Dependencies

Capstone Disassembly Framework XZ Utils HttpLib Zstd

Techincal System

| Project | Path | |:------------:|---------------------------------------------------| |core-parser | https://github.com/Penguin38/OpenCoreAnalysisKit | |linux-parser | https://github.com/Penguin38/OpenLinuxAnalysisKit | |crash-android | https://github.com/Penguin38/crash-android | |OpenCoreSDK | https://github.com/Penguin38/OpenCoreSDK |

Getting Started

Install cmake 3.21.1+ on ubuntu 22.04, download cmake 3.21.1+, please see:

https://cmake.org/download/

sudo apt-get install cmake

Install clang-12

sudo apt-get install clang-12

Dowload NDK r22+, please see:

https://github.com/android/ndk/wiki/Unsupported-Downloads

Build For Ubuntu

Optional:
export BUILD_TYPE="Debug"
export SUPPORT_CLANG_VERSIONS="10 11 12 13 14 15 16 17 18"

Required:
./script/build.sh

Build For MacOS

Optional:
export BUILD_TYPE="Debug"
export SUPPORT_CLANG_VERSIONS="10 11 12 13 14 15 16 17 18"

Required:
./script/build_macos.sh

Build For Android

Optional:
export BUILD_TYPE="Debug"
export BUILD_ANDROID_ABIS="arm64-v8a armeabi-v7a x86_64 x86"
export BUILD_ANDROID_PLATFORM="android-30"

Required:
export ANDROID_NDK_HOME=<NDK_DIR>
./script/build_android.sh

Build Artifacts

| Platform | Path | |:------------:|-----| |Emulator| output/aosp/<BUILD_TYPE>/android/x86_64/bin/core-parser</br>output/aosp/<BUILD_TYPE>/android/x86/bin/core-parser | |Phone| output/aosp/<BUILD_TYPE>/android/arm64-v8a/bin/core-parser</br>output/aosp/<BUILD_TYPE>/android/armeabi-v7a/bin/core-parser| |Ubuntu| output/aosp/<BUILD_TYPE>/linux/bin/core-parser | |MacOS| output/aosp/<BUILD_TYPE>/macos/bin/core-parser |

Compatible

| sdk | arm64 | arm | x86_64 | x86 | riscv64 | |:------------:|:-----:|:----:|:------:|:----:|:-------:| |Android-5.0 (21) | x | x | x | x | ? | |Android-5.1 (22) | x | x | x | x | ? | |Android-6.0 (23) | x | x | x | x | ? | |Android-7.0 (24) | √ | √ | √ | √ | ? | |Android-7.1 (25) | - | - | - | - | - | |Android-8.0 (26) | √ | √ | √ | √ | ? | |Android-8.1 (27) | - | - | - | - | - | |Android-9.0 (28) | √ | √ | √ | √ | ? | |Android-10.0(29) | √ | √ | √ | √ | ? | |Android-11.0(30) | √ | √ | √ | √ | ? | |Android-12.0(31) | √ | √ | √ | √ | ? | |Android-12.1(32) | √ | √ | √ | √ | ? | |Android-13.0(33) | √ | √ | √ | √ | ? | |Android-14.0(34) | √ | √ | √ | √ | ? | |Android-15.0(35) | √ | - | √ | - | ? | |Android-16.0(36) | √ | - | √ | - | ? | |Android-17.0(37) | √ | - | √ | - | ? |

MCP Server

claude mcp add core-parser --scope user <path_to/core-parser> -- --mcp

HTTP Server

core-parser --http [ip:port]

How To Launch

Usage: core-parser [OPTION]
Option:
    -c, --core <COREFILE>    load core-parser from corefile
    -p, --pid <PID>          load core-parser from target process
    -m, --machine <ARCH>     arch support arm64, arm, x86_64, x86, riscv64
        --sdk <SDK>          sdk support 26 ~ 36
        --no-filter-any      load core-parser no filter any vma
    -t, --tomb <TOMBSTONE>   load core-parser form tombstone file
        --sysroot <DIR:DIR>  set sysroot path
        --va_bits <BITS>     set virtual valid addr bits
        --page_size <SIZE>   set target core page size
        --no-load            no auto load corefile
        --no-fake-phdr [EXE] rebuild fakecore phdr
Exp:
    core-parser -c /tmp/tmp.core
    core-parser -p 1 -m arm64
    core-parser -t tombstone_00 --sysroot symbols

emu64xa:/ # chmod +x /data/core-parser
emu64xa:/ # /data/core-parser -c /sdcard/Android/data/penguin.opencore.tester/files/core.opencore.tester_6422_Thread-2_6550_1709932681
Copyright (C) 2024-present, Guanyou.Chen. All rights reserved.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

For bug reporting instructions, please see:
     https://github.com/Penguin38/OpenCoreAnalysisKit
Core load (0x787ec5231148) /sdcard/Android/data/penguin.opencore.tester/files/core.opencore.tester_6422_Thread-2_6550_1709932681
Core env: /sdcard/Android/data/penguin.opencore.tester/files/core.opencore.tester_6422_Thread-2_6550_1709932681
  * Machine: x86_64
  * PointSize: 64
  * PointMask: 0xffffffffffffffff
  * VabitsMask: 0xffffffffffffffff
  * Thread: 6422
Switch android(34) env.
Android env:
  * ID: UE1A.230829.036.A1
  * Name: sdk_gphone64_x86_64
  * Model: sdk_gphone64_x86_64
  * Manufacturer: Google
  * Brand: google
  * Hardware: ranchu
  * ABIS: x86_64,arm64-v8a
  * Incremental: 11228894
  * Release: 14
  * Security: 2023-09-05
  * Type: userdebug
  * Tag: dev-keys
  * Fingerprint: google/sdk_gphone64_x86_64/emu64xa:14/UE1A.230829.036.A1/11228894:userdebug/dev-keys
  * Time: 1702767675
  * Debuggable: <unknown>
  * Sdk: 34
core-parser>

Command Set

core-parser> help
        core          exec       sysroot          mmap          auxv
        file           map          read         write      register
      thread            cs          vtor          ptov         ptype
   backtrace         frame   disassemble       getprop         print
   reference         hprof        search         class           top
       space           dex        method        logcat       dumpsys
     fdtrack           cxx         scudo           env           ini
       shell        plugin          help        remote          fake
        time       version          quit

Show Jvm Space and Check Bad Object

core-parser> help space
Usage: space [OPTION] [TYPE]
Option:
    -c, --check   check space bad object.
Type: {--app, --zygote, --image, --fake}

core-parser> space
TYPE   REGION                  ADDRESS             NAME
  5  [0x12c00000, 0x2ac00000)  0x75db0d608820  main space (region space)
  0  [0x70209000, 0x7033d840)  0x75dbad608430  /system/framework/x86_64/boot.art
  0  [0x704c2000, 0x704dfc88)  0x75dbad6086f0  /system/framework/x86_64/boot-core-libart.art
  ...

core-parser> space --check --app
ERROR: Region:[0x12c00000, 0x12c00018) main space (region space) has bad object!!

How to Count the Number of Objects

core-parser> help top
Usage: top <NUM> [OPTION] [TYPE] [REF]
Option:
    -a, --alloc     order by allocation
    -s, --shallow   order by shallow
    -n, --native    order by native
    -d, --display   show class name
Type: {--app, --zygote, --image, --fake}
Ref: {--local, --global, --weak, --thread <TID>}

core-parser> top 10 -d
Address       Allocations      ShallowSize        NativeSize     ClassName
TOTAL              136939          8045084            108415
------------------------------------------------------------
0x6f817d58          43562          2629504                 0     java.lang.String
0x6f7fdd30          14281          1405792                 0     long[]
0x6f7992c0          12084           479956                 0     java.lang.Object[]
0x6f824fd0           9405           225720                 0     java.util.HashMap$Node
0x6f7fda18           4689          1033816                 0     int[]
0x6f7fa7b0           3457           110624                 0     java.lang.ref.SoftReference
0x6f835118           3381            40572                 0     java.lang.Integer
0x6f8420e8           2684            85888                 0     java.util.LinkedHashMap$LinkedHashMapEntry
0x6fab25d0           2293            45860                 0     android.icu.util.CaseInsensitiveString
0x6f865b80           1859            37180                 0     java.util.ArrayList

core-parser> top 10 -d -s --app
Address       Allocations      ShallowSize        NativeSize     ClassName
TOTAL                7592          1943315            104175
------------------------------------------------------------
0x6f7fda18            322           561344                 0     int[]
0x6f817d58           1504           509408                 0     java.lang.String
0x6f799100              9           299177                 0     byte[]
0x6f7fd688             18           247138                 0     char[]
0x6f7fdd30            390           113576                 0     long[]
0x6f7992c0            577            27196                 0     java.lang.Object[]
0x6f865b80            335             6700                 0     java.util.ArrayList
0x6f79ba88            174             6264                 0     sun.misc.Cleaner
0x70101c18            258             6192                 0     android.graphics.Rect
0x70360328             40             5600                 0     android.animation.ObjectAnimator

Dump Heap Snapshot

core-parser> help hprof
Usage: hprof [<FILE>] [OPTION]
Option:
    -v, --visible     show hprof detail
    -q, --quick       fast dump hprof

core-parser> hprof /tmp/1.hprof
hprof: heap dump /tmp/1.hprof starting...
hprof: heap dump completed, scan obj