Skip to content

android: add opt-in JVMTI disable and handle unknown copied-methods offset - #406

Closed
staleroot wants to merge 5 commits into
frida:mainfrom
staleroot:main
Closed

staleroot wants to merge 5 commits into
frida:mainfrom
staleroot:main

Conversation

@staleroot

Copy link
Copy Markdown

A workaround for #404

  • Add globalThis.FRIDA_JAVA_BRIDGE_DISABLE_JVMTI flag. When true, tryGetEnvJvmti() returns null without calling Runtime::EnsurePluginLoaded(), which aborts ART on some Android 16 devices ("method_index < num_methods_" in boot-framework.oat). Callers already fall back to the non-JVMTI path when jvmti is null.
  • getArtClassSpec(): if no u16 matching the methods array length is found in java/lang/Thread (layout differs on Android 16), use 0 as "unknown" instead of throwing. 0 is the klass_ header, so it can never be a valid offset.
  • class-model: when copied_methods_offset is 0, iterate over the whole methods array instead of reading a u16 count, both in model_new() and in collect_matching_class_methods().

Tested on Android 16 (API 36) with the flag enabled: Java.use, static method calls and Java.scheduleOnMainThread work. Without the flag, behavior is unchanged on devices where the class probe succeeds.

…ffset

- Add globalThis.FRIDA_JAVA_BRIDGE_DISABLE_JVMTI flag. When true,
  tryGetEnvJvmti() returns null without calling
  Runtime::EnsurePluginLoaded(), which aborts ART on some Android 16
  devices ("method_index < num_methods_" in boot-framework.oat).
  Callers already fall back to the non-JVMTI path when jvmti is null.
- getArtClassSpec(): if no u16 matching the methods array length is
  found in java/lang/Thread (layout differs on Android 16), use 0 as
  "unknown" instead of throwing. 0 is the klass_ header, so it can
  never be a valid offset.
- class-model: when copied_methods_offset is 0, iterate over the whole
  methods array instead of reading a u16 count, both in model_new()
  and in collect_matching_class_methods().

Tested on Android 16 (API 36) with the flag enabled: Java.use, static
method calls and Java.scheduleOnMainThread work. Without the flag,
behavior is unchanged on devices where the class probe succeeds.
@staleroot
staleroot marked this pull request as draft September 21, 2026 08:58
@staleroot staleroot closed this by deleting the head repository Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants