hluwa / wallbreaker

🔨 Break Java Reverse Engineering form Memory World!

Wallbreaker

🔨 Break Java Reverse Engineering form Memory World!

WTF?

Wallbreaker is a useful tool to live analyzing Java heap, powered by frida. Provide some commands to search object or class from the memory, and beautifully visualize the real structure of the target.

Want to know real data content? list item? map entries? Want to know about implementation of the interface? Try it! What you see is what you get!

How to start?

1. Install objection

pip3 install objection

2. Download wallbreaker

mkdir -p ~/.objection/plugins/
git clone https://github.com/hluwa/Wallbreaker ~/.objection/plugins/Wallbreaker

3. Loading as objection plugin

objection -g com.app.name explore -P ~/.objection/plugins

or

objection -g com.app.name explore
plugin load ~/.objection/plugins/Wallbreaker

4. Use wallbreaker command

plugin wallbreaker objectsearch java.util.HashMap
plugin wallbreaker objectdump <object-handle>

Commands

Search

wallbreaker classsearch <type-pattern>

[return all matched class]

wallbreaker objectsearch <instance-class-name>

[return all matched object-handle and toString]

Dump

wallbreaker classdump <class-name> [--fullname]

[
   pretty print class structure: fields declare, static field value, methods declare.
      set --fullname to display package name of type name.
]

wallbreaker objectdump <object-handle> [--fullname] [--as-class class-name]

[
   pretty print object structure: fields declare and value, methods declare.
      set --fullname to display package name of type name;
      set --as-class to cast instance type(super class, not interface).
   if instance is a collection or map, dump all entries.
]

Demo

wallbreaker's Issues

AttributeError: module 'affed49f' has no attribute 'namespace'

葫芦娃，请教问题，不适用wall breaker脚本的时候没有问题，带上脚本就报错。

无法正常使用

问题现象：
可以找到目标，但是无法打印目标的位置,
com.example.myapplication on (google: 7.1.2) [usb] # plugin wallbreaker objectsearch com.e
xample.myapplication.MainActivity
[undefined]: com.example.myapplication.MainActivity@bf5b87c

出现问题环境：
安卓 7.1.2 、8.1
frida 14.0.8
objection 1.9.6

加载插件Wallbreaker总是报错

objection -g com.adidas.app explore -P objection\plugins\Wallbreaker 加载插件Wallbreaker总是报错，加载别外一个插件dexdump是正常的。

What is the best approach to search variables?

Hello, I'm trying to find a variable that is being changed during runtime, I was looking through the Java of the reverse application,but I have no idea how to locate the variable via Wallbreaker since the apllication has lots of classes and objects, what would be the best approach for that?

frida-compile后无法运行

大佬好，我在研究您的项目时遇到了一个问题，即使不对您的项目代码做任何改变，我在运行frida-compile src/index.ts -o _agent.js后，得到的_agent.js 120多KB，您的只有40多KB，除此之外，我自己编译的agent无法顺利运行，不知道出了什么问题。

请问是否支持windows

git clone下来后，在WINDOWS加载插件提示错误
PS C:\Users\Administrator.TKKAM07971D8K4K\Desktop\frida> objection -g com.admin.test explore -P C:\Users\Administrator.TKKAM07971D8K4K\Wallbreaker
Using USB device SM A716S
Agent injected and responds ok!
[plugin] C:\Users\Administrator.TKKAM07971D8K4K\Wallbreaker\agent does not appear to be a valid plugin. Missing init.py
[plugin] C:\Users\Administrator.TKKAM07971D8K4K\Wallbreaker\tests does not appear to be a valid plugin. Missing init.py
Traceback (most recent call last):
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 196, in _run_module_as_main
return _run_code(code, main_globals, None,
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 86, in run_code
exec(code, run_globals)
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\Scripts\objection.exe_main.py", line 7, in
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\lib\site-packages\click\core.py", line 1130, in call
return self.main(*args, **kwargs)
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\lib\site-packages\click\core.py", line 1055, in main
rv = self.invoke(ctx)
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\lib\site-packages\click\core.py", line 1657, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\lib\site-packages\click\core.py", line 1404, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\lib\site-packages\click\core.py", line 760, in invoke
return __callback(*args, **kwargs)
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\lib\site-packages\objection\console\cli.py", line 134, in explore
load_plugin([p.path])
File "C:\Users\Administrator.TKKAM07971D8K4K\AppData\Local\Programs\Python\Python310\lib\site-packages\objection\commands\plugin_manager.py", line 36, in load_plugin
namespace = plugin.namespace
AttributeError: module 'a60e6023' has no attribute 'namespace'
Asking jobs to stop...
Unloading objection agent...

LICENSE

This repository is missing a license. Please add the GPLv3 license as noted at https://pypi.org/project/wallbreaker/.

打印参数有误

葫芦娃大佬，我尝试使用WallBreaker对某个方法的参数进行打印。如果只用objection打印的结果是这样的

而函数的原型是这样的

也就是说除了第二个参数外，其他两个参数并没有显示其具体的值，二是把他的类显示出来了。在肉丝大佬的推荐下，叫我使用wallbreaker，但是我用wallbreaker dump的结果是这样的

问题是我命令用错了，还是环境有问题?

how to use ? my brother

一人血书建议下版本优化增加反射深度

只是个小小建议，可以写个加个递归函数判断类的Filed是否为基础的类型，是的直接输出，否的继续递归获取Filed 的Filed 继续打印。或者像gson的打印object。