frida-java-bridge icon indicating copy to clipboard operation
frida-java-bridge copied to clipboard

Stalker follow libart and not Java code

Open andreafioraldi opened this issue 5 years ago • 1 comments

Hi @oleavr, Further experiments with frida-fuzzer on Java code show that the Stalker follows libart.so

*** block=0x7efbdc22159f module=frida-agent-64.so 0x7efbdc22159f frida-agent-64.so!0x19b59f

*** block=0x7efbdc221633 module=frida-agent-64.so 0x7efbdc221633 frida-agent-64.so!0x19b633

*** block=0x7efbdc221643 module=frida-agent-64.so 0x7efbdc221643 frida-agent-64.so!0x19b643

*** block=0x7efbdc221ee0 module=frida-agent-64.so 0x7efbdc221ee0 frida-agent-64.so!0x19bee0

*** block=0x7efbdc221f29 module=frida-agent-64.so 0x7efbdc221f29 frida-agent-64.so!0x19bf29

*** block=0x7efc53d1cfe0 module=libart.so 0x7efc53d1cfe0 libart.so!0x3cffe0

*** block=0x7efc53d1d025 module=libart.so 0x7efc53d1d025 libart.so!0x3d0025

*** block=0x7efc53d1d092 module=libart.so 0x7efc53d1d092 libart.so!0x3d0092

*** block=0x7efc53d1d0a9 module=libart.so 0x7efc53d1d0a9 libart.so!0x3d00a9

*** block=0x7efbdc221f35 module=frida-agent-64.so 0x7efbdc221f35 frida-agent-64.so!0x19bf35

*** block=0x7efbdc221f59 module=frida-agent-64.so 0x7efbdc221f59 frida-agent-64.so!0x19bf59

*** block=0x7efbdc221f68 module=frida-agent-64.so 0x7efbdc221f68 frida-agent-64.so!0x19bf68

*** block=0x7efbdc221674 module=frida-agent-64.so 0x7efbdc221674 frida-agent-64.so!0x19b674

This is unwanted, I'm calling a pure Java method and seems like ART is using the interpreter instead of the AOT compiler (i guess). To be effective, Stalker have to work with native code. There is any possibility to force ART to produce JIT code in frida? Or, if you know, some OS conf to tell ART to always use AOT compilation.

andreafioraldi avatar Jan 03 '20 13:01 andreafioraldi

In the mappings there are some odex file loaded but they are not executed.

/system/framework/oat/x86_64/android.hidl.base-V1.0-java.odex
/system/framework/oat/x86_64/android.hidl.manager-V1.0-java.odex

Seems code not related to the application.

andreafioraldi avatar Jan 03 '20 13:01 andreafioraldi