Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bug] A Frida agent exception has occurred cannot read property 'address' of undefined #361

Closed
OsamaMahmood opened this issue Apr 14, 2020 · 17 comments
Labels

Comments

@OsamaMahmood
Copy link

OsamaMahmood commented Apr 14, 2020

Describe the bug
When i try to watch any method of a class i ran into this error after that i updated my Frida and objection framework to see if the issue gets resolved but still getting the same error.

WARNING: Ignoring this template and not completing the fields could result in your issue simply being closed.

To Reproduce
Steps to reproduce the behavior:

  1. Run command 'ios hooking set return_value "-[FIRGetAccountInfoResponseUser emailVerified:]" true'

  2. ios hooking watch method "-[FIRSecureTokenRequest APIKey:]" --dump-args

Both Commands result into same error.
Expected behavior
A clear and concise description of what you expected to happen.

Evidence / Logs / Screenshots
Any output from objection, such as stack traces or errors that occurred. Be sure to run objection with the --debug flag so that errors from the agent are verbose enough to debug. For example:
Getting this error when trying to dump arguments of a method call

A Frida agent exception has occurred.
TypeError: cannot read property 'address' of undefined
at [anon] (../../../frida-gum/bindings/gumjs/duktape.c:56618)
at /script1.js:10272
at frida/runtime/message-dispatcher.js:15
at o (frida/runtime/message-dispatcher.js:25)

Python stack trace: Traceback (most recent call last):
File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/objection/console/repl.py", line 371, in start_repl
self.run_command(document)
File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/objection/console/repl.py", line 185, in run_command
exec_method(arguments)
File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/objection/commands/ios/hooking.py", line 234, in watch_class_method
api.ios_hooking_watch_method(selector,
File "/Users/osamamahmood/Library/Python/3.8/lib/python/site-packages/frida/core.py", line 401, in method
return script._rpc_request('call', js_name, args, **kwargs)
File "/Users/osamamahmood/Library/Python/3.8/lib/python/site-packages/frida/core.py", line 26, in wrapper
return f(*args, **kwargs)
File "/Users/osamamahmood/Library/Python/3.8/lib/python/site-packages/frida/core.py", line 333, in _rpc_request
raise result[2]
frida.core.RPCException: TypeError: cannot read property 'address' of undefined
at [anon] (../../../frida-gum/bindings/gumjs/duktape.c:56618)
at /script1.js:10272
at frida/runtime/message-dispatcher.js:15
at o (frida/runtime/message-dispatcher.js:25)

Environment (please complete the following information):

  • Device: iPhone X
  • OS: iOS 13.4
  • Frida Version 12.8.20
  • Objection Version 1..9.1
@OsamaMahmood OsamaMahmood added the freshissue Default label for new, untriaged issues. label Apr 14, 2020
@leonjza
Copy link
Member

leonjza commented Apr 14, 2020

Please run objection with the --debug flag and paste that stack trace.

@OsamaMahmood
Copy link
Author

OsamaMahmood commented Apr 14, 2020

objection --debug explore                 
[debug] Agent path is: /Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/objection/agent.js
[debug] Injecting agent...
Using USB device `iPhone`
[debug] Attempting to attach to process: `Gadget`
[debug] Unable to find process: `Gadget`, attempting spawn
Unable to connect to the frida server: unable to launch iOS app: The operation couldn’t be completed. Application "Gadget" is unknown to FrontBoard.
Exception ignored in: <function Pool.__del__ at 0x105b85dc0>
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/pool.py", line 268, in __del__
    self._change_notifier.put(None)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/queues.py", line 368, in put
    self._writer.send_bytes(obj)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/connection.py", line 200, in send_bytes
    self._send_bytes(m[offset:offset + size])
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/connection.py", line 411, in _send_bytes
    self._send(header + buf)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/connection.py", line 368, in _send
    n = write(self._handle, buf)
OSError: [Errno 9] Bad file descriptor

@leonjza
Copy link
Member

leonjza commented Apr 14, 2020

And then run your commands after that please.

@OsamaMahmood
Copy link
Author

When i run objection with --debug flag it closes after giving this stack trace.

@OsamaMahmood
Copy link
Author

OsamaMahmood commented Apr 14, 2020

Even when I run objection version it gives this stack trace after printing out the version.

objection version                           
objection: 1.9.1
Exception ignored in: <function Pool.__del__ at 0x112b11dc0>
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/pool.py", line 268, in __del__
    self._change_notifier.put(None)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/queues.py", line 368, in put
    self._writer.send_bytes(obj)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/connection.py", line 200, in send_bytes
    self._send_bytes(m[offset:offset + size])
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/connection.py", line 411, in _send_bytes
    self._send(header + buf)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/multiprocessing/connection.py", line 368, in _send
    n = write(self._handle, buf)
OSError: [Errno 9] Bad file descriptor

@leonjza
Copy link
Member

leonjza commented Apr 14, 2020

[debug] Unable to find process: Gadget, attempting spawn

The error says it cant find the gadget. Is the app running?

@OsamaMahmood
Copy link
Author

here is the stack trace in debug mode:

app.app on (iPhone: 13.4) [usb] # ios hooking watch method "-[FIRSecureTokenRequest APIKey:]" --dump-args
A Frida agent exception has occurred.
TypeError: cannot read property 'address' of undefined
    at [anon] (../../../frida-gum/bindings/gumjs/duktape.c:56618)
    at src/ios/hooking.ts:54
    at frida/runtime/message-dispatcher.js:15
    at o (frida/runtime/message-dispatcher.js:25)

Python stack trace: Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/objection/console/repl.py", line 371, in start_repl
    self.run_command(document)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/objection/console/repl.py", line 185, in run_command
    exec_method(arguments)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/objection/commands/ios/hooking.py", line 234, in watch_class_method
    api.ios_hooking_watch_method(selector,
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/frida/core.py", line 401, in method
    return script._rpc_request('call', js_name, args, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/frida/core.py", line 26, in wrapper
    return f(*args, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/frida/core.py", line 333, in _rpc_request
    raise result[2]
frida.core.RPCException: TypeError: cannot read property 'address' of undefined
    at [anon] (../../../frida-gum/bindings/gumjs/duktape.c:56618)
    at src/ios/hooking.ts:54
    at frida/runtime/message-dispatcher.js:15
    at o (frida/runtime/message-dispatcher.js:25)

@leonjza leonjza added 🐛bug and removed freshissue Default label for new, untriaged issues. labels Apr 17, 2020
@OsamaMahmood
Copy link
Author

@leonjza any update on this?

@leonjza
Copy link
Member

leonjza commented May 7, 2020

Just tested this, I can only replicate it when I try and watch a selector which the ApiResolver could not find. Are you sure you have the selector right there?

I am going to add better error reporting for this case shortly.

leonjza added a commit that referenced this issue May 7, 2020
Improves error reporting for cases like #361
@OsamaMahmood
Copy link
Author

Yes the selector is there, that will be great to better understand what is causing this error.

@leonjza
Copy link
Member

leonjza commented May 7, 2020

It could be that you are trying to watch an instance method when in fact you are after a class method. Try swapping out the - for a +.

@hax0rgb
Copy link

hax0rgb commented May 19, 2020

Even I'm facing the same issue when running objection on Mac osx :/

@leonjza
Copy link
Member

leonjza commented May 20, 2020

The command invokes this logic to find your method. Maybe write a small Frida script to replicate that for your target to help you debug the name?

@MarshalX

This comment has been minimized.

@leonjza
Copy link
Member

leonjza commented Jun 6, 2020

@MarshalX that is unrelated to this ticket. I will reference a new issue for it as this is related to the update checker.

@MarshalX
Copy link
Contributor

MarshalX commented Jun 6, 2020

@MarshalX that is unrelated to this ticket. I will reference a new issue for it as this is related to the update checker.

the same exception #361 (comment) in this ticket

@leonjza
Copy link
Member

leonjza commented Jun 6, 2020

the same exception #361 (comment) in this ticket

Which can be discussed in #381 now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants