frida - How to translate native backtrace to use with addr2line tool

Question

Frida can print out backtrace with below code:

var backtrace = Thread.backtrace(this.context, Backtracer.ACCURATE)
            .map(DebugSymbol.fromAddress)
            .join("\n\t");

The output looks like below in android:

0x72e82c2a50 libc.so!fopen64+0x50
0x72e82c2a4c libc.so!fopen64+0x4c

But when I try to use addr2line to get code line, it doesn't work:

$ addr2line -f -C -i -e symbols/apex/com.android.runtime.release/lib64/bionic/libc.so 0x72e82c2a50 
??
??:0

Sounds like that address is not the actual PC as crash stack. How can I translate this address to be used in addr2line tool?

Answer 1

Below steps (eg libc.so)

1. Get library base address:

0xac0ad000 <- Module.findBaseAddress("libc.so")

2. Get backtrace

Thread.backtrace(thz.context,Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\\n ");

Sample output:

0xac151ed7 libc.so!fopen64+0x2e

3.Substract baseAddr to get PC value

#pc 0x000a4ed7 <- 0xac151ed7 - 0xac0ad000

4. Addr2line with PC value

$ addr2line -f -C -i -e symbols/apex/com.android.runtime/lib/bionic/libc.so 0x000a4ed7
open(char const*, int pass_object_size1, unsigned short)
bionic/libc/include/bits/fortify/fcntl.h:74 fopen
bionic/libc/stdio/stdio.cpp:256