{"id":8277,"date":"2015-09-12T08:36:03","date_gmt":"2015-09-12T08:36:03","guid":{"rendered":"http:\/\/tajdini.net\/blog\/2015\/09\/12\/android-memory-plaintext-var\/"},"modified":"2020-12-20T11:17:55","modified_gmt":"2020-12-20T09:17:55","slug":"android-memory-plaintext-var","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/technology-notes\/android-memory-plaintext-var\/","title":{"rendered":"\u06a9\u0634\u0641 \u0645\u0642\u0627\u06cc\u0631 \u0645\u062a\u063a\u06cc\u0631 \u0647\u0627\u06cc Plain Text \u0627\u0632 \u062d\u0627\u0641\u0638\u0647 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0639\u0627\u0645\u0644 \u0627\u0646\u062f\u0631\u0648\u06cc\u062f"},"content":{"rendered":"

\t1. Upload the file$ adb push gdbserver \/sdcard <\/span><\/span>
\t
\t2. Enter a shell and become root<\/span>
\t$ adb shell<\/span>
\t$ su<\/span>
\t
\t3. Remount \/system as read\/write<\/span>
\t$ mount -o rw,remount \/system<\/span>
\t
\t4. Copy file to \/system\/xbin (or \/system\/bin)<\/span>
\t$ cp \/sdcard\/gdbserver \/system\/xbin<\/span>
\t
\t5. Change permissions to ensure that it is executable<\/span>
\t$ chmod 555 \/system\/xbin<\/span>
\t
\t6. Clean up<\/span>
\t$ mount -o ro,remount \/system<\/span>
\t$ rm \/sdcard\/gdbserver<\/span>
\t
\t7. Download and compile gdb<\/span>
\t$ wget http:\/\/ftp.gnu.org\/gnu\/gdb\/gdb-7.7.tar.bz2<\/span>
\t$ bunzip2 gdb-7.7.tar.bz2<\/span>
\t$ tar xf gdb-7.7.tar<\/span>
\t$ cd gdb-7.7\/ <\/span><\/span>
\t$ .\/configure –target=arm-linux-gnueabi<\/span>
\t$ make<\/span>
\t
\t8. Find the keystore pid<\/span>
\t$ ps | grep key<\/span>
\t$ cd \/proc\/228<\/span>
\t
\t9. Find the heap<\/span>
\tWhat we\u2019ll normally find are is the code that makes up the process and its libraries and then a copy of the important bits of the process:<\/span>
\t– heap   – memory assigned by the VM or by the kernel for data storage<\/span>
\t– stack  – memory used during function calls etc.<\/span>
\t So above we can see that the heap runs from 0xb7712000(start of heap) \u2013 0xb771f000(end of heap)<\/span>
\t
\t10. Start gdbserver on the process listening on a port on the device<\/span>
\t$ gdbserver –attach :1234 228<\/span>
\t1234 => any Port<\/span>
\t228 => any PID<\/span>
\t
\t11. Use adb to forward the port on the device to a local port<\/span>
\t$ adb forward tcp:1234 tcp:1234<\/span>
\t
\tThis will now allow us to talk to the device on port 1234\/tcp by connecting to 1234\/tcp on the host device. <\/span><\/span>
\t
\t12. Use a third party program to forward the local port to the device where you will be running gdb<\/span>
\t> Use program “Port Forwarding for Windows\u201d to forward from my native OS to the virtual machine I run gdb on <\/span><\/span>
\t
\t
\t
\t13. Connect via gdb<\/span>
\t$ .\/gdb<\/span>
\t$ gdb> target remote 192.168.0.41:1234 <\/span><\/span>
\t
\t
\t14. Dump the memory<\/span>
\t$ gdb> dump memory \/tmp\/heapout 0xb7712000 0xb771f000 <\/span><\/span>
\t
\t
\t
\t15. Look for some strings that can be user, password<\/span>
\t$ strings \/tmp\/heapout | more <\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

1. Upload the file$ adb push gdbserver \/sdcard  2. Enter a shell and become root $ adb shell $ su 3. Remount \/system as read\/write $ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[233],"tags":[264],"class_list":["post-8277","post","type-post","status-publish","format-standard","hentry","category-technology-notes","tag-persian"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8277"}],"version-history":[{"count":1,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8277\/revisions"}],"predecessor-version":[{"id":8615,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8277\/revisions\/8615"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}