frida-core icon indicating copy to clipboard operation
frida-core copied to clipboard

Unable to connect to the frida server: unexpected error while probing dyld of target process

Open imaverick1337 opened this issue 10 months ago • 4 comments

frida is capable to list the device:

1757  Files                                  com.apple.DocumentsApp
1754  Find My                                com.apple.findmy
1797  MobileSMS                              com.apple.MobileSMS
2167  MobileSafari                           com.apple.mobilesafari
1795  Music                                  com.apple.Music
1690  Search                                 com.apple.Spotlight
2168  Settings                               com.apple.Preferences
1796  Tips                                   com.apple.tips
1794  TrollStore                             com.opa334.TrollStore
1756  Watch                                  com.apple.Bridge

But when I launch frida, following error occurs: Image

imaverick1337 avatar Feb 27 '25 13:02 imaverick1337

This is an issue with the code that seeks back from the pages starting at _dyld_start (https://github.com/frida/frida-core/blob/9594e1a8b81f151f49dedafeca1d85a33654137c/src/darwin/frida-helper-backend-glue.m#L1999-L2015). Because on Dopamine 2.4+ dyld is merged together with the stock dyld and a custom dylib, there are three mach headers and the code finds the wrong one (it finds the first one going back, but it should find the last one going back). I have fixed this (in a currently unreleased build) by replacing the magics of the two wrong headers, which makes it work again, however I would argue that the logic is still wrong, it might be a better idea to get the dyld boundary using vm_recurse and then use the base from that.

opa334 avatar Mar 06 '25 19:03 opa334

Thank you for the insights.

Initially i jailbreak with dopamine and was facing the above issue, jailbroke with winra1n and now frida is working fine.

imaverick1337 avatar Mar 09 '25 06:03 imaverick1337

'hide jailbreak' in dopamine fixes this

STUPIDCONTEM avatar Apr 04 '25 02:04 STUPIDCONTEM

Fff

195tiko avatar May 19 '25 19:05 195tiko