/gpu/esx_config_com.example.displaydemo.txt", oflag=0x0)
   739 ms  open(path="/data/vendor/gpu/esx_config.txt", oflag=0x0)
   739 ms  open(path="/data/misc/gpu/esx_config_com.example.displaydemo.txt", oflag=0x0)
   739 ms  open(path="/data/misc/gpu/esx_config.txt", oflag=0x0)
           /* TID 0x73a5 */
   752 ms  __android_log_buf_write()
   753 ms     | __android_log_is_loggable()
   753 ms     |    | __android_log_get_minimum_priority()
   753 ms     | __android_log_write_log_message()
   753 ms     |    | __android_log_logd_logger()
   753 ms     |    |    | __android_log_is_debuggable()
   769 ms  __cfi_slowpath()
   769 ms  __cfi_slowpath()
   783 ms  __cfi_slowpath()
。。。
   964 ms  dladdr(addr=0x6dc20f4b08, info=0x6d6dbfc760)
   964 ms  __android_log_print()
   964 ms     | __android_log_is_loggable()
   964 ms     |    | __android_log_get_minimum_priority()
   964 ms     | __android_log_write_log_message()
   964 ms     |    | __android_log_logd_logger()
   964 ms     |    |    | __android_log_is_debuggable()
   965 ms  android_dlopen_ext()
   965 ms  dlsym(handle=0xf4f687c6329daa95, symbol="HMI")
   966 ms  open(path="/data/vendor/gpu/esx_config_com.example.displaydemo.txt", oflag=0x0)
   966 ms  open(path="/data/vendor/gpu/esx_config.txt", oflag=0x0)
   966 ms  open(path="/data/misc/gpu/esx_config_com.example.displaydemo.txt", oflag=0x0)
   966 ms  open(path="/data/misc/gpu/esx_config.txt", oflag=0x0)
   966 ms  open(path="./adreno_config.txt", oflag=0x0)
   966 ms  open(path="/data/vendor/gpu//adreno_config.txt", oflag=0x0)
   966 ms  open(path="/data/misc/gpu//adreno_config.txt", oflag=0x0)
   966 ms  open(path="./yamato_panel.txt", oflag=0x0)
   966 ms  open(path="/data/vendor/gpu//yamato_panel.txt", oflag=0x0)
   966 ms  open(path="/data/misc/gpu//yamato_panel.txt", oflag=0x0)
   966 ms  open(path="/data/vendor/gpu/esx_config_com.example.displaydemo.txt", oflag=0x0)
   966 ms  open(path="/data/vendor/gpu/esx_config.txt", oflag=0x0)
   966 ms  open(path="/data/misc/gpu/esx_config_com.example.displaydemo.txt", oflag=0x0)
   967 ms  open(path="/data/misc/gpu/esx_config.txt", oflag=0x0)
   967 ms  __android_log_print()
   967 ms     | __android_log_is_loggable()
   967 ms     |    | __android_log_get_minimum_priority()
   967 ms     | __android_log_write_log_message()
   967 ms     |    | __android_log_logd_logger()
   967 ms     |    |    | __android_log_is_debuggable()
   967 ms  open(path="/data/vendor/gpu/esx_config_com.example.displaydemo.txt", oflag=0x0)
   967 ms  open(path="/data/vendor/gpu/esx_config.txt", oflag=0x0)
   967 ms  open(path="/data/misc/gpu/esx_config_com.example.displaydemo.txt", oflag=0x0)
   967 ms  open(path="/data/misc/gpu/esx_config.txt", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/present", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/cpu0/cpu_capacity", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/cpu1/cpufreq/cpuinfo_max_freq", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/cpu2/cpufreq/cpuinfo_max_freq", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/cpu3/cpufreq/cpuinfo_max_freq", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/cpu4/cpufreq/cpuinfo_max_freq", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/cpu5/cpufreq/cpuinfo_max_freq", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/cpu6/cpufreq/cpuinfo_max_freq", oflag=0x0)
   968 ms  open(path="/sys/devices/system/cpu/cpu7/cpufreq/cpuinfo_max_freq", oflag=0x0)
   969 ms  open(path="/sys/class/kgsl/kgsl-3d0/gpu_model", oflag=0x0)
   969 ms  __android_log_print()
   969 ms     | __android_log_is_loggable()
   969 ms     |    | __android_log_get_minimum_priority()
   969 ms     | __android_log_write_log_message()
   969 ms     |    | __android_log_logd_logger()
   969 ms     |    |    | __android_log_is_debuggable()
   969 ms  __android_log_print()
   969 ms     | __android_log_is_loggable()
   969 ms     |    | __android_log_get_minimum_priority()
   969 ms     | __android_log_write_log_message()
   969 ms     |    | __android_log_logd_logger()
   969 ms     |    |    | __android_log_is_debuggable()
   969 ms  dlopen(path="libEGL_adreno.so", mode=0x2)
   970 ms  dlsym(handle=0xf9e57fda79bd3c09, symbol="eglSetBlobCacheFuncsANDROID")
   971 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetStringi")
   971 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetStringi")
   971 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetStringi")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetStringi")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glMemoryBarrier")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glMemoryBarrier")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glBindVertexArray")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glBindVertexArray")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDeleteVertexArrays")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDeleteVertexArrays")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGenVertexArrays")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGenVertexArrays")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glPatchParameteri")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glPatchParameteri")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glBindFragDataLocationEXT")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glBindFragDataLocationEXT")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glBindFragDataLocationIndexedEXT")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glBindFragDataLocationIndexedEXT")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glBlendBarrierKHR")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glBlendBarrierKHR")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDrawArraysInstanced")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDrawArraysInstanced")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDrawElementsInstanced")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDrawElementsInstanced")
   972 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDrawBuffers")
   972 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDrawBuffers")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glReadBuffer")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glReadBuffer")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDrawArraysIndirect")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDrawArraysIndirect")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDrawElementsIndirect")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDrawElementsIndirect")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDrawRangeElements")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDrawRangeElements")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetMultisamplefv")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetMultisamplefv")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetTexLevelParameteriv")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetTexLevelParameteriv")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glTexBuffer")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glTexBuffer")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glTexBufferRange")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glTexBufferRange")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glTexStorage2D")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glTexStorage2D")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDiscardFramebufferEXT")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDiscardFramebufferEXT")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glEndTilingQCOM")
   973 ms  dlsym(handle=0x231259e63d1aef61, symbol="glEndTilingQCOM")
   973 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glStartTilingQCOM")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glStartTilingQCOM")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glVertexAttribDivisor")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glVertexAttribDivisor")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glVertexAttribIPointer")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glVertexAttribIPointer")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glBlitFramebuffer")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glBlitFramebuffer")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glRenderbufferStorageMultisample")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glRenderbufferStorageMultisample")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glFramebufferTexture2DMultisampleEXT")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glFramebufferTexture2DMultisampleEXT")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glRenderbufferStorageMultisampleEXT")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glRenderbufferStorageMultisampleEXT")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glUnmapBuffer")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glUnmapBuffer")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glFlushMappedBufferRange")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glFlushMappedBufferRange")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glMapBufferRange")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glMapBufferRange")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glInsertEventMarkerEXT")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glInsertEventMarkerEXT")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glPopGroupMarkerEXT")
   974 ms  dlsym(handle=0x231259e63d1aef61, symbol="glPopGroupMarkerEXT")
   974 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glPushGroupMarkerEXT")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glPushGroupMarkerEXT")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetProgramResourceLocation")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetProgramResourceLocation")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDebugMessageCallbackKHR")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDebugMessageCallbackKHR")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDebugMessageControlKHR")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDebugMessageControlKHR")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDebugMessageInsertKHR")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDebugMessageInsertKHR")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetDebugMessageLogKHR")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetDebugMessageLogKHR")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glObjectLabelKHR")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glObjectLabelKHR")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glPopDebugGroupKHR")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glPopDebugGroupKHR")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glPushDebugGroupKHR")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glPushDebugGroupKHR")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glClientWaitSync")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glClientWaitSync")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDeleteSync")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDeleteSync")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glFenceSync")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glFenceSync")
   975 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glIsSync")
   975 ms  dlsym(handle=0x231259e63d1aef61, symbol="glIsSync")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glWaitSync")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glWaitSync")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetInternalformativ")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetInternalformativ")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetProgramBinary")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetProgramBinary")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glProgramBinary")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glProgramBinary")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glProgramParameteri")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glProgramParameteri")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glBindSampler")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glBindSampler")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDeleteSamplers")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDeleteSamplers")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGenSamplers")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGenSamplers")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glSamplerParameteri")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glSamplerParameteri")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glSamplerParameteriv")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glSamplerParameteriv")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glBeginQuery")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glBeginQuery")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glDeleteQueries")
   976 ms  dlsym(handle=0x231259e63d1aef61, symbol="glDeleteQueries")
   976 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glEndQuery")
   977 ms  dlsym(handle=0x231259e63d1aef61, symbol="glEndQuery")
   977 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGenQueries")
   977 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGenQueries")
   977 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetQueryObjectuiv")
   977 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetQueryObjectuiv")
   977 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glGetQueryiv")
   977 ms  dlsym(handle=0x231259e63d1aef61, symbol="glGetQueryiv")
   977 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glInvalidateFramebuffer")
   977 ms  dlsym(handle=0x231259e63d1aef61, symbol="glInvalidateFramebuffer")
   977 ms  dlsym(handle=0x5dae32eb4dcc0329, symbol="glInvalidateSubFramebuffer")
   977 ms  dlsym(handle=0x231259e63d1aef61, symbol="glInvalidateSubFramebuffer")
   977 ms  open(path="/data/user_de/0/com.example.displaydemo/code_cache/com.android.skia.shaders_cache", oflag=0x0)
   990 ms  __android_log_print()
   990 ms     | __android_log_is_loggable()
   990 ms     |    | __android_log_get_minimum_priority()
   990 ms     | __android_log_write_log_message()
   990 ms     |    | __android_log_logd_logger()
   990 ms     |    |    | __android_log_is_debuggable()
   990 ms  __android_log_print()
   990 ms     | __android_log_is_loggable()
   990 ms     |    | __android_log_get_minimum_priority()
   990 ms     | __android_log_write_log_message()
   990 ms     |    | __android_log_logd_logger()
   990 ms     |    |    | __android_log_is_debuggable()
   990 ms  dlerror()
   990 ms  android_dlopen_ext()
   991 ms  dlsym(handle=0x32a24e38d5386b55, symbol="HIDL_FETCH_IMapper")
   991 ms  __android_log_is_loggable()
   991 ms     | __android_log_get_minimum_priority()
   991 ms  dlopen(path="libadreno_utils.so", mode=0x2)
   992 ms  dlsym(handle=0xf1188f74383613ef, symbol="compute_aligned_width_and_height")
   992 ms  dlsym(handle=0xf1188f74383613ef, symbol="compute_fmt_aligned_width_and_height")
   992 ms  dlsym(handle=0xf1188f74383613ef, symbol="compute_surface_padding")
   992 ms  dlsym(handle=0xf1188f74383613ef, symbol="compute_compressedfmt_aligned_width_and_height")
   992 ms  dlsym(handle=0xf1188f74383613ef, symbol="isUBWCSupportedByGpu")
   992 ms  dlsym(handle=0xf1188f74383613ef, symbol="get_gpu_pixel_alignment")
   992 ms  dlsym(handle=0xf1188f74383613ef, symbol="adreno_get_metadata_blob_size")
   992 ms  dlsym(handle=0xf1188f74383613ef, symbol="adreno_init_memory_layout")
   992 ms  dlsym(handle=0xf1188f74383613ef, symbol="adreno_get_aligned_gpu_buffer_size")
   992 ms  __cfi_slowpath()
           /* TID 0x73cc */
  1406 ms  __cfi_slowpath()
  1407 ms  __cfi_slowpath()
  1407 ms  __cfi_slowpath()
  1407 ms  __cfi_slowpath()
  1407 ms  __cfi_slowpath()

...

           /* TID 0x73a5 */
 35028 ms  __cfi_slowpath()
 35028 ms  __cfi_slowpath()
 35035 ms  __android_log_buf_write()
 35036 ms     | __android_log_is_loggable()
。。。
           /* TID 0x73c9 */
 35113 ms  open(path="/data/user_de/0/com.example.displaydemo/code_cache/com.android.opengl.shaders_cache", oflag=0x0)
 36036 ms  open(path="/proc/self/cmdline", oflag=0x80000)
 36037 ms  open(path="/proc/self/cmdline", oflag=0x80000)
 36037 ms  open(path="/proc/self/cmdline", oflag=0x80000)
           /* TID 0x73a5 */
。。。
 36345 ms  __cfi_slowpath()
 37083 ms  open(path="/data/app/~~OyO-UMCLSaECmfJvvRSy1w==/com.example.displaydemo-EXz8U1Y8uB9h_Modc1C__Q==/lib/arm64/libtacker.so", oflag=0x0)
 37085 ms  open(path="/data/app/~~OyO-UMCLSaECmfJvvRSy1w==/com.example.displaydemo-EXz8U1Y8uB9h_Modc1C__Q==/base.apk", oflag=0x80000)
 37086 ms  android_dlopen_ext()
 37094 ms  dlsym(handle=0x2bb94aab7ee5d9eb, symbol="JNI_OnLoad")
 37097 ms  __android_log_print()
 37097 ms     | __android_log_is_loggable()
 37097 ms     |    | __android_log_get_minimum_priority()
 37097 ms     | __android_log_write_log_message()
 37097 ms     |    | __android_log_logd_logger()
 37097 ms     |    |    | __android_log_is_debuggable()
 37099 ms  dlerror()
 37100 ms  android_dlopen_ext()
 37111 ms     | dlsym(handle=0x0, symbol="android_get_exported_namespace")
 37111 ms     | dlopen(path="libRS_internal.so", mode=0x1)
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocation1DData")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocation1DRead")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocation2DData")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocation2DRead")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocation3DData")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocation3DRead")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationAdapterCreate")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationAdapterOffset")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationCopy2DRange")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationCopy3DRange")
 37141 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationCopyToBitmap")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationCreateFromBitmap")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationCreateStrided")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationCreateTyped")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationCubeCreateFromBitmap")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationElementData")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationElementRead")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationGenerateMipmaps")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationGetPointer")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationGetSurface")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsaAllocationGetType")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationIoReceive")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationIoSend")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationRead")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationResize1D")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationSetSurface")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationSyncAll")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationSetupBufferQueue")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAllocationShareBufferQueue")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsAssignName")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsClosureCreate")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsClosureSetArg")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsClosureSetGlobal")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextCreateVendor")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextDeinitToClient")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextDestroy")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextDump")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextFinish")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextGetMessage")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextInitToClient")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextPeekMessage")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextSendMessage")
 37142 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextSetPriority")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsContextSetCacheDir")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsElementCreate2")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsElementCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsaElementGetNativeData")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsaElementGetSubElements")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsaGetName")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsInvokeClosureCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsObjDestroy")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsSamplerCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptBindAllocation")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptCCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptFieldIDCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptForEachMulti")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptGetVarV")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptGroup2Create")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptGroupCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptGroupExecute")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptGroupSetInput")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptGroupSetOutput")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptIntrinsicCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptInvoke")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptInvokeIDCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptInvokeV")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptKernelIDCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptReduce")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptSetTimeZone")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptSetVarD")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptSetVarF")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptSetVarI")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptSetVarJ")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptSetVarObj")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptSetVarVE")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsScriptSetVarV")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsTypeCreate")
 37143 ms     | dlsym(handle=0xb510c3446c65bd65, symbol="rsaTypeGetNativeData")
 37144 ms  dlsym(handle=0xdd4f837609790777, symbol="HIDL_FETCH_IDevice")
...
           /* TID 0x748b */
 37148 ms  dlopen(path="libRSDriver_adreno.so", mode=0x1)
 37169 ms  dlerror()
 37169 ms  dlsym(handle=0xd30b16fb5b2b6c41, symbol="rsdHalQueryVersion")
 37169 ms  dlsym(handle=0xd30b16fb5b2b6c41, symbol="rsdHalQueryHal")
 37169 ms  dlsym(handle=0xd30b16fb5b2b6c41, symbol="rsdHalInit")
 37169 ms  dlsym(handle=0xd30b16fb5b2b6c41, symbol="rsdHalAbort")
 37169 ms  open(path="/proc/cpuinfo", oflag=0x80000)
 37170 ms  open(path="./adreno_config.txt", oflag=0x0)
 37170 ms  open(path="/data/vendor/gpu//adreno_config.txt", oflag=0x0)
 37170 ms  open(path="/data/misc/gpu//adreno_config.txt", oflag=0x0)
 37170 ms  open(path="./yamato_panel.txt", oflag=0x0)
 37171 ms  open(path="/data/vendor/gpu//yamato_panel.txt", oflag=0x0)
 37171 ms  open(path="/data/misc/gpu//yamato_panel.txt", oflag=0x0)
 37172 ms  __cfi_slowpath()
 37180 ms  dlopen(path="libllvm-qcom.so", mode=0x2)
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_create_llvm_instance")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_destroy_llvm_instance")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_compile_source")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_link_program")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_get_error_code")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_get_build_log")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_query_handle_type")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_handle_to_executable")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_free_handle")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_disassemble")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_free_assembly")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_program_get_ddl_data")
 37256 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_handle_from_binary")
 37257 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_handle_create_binary")
 37257 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_program_free_binary")
 37257 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_interpret_printf_buffer")
 37257 ms  dlsym(handle=0x2dd005fbeae03129, symbol="cl_compiler_query_version_string")
 37264 ms  __cfi_slowpath()
 37265 ms  __cfi_slowpath()
 37265 ms  __cfi_slowpath()
 37265 ms  __cfi_slowpath()
 37265 ms  dlopen(path="libqti-perfd-client.so", mode=0x2)
...
 37266 ms  __cfi_slowpath()
 37266 ms  dlopen(path="librs_adreno_sha1.so", mode=0x2)
 37269 ms  dlsym(handle=0xe42754d5434639f, symbol="libllvm_qcom_so_SHA1")
 37269 ms  dlsym(handle=0xe42754d5434639f, symbol="libCB_so_SHA1")
 37269 ms  dlsym(handle=0xe42754d5434639f, symbol="libgsl_so_SHA1")
 37269 ms  dlsym(handle=0xe42754d5434639f, symbol="librs_adreno_so_SHA1")
 37269 ms  dlsym(handle=0xe42754d5434639f, symbol="libRSDriver_adreno_so_SHA1")
 37269 ms  dlclose(handle=0xe42754d5434639f)
 37269 ms  __cfi_slowpath()
 37270 ms  __android_log_print()
 37270 ms     | __android_log_is_loggable()
 37270 ms     |    | __android_log_get_minimum_priority()
 37270 ms     | __android_log_write_log_message()
 37270 ms     |    | __android_log_logd_logger()
 37270 ms     |    |    | __android_log_is_debuggable()
           /* TID 0x73a5 */
 37270 ms  dlopen(path="libRSCacheDir.so", mode=0x1)
 37272 ms  dlsym(handle=0xaaa10682b389f92b, symbol="rsQueryCacheDir")
...
 37339 ms  __cfi_slowpath()
           /* TID 0x73e8 */
 39181 ms  open(path="/data/user_de/0/com.example.displaydemo/code_cache/com.android.opengl.shaders_cache", oflag=0xc2)
 39196 ms  open(path="/data/user_de/0/com.example.displaydemo/code_cache/com.android.opengl.shaders_cache", oflag=0xc2)

           /* TID 0x73e9 */
 39255 ms  open(path="/data/user_de/0/com.example.displaydemo/code_cache/com.android.skia.shaders_cache", oflag=0xc2)
 39257 ms  open(path="/data/user_de/0/com.example.displaydemo/code_cache/com.android.skia.shaders_cache", oflag=0xc2)

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-15 22:26:56

常见问题

常见问题

Failed to spawn timeout was reached

现象

➜  frida frida-trace -U -f com.example.displaydemo -i JIN_OnLoad -i RegisterNatives
Spawning `com.example.displaydemo`...

Failed to spawn: timeout was reached

原因：偶发的bug

解决办法

多试试几次

重启安卓手机

杀掉frida-server后，手动重启几次

注：此处由于之前是Magisk安装的插件MagiskFrida，好像是：

发现frida-server被杀掉后，会自动重启frida-server

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-15 21:34:22

心得

心得

Frida的js脚本中过滤字符串参数

背景

想要在Interceptor.attach的onEnter中，实现参入参数的过滤=判断，去实现，当满足某些条件，才打印（或不打印）某些日志之类的需求

核心逻辑：用someJsStrList.includes(inputParaStr)去判断即可

示例代码

  const KnownStrList = [
    "CurrencyMap/US/0/",
    "CurrencyMap/CN/0/",
    "CurrencyMap/CN/",
    "CurrencyMap/",
    "CurrencyMap",
    "CN",
    "US",
    "/",
    "0",
    "id",
    "zh_CN_#HANS",
    "zh_Hans_CN",
    "zh",
    "Hans",
    "HANS",
  ]

  // char *strcpy(char *restrict dst, const char *restrict src);
  Interceptor.attach(Module.findExportByName(null, "strcpy"), {
    onEnter: function (args) {
      var dst = Memory.readCString(args[0]);
      var src = Memory.readCString(args[1]);
      if (!KnownStrList.includes(src)) {
        console.log("strcpy: dst=" + dst + ", src=" + src);
      }
    },
    onLeave: function (args) {
    }
  });

Frida去hook安卓JNI函数JIN_OnLoad却hook不到无输出

现象

此处，要调试的安卓app：

DisplayDemo

内部的so库：libtacker.so

加载方式：System.loadLibrary("tacker");

-》可能是此处特殊的加载方式，导致了：

frida-trace无法去hook到，libtacker.so的加载，也就无法找到其内部的函数JNI_OnLoad了

所以frida-trace无法hook此处的JNI_OnLoad，无输出。

解决办法

手动写frida的js脚本，去

  const funcSym = "JNI_OnLoad";
  const funcPtr = Module.findExportByName(libraryName, "libtacker.so");
...

完整代码：

hook_libtacker_JNI_Onload.js

/**
 * frida -U -f com.example.displaydemo -l hook_libtacker_JNI_Onload.js
 */

function processJniOnLoad(libraryName) {
  const funcSym = "JNI_OnLoad";
  const funcPtr = Module.findExportByName(libraryName, funcSym);

  console.log("[+] Hooking " + funcSym + "() @ " + funcPtr + "...");
  // jint JNI_OnLoad(JavaVM *vm, void *reserved);
  var funcHook = Interceptor.attach(funcPtr, {
      onEnter: function (args) {
          const vm = args[0];
          const reserved = args[1];
          console.log("[+] " + funcSym + "(" + vm + ", " + reserved + ") called");
      },
      onLeave: function (retval) {
          console.log("[+]\t= " + retval);
      }
  });
}

function waitForLibLoading(libraryName) {
  var isLibLoaded = false;

  Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"), {
      onEnter: function (args) {
          var libraryPath = Memory.readCString(args[0]);
          if (libraryPath.includes(libraryName)) {
              console.log("[+] Loading library " + libraryPath + "...");
              isLibLoaded = true;
          }
      },
      onLeave: function (args) {
          if (isLibLoaded) {
              processJniOnLoad(libraryName);
              isLibLoaded = false;
          }
      }
  });
}

Java.perform(function() {
  const libraryName = "libtacker.so";
  waitForLibLoading(libraryName);
});

（此处点击Jump跳转页面后）即可hook到JNI_OnLoad函数的执行：

=> 输出：

截图

log日志

➜  frida frida -U -f com.example.displaydemo -l hook_libtacker_JNI_Onload.js
   ____
  / _  |   Frida 16.1.3 - A world-class dynamic instrumentation toolkit
 | (_| |
  > _  |   Commands:
 /_/ |_|       help      -> Displays the help system
 . . . .       object?   -> Display information about 'object'
 . . . .       exit/quit -> Exit
 . . . .
 . . . .   More info at https://frida.re/docs/home/
 . . . .
 . . . .   Connected to Pixel 3 (id=91BX1VSA3)
Spawned `com.example.displaydemo`. Resuming main thread!
[Pixel 3::com.example.displaydemo ]-> %resume
[Pixel 3::com.example.displaydemo ]-> [+] Loading library /data/app/~~OyO-UMCLSaECmfJvvRSy1w==/com.example.displaydemo-EXz8U1Y8uB9h_Modc1C__Q==/base.apk!/lib/arm64-v8a/libtacker.so...
[+] Hooking JNI_OnLoad() @ 0x6dd0349438...
[+] JNI_OnLoad(0x6eaf3380d0, 0x0) called
[+]    = 0x10006

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-02 17:20:44

模拟代码运行

模拟代码运行

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-25 21:38:45

Unidbg

Unidbg

Unidbg

Github

https://github.com/zhkl0228/unidbg

Allows you to emulate an Android native library, and an experimental iOS emulation

概述

unidbg是unicorn的一个实现，它可以让你在电脑上跑arm的可执行文件或共享库文件

unidbg是一个基于unicorn的逆向工具，可以在PC端直接调用Android（的apk中）和iOS（的ipa中）的so动态库文件（中的native函数方法）

背景

目前很多 App 的加密签名算法都在so文件中，强行逆向so的话可能会消耗大量时间和资源

规避方式

用 xposed 采用 hook 的方法从程序计算签名

缺点：需要模拟器或者真机运行这个应用，使用效率不高

用过 jtype 启动JVM，然后通过 native 对so文件进行调用

缺点：因为每次都需要启动JVM，所以效率也不高

unidbg

原理：通过在 app 中找到对应的 JNI 接口，然后用 unicorn 引擎直接调用 so 文件

优点：不需要运行 app，也无需逆向 so 文件，所以效率相对要高不少

底层依赖于：Unicorn

详见

CPU模拟利器：Unicorn

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-25 21:40:06

Hook框架

安卓的Hook框架

TODO：

hook框架

【整理】安卓hook框架：Sandhook

安卓的Hook框架

Xposed（系列）

Cydia Substrate

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-25 22:00:39

Xposed框架

Xposed框架

概述

Xposed/EdXposed/LSPosed系列框架

可以安装插件实现各种功能

也可以自己自己写Xposed插件，实现特定功能

理论上也可以动态调试Xposed插件

详解：安卓逆向调试：XPosed框架

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-14 20:37:31

CydiaSubstrate

CydiaSubstrate

主页

CydiaSubstrate

下载

com.saurik.substrate.apk

功能

和Xposed类似的框架，用来安装各种插件，实现各种功能。

比如可以：

安装绕过ssl检测的插件，用来破解ssl pinning

关于安卓的app中的https：

app内部启用了：

SSL Pinning=ssl certificate pinning=certificate pinning

=ssl证书绑定=证书绑定`

此处也可以用来安装相关插件，导出安卓的dex文件

特点

Hook底层方法非常方便

对so中的方法hook操作非常便捷

截图

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-09-13 22:14:29

Android-OpenDebug

Android-OpenDebug

主页

iSECPartners/Android-OpenDebug: Make any application debuggable

功能

是一个Cydia Substrate的插件

所以前提是要先安装Cydia Substrate

可以使得任何一个安卓程序可以被调试

就有了分析和破解的可能

下载

Android-OpenDebug APK下载

安装

adb install Android-OpenDebug.apk

或直接安装apk

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-25 21:58:50

Introspy-Android

Introspy-Android

主页

GitHub

iSECPartners/Introspy-Android: Security profiling for blackbox Android

网站

Introspy-Android

功能

帮助分析安卓app运行期间的行为

以便于找到可能存在的安全问题

提示

是个Cydia Substrate插件

所以前提是先安装Cydia Substrate

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-25 21:58:50

adb辅助调试

adb辅助调试

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-02 17:09:13

查看内存映射

adb查看进程内存映射

查看进程的内存映射real layout of process segment

/proc/<pid>/maps

举例：

查看安卓app：AIO File Manager=包名：com.manager.files.super.cleaner的进程的内存映射

adb shell

后：

查看确认进程PID：

blueline:/storage/emulated/0/dev # ps -A | grep clean
u0_a256       14868   1025 2051980  61568 SyS_epoll_wait      0 S com.manager.files.super.cleaner

查看到AIO File Manager的PID是：14868

再去切换到root权限：

su

然后才能看到maps映射：

cat /proc/14868/maps

输出结果：

blueline:/sdcard/dev $ cat /proc/14868/map
map_files/  maps

详细结果：

blueline:/storage/emulated/0/dev # cat /proc/14868/maps
12c00000-52c00000 rw-p 00000000 00:00 0                                  [anon:dalvik-main space (region space)]
6faeb000-6fcc8000 rw-p 00000000 00:00 0                                  [anon:dalvik-/apex/com.android.art/javalib/boot.art]
6fcc8000-6fd0b000 rw-p 00000000 00:00 0                                  [anon:dalvik-/apex/com.android.art/javalib/boot-core-libart.art]
6fd0b000-6fda9000 rw-p 00000000 00:00 0                                  [anon:dalvik-/apex/com.android.art/javalib/boot-core-icu4j.art]
6fda9000-6fdd2000 rw-p 00000000 00:00 0                                  [anon:dalvik-/apex/com.android.art/javalib/boot-okhttp.art]
6fdd2000-6fe08000 rw-p 00000000 00:00 0                                  [anon:dalvik-/apex/com.android.art/javalib/boot-bouncycastle.art]
6fe08000-6fe13000 rw-p 00000000 00:00 0                                  [anon:dalvik-/apex/com.android.art/javalib/boot-apache-xml.art]
6fe13000-6fe90000 r--p 00000000 07:78 44                                 /apex/com.android.art/javalib/arm/boot.oat
6fe90000-70094000 r-xp 0007d000 07:78 44                                 /apex/com.android.art/javalib/arm/boot.oat
70094000-70095000 rw-p 00000000 00:00 0                                  [anon:.bss]
70095000-70097000 r--p 00000000 07:78 45                                 /apex/com.android.art/javalib/arm/boot.vdex
70097000-70098000 r--p 00281000 07:78 44                                 /apex/com.android.art/javalib/arm/boot.oat
70098000-70099000 rw-p 00282000 07:78 44                                 /apex/com.android.art/javalib/arm/boot.oat
70099000-700a8000 r--p 00000000 07:78 38                                 /apex/com.android.art/javalib/arm/boot-core-libart.oat
700a8000-700e7000 r-xp 0000f000 07:78 38                                 /apex/com.android.art/javalib/arm/boot-core-libart.oat
700e7000-700e8000 rw-p 00000000 00:00 0                                  [anon:.bss]
700e8000-700e9000 r--p 00000000 07:78 39                                 /apex/com.android.art/javalib/arm/boot-core-libart.vdex
700e9000-700ea000 r--p 0004e000 07:78 38                                 /apex/com.android.art/javalib/arm/boot-core-libart.oat
700ea000-700eb000 rw-p 0004f000 07:78 38                                 /apex/com.android.art/javalib/arm/boot-core-libart.oat
700eb000-70114000 r--p 00000000 07:78 35                                 /apex/com.android.art/javalib/arm/boot-core-icu4j.oat
70114000-701ad000 r-xp 00029000 07:78 35                                 /apex/com.android.art/javalib/arm/boot-core-icu4j.oat
701ad000-701ae000 rw-p 00000000 00:00 0                                  [anon:.bss]
701ae000-701af000 r--p 00000000 07:78 36                                 /apex/com.android.art/javalib/arm/boot-core-icu4j.vdex
701af000-701b0000 r--p 000c2000 07:78 35                                 /apex/com.android.art/javalib/arm/boot-core-icu4j.oat
701b0000-701b1000 rw-p 000c3000 07:78 35                                 /apex/com.android.art/javalib/arm/boot-core-icu4j.oat
701b1000-701bc000 r--p 00000000 07:78 41                                 /apex/com.android.art/javalib/arm/boot-okhttp.oat
701bc000-701e2000 r-xp 0000b000 07:78 41                                 /apex/com.android.art/javalib/arm/boot-okhttp.oat
701e2000-701e3000 rw-p 00000000 00:00 0                                  [anon:.bss]
701e3000-701e4000 r--p 00000000 07:78 42                                 /apex/com.android.art/javalib/arm/boot-okhttp.vdex
701e4000-701e5000 r--p 00031000 07:78 41                                 /apex/com.android.art/javalib/arm/boot-okhttp.oat
701e5000-701e6000 rw-p 00032000 07:78 41                                 /apex/com.android.art/javalib/arm/boot-okhttp.oat
701e6000-701f1000 r--p 00000000 07:78 32                                 /apex/com.android.art/javalib/arm/boot-bouncycastle.oat
701f1000-70200000 r-xp 0000b000 07:78 32                                 /apex/com.android.art/javalib/arm/boot-bouncycastle.oat
70200000-70201000 rw-p 00000000 00:00 0                                  [anon:.bss]
70201000-70202000 r--p 00000000 07:78 33                                 /apex/com.android.art/javalib/arm/boot-bouncycastle.vdex
70202000-70203000 r--p 0001a000 07:78 32                                 /apex/com.android.art/javalib/arm/boot-bouncycastle.oat
70203000-70204000 rw-p 0001b000 07:78 32                                 /apex/com.android.art/javalib/arm/boot-bouncycastle.oat
70204000-70209000 r--p 00000000 07:78 29                                 /apex/com.android.art/javalib/arm/boot-apache-xml.oat
70209000-7020a000 r--p 00000000 07:78 30                                 /apex/com.android.art/javalib/arm/boot-apache-xml.vdex
7020a000-7020b000 r--p 00005000 07:78 29                                 /apex/com.android.art/javalib/arm/boot-apache-xml.oat
7020b000-7020c000 rw-p 00006000 07:78 29                                 /apex/com.android.art/javalib/arm/boot-apache-xml.oat
7020c000-70b13000 rw-p 00000000 00:00 0                                  [anon:dalvik-/system/framework/boot-framework.art]
70b13000-70b44000 rw-p 00000000 00:00 0                                  [anon:dalvik-/system/framework/boot-ext.art]
70b44000-70c6f000 rw-p 00000000 00:00 0                                  [anon:dalvik-/system/framework/boot-telephony-common.art]
70c6f000-70cf2000 rw-p 00000000 00:00 0                                  [anon:dalvik-/system/framework/boot-voip-common.art]
70cf2000-70d0f000 rw-p 00000000 00:00 0                                  [anon:dalvik-/system/framework/boot-ims-common.art]
70d0f000-70d12000 rw-p 00000000 00:00 0                                  [anon:dalvik-/system/framework/boot-framework-atb-backward-compatibility.art]
70d12000-70f01000 r--p 00000000 fd:04 1225                               /system/framework/arm/boot-framework.oat
70f01000-71613000 r-xp 001ef000 fd:04 1225                               /system/framework/arm/boot-framework.oat
71613000-71615000 r--p 00901000 fd:04 1225                               /system/framework/arm/boot-framework.oat
71615000-71616000 rw-p 00000000 00:00 0                                  [anon:.bss]
71616000-71620000 r--p 00000000 fd:04 1258                               /system/framework/boot-framework.vdex
71620000-71621000 r--p 00903000 fd:04 1225                               /system/framework/arm/boot-framework.oat
71621000-71622000 rw-p 00904000 fd:04 1225                               /system/framework/arm/boot-framework.oat
71622000-71627000 r--p 00000000 fd:04 1219                               /system/framework/arm/boot-ext.oat
71627000-71638000 r-xp 00005000 fd:04 1219                               /system/framework/arm/boot-ext.oat
71638000-71639000 r--p 00016000 fd:04 1219                               /system/framework/arm/boot-ext.oat
71639000-7163a000 r--p 00000000 fd:04 1256                               /system/framework/boot-ext.vdex
7163a000-7163b000 r--p 00017000 fd:04 1219                               /system/framework/arm/boot-ext.oat
7163b000-7163c000 rw-p 00018000 fd:04 1219                               /system/framework/arm/boot-ext.oat
7163c000-71644000 r--p 00000000 fd:04 1231                               /system/framework/arm/boot-telephony-common.oat
71644000-71645000 r--p 00000000 fd:04 1260                               /system/framework/boot-telephony-common.vdex
71645000-71646000 r--p 00008000 fd:04 1231                               /system/framework/arm/boot-telephony-common.oat
71646000-71647000 rw-p 00009000 fd:04 1231                               /system/framework/arm/boot-telephony-common.oat
71647000-7164c000 r--p 00000000 fd:04 1234                               /system/framework/arm/boot-voip-common.oat
7164c000-7164d000 r-xp 00005000 fd:04 1234                               /system/framework/arm/boot-voip-common.oat
7164d000-7164e000 r--p 00000000 fd:04 1261                               /system/framework/boot-voip-common.vdex
7164e000-7164f000 r--p 00006000 fd:04 1234                               /system/framework/arm/boot-voip-common.oat
7164f000-71650000 rw-p 00007000 fd:04 1234                               /system/framework/arm/boot-voip-common.oat
71650000-71652000 r--p 00000000 fd:04 1228                               /system/framework/arm/boot-ims-common.oat
71652000-71653000 r--p 00000000 fd:04 1259                               /system/framework/boot-ims-common.vdex
71653000-71654000 r--p 00002000 fd:04 1228                               /system/framework/arm/boot-ims-common.oat
71654000-71655000 rw-p 00003000 fd:04 1228                               /system/framework/arm/boot-ims-common.oat
71655000-71657000 r--p 00000000 fd:04 1222                               /system/framework/arm/boot-framework-atb-backward-compatibility.oat
71657000-71658000 r--p 00000000 fd:04 1257                               /system/framework/boot-framework-atb-backward-compatibility.vdex
71658000-71659000 r--p 00002000 fd:04 1222                               /system/framework/arm/boot-framework-atb-backward-compatibility.oat
71659000-7165a000 rw-p 00003000 fd:04 1222                               /system/framework/arm/boot-framework-atb-backward-compatibility.oat
7165a000-719bd000 rw-p 00000000 00:00 0                                  [anon:dalvik-zygote space]
719bd000-719bf000 rw-p 00000000 00:00 0                                  [anon:dalvik-non moving space]
719bf000-719cc000 rw-p 00000000 00:00 0                                  [anon:dalvik-non moving space]
719cc000-74e5b000 ---p 00000000 00:00 0                                  [anon:dalvik-non moving space]
74e5b000-7565a000 rw-p 00000000 00:00 0                                  [anon:dalvik-non moving space]
b1562000-b1564000 r--p 00000000 fd:04 176                                /system/bin/app_process32
b1564000-b1568000 r-xp 00001000 fd:04 176                                /system/bin/app_process32
...
...
...

f4226000-f4246000 r--s 00000000 00:11 23653                              /dev/__properties__/u:object_r:vendor_socket_hook_prop:s0
f4246000-f4266000 r--s 00000000 00:11 23566                              /dev/__properties__/u:object_r:heapprofd_prop:s0
f4266000-f4286000 r--s 00000000 00:11 23535                              /dev/__properties__/u:object_r:exported2_default_prop:s0
f4286000-f434e000 r--p 00000000 00:00 0                                  [anon:linker_alloc]
f434e000-f436e000 r--s 00000000 00:11 23665                              /dev/__properties__/u:object_r:vndk_prop:s0
f436e000-f436f000 rw-p 00000000 00:00 0                                  [anon:bionic_alloc_small_objects]
f436f000-f4370000 r--p 00002000 07:78 28                                 /apex/com.android.art/javalib/arm/boot-apache-xml.art
f4370000-f4371000 rw-p 00000000 00:00 0                                  [anon:bionic_alloc_small_objects]
f4371000-f4372000 r--p 00015000 07:78 31                                 /apex/com.android.art/javalib/arm/boot-bouncycastle.art
f4372000-f4377000 rw-p 00000000 00:00 0                                  [anon:bionic_alloc_small_objects]
f4377000-f4378000 r--p 00011000 07:78 40                                 /apex/com.android.art/javalib/arm/boot-okhttp.art
f4378000-f4379000 r--p 0001b000 07:78 37                                 /apex/com.android.art/javalib/arm/boot-core-libart.art
f4379000-f437d000 r--p 000b7000 07:78 43                                 /apex/com.android.art/javalib/arm/boot.art
f437d000-f437e000 ---p 00000000 00:00 0
f437e000-f4381000 rw-p 00000000 00:00 0                                  [anon:stack_and_tls:main]
f4381000-f4382000 ---p 00000000 00:00 0
f4382000-f438a000 rw-p 00000000 00:00 0                                  [anon:bionic_alloc_small_objects]
f438a000-f43ee000 r--p 00000000 00:00 0                                  [anon:linker_alloc]
f43ee000-f43ef000 rw-p 00000000 00:00 0                                  [anon:bionic_alloc_small_objects]
f43ef000-f440f000 r--s 00000000 00:11 23514                              /dev/__properties__/u:object_r:debug_prop:s0
f440f000-f442f000 r--s 00000000 00:11 23535                              /dev/__properties__/u:object_r:exported2_default_prop:s0
f442f000-f4430000 ---p 00000000 00:00 0
f4430000-f4438000 rw-p 00000000 00:00 0
f4438000-f4439000 ---p 00000000 00:00 0
f4439000-f4459000 r--s 00000000 00:11 23669                              /dev/__properties__/properties_serial
f4459000-f445b000 rw-p 00000000 00:00 0                                  [anon:System property context nodes]
f445b000-f446a000 r--s 00000000 00:11 23470                              /dev/__properties__/property_info
f446a000-f44ce000 r--p 00000000 00:00 0                                  [anon:linker_alloc]
f44ce000-f44cf000 rw-p 00000000 00:00 0                                  [anon:bionic_alloc_small_objects]
f44cf000-f44d0000 r--p 00000000 00:00 0                                  [anon:atexit handlers]
f44d0000-f44d1000 ---p 00000000 00:00 0
f44d1000-f44d5000 rw-p 00000000 00:00 0                                  [anon:thread signal stack]
f44d5000-f44d6000 rw-p 00000000 00:00 0                                  [anon:arc4random data]
f44d6000-f44d8000 rw-p 00000000 00:00 0                                  [anon:System property context nodes]
f44d8000-f44d9000 rw-p 00000000 00:00 0                                  [anon:arc4random data]
f44d9000-f44da000 r--p 00000000 00:00 0                                  [vvar]
f44da000-f44dc000 r-xp 00000000 00:00 0                                  [vdso]
f44dc000-f44f5000 r--p 00000000 07:b8 13                                 /apex/com.android.runtime/bin/linker
f44f5000-f457c000 r-xp 00018000 07:b8 13                                 /apex/com.android.runtime/bin/linker
f457c000-f4580000 r--p 0009e000 07:b8 13                                 /apex/com.android.runtime/bin/linker
f4580000-f4582000 rw-p 000a1000 07:b8 13                                 /apex/com.android.runtime/bin/linker
f4582000-f4585000 rw-p 00000000 00:00 0                                  [anon:.bss]
f4585000-f4586000 r--p 00000000 00:00 0                                  [anon:.bss]
f4586000-f458c000 rw-p 00000000 00:00 0                                  [anon:.bss]
ff77f000-ff780000 ---p 00000000 00:00 0
ff780000-fff7f000 rw-p 00000000 00:00 0                                  [stack]
ffff0000-ffff1000 r-xp 00000000 00:00 0                                  [kuserhelpers]

内存映射信息的解读

想要搞懂：

内存对齐

哪个是stack

等具体含义。

Understanding ELF using readelf and objdump (studylib.net)

[1] 0039d000-003b2000 r-xp 00000000 16:41 1080084 /lib/ld-2.3.3.so
[2] 003b2000-003b3000 r--p 00014000 16:41 1080084 /lib/ld-2.3.3.so
[3] 003b3000-003b4000 rw-p 00015000 16:41 1080084 /lib/ld-2.3.3.so
[4] 003b6000-004cb000 r-xp 00000000 16:41 1080085 /lib/tls/libc-2.3.3.so
[5] 004cb000-004cd000 r--p 00115000 16:41 1080085 /lib/tls/libc-2.3.3.so
[6] 004cd000-004cf000 rw-p 00117000 16:41 1080085 /lib/tls/libc-2.3.3.so
[7] 004cf000-004d1000 rw-p 004cf000 00:00 0
[8] 08048000-08049000 r-xp 00000000 16:06 66970 /tmp/test
[9] 08049000-0804a000 rw-p 00000000 16:06 66970 /tmp/test
[10] b7fec000-b7fed000 rw-p b7fec000 00:00 0
[11] bffeb000-c0000000 rw-p bffeb000 00:00 0
[12] ffffe000-fffff000 ---p 00000000 00:00 0

其中：

VMA# 11

[11] bffeb000-c0000000 rw-p bffeb000 00:00 0

是：

stack

usually, the kernel allocate several pages dynamically and map to the highest virtual address possible in user space to form stack area.

-> 此处去搜stack，还真有多个stack这样的：

e6ded000-e6df1000 rw-p 00000000 00:00 0                                  [anon:thread signal stack]

e84d3000-e86d3000 rw-p 00000000 00:00 0                                  [anon:dalvik-rb copying gc mark stack]
e86d3000-e96d3000 rw-p 00000000 00:00 0                                  [anon:dalvik-concurrent copying gc mark stack]
e96d3000-e9ed4000 rw-p 00000000 00:00 0                                  [anon:dalvik-live stack]
e9ed4000-ea6d5000 rw-p 00000000 00:00 0                                  [anon:dalvik-allocation stack]

ebbc0000-ebdc0000 rw-p 00000000 00:00 0                                  [anon:dalvik-rb copying gc mark stack]

f2282000-f228e000 rw-p 00000000 00:00 0                                  [anon:dalvik-thread local mark stack]
...

倒数最后一个：

ff780000-fff7f000 rw-p 00000000 00:00 0                                  [stack]

整个名字就是Stack：

是我们希望的，要找的

Simply speaking, each process address space isdivid ed into two part (this assume Intel compatible 32 bit processor): user space and kernel space. User space is in 0x00000000-0xc0000000 range, while kernel space starts on 0xc0000000 onward

->

每个进程的（Intel 的32位处理器的）地址空间都被分为2部分

用户空间

范围：0x00000000-0xc0000000

所以上述test的地址空间的，最高位置(地址范围bffeb000-c0000000),分配给了stack

[11] bffeb000-c0000000 rw-p bffeb000 00:00 0

内核空间

范围：0xc0000000-...

其他相关解释：

Executable and Linkable Format (ELF) (netmeister.org)

0000000000400000      8K r-x--  a.out
0000000000601000      4K rw---  a.out
0000003433e00000    112K r-x--  /lib64/ld-2.5.so
000000343401b000      4K r----  /lib64/ld-2.5.so
000000343401c000      4K rw---  /lib64/ld-2.5.so
0000003434200000   1336K r-x--  /lib64/libc-2.5.so     <-- The first "LOAD" segment, which contains .text and .rodata sections
000000343434e000   2044K -----  /lib64/libc-2.5.so     <-- "Hole"
000000343454d000     16K r----  /lib64/libc-2.5.so     <-- Relocation (GNU_RELRO) info  -+---- The second "LOAD" segment
0000003434551000      4K rw---  /lib64/libc-2.5.so     <-- .got.plt .data sections      -+
0000003434552000     20K rw---    [ anon ]             <-- The remaining zero-filled sections (e.g. .bss)
0000003434e00000     88K r-x--  /lib64/libpthread-2.5.so     <-- The first "LOAD" segment, which contains .text and .rodata sections
0000003434e16000   2044K -----  /lib64/libpthread-2.5.so     <-- "Hole"
0000003435015000      4K r----  /lib64/libpthread-2.5.so     <-- Relocation (GNU_RELRO) info  -+---- The second "LOAD" segment
0000003435016000      4K rw---  /lib64/libpthread-2.5.so     <-- .got.plt .data sections      -+
0000003435017000     16K rw---    [ anon ]                   <-- The remaining zero-filled sections (e.g. .bss)
00002aaaaaaab000      4K rw---    [ anon ]
00002aaaaaac6000     12K rw---    [ anon ]
00007ffffffea000     84K rw---    [ stack ]
ffffffffff600000   8192K -----    [ anon ]
 total            14000K

供参考。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-02 17:19:54

其他工具

其他工具

此处整理和安卓逆向的动态调试有关的，其他的分析和调试方面的工具。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-08-25 21:40:29

AndBug

AndBug

主页

swdunlop/AndBug: Android Debugging Library

作用

在没有源代码的情况下，调试android上的java程序

功能

支持断点、call stack查看、查看class、method等信息

截图

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2022-10-27 16:04:53

redexer

redexer

主页

plum-umd/redexer: The Redexer binary instrumentation framework for Dalvik bytecode

The Redexer Dalvik bytecode instrumentation platform

文档

Tutorial: using redexer to implement logging in Android apps

功能

Dalvik 字节码（用于安卓APP）分析框架

它是一套基于OCaml的实用工具

帮助程序员解析、操作Dalvik虚拟机

作者

Redexer由来自马里兰大学帕克分校的PLUM组织开发完成

主要作者是：Jinseong Jeon，Kristopher Micinski以及Jeff Foster

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2021-07-18 09:55:45

Fino

Fino

Fino=FINO

主页

sysdream/fino: Android small footprint inspection tool

功能

An Android Dynamic Analysis Tool

特点

资源占用少

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2021-07-18 09:55:45

附录

附录

下面列出相关参考资料。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2022-10-27 14:20:47

参考资料

参考资料

【未解决】Mac中用LLDB调试DisplayDemo安卓app中的libtacker.so

【已解决】安卓逆向：lldb调试安卓app

【已解决】Mac中下载和安装lldb-server到安卓手机Pixel3

【已解决】已root的Android13的Pixel5中：用lldb调试安卓

【已解决】Mac中lldb连接安卓中lldb-server报错：error Connection shut down by remote side while waiting for reply to initial handshake packet

【记录】用lldb去调试安卓app：LiftFileManager

【已解决】Mac中给安卓手机Pixel3中初始化Frida调试环境

【已解决】安卓手机Pixel3中运行frida-server

【已解决】安卓手机Pixel3中adb shell中chmod无效

【部分解决】Mac中运行adb root卡死restarting adbd as root

【已解决】Mac中调试Pixel3中frida报错：Failed to enumerate processes connection closed

【已解决】Mac中用frida去调试安卓手机Pixel3中的安卓app

【已解决】尝试解决Android的frida不可用问题：MagiskFrida

【已解决】安卓逆向：Pixel3中初始化frida调试安卓apk的环境

【未解决】安卓逆向：用frida去hook调试JNI_OnLoad

【记录】用frida-trace调试DisplayDemo中更多的函数调用

【已解决】frida-trace去hook安卓应用报错：Failed to spawn timeout was reached

【已解决】安卓逆向DisplayDemo：用Frida去hook调试dlopen

【未解决】安卓逆向DisplayDemo：用Frida去hook调试android_dlopen_ext

【未解决】安卓逆向LiftFileManager：用frida去hook调试

【未解决】安卓逆向：用frida去hook调试RegisterNatives

【已解决】安卓逆向LiftFileManager：用frida调试lcodecorex/KeepAlive相关底层C函数

【记录】安卓逆向LiftFileManager：分析frida调试lcodecorex/KeepAlive的结果

【已解决】安卓逆向LiftFileManager：用frida调试flock及结果分析

【未解决】安卓逆向LiftFileManager：用frida调试pthread_create并分析结果

【未解决】安卓逆向LiftFileManager：用frida调试创建进程的Linux的C函数

【未解决】Mac中安装frida

【已解决】Frida去hook安卓JNI函数JIN_OnLoad却hook不到无输出

【已解决】安卓逆向DisplayDemo：用frida+js脚本去hook函数JIN_OnLoad

【已解决】Frida调试安卓进程：字符串参数判断过滤

【未解决】尝试解决Android Studio中smali断点不生效：smalidea插件问题

【未解决】尝试解决Android Studio中smali断点不生效：卸载重装smalidea插件

【记录】Android Studio调试smali：IDE出错Exception in plugin Smalidea

【记录】安卓手机中查看进程内存映射

crifan/AndroidYouTubeDynamicDebug: 安卓逆向动态调试YouTube (github.com)

主流调试器：LLDB

Xposed插件开发 · 安卓逆向调试：XPosed框架

CPU模拟利器：Unicorn

lldb-server – Server for LLDB Debugging Sessions — The LLDB Debugger

Android SDK Offline: Android NDK LLDB Direct Download

内容相对最完整

安卓逆向13 --- AndroidStudio + Smalidea 动态调试 smali 代码【APK可调试】、gradle 配置擒贼先擒王的博客-CSDN博客_smalidea

DDMS adb 调试 端口 映射 关系

Android调试系列—使用android studio调试smali代码 - Gordon0918 - 博客园 (cnblogs.com)

Android Studio 动态调试 apk 反编译出的 smali 代码 - yhjoker - 博客园 (cnblogs.com)

Android逆向破解：使用Android Studio调试反编译后的smali代码 - 简书 (jianshu.com)

Android逆向｜AndroidStudio的两种动态调试技巧 - 腾讯云开发者社区-腾讯云 (tencent.com)

超详细的android so库的逆向调试 - 掘金 (juejin.cn)

学习笔记： Android studio 调试smali_深秋黄金甲的博客-CSDN博客_androidstudio smali

Android Studio 3.6 调试 smali的全过程 - 腾讯云开发者社区-腾讯云 (tencent.com)

Smali动态调试之Android Studio - Blog - teisyogun (bushrose.github.io)

基于Android studio动态调试smali全过程 - 简书 (jianshu.com)

Android逆向笔记-使用Android Studio调试Smali代码（方式一）_IT1995的博客-CSDN博客

android 动态调试 - 简书 (jianshu.com)

Android Applications Reversing 101 (evilsocket.net)

安卓逆向-从环境搭建到动态调试apk - FreeBuf网络安全行业门户

安卓逆向分析中常用动态调试方法总结Denny_Chen的博客-CSDN博客_安卓动态调试

Android逆向破解：使用Android Studio调试反编译后的smali代码 - 简书 (jianshu.com)

Android Studio 动态调试 apk 反编译出的 smali 代码 - yhjoker - 博客园 (cnblogs.com)

[免费专栏] Android安全之Android Studion 动态调试APK的两种方法菠萝橙留香的博客-CSDN博客_安卓apk调试

[原创]修改Nexus5的boot.img - 打开系统调试-Android安全-看雪论坛-安全社区|安全招聘|bbs.pediy.com

unidbg调用so生成xgorgon - SegmentFault 思否

unidbg调用so文件 - SegmentFault 思否

菜鸡诈尸水贴之unidbg学习笔记 - 『移动安全区』 - 吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

Android逆向之旅---Hook神器家族的Frida工具使用详解 - Android应用安全防护和逆向分析-----作者 - CSDN博客

浅谈 android hook 技术 - Android - 掘金

使用Frida框架进行hook | La0s

Android逆向之旅-Hook神器家族的Frida工具使用详解 - 云+社区 - 腾讯云

hookmaster/frida-all-in-one: 《FRIDA操作手册》by @hluwa @r0ysue

详解Hook框架frida，让你在逆向工作中效率成倍提升 - 知乎

Android Hook工具之Frida 基础使用 - 简书

Understanding ELF using readelf and objdump (studylib.net)

Executable and Linkable Format (ELF) (netmeister.org)

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-02 17:14:32