Skip to content

Dump libil2cpp.so failed: access violation accessing 0x79acb94000 #16

Description

@79t1ckz

我遇到一个样本,用脚本dump失效。 如下是本人摘取的分析片段

[so-dump] found libil2cpp.so!
[so-dump] base = 0x79a5401000, end = 0x79acbb0000
...
[shell]-> var page = Process.findRangeByAddress(ptr(0x79acb94000))
[shell]-> page.base
"0x79acb94000"
[shell]-> page.protection
"---"

样本疑似在模块内存中塞了一个不可访问的内存来防dump,作者有兴趣改进脚本吗

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions