Wallbreaker

🔨 Break Java Reverse Engineering form Memory World!

WTF?

Wallbreaker is a useful tool to live analyzing Java heap, powered by frida. Provide some commands to search object or class from the memory, and beautifully visualize the real structure of the target.

Want to know real data content? list item? map entries? Want to know about implementation of the interface? Try it! What you see is what you get!

How to start?

1. Install objection

pip3 install objection

2. Download wallbreaker

mkdir -p ~/.objection/plugins/
git clone https://github.com/hluwa/Wallbreaker ~/.objection/plugins/Wallbreaker

3. Loading as objection plugin

objection -g com.app.name explore -P ~/.objection/plugins

objection -g com.app.name explore
plugin load ~/.objection/plugins/Wallbreaker

4. Use wallbreaker command

plugin wallbreaker objectsearch java.util.HashMap
plugin wallbreaker objectdump <object-handle>

Commands

Search

wallbreaker classsearch <type-pattern>

[return all matched class]

wallbreaker objectsearch <instance-class-name>

[return all matched object-handle and toString]

Dump

wallbreaker classdump <class-name> [--fullname]

[
   pretty print class structure: fields declare, static field value, methods declare.
      set --fullname to display package name of type name.
]

wallbreaker objectdump <object-handle> [--fullname] [--as-class class-name]

[
   pretty print object structure: fields declare and value, methods declare.
      set --fullname to display package name of type name;
      set --as-class to cast instance type(super class, not interface).
   if instance is a collection or map, dump all entries.
]

Demo

Metadata

Release files for wallbreaker 1.0.3

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for wallbreaker 1.0.3
File	Size	Uploaded
wallbreaker-1.0.3.tar.gz	18.5 kB	May 10, 2022	Details

Built distribution (wheel)

Table of built distributions (wheels) for wallbreaker 1.0.3
File	Interpreter	ABI	Platform	Reset
wallbreaker-1.0.3-py3-none-any.whl 18.5 kB May 10, 2022	Python 3	none	any	Details

Total release size: 36.9 kB

Release files / wallbreaker-1.0.3.tar.gz

Download URL	wallbreaker-1.0.3.tar.gz
Size	18.5 kB
Tags	Source
SHA-256 checksum How to use checksums	`72013491d24b081de56b743b717742aea826bf0a4ee0f7b5c859cb257cf4f83c`
BLAKE2b-256 checksum How to use checksums	`b3985f67bce968b157ee3cbe9183508cecd8e721acc804b7a330b0ad252b369c`
Upload date	May 10, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.0 CPython/3.10.4`

Release files / wallbreaker-1.0.3-py3-none-any.whl

Download URL	wallbreaker-1.0.3-py3-none-any.whl
Size	18.5 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`cf164096ae716e1aa211a854037edf1977bf05d067ee7d74cfedc4bf690ce6a3`
BLAKE2b-256 checksum How to use checksums	`6dcba0ee8efc21dc461065620c62489084b4d85cd58613e102f702a4aff45cfd`
Upload date	May 10, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.0 CPython/3.10.4`