search

anestisb / vdexExtractor

Tool to decompile & extract Android Dex bytecode from Vdex files
Apache License 2.0
1k stars 214 forks source link

SEGFAULT with some .vdex #18

Closed hexedit closed 6 years ago

hexedit commented 6 years ago

Crash with some .vdex files, built with gcc, tested on MSYS2, Gentoo, Arch

Program received signal SIGSEGV, Segmentation fault.
0x00005555555702f1 in QuickeningInfoItGetCurrentPtr () at vdex/vdex_backend_010.c:54
54    return quickening_info_ptr + current_code_item_ptr[1] + sizeof(u4);
(gdb) bt
#0  0x00005555555702f1 in QuickeningInfoItGetCurrentPtr () at vdex/vdex_backend_010.c:54
#1  0x0000555555571937 in vdex_backend_010_process (VdexFileName=0x7fffffffded2 "system/app/FidoClient/oat/arm64/FidoClient.vdex", cursor=0x7ffff7297000 "vdex010", pRunArgs=0x7fffffffd7f0) at vdex/vdex_backend_010.c:395
#2  0x000055555557263a in vdex_010_process (VdexFileName=0x7fffffffded2 "system/app/FidoClient/oat/arm64/FidoClient.vdex", cursor=0x7ffff7297000 "vdex010", pRunArgs=0x7fffffffd7f0) at vdex/vdex_010.c:183
#3  0x00005555555641a3 in main (argc=5, argv=0x7fffffffdac8) at vdexExtractor.c:229

.vdex files causing segfault

DriffeX commented 6 years ago

I confirm bug

anestisb commented 6 years ago

Thanks for reporting. Will have a look at it.

anestisb commented 6 years ago

The problem with the reported Vdex files is that the QuickeningInfo offsets (as extracted from Vdex header) are pointing past the end of file (aka offset bigger than file size). Have added some additional error handling cases so there malformed files can be detected without a crash.

Not sure how you generated these Vdex file (or obtained from), although the corresponding env is either broken, or not compatible with the upstream Android.

$ bin/vdexExtractor -i ~/Downloads/FidoClient.vdex -v 4 -o /tmp
[INFO] Processing 1 file(s) from /Users/anestisb/Downloads/FidoClient.vdex
[DEBUG] [81287] 2018/08/12 13:52:29 (vdexExtractor.c:194 main) Processing '/Users/anestisb/Downloads/FidoClient.vdex'
[DEBUG] [81287] 2018/08/12 13:52:29 (vdex.c:40 vdex_initEnv) Initializing environment for Vdex version '010'
------ Vdex Header Info ------
magic header & version      : vdex-010
number of dex files         : 1 (1)
dex size (overall)          : 21545c (2184284)
verifier dependencies size  : 4aec (19180)
verifier dependencies offset: 215478 (2184312)
quickening info size        : 21094 (135316)
quickening info offset      : 219f64 (2203492)
dex files info              :
  [0] location checksum : a822e26f (2820858479)
---- EOF Vdex Header Info ----
[ERROR] [81287] 2018/08/12 13:52:29 (vdex/vdex_010.c:179 vdex_010_SanityCheck) Verifier dependencies section points past the end of file (215478 + 4aec > 1c0000)
[ERROR] [81287] 2018/08/12 13:52:29 (vdex/vdex_backend_010.c:328 vdex_backend_010_process) Malformed Vdex file
[DEBUG] [81287] 2018/08/12 13:52:29 (vdex/vdex_010.c:206 vdex_010_process) Took 0 ms to process Vdex file
[ERROR] [81287] 2018/08/12 13:52:29 (vdexExtractor.c:231 main) Failed to process Dex files - skipping '/Users/anestisb/Downloads/FidoClient.vdex'
[INFO] 0 out of 1 Vdex files have been processed
[INFO] 0 Dex files have been extracted in total
[INFO] Extracted Dex files are available in '/tmp'
$ bin/vdexExtractor -i ~/Downloads/DeskClock.vdex -v 4 -o /tmp
[INFO] Processing 1 file(s) from /Users/anestisb/Downloads/DeskClock.vdex
[DEBUG] [81310] 2018/08/12 13:52:46 (vdexExtractor.c:194 main) Processing '/Users/anestisb/Downloads/DeskClock.vdex'
[DEBUG] [81310] 2018/08/12 13:52:46 (vdex.c:40 vdex_initEnv) Initializing environment for Vdex version '010'
------ Vdex Header Info ------
magic header & version      : vdex-010
number of dex files         : 1 (1)
dex size (overall)          : 12fab8 (1243832)
verifier dependencies size  : 3e40 (15936)
verifier dependencies offset: 12fad4 (1243860)
quickening info size        : 124d6 (74966)
quickening info offset      : 133914 (1259796)
dex files info              :
  [0] location checksum : ccb59b44 (3434453828)
---- EOF Vdex Header Info ----
[ERROR] [81310] 2018/08/12 13:52:46 (vdex/vdex_010.c:179 vdex_010_SanityCheck) Verifier dependencies section points past the end of file (12fad4 + 3e40 > 110000)
[ERROR] [81310] 2018/08/12 13:52:46 (vdex/vdex_backend_010.c:328 vdex_backend_010_process) Malformed Vdex file
[DEBUG] [81310] 2018/08/12 13:52:46 (vdex/vdex_010.c:206 vdex_010_process) Took 0 ms to process Vdex file
[ERROR] [81310] 2018/08/12 13:52:46 (vdexExtractor.c:231 main) Failed to process Dex files - skipping '/Users/anestisb/Downloads/DeskClock.vdex'
[INFO] 0 out of 1 Vdex files have been processed
[INFO] 0 Dex files have been extracted in total
[INFO] Extracted Dex files are available in '/tmp'