Full featured multi arch/os debugger built on top of PyQt5 and frida

Overview

Dwarf

PyPI pyversions PyPI version shields.io GitHub license GitHub issues

A debugger for reverse engineers, crackers and security analyst. Or you can call it damn, why are raspberries so fluffy or yet, duck warriors are rich as fuck. Whatever you like! Built on top of pyqt5, frida and some terrible code.

Known Issues

  • JavaTraceView is distorted
  • JavaTraceView shows weakref/handle instead of value

We are working on Dwarf 2.0 release

Installation

pip3 install dwarf-debugger

Development

pip3 install https://github.com/iGio90/Dwarf/archive/master.zip

Usage

Debugging UI (attach wizard)

dwarf

Debugging UI (straightforward)

dwarf -t android com.facebook.katana
dwarf -t android 2145
dwarf -t ios 2145
dwarf -t local /usr/bin/cat /etc/shadow

Debugging UI (own agent)

dwarf -t android -s /path/to/agent.js com.facebook.katana
dwarf -t local -s /path/to/agent.js /usr/bin/cat /etc/shadow

Dwarf typings + injector

$ dwarf-creator
project path (/home/igio90/test):
> 
project name (test):
> 
Session type (local)
[*] L (local)
[*] A (android)
[*] I (iOS)
[*] R (remote)

append i to use dwarf-injector (ai | android inject)
> ai
target package (com.whatsapp)
> com.whatsapp

$ (./intelliJ || ./vsCode).open(/home/igio90/test)
    .echo('enjoy scripting with frida and dwarf api autocompletition and in-line doc')

$ ./dwarf if myOs == 'unix' else 'dwarf.bat'

Dwarf trace

dwarf-trace -t android --java java.io.File.$init com.facebook.katana

* Trying to spawn com.facebook.katana
* Dwarf attached to 19337
java.io.File $init
    /data  - java.io.File
    misc

java.io.File $init
    /data/misc  - java.io.File
    user

...
dwarf-trace -t android --native --native-registers x0,x1,sp open+0x32
dwarf-trace -t android --native --native-registers x0,x1,sp targetModule@0x1234
dwarf-trace -t android --native --native-registers x0,x1,sp 0xdc00d0d0
dwarf-trace -t android --native --native-registers x0,x1,sp popen





Javascript | License | Become a patron | Slack

Comments
  • Can this software be installed on my Windows 10?

    Can this software be installed on my Windows 10?

    Hi, dude. I love this software and I installed it on my Mac. But I wonder if this can be installed on Windows 10? Sorry for my bad English. Thank you.

    opened by pharazone 68
  • Error installing frida on Android

    Error installing frida on Android

    Hi, I tried to automatically install frida on the device but it seems not working I've tried on a Nexus 5 with 5.1 and on a Pixel XL with android 8 rooted with Magisk from Ubuntu my steps are: I start Dwarf select Android A dwarf USB session window opens with a red bar saying waiting for device and a button install frida I click on install frida, a series of messages appear once done on the red bar appears a dropdown menu with 2 entries of Pixel XL If I try again Install frida more pixel xl entries appear in the dropdown menu I checked on the device and frida is not running nor installed

    opened by matbrik 15
  • There are too many same classes.

    There are too many same classes.

    Describe the bug There are too many same classes.

    To Reproduce Steps to reproduce the behavior:

    1. Attach android app whose package is "com.example.myapplication"
    2. Click on 'Java->Trace'
    3. search "MainActivity"
    4. See some same classes.

    Expected behavior For each, there should be only one class.

    Screenshots burning

    Desktop (please complete the following information):

    • OS: Ubuntu
    • Version 20.04

    Smartphone (please complete the following information):

    • OS: Android10
    opened by BurningTeng 11
  • empty debug window

    empty debug window

    i put a breakpoint on class constructor, breakpoint gets hit but everything is blank!!

    
    02:35:04 [ERROR-LogicJava.hook] Error: java.lang.ClassNotFoundException: Didn't find class "com.whatsapp.jobqueue.job" on path: DexPathList[[zip file "/system/framework/org.apache.http.legacy.boot.jar", zip file "/data/app/com.whatsapp-LqLY5Xrpfu9W8PvMcn2vHg==/base.apk"],nativeLibraryDirectories=[/data/app/com.whatsapp-LqLY5Xrpfu9W8PvMcn2vHg==/lib/arm64, /data/app/com.whatsapp-LqLY5Xrpfu9W8PvMcn2vHg==/base.apk!/lib/arm64-v8a, /system/lib64]]
    02:35:12 [ERROR-jvmExplorer-2] TypeError: Cannot read property '$className' of undefined
    02:35:12 [ERROR-jvmExplorer-2] TypeError: Cannot read property '$className' of undefined
    02:35:12 [ERROR-jvmExplorer-2] TypeError: Cannot read property '$className' of undefined
    02:35:12 [ERROR-jvmExplorer-2] TypeError: Cannot read property '$className' of undefined
    02:35:12 [ERROR-jvmExplorer-2] TypeError: Cannot read property '$className' of undefined
    02:35:12 [ERROR-jvmExplorer-2] TypeError: Cannot read property '$className' of undefined
    
    opened by 0x410c 11
  • Error message is shown when adding breakpoint for export function at first time

    Error message is shown when adding breakpoint for export function at first time

    Describe the bug Error message is shown when adding breakpoint of export function at first time. Error message is below.

    TypeError: not a function at attach (/script1.js:3640) at putNativeBreakpoint (/script1.js:3872) at putBreakpoint (/script1.js:3854) at putBreakpoint (/script1.js:2126) at apply (native) at api (/script1.js:3508) at apply (native) at (frida/runtime/message-dispatcher.js:13) at c (frida/runtime/message-dispatcher.js:23)

    To Reproduce Steps to reproduce the behavior:

    1. Attach android app whose package is "com.jingdong.app.mall"
    2. Click on View->Panels->Modules
    3. Add breakpoint for export function "Java_com_jingdong_common_utils_BitmapkitUtils_getSignFromJni" at first time
    4. The error message is shown.
    5. Add breakpoint again, the console will print "0xc0b4a8b5 already has a breakpoint"
    6. When I run app to trigger breakpoint, the breakpoint doesn't work. But following message will be shown:

    19:32:31.758101 @thread 18321 loading class := com.tencent.smtt.net.AwNetworkUtils 19:32:34.505922 @thread 18048 loading class := com.jd.lib.search.view.Activity.SearchActivity 19:32:53.064365 @thread 18048 loading class := com.jd.lib.search.view.holder.tip.a 19:32:53.065138 @thread 18048 loading class := com.jd.lib.search.view.adapter.cw 19:32:53.068883 @thread 18048 loading class := com.jd.lib.search.view.holder.tip.b 19:32:53.072689 @thread 18048 loading class := com.jd.lib.search.view.adapter.cw$a 19:33:00.650688 @thread 18048 loading class := com.jd.lib.search.view.Activity.ProductListActivity

    Expected behavior No error message and breakpoint can work.

    Screenshots burning

    Desktop (please complete the following information):

    • OS: Ubuntu
    • Version 20.04

    Smartphone (please complete the following information):

    • OS: Android 10
    opened by BurningTeng 9
  • IOS not supported ???

    IOS not supported ???

    Hello,

    It's me, again :). I'm trying to use DWARF with my iphone, and... I cannot even click on the apple button. If I press the Android Button, I can see a green ruban saying "Iphone Connected" but the tools does not give me any options.

    Thanks a lot,

    • Wally
    opened by folkene 9
  • Not Able to launch

    Not Able to launch

    PS D:\Tools for Testing\Dwarf\Dwarf> python .\dwarf.py adb: True dev/emu: True su: True root: False

    at least 3x True required Traceback (most recent call last): File ".\dwarf.py", line 41, in app_window = AppWindow(args) File "D:\Tools for Testing\Dwarf\Dwarf\ui\app.py", line 36, in init self.dwarf = Dwarf(self) File "D:\Tools for Testing\Dwarf\Dwarf\lib\core.py", line 80, in init self.script_manager = ScriptsManager(self) File "D:\Tools for Testing\Dwarf\Dwarf\lib\scripts_manager.py", line 24, in init self.update_scripts() File "D:\Tools for Testing\Dwarf\Dwarf\lib\scripts_manager.py", line 27, in update_scripts scripts = self.dwarf.get_git().get_dwarf_scripts()
    AttributeError: 'NoneType' object has no attribute 'replace'

    opened by mohittyagi11 9
  • the decompiler output is wrong

    the decompiler output is wrong

    Describe the bug the decompiler output is different with ida

    To Reproduce Steps to reproduce the behavior:

    1. open an app with dwarf

    Expected behavior the decompiler should output the correct asm code Screenshots the wrong output image the correct output image

    Desktop (please complete the following information):

    • OS: win10

    Smartphone (please complete the following information):

    • Device: mi6x
    • OS:android 6.0
    opened by jambooid 8
  • Empty spawn and procs

    Empty spawn and procs

    Phone: Nexus 5X - Android 8.1.0 root: magisk (Magisk Hide -> OFF) frida: last (v12.8.20) Python: 3.8.1 (Pyenv) In virtualenv installed last frida-tools and Dwarf (git clone)

    If execute frida-ps -U in terminal, there is a list of processes Dwarf empty process list

    opened by 4val0v 8
  • ReferenceError: breakpoint is not defined

    ReferenceError: breakpoint is not defined

    I am getting the error in the title when breakpoint() is executed. Here is how the command: Interceptor.attach(Module.findBaseAddress("libhello-jni.so").add(0x1161),function(arg) {console.log("hit");breakpoint()});

    Also, I am getting the same error as #88 when I run api.nativeBacktrace(); So I followed all the instructions there:

    • frida & frida server changed to 12.x
    • "disable_local_frida_update":true to prevent autoupdate
    • self._script = self._process.create_script(script_content, runtime='v8')
    • also made sure that "memPtr = ptr(address);" is fixed as per the patch in core.js
    • attached apk and source code (example hello-jni with a button to re-run the lib, apk located in hello3\app\debug\app-debug.apk) hello3.zip

    image

    The above command works for armv7 only, the following command should work on any arch: Interceptor.attach(Module.findExportByName("libhello-jni.so","getStr"),function(arg) {console.log("hit");breakpoint()});

    opened by wahibimoh 7
  • Remounting /system fails because it's missing in /proc/mounts

    Remounting /system fails because it's missing in /proc/mounts

    I am running OxygenOS 10.5.4 (OnePlus stock OS) with a Magisk patched bootloader. Dwarf provides a way to automatically install frida into /system. One of the steps is remounting /system to make it writeable which fails on my device.

    # mount -o rw,remount /system
    mount: '/system' not in /proc/mounts
    
    # cat /proc/mounts | grep system
    /sbin/.magisk/block/system_root /sbin/.magisk/mirror/system_root ext4 ro,seclabel,relatime,discard 0 0
    /sbin/.magisk/block/system_root /sbin/wlchg ext4 ro,seclabel,relatime,discard 0 0
    /sbin/.magisk/block/system_root /sbin/dashd ext4 ro,seclabel,relatime,discard 0 0
    /dev/block/loop2 /system/reserve ext4 ro,context=u:object_r:system_file:s0,relatime 0 0
    

    I know that Dwarf does have a check for /system_root, but it does not seem to work in my case, since it just sets the system partition's name to /system_root which doesn't even exist.

    I'm happy to share any further logs if needed.

    opened by sn0opy 7
Owner
iGio90
iGio90
iOS & tvOS multi-emulator frontend, supporting various Atari, Bandai, NEC, Nintendo, Sega, SNK and Sony console systems

iOS & tvOS multi-emulator frontend, supporting various Atari, Bandai, NEC, Nintendo, Sega, SNK and Sony console systems… Get Started: https://wiki.provenance-emu.com |

Provenance Emu 5.1k Dec 31, 2022
nds4ios is a port of the multi-platform Nintendo DS emulator, DeSmuME to iOS.

nds4ios Supports iOS 6 to iOS 9. nds4ios is a port of the multi-platform Nintendo DS emulator, DeSmuME to iOS. Currently, emulation is powered by a th

Kevin 162 Dec 25, 2022
AuroraEditor is a IDE built by the community, for the community, and written in Swift for the best native performance and feel for macOS.

AuroraEditor AuroraEditor is a IDE built by the community, for the community, and written in Swift for the best native performance and feel for macOS.

Aurora Editor 704 Jan 8, 2023
Wiggles-iOS - Beautiful Puppy adoption app built to Demonstrate the SwiftUI and MVVM Architecture

Wiggles ?? Beautiful Puppy adoption app built to Demonstrate the use of SwiftUI

Sameer Nawaz 186 Dec 18, 2022
Tofu - A simple Todo app built with SwiftUI, a REST API, and a local Realm cache

Tofu A simple Todo app built with SwiftUI, a REST API, and a local Realm cache.

Brianna Zamora 1 Feb 23, 2022
This was built during my bootcamp using SwiftUI, WebKit and an API from Hacker News

HackerNewsReader This was built during my bootcamp using SwiftUI, WebKit and an API from Hacker News. This was programmed from scratch with SwiftUI. I

Wilson Woodyard 2 Feb 25, 2022
an onboarding app built in SwiftUI

hello hello is application onboarding macOS devices. Inspired by Kandji's Liftoff Logo created with Type with Pride font family Warning DO NOT USE THI

Erik Gomez 118 Dec 26, 2022
A collection of Swift Tutorials built with Apple's DocC.

Swift Tutorials This is not a package, it's just a bunch of tutorials This project uses Apple's DocC (Documentation Compiler) to create a set of Swift

Swift Innovators Network 11 Aug 9, 2022
A web API client in Swift built using Async/Await

Web API Client A modern web API client in Swift built using Async/Await and Actors. let client = APIClient(host: "api.github.com") // Using the clien

Alexander Grebenyuk 741 Dec 30, 2022
Food Recipes App Built With Swift

Food Recipes Application This is my first IOS App. The first page is sign in and sign up page. I controll informations with regex in sign up page. If

Buse Köseoğlu 1 Dec 17, 2021
Home Assistant Native iOS Application built with SwiftUI for iOS 15+

Home Assistant - Native iOS SwiftUI Application Screenshots Disclaimer - Please read This application is mostly a not-working mockup written in SwiftU

Alessio Santoru 34 Dec 13, 2022
A developer-focused Meetup clone built with React Native

Assemblies Where Developers Connect Assemblies is an open-source mobile app built with React Native which developers can use to connect through 'assem

Build React Native 360 Dec 7, 2022
CurrencyConverter - Currency Converter App Built With Swift

CurrencyConverter Stack: Xcode 12.5.1 iOS 14.5 UIkit iOS deployment target: 13.0

Nikita Yarosh 2 Sep 4, 2022
GitHub in your pocket. Built with React Native

GitPoint GitHub in your pocket. Built with React Native. Table of Contents Introduction Features Feedback Contributors Build Process Backers Sponsors

GitPoint 4.6k Jan 1, 2023
React Native utility library around image and video files for getting metadata like MIME type, timestamp, duration, and dimensions. Works on iOS and Android using Java and Obj-C, instead of Node 🚀.

Qeepsake React Native File Utils Extracts information from image and video files including MIME type, duration (video), dimensions, and timestamp. The

Qeepsake 12 Oct 19, 2022
LinkedLog is a Xcode plugin that includes a Xcode PCH header file template that adds the macros `LLog` and `LLogF` and parses their output to link from the console to the corresponding file and line.

LinkedLog Xcode Plugin LinkedLog is a Xcode plugin that includes a Xcode PCH file template that adds the macros LLog and LLogF. The LLog macro will wo

Julian F. Weinert 22 Nov 14, 2022
BioViewer - Protein (.pdb, .cif and .fasta) viewer for iPhone, iPad and Mac, using SwiftUI + SceneKit

BioViewer - Protein (.pdb, .cif and .fasta) viewer for iPhone, iPad and Mac, using SwiftUI + SceneKit

Raúl Montón 16 Dec 21, 2022
Custom MacBook login screen and pam modules using multipeer connectivity and usb hardware checks with iOS app for sign in.

Custom MacBook login screen and pam modules using multipeer connectivity and usb hardware checks with iOS app for sign in.

null 2 Aug 17, 2022
A simple, reliable and scalable delivery API for transactional push notifications for websites and applications

Catapush is a simple, reliable and scalable delivery API for transactional push notifications for websites and applications. Ideal for sending data-dr

Catapush 0 Dec 29, 2021