Redex crash with -6 code after adding mapping.txt file

[amiton]

Hi, I'm using the latest redex (December 23, 2019).

When running the following command the redex completes successfully: redex -c default.config -o out.apk in.apk -P proguard.cfg --sign -s key.keystore -a XXX -p XXX

But when i add the mapping.txt the redex crashes (see blow command and result): redex -c default.config -o out.apk in.apk -m mapping.txt -P proguard.cfg --sign -s key.keystore -a XXX -p XXX

libc++abi.dylib: terminating with uncaught exception of type boost::exception_detail::error_info_injector<RedexException>: libredex/ProguardMap.cpp:354: DexString *pg_impl::file_name_from_method_string(const DexString *): assertion `start != std::string::npos && end != std::string::npos' failed.

0 redex-all 0x00000001099bfc32 _Z23crash_backtrace_handleri + 50 1 libsystem_platform.dylib 0x00007fff6dae342d _sigtramp + 29 2 ??? 0x0000000000000400 0x0 + 1024 3 libsystem_c.dylib 0x00007fff6d9b8a1c abort + 120 4 libc++abi.dylib 0x00007fff6aa56be8 __cxa_bad_cast + 0 5 libc++abi.dylib 0x00007fff6aa56d84 _ZL28demangling_terminate_handlerv + 238 6 libobjc.A.dylib 0x00007fff6c57e792 _ZL15_objc_terminatev + 104 7 libc++abi.dylib 0x00007fff6aa63dc7 _ZSt11__terminatePFvvE + 8 8 libc++abi.dylib 0x00007fff6aa63b6c __cxa_get_exception_ptr + 0 9 libc++abi.dylib 0x00007fff6aa5545d __cxa_get_globals + 0 10 redex-all 0x00000001099c020c _Z11assert_failPKcS0_jS0_10RedexErrorS0_z + 892 11 redex-all 0x0000000109abc33b _ZN7pg_impl28file_name_from_method_stringEPK9DexString + 811 12 redex-all 0x0000000109abc41d _ZN7pg_impl28apply_deobfuscated_positionsEP6IRCodeRK11ProguardMap + 141 13 redex-all 0x0000000109abf193 _ZNSt3__110__function6__funcIZ24apply_deobfuscated_namesRKNS_6vectorINS2_IP8DexClassNS_9allocatorIS4_EEEENS5_IS7_EEEERK11ProguardMapE3$1NS5_ISF_EEFvS4_EEclEOS4 + 771 14 redex-all 0x00000001094d3a72 ZNSt3__110__function6__funcIZ17workqueue_foreachIP8DexStoreE9WorkQueueIT_ERKNS_8functionIFvS6_EEEjEUlP11WorkerStateIS4_ES4_E_NS_9allocatorISG_EEFvSF_S4_EEclEOSF_OS4 + 34 15 redex-all 0x00000001094d645d _ZZN9WorkQueueIP8DexClassE7run_allEvENKUlP11WorkerStateIS1_EmE_clES5_m + 141 16 libboost_thread-mt.dylib 0x000000010ae13ae8 _ZN5boost12_GLOBAL__N_112thread_proxyEPv + 136 17 libsystem_pthread.dylib 0x00007fff6daeee65 _pthread_start + 148 18 libsystem_pthread.dylib 0x00007fff6daea83b thread_start + 15 Traceback (most recent call last): File "/tmp/redex.T873nV/redex.py", line 1146, in run_redex(args) File "/tmp/redex.T873nV/redex.py", line 1124, in run_redex run_redex_binary(state) File "/tmp/redex.T873nV/redex.py", line 448, in run_redex_binary if run(): File "/tmp/redex.T873nV/redex.py", line 433, in run ).format(returncode, gdb_script_name, lldb_script_name) RuntimeError: redex-all crashed with exit code -6! You can re-run it under gdb by running /tmp/redex.T873nV/redex-gdb-c6ipb0my.sh or under lldb by running /tmp/redex.T873nV/redex-lldb-w254lpt0.sh

Kindly let me know if this is a known bug or if there's a workaround i can use?

Thanks,

[helloguo]

The exception happens in function file_name_from_method_string. The function is supposed to return the file name. Maybe you can print out the method name const auto& s to see if anything weird happens there.

[amiton]

@helloguo Thanks for the quick response.

It seems that the failing assertion is when s = L$r8$java8methods$utility$Boolean$hashCode$IZ;.hashCode:(Z)I

I'm assuming this is because the code might be searching for "/" which doesn't exist?

Thanks,

[amiton]

@helloguo I think the fix should be changing code lines 354-355 in libredex/ProguardMap.cpp to the following:

always_assert(end != std::string::npos);
  ++start; // Skip over the "/" OR go to 0 if there was no "/" which might happen in cases like java8 classes (example: "L$r8$java8methods$utility$Boolean$hashCode$IZ;.hashCode:(Z)I")

Kindly let me know what you think?

[helloguo]

I assume this method is auto generated by r8? cc @justinjhendrick who is familiar with d8/r8.

[justinjhendrick]

Yes, L$r8$java8methods$utility$Boolean$hashCode$IZ;.hashCode:(Z)I is generated by d8. It doesn't have a source file associated with it, so I think we shouldn't be calling file_name_from_method_string on it at all.