Skip to content

Dump libil2cpp.so failed: access violation accessing 0x79acb94000 #16

@79t1ckz

Description

@79t1ckz

我遇到一个样本,用脚本dump失效。 如下是本人摘取的分析片段

[so-dump] found libil2cpp.so!
[so-dump] base = 0x79a5401000, end = 0x79acbb0000
...
[shell]-> var page = Process.findRangeByAddress(ptr(0x79acb94000))
[shell]-> page.base
"0x79acb94000"
[shell]-> page.protection
"---"

样本疑似在模块内存中塞了一个不可访问的内存来防dump,作者有兴趣改进脚本吗

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions