Hi, I've installed and used Frida on my Gentoo system, which works fine without any problems, but just lately I've also tried to install and use it on one of the latest 64-bit Ubuntu systems, which resulted in Frida terminating the target process, which was supposed to analyze. The details are attached below.
>>> import frida
>>> session = frida.attach("cat")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/usr/local/lib/python2.7/dist-packages/frida/__init__.py", line 55, in attach
return get_local_device().attach(target)
File "/usr/local/lib/python2.7/dist-packages/frida/core.py", line 87, in attach
return Session(self._impl.attach(self._pid_of(target)))
frida.ProcessNotRespondingError: timed out while waiting for session to establish
>>> session = frida.attach("cat")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/usr/local/lib/python2.7/dist-packages/frida/__init__.py", line 55, in attach
return get_local_device().attach(target)
File "/usr/local/lib/python2.7/dist-packages/frida/core.py", line 87, in attach
return Session(self._impl.attach(self._pid_of(target)))
frida.ProcessNotRespondingError: timed out while waiting for session to establish
Below, the core dump has been analyzed and useful information printed for debugging purposes and finding the culprit of the problem.
# gdb /bin/cat core
Core was generated by `cat'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f5dc8d6a912 in _dl_lookup_symbol_x (undef_name=0x7f5dc8f7e440 "frida_agent_main", undef_map=0x0, ref=0x7f5dc84b2ee8, symbol_scope=0x388, version=0x0, type_class=0, flags=2, skip_map=0x0) at dl-lookup.c:731
731 dl-lookup.c: No such file or directory.
(gdb) backtrace full
#0 0x00007f5dc8d6a912 in _dl_lookup_symbol_x (undef_name=0x7f5dc8f7e440 "frida_agent_main", undef_map=0x0, ref=0x7f5dc84b2ee8, symbol_scope=0x388, version=0x0, type_class=0, flags=2, skip_map=0x0) at dl-lookup.c:731
new_hash = 1845031485
old_hash = 4294967295
current_value = {s = 0x0, m = 0x0}
scope = 0x388
__PRETTY_FUNCTION__ = "_dl_lookup_symbol_x"
i = 0
protected = <optimized out>
#1 0x00007f5dc8ad1145 in do_dlsym (ptr=ptr@entry=0x7f5dc84b2ed0) at dl-libc.c:97
args = 0x7f5dc84b2ed0
#2 0x00007f5dc8d6fff4 in _dl_catch_error (objname=0x7f5dc84b2eb0, errstring=0x7f5dc84b2ec0, mallocedp=0x7f5dc84b2ea0, operate=0x7f5dc8ad1100 <do_dlsym>, args=0x7f5dc84b2ed0) at dl-error.c:187
errcode = 0
c = {objname = 0x7f5dc84b2eb0, errstring = 0x7f5dc84b2ec0, malloced = 0x7f5dc84b2ea0, errcode = 0x7f5dc84b2da4, env = {{__jmpbuf = {0, 6355741775290325035, 0, 0, 140040769059264, 140040769058560, 6355741775363725355, 6355740449778980907}, __mask_was_saved = 0, __saved_mask = {__val = {0, 0, 4294967296, 0,
0, 0, 0, 0, 0, 140040771260656, 0, 140040769058560, 140040769056528, 0, 0, 140040769059264}}}}}
catchp = 0x7f5dc84b36f8
old = <optimized out>
#3 0x00007f5dc8ad1249 in dlerror_run (args=0x7f5dc84b2ed0, operate=0x7f5dc8ad1100 <do_dlsym>) at dl-libc.c:46
objname = 0x7f5dc0002f40 "/usr/lib/x86_64-linux-gnu/libstdc++.so.6"
last_errstring = 0x0
malloced = true
result = <optimized out>
#4 __GI___libc_dlsym (map=<optimized out>, name=<optimized out>) at dl-libc.c:210
args = {map = 0x0, name = 0x7f5dc8f7e440 "frida_agent_main", loadbase = 0x7f5dc8f7e0ed, ref = 0x0}
#5 0x00007f5dc8f7e10a in ?? ()
No symbol table info available.
#6 0x0000000000000000 in ?? ()
No symbol table info available.
(gdb) info registers
rax 0x388 904
rbx 0x7f5dc84b2ee8 140040769056488
rcx 0xdbc0f6cb154e7de0 -2611816431778628128
rdx 0x7f5dc8f7e450 140040780375120
rsi 0x0 0
rdi 0x7f5dc8f7e440 140040780375104
rbp 0x7f5dc84b2d30 0x7f5dc84b2d30
rsp 0x7f5dc84b2c10 0x7f5dc84b2c10
r8 0x0 0
r9 0x0 0
r10 0x64747362696c2f75 7238537367603916661
r11 0x200 512
r12 0x0 0
r13 0x0 0
r14 0xda9efe816df8f23d -2693435695271710147
r15 0x0 0
rip 0x7f5dc8d6a912 0x7f5dc8d6a912 <_dl_lookup_symbol_x+178>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
(gdb) x/16i $pc
=> 0x7f5dc8d6a912 <_dl_lookup_symbol_x+178>: mov (%rax),%r9
0x7f5dc8d6a915 <_dl_lookup_symbol_x+181>: jne 0x7f5dc8d6ab20 <_dl_lookup_symbol_x+704>
0x7f5dc8d6a91b <_dl_lookup_symbol_x+187>: test %r9,%r9
0x7f5dc8d6a91e <_dl_lookup_symbol_x+190>: je 0x7f5dc8d6b159 <_dl_lookup_symbol_x+2297>
0x7f5dc8d6a924 <_dl_lookup_symbol_x+196>: mov %rax,%r10
0x7f5dc8d6a927 <_dl_lookup_symbol_x+199>: lea -0x90(%rbp),%rax
0x7f5dc8d6a92e <_dl_lookup_symbol_x+206>: mov %r10,%r14
0x7f5dc8d6a931 <_dl_lookup_symbol_x+209>: mov %rax,-0xc0(%rbp)
0x7f5dc8d6a938 <_dl_lookup_symbol_x+216>: lea -0xa0(%rbp),%rax
0x7f5dc8d6a93f <_dl_lookup_symbol_x+223>: mov %rax,-0xb8(%rbp)
0x7f5dc8d6a946 <_dl_lookup_symbol_x+230>: mov 0x10(%rbp),%eax
0x7f5dc8d6a949 <_dl_lookup_symbol_x+233>: mov -0xc0(%rbp),%r8
0x7f5dc8d6a950 <_dl_lookup_symbol_x+240>: mov (%rbx),%rcx
0x7f5dc8d6a953 <_dl_lookup_symbol_x+243>: mov -0xb8(%rbp),%rdx
0x7f5dc8d6a95a <_dl_lookup_symbol_x+250>: mov -0xb0(%rbp),%rsi
0x7f5dc8d6a961 <_dl_lookup_symbol_x+257>: mov -0xa8(%rbp),%rdi
(gdb) thread apply all backtrace
Thread 2 (Thread 0x7f5dc8f54740 (LWP 15710)):
#0 0x00007f5dc8a86810 in __read_nocancel () at ../sysdeps/unix/syscall-template.S:81
#1 0x0000000000404e46 in ?? ()
#2 0x00000000004024cf in ?? ()
#3 0x00007f5dc89bcec5 in __libc_start_main (main=0x401a40, argc=1, argv=0x7fffea5eae18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffea5eae08) at libc-start.c:287
#4 0x000000000040262b in ?? ()
Thread 1 (Thread 0x7f5dc84b3700 (LWP 15711)):
#0 0x00007f5dc8d6a912 in _dl_lookup_symbol_x (undef_name=0x7f5dc8f7e440 "frida_agent_main", undef_map=0x0, ref=0x7f5dc84b2ee8, symbol_scope=0x388, version=0x0, type_class=0, flags=2, skip_map=0x0) at dl-lookup.c:731
#1 0x00007f5dc8ad1145 in do_dlsym (ptr=ptr@entry=0x7f5dc84b2ed0) at dl-libc.c:97
#2 0x00007f5dc8d6fff4 in _dl_catch_error (objname=0x7f5dc84b2eb0, errstring=0x7f5dc84b2ec0, mallocedp=0x7f5dc84b2ea0, operate=0x7f5dc8ad1100 <do_dlsym>, args=0x7f5dc84b2ed0) at dl-error.c:187
#3 0x00007f5dc8ad1249 in dlerror_run (args=0x7f5dc84b2ed0, operate=0x7f5dc8ad1100 <do_dlsym>) at dl-libc.c:46
#4 __GI___libc_dlsym (map=<optimized out>, name=<optimized out>) at dl-libc.c:210
#5 0x00007f5dc8f7e10a in ?? ()
#6 0x0000000000000000 in ?? ()
(gdb) quit
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent