YAHFA icon indicating copy to clipboard operation
YAHFA copied to clipboard

Hook System.loadLibrary失败

Open WanQingGit opened this issue 5 years ago • 8 comments

2020-10-14 00:17:10.009 19886-19886/lab.galaxy.yahfa.demoApp W/y.yahfa.demoAp: Got a deoptimization request on un-deoptimizable method void java.lang.System.loadLibrary(java.lang.String) 2020-10-14 00:17:10.009 19886-19886/lab.galaxy.yahfa.demoApp W/y.yahfa.demoAp: Got a deoptimization request on un-deoptimizable method void java.lang.System.loadLibrary(java.lang.String) 2020-10-14 00:17:17.101 19886-19886/lab.galaxy.yahfa.demoApp D/AndroidRuntime: Shutting down VM 2020-10-14 00:17:17.177 19886-19886/lab.galaxy.yahfa.demoApp E/AndroidRuntime: FATAL EXCEPTION: main Process: lab.galaxy.yahfa.demoApp, PID: 19886 java.lang.UnsatisfiedLinkError: dlopen failed: library "libhello.so" not found at java.lang.Runtime.loadLibrary0(Runtime.java:1082) at java.lang.Runtime.loadLibrary0(Runtime.java:1007) at java.lang.System.loadLibrary(Native Method) at lab.galaxy.yahfa.demoApp.MainActivity$1.onClick(MainActivity.java:72)

没办法hook System.loadLibrary,会报如上的错误,加入不hook,则会运行正确

WanQingGit avatar Oct 18 '20 09:10 WanQingGit

设备是piexl xl,android10

WanQingGit avatar Oct 18 '20 09:10 WanQingGit

我通过观察源码,发现loadLibrary方法有注解 @CallerSensitive,而String的startswith没有,是不是这个原因导致失败的

WanQingGit avatar Oct 18 '20 09:10 WanQingGit

应该是了,调用loadLibrary会把callerClass也传入作为参数,可能和这里的检查有关,导致找不到动态库

rk700 avatar Oct 20 '20 07:10 rk700

那大佬能修复这个bug吗?

WanQingGit avatar Oct 20 '20 07:10 WanQingGit

调用原方法是从hook代码里唤起的,所以callerClass是插件中而不是在原始APP中

可以试下在创建插件的DexClassLoader时把要搜索的librarySearchPath设置为APP动态库所在的目录

rk700 avatar Oct 21 '20 01:10 rk700

并没有hook成功,没有执行hook代码,不过应该是librarySearchPath不正确,谢谢。

WanQingGit avatar Oct 21 '20 01:10 WanQingGit

whale可以hook成功,执行hook代码,但同样也会报dlopen failed: library "libhello.so" not found,它应该是这种原因造成的

WanQingGit avatar Oct 21 '20 01:10 WanQingGit

这个其实是art的bug, 放弃这个思路

google-mirror avatar Oct 21 '20 03:10 google-mirror