Skip to content

android: add opt-in JVMTI disable and handle unknown copied-methods offset - #407

Open
staleroot wants to merge 4 commits into
frida:mainfrom
staleroot:main
Open

staleroot wants to merge 4 commits into
frida:mainfrom
staleroot:main

Conversation

@staleroot

Copy link
Copy Markdown

A workaround for #404

  • Add globalThis.FRIDA_JAVA_BRIDGE_DISABLE_JVMTI flag. When true,
    tryGetEnvJvmti() returns null without calling
    Runtime::EnsurePluginLoaded(), which aborts ART on some Android 16
    devices ("method_index < num_methods_" in boot-framework.oat).
    Callers already fall back to the non-JVMTI path when jvmti is null.
  • getArtClassSpec(): if no u16 matching the methods array length is
    found in java/lang/Thread (layout differs on Android 16), use 0 as
    "unknown" instead of throwing. 0 is the klass_ header, so it can
    never be a valid offset.
  • class-model: when copied_methods_offset is 0, iterate over the whole
    methods array instead of reading a u16 count, both in model_new()
    and in collect_matching_class_methods().

Tested on Android 16 (API 36) with the flag enabled: Java.use, static
method calls and Java.scheduleOnMainThread work. Without the flag,
behavior is unchanged on devices where the class probe succeeds.

…ffset

- Add globalThis.FRIDA_JAVA_BRIDGE_DISABLE_JVMTI flag. When true,
  tryGetEnvJvmti() returns null without calling
  Runtime::EnsurePluginLoaded(), which aborts ART on some Android 16
  devices ("method_index < num_methods_" in boot-framework.oat).
  Callers already fall back to the non-JVMTI path when jvmti is null.
- getArtClassSpec(): if no u16 matching the methods array length is
  found in java/lang/Thread (layout differs on Android 16), use 0 as
  "unknown" instead of throwing. 0 is the klass_ header, so it can
  never be a valid offset.
- class-model: when copied_methods_offset is 0, iterate over the whole
  methods array instead of reading a u16 count, both in model_new()
  and in collect_matching_class_methods().

Tested on Android 16 (API 36) with the flag enabled: Java.use, static
method calls and Java.scheduleOnMainThread work. Without the flag,
behavior is unchanged on devices where the class probe succeeds.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant