search

PAGalaxyLab / YAHFA

Yet Another Hook Framework for ART
GNU General Public License v3.0
1.56k stars 350 forks source link

Debuggable模式下，12系统崩溃 #165

Open shuajinanhai opened 2 years ago

shuajinanhai commented 2 years ago

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 Cause: null pointer dereference x0 0000007fcda60a00 x1 000000722dc489c0 x2 0000000000000000 x3 0000000000000000 x4 0000000000000000 x5 0000000000000000 x6 4b5502ff484b5502 x7 0000000000000000 x8 0000000000000000 x9 0000000000000000 x10 0000007fcda60919 x11 0000007fcda60a00 x12 0000007fcda60b48 x13 0000007fcda6095c x14 000000722dc18b80 x15 0000000000000000 x16 000000722e211ae8 x17 00000072aff41fc0 x18 00000072d5e74000 x19 00000072d5796000 x20 0000000000000000 x21 00000072d5412a00 x22 00000072d5476c00 x23 0000007fcda60b74 x24 0000007fcda60b58 x25 0000007fcda60b40 x26 0000000000000000 x27 000000722e417000 x28 0000000000000000 x29 0000007fcda60990 lr 000000722dc24bdc sp 0000007fcda607f0 pc 000000722dc48b30 pst 0000000020000000 backtrace:

00 pc 0000000000248b30 /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<true, false>(art::interpreter::SwitchImplContext*)+368) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

01 pc 0000000000224bd8 /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

02 pc 00000000003e0cf0 /apex/com.android.art/lib64/libart.so (art::interpreter::ExecuteSwitch(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

03 pc 00000000003d8eb8 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+216) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

04 pc 00000000007426bc /apex/com.android.art/lib64/libart.so!libart.so (artQuickToInterpreterBridge+780) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

05 pc 0000000000222378 /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

06 pc 0000000000218be8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

07 pc 000000000028520c /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread, unsigned int, unsigned int, art::JValue, char const)+212) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

08 pc 00000000003e6720 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread, art::ArtMethod, art::ShadowFrame, unsigned short, art::JValue)+400) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

09 pc 00000000003e131c /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod, art::Thread, art::ShadowFrame&, art::Instruction const, unsigned short, art::JValue)+804) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

10 pc 000000000022cbc8 /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false, false>(art::interpreter::SwitchImplContext*)+23256) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

11 pc 0000000000224bd8 /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

13 pc 00000000003e0cf0 /apex/com.android.art/lib64/libart.so (art::interpreter::ExecuteSwitch(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

14 pc 00000000003d8eb8 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+216) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

15 pc 00000000007426bc /apex/com.android.art/lib64/libart.so!libart.so (artQuickToInterpreterBridge+780) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

16 pc 0000000000222378 /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

17 pc 0000000000218be8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

18 pc 000000000028520c /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread, unsigned int, unsigned int, art::JValue, char const)+212) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

19 pc 00000000003e6720 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread, art::ArtMethod, art::ShadowFrame, unsigned short, art::JValue)+400) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

20 pc 00000000003e131c /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod, art::Thread, art::ShadowFrame&, art::Instruction const, unsigned short, art::JValue)+804) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

21 pc 000000000075ef14 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeStatic+980) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

22 pc 0000000000203994 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

24 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

25 pc 00000000003e0884 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread, art::CodeItemDataAccessor const&, art::ShadowFrame, art::JValue*)+204) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

26 pc 00000000003e12f8 /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod, art::Thread, art::ShadowFrame&, art::Instruction const, unsigned short, art::JValue)+768) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

27 pc 0000000000753ea4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+1164) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

28 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

29 pc 00000000001c695c /system/framework/framework.jar (android.app.Application.attach+0)

30 pc 00000000007545f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3036) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

31 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

32 pc 000000000021be78 /system/framework/framework.jar (android.app.Instrumentation.newApplication+24)

33 pc 00000000007545f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3036) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

34 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

35 pc 0000000000220ddc /system/framework/framework.jar (android.app.LoadedApk.makeApplication+204)

36 pc 00000000007546c4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3244) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

37 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

38 pc 00000000001a5848 /system/framework/framework.jar (android.app.ActivityThread.handleBindApplication+1388)

39 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

40 pc 00000000003e0884 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread, art::CodeItemDataAccessor const&, art::ShadowFrame, art::JValue*)+204) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

41 pc 00000000003e1cdc /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, true>(art::ArtMethod, art::Thread, art::ShadowFrame&, art::Instruction const, unsigned short, art::JValue)+1676) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

42 pc 000000000075d1f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeDirect+1068) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

43 pc 0000000000203914 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_direct+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

44 pc 00000000001a27cc /system/framework/framework.jar (android.app.ActivityThread.access$1500+0)

45 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

46 pc 00000000003e0884 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread, art::CodeItemDataAccessor const&, art::ShadowFrame, art::JValue*)+204) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

47 pc 00000000003e12f8 /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod, art::Thread, art::ShadowFrame&, art::Instruction const, unsigned short, art::JValue)+768) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

48 pc 000000000075ef14 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeStatic+980) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

49 pc 0000000000203994 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

50 pc 000000000019f228 /system/framework/framework.jar (android.app.ActivityThread$H.handleMessage+1536)

51 pc 00000000007545f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3036) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

52 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

53 pc 0000000000430df2 /system/framework/framework.jar (android.os.Handler.dispatchMessage+38)

54 pc 00000000007545f4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+3036) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

55 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

56 pc 0000000000459b20 /system/framework/framework.jar (android.os.Looper.loopOnce+312)

57 pc 000000000075f3a8 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeStatic+2152) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

58 pc 0000000000203994 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

59 pc 000000000045a0bc /system/framework/framework.jar (android.os.Looper.loop+152)

60 pc 000000000075f470 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeStatic+2352) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

61 pc 0000000000203994 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

62 pc 00000000001a8cde /system/framework/framework.jar (android.app.ActivityThread.main+202)

63 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

64 pc 00000000007426bc /apex/com.android.art/lib64/libart.so!libart.so (artQuickToInterpreterBridge+780) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

65 pc 0000000000222378 /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

66 pc 0000000000218be8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

67 pc 000000000028520c /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread, unsigned int, unsigned int, art::JValue, char const)+212) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

68 pc 0000000000625688 /apex/com.android.art/lib64/libart.so!libart.so (_jobject art::InvokeMethod<(art::PointerSize)8>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject, _jobject, _jobject, unsigned long)+1384) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

69 pc 0000000000595cb8 /apex/com.android.art/lib64/libart.so!libart.so (art::Method_invoke(_JNIEnv, _jobject, _jobject, _jobjectArray)+48) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

70 pc 00000000000b2f74 /apex/com.android.art/javalib/arm64/boot.oat (art_jni_trampoline+132) (BuildId: e9be90d95f3564cc2743d102f4b805e39746b915)

71 pc 0000000000218964 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+548) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

72 pc 00000000002851f0 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread, unsigned int, unsigned int, art::JValue, char const)+184) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

73 pc 00000000003e6720 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread, art::ArtMethod, art::ShadowFrame, unsigned short, art::JValue)+400) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

74 pc 00000000003e131c /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod, art::Thread, art::ShadowFrame&, art::Instruction const, unsigned short, art::JValue)+804) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

75 pc 0000000000753ea4 /apex/com.android.art/lib64/libart.so!libart.so (MterpInvokeVirtual+1164) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

76 pc 0000000000203814 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+20) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

77 pc 0000000000239ec2 /system/framework/framework.jar (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run+22)

78 pc 00000000003d8f10 /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool)+304) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

79 pc 00000000007426bc /apex/com.android.art/lib64/libart.so!libart.so (artQuickToInterpreterBridge+780) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

80 pc 0000000000222378 /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

81 pc 00000000008579ec /system/framework/arm64/boot-framework.oat (com.android.internal.os.ZygoteInit.main+2172) (BuildId: 132cf3687181c15b3a66f37a365dfcd52870cc43)

82 pc 0000000000218be8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

83 pc 000000000028520c /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread, unsigned int, unsigned int, art::JValue, char const)+212) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

84 pc 0000000000625de8 /apex/com.android.art/lib64/libart.so!libart.so (art::JValue art::InvokeWithVarArgs<art::ArtMethod>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject, art::ArtMethod*, std::__va_list)+448) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

85 pc 00000000006262bc /apex/com.android.art/lib64/libart.so!libart.so (art::JValue art::InvokeWithVarArgs<_jmethodID>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject, _jmethodID*, std::__va_list)+92) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

86 pc 0000000000500324 /apex/com.android.art/lib64/libart.so!libart.so (art::JNI::CallStaticVoidMethodV(_JNIEnv, _jclass, _jmethodID*, std::__va_list)+612) (BuildId: 85ad158e2cd84e31e3d6a557fad29411)

87 pc 00000000000aeb28 /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod(_jclass, _jmethodID, ...)+120) (BuildId: 16239c6d7fe55bcf8081fd34e682de81)

88 pc 00000000000ba1ac /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start(char const*, android::Vector const&, bool)+844) (BuildId: 16239c6d7fe55bcf8081fd34e682de81)

89 pc 0000000000002580 /system/bin/app_process64 (main+1320) (BuildId: 1410b6f6903418cf8ba5b10d7f351072)

90 pc 0000000000082098 /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+96) (BuildId: 4c5e8a526aee4654389c4f3c4d7219aa)

shuajinanhai commented 2 years ago

https://github.com/canyie/pine/issues/25

https://github.com/canyie/pine/commit/b971bf658891c0cedb089fdd95d9e1604d12f8e2

shuajinanhai commented 2 years ago

https://cs.android.com/android/platform/superproject/+/master:art/runtime/art_method.h;drc=c226211ebcf8e0185d4e46376bff6468d0c6967f;l=589

https://cs.android.com/android/platform/superproject/+/master:art/runtime/class_linker.cc;drc=5171813632baff231dc2a9b0e794a13c908ab344;l=3706

rk700 commented 2 years ago

Yes it's a known bug.

https://github.com/PAGalaxyLab/YAHFA/commit/b15b08adac8758060951f7e270ddf2dda0664586

shuajinanhai commented 2 years ago

but do not set native flag，hook will fail

shuajinanhai commented 2 years ago

but do not set native flag，hook will fail in debuggable

ghost commented 2 years ago

和Pending Hook有关，安卓12的调试模式必须使用Pending Hook，否则崩溃。 Pending Hook太麻烦，你在项目设置debuggable为false即可