search

PAGalaxyLab / YAHFA

Yet Another Hook Framework for ART
GNU General Public License v3.0
1.56k stars 350 forks source link

dlopen fail when JNI method compiled #161

Closed yearsyan closed 2 years ago

yearsyan commented 2 years ago

I try to build YAHFA demo app.When I first install app and push the plugin, the App run success. And here is the linker log

2022-01-20 19:17:31.344 20391-20391/lab.galaxy.yahfa.demoApp I/DLFUNC: dlfunc_init done
2022-01-20 19:17:31.344 20391-20391/lab.galaxy.yahfa.demoApp D/linker: dlopen(name="libart.so", flags=0x1, extinfo=(null), caller="/apex/com.android.art/lib64/libart.so", caller_ns=com_android_art@0x7f8f1120c0, targetSdkVersion=28) ...

But when I open the app on the second time, the app crashed , here is the log:

2022-01-20 19:23:39.862 21699-21699/lab.galaxy.yahfa.demoApp I/DLFUNC: dlfunc_init done
2022-01-20 19:23:39.862 21699-21699/lab.galaxy.yahfa.demoApp D/linker: dlopen(name="libart.so", flags=0x1, extinfo=(null), caller="/data/app/~~j-M82ohd0GmCUQgdY6w7PA==/lab.galaxy.yahfa.demoApp-k4MtWxJUQWAw5LBlR5pmAw==/oat/arm64/base.odex", caller_ns=(default)@0x7f904024c0, targetSdkVersion=28) ...

It seems that the aot compiler will compile JNI method, then the return address will be the trampoline that created by aot compiler instead of artQuickGenericJniTrampoline .

Device: Redmi K40, Android 11/MIUI 12.5.19

rk700 commented 2 years ago

Yes that's a known bug for dlfunc. It took me quite a while but still could not figure out how to disable method compilation.

yearsyan commented 2 years ago

I think there are 2 ways :

  1. Use InMemoryDexClassLoader to load the dex dynamic.
  2. Parse elf file and read /proc/self/maps to get symbol address.
rk700 commented 2 years ago

Take the first one and it seems to work: https://github.com/rk700/dlfunc/commit/aae30486c4ef3878fda023891cf2f7171f63430f . Thanks!