trace android binder call from binderproxy
4 views
7d740dc3...
Description
add trace for binder call from binderproxy, use this feature to figure out which binder interface it calls
How to Use
Download the script and run it with Frida CLI:
Download ScriptThen run with Frida:
frida -U -f YOUR_PACKAGE_NAME -l trace-android-binder-call-from-binderproxy.js
Replace YOUR_PACKAGE_NAME with the target app's package name.
Source Code
JavaScript
// used to show which binder call did callers made instead of just showing binder transaction/reply in perfetto trace
Java.perform(() => {
// used to add trace
const Trace = Java.use('android.os.Trace');
// used to get callstack
const Thread = Java.use('java.lang.Thread');
// used to hook binder call from binder proxy
const BinderProxy = Java.use('android.os.BinderProxy');
// hook transact of BinderProxy
BinderProxy.transact.implementation = function(...args) {
// get callstacks
const stacktrace = Thread.currentThread().getStackTrace();
// the binder call is in the 4th line
const callingStack = stacktrace[3];
// begin trace
Trace.beginSection(callingStack.toString());
// call
var result = this.transact(...args);
// end trace
Trace.endSection();
// return
return result;
};
})
Comments