[Armv7a Android11] Regression issue: `Java.perform` api fails due to instructions parsing error

未关闭
  • 哪里不对？
#364 0 条评论 2 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
停滞
技术栈
android, javascript
领域
devtools, mobile-dev

调研方向

从 frida-java-bridge 中的回归提交以及 lib/android.js 第 4331 行的失败路径开始。将其行为与手动回滚的版本进行比较，然后检查 frida-gum/bindings/gumjs/gumquickinstruction.c 第 236 行的指令解析。在 ARMv7 Android 11 上复现，并验证 Java.perform 不再引发解析错误。

由索引模型根据 Issue 内容生成。

描述

Environment

  • OS: Android 11 based smart TV OS (not reproducible in Android 14 based OS);
  • CPU: ARMv7 Processor rev 0 (v7l). Features: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32
  • Frida & server version: 17.2.14
  • Frida java bridge version: 7.0.7

Reproduce steps

  1. Attach to any application using python-frida;
  2. Run a Java.perform command. For example:
Java.perform(() => { console.log('111'); })

Logs

The exception is thrown from: https://github.com/frida/frida-java-bridge/blob/main/lib/android.js#L4331

Exception message when loading a js file containing a Java.perform invocation:

Error: Failed to parse instruction at ab8b5817: invalid instruction
    at recompileExceptionClearForArm (/my-debug.js:5768)
    at <anonymous> (/my-debug.js:5565)
    at _patchCode (native)
    at value (/frida/runtime/core.js:183)
    at makeArtThreadStateTransitionImpl (/my-debug.js:5566)
    at _getArtThreadStateTransitionImpl (/my-debug.js:3898)
    at <anonymous> (/my-debug.js:1929)
    at withRunnableArtThread (/my-debug.js:3887)
    at <anonymous> (/my-debug.js:3627)
    at <anonymous> (/my-debug.js:2774)
    at getArtClassSpec (/my-debug.js:3679)
    at compileModule (/my-debug.js:8065)
    at ensureInitialized (/my-debug.js:8034)
    at build (/my-debug.js:9331)
    at _make (/my-debug.js:11627)
    at use (/my-debug.js:11506)
    at <anonymous> (/my-debug.js:13292)
    at <anonymous> (/my-debug.js:2774)
    at _performPendingVmOpsWhenReady (/my-debug.js:13330)
    at perform (/my-debug.js:13271)
    at my-debug.js (/my-debug.js:13438)
    at __require (/my-debug.js:7)
    at <anonymous> (/my-debug.js:13441)
TypeError: cannot set property '_code' of null
    at makeArtThreadStateTransitionImpl (/my-debug.js:5567)
    at _getArtThreadStateTransitionImpl (/my-debug.js:3898)
    at <anonymous> (/my-debug.js:1929)
    at withRunnableArtThread (/my-debug.js:3887)
    at <anonymous> (/my-debug.js:3627)
    at <anonymous> (/my-debug.js:2774)
    at getArtClassSpec (/my-debug.js:3679)
    at compileModule (/my-debug.js:8065)
    at ensureInitialized (/my-debug.js:8034)
    at build (/my-debug.js:9331)
    at _make (/my-debug.js:11627)
    at use (/my-debug.js:11506)
    at <anonymous> (/my-debug.js:13292)
    at <anonymous> (/my-debug.js:2774)
    at _performPendingVmOpsWhenReady (/my-debug.js:13330)
    at perform (/my-debug.js:13271)
    at my-debug.js (/my-debug.js:13438)
    at __require (/my-debug.js:7)
    at <anonymous> (/my-debug.js:13441)

I also added some logs in the native code where an instruction is parsed: https://github.com/frida/frida-gum/blob/main/bindings/gumjs/gumquickinstruction.c#L236

When the error occurs, the 16 bytes from the address are

d9 ff 07 f7 d9 ff 68 7d 20 00 be 98 20 00 f8 20

The return value from cs_disasm api is 0 and the error code got from cs_errno is also 0(CS_ERR_OK).

Regression

This issue is no longer seen after I manually revert this commit: https://github.com/frida/frida-java-bridge/commit/996a4a3fb7c8f2969e4a6f0c537a93eabaa15306

Hi @Rwkeith , could you please provide some insights on how to further debug this issue? Any help would be greatly appreciated.

主要语言
JavaScript
星标
415
派生
174
30 天内没有已合并 PR

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

frida/frida-java-bridge 的其他 Issue

查看 frida/frida-java-bridge 的全部 Issue

相似的 Issue

更多 JavaScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。