Android环境下用Frida无法定位JNI函数及模块的问题求助

背景 #

我在Android应用中有如下Java类：

package com.app.s;

public final class Api {
    public native int func(String str, String str2);

    ...
    ...
    static {
        try {
            System.loadLibrary("nativelib");
        } catch (UnsatisfiedLinkError e) {
            Log.e("lib", "fail:" + e.getMessage());
        }
    }
}

在libnativelib.so中，函数Java_com_app_s_Api_func会调用target_func，我想要访问target_func的变量，但无法用Frida定位到已加载的该模块。

我尝试了以下几种Frida操作：

• 尝试1 - 未打印出目标库名称

var allModules = Process.enumerateModules()
for(var i=0;i<allModules.length;i++){ 
  console.log(allModules[i].name); 
}

• 尝试2 - 报错：java.lang.ClassNotFoundException: Didn't find class "Java_com_app_s_Api"

Java.perform(function() {
  var it = setInterval(function(){
    try{
      var hook = Java.use("Java_com_app_s_Api");
      console.log("info: hooking target class");

      hook.func.overload().implementation = function() {
                console.log("[+] func")

                var ret = this.func()
                console.log("[*] retval: " + ret)
                return ret

      }
    } catch(e) {
      console.log(e);
    }
  },200); // runs every 200milisecods
});

• 尝试3 - 未打印出库中的函数，尽管这些函数正在被调用

frida-trace -U -i "Java_*" -f <app>

• 尝试4（报错） - 按照Robert的建议使用dlopen的Frida代码片段加载findExportByName
  执行后输出如下：

dlopen called with: libandroid.so
dlopen called with: /system/lib64/libEGL.so
dlopen called with: /system/lib64/libGLESv1_CM.so
dlopen called with: /system/lib64/libGLESv2.so
dlopen called with: /vendor/lib64/egl/libGLESv1_CM_emulation.so
Process crashed: Trace/BPT trap

***
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'google/sdk_gphone64_x86_64/emu64xa:14/UE1A.230829.036.A1/11228894:userdebug/dev-keys'
Revision: '0'
ABI: 'x86_64'
Timestamp: 2024-02-24 17:01:44.281739700+0000
Process uptime: 4s
Cmdline: com.app
pid: 5917, tid: 5986, name: RenderThread  >>> com.app <<<
uid: 10192
signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
Abort message: 'Failed to create context, error = EGL_NOT_INITIALIZED'

• 尝试5

Java.perform(function() {
    var flag = false;
    try{
      Java.use("com.app.s.Api");
      var allModules = Process.enumerateModules()
        for(var i=0;i<allModules.length;i++){ 
            if(allModules[i].name.includes("nativelib")){
                console.log(allModules[i].name); 
                flag = true;
            }
        }
        if(!flag){
            console.log("not found");
        }
    } catch(e) {
      console.log(e);
    }
});

请问我忽略了什么问题？

内容的提问来源于stack exchange，提问作者Dinamo