chame1eon / jnitrace

A Frida based tool that traces usage of the JNI API in Android apps.
MIT License
1.62k stars 260 forks source link

Error: abort was called #14

Closed PeterParker369 closed 4 years ago

PeterParker369 commented 4 years ago

Hello. I am new in studying your toolkit. Thank you for developing such interesting tool. Together with frida you can do everything you want:)

I've got an error. The log and error below. The app doesn't starts. Is it because of unity libs? Tried frida 12.8.20 and last 12.9.3. Thanks. Waiting for reply:)

Also I'd like to suggest to add an argument :)

-el <regex> - is used to specify library names that should be ignored in the trace. 
              This can be helpful for reducing the noise in particularly large JNI apps.
              The option can be supplied multiple times.
              For example, -el testLib1.so -el testLib2.so would exclude from the results all JNI method names that contained in this libs.

jnitrace -l * -m spawn com.boundless.jawaker (https://play.google.com/store/apps/details?id=com.boundless.jawaker&hl=en) Tracing. Press any key to quit...

     /* TID 7713 */
124 ms [+] JavaVM->GetEnv
124 ms |- JavaVM*          : 0x7df82c8cc0
124 ms |- void**           : 0x7fceef5190
124 ms |:     0x7df82e8460
124 ms |- jint             : 65542
124 ms |= jint             : 0

124 ms ----------------------------------Backtrace----------------------------------
124 ms |->       0x7dd6112960: JNI_OnLoad+0x3c (libqti_performance.so:0x7dd6111000)

       /* TID 7713 */
199 ms [+] JNIEnv->FindClass
199 ms |- JNIEnv*          : 0x7df82e8460
199 ms |- char*            : 0x7dd6113764
199 ms |:     com/qualcomm/qti/Performance
199 ms |= jclass           : 0x85    { com/qualcomm/qti/Performance }

199 ms ----------------------------------------Backtrace----------------------------------------
199 ms |->       0x7e7cba0484: jniRegisterNativeMethods+0x40 (libnativehelper.so:0x7e7cb9e000)

       /* TID 7713 */
204 ms [+] JNIEnv->RegisterNatives
204 ms |- JNIEnv*          : 0x7df82e8460
204 ms |- jclass           : 0x85    { com/qualcomm/qti/Performance }
204 ms |- JNINativeMethod* : 0x7dd6131008
204 ms |:     0x7dd61129f0 - native_perf_lock_acq(II[I)I
204 ms |:     0x7dd6112abc - native_perf_lock_rel(I)I
204 ms |:     0x7dd6112ad8 - native_perf_hint(ILjava/lang/String;II)I
204 ms |:     0x7dd6112b90 - native_perf_get_feedback(ILjava/lang/String;)I
204 ms |:     0x7dd6112c24 - native_perf_io_prefetch_start(ILjava/lang/String;Ljava/lang/String;)I
204 ms |:     0x7dd6112e58 - native_perf_io_prefetch_stop()I
204 ms |:     0x7dd6112f80 - native_perf_uxEngine_events(IILjava/lang/String;I)I
204 ms |:     0x7dd6113154 - native_perf_uxEngine_trigger(I)Ljava/lang/String;
204 ms |- jint             : 8
204 ms |= jint             : 0

204 ms ----------------------------------------Backtrace----------------------------------------
204 ms |->       0x7e7cba04e0: jniRegisterNativeMethods+0x9c (libnativehelper.so:0x7e7cb9e000)

       /* TID 7713 */
213 ms [+] JNIEnv->DeleteLocalRef
213 ms |- JNIEnv*          : 0x7df82e8460
213 ms |- jobject          : 0x85

213 ms ----------------------------------------Backtrace----------------------------------------
213 ms |->       0x7e7cba0534: jniRegisterNativeMethods+0xf0 (libnativehelper.so:0x7e7cb9e000)

       /* TID 7713 */
432 ms [+] JavaVM->AttachCurrentThread
432 ms |- JavaVM*          : 0x7df82c8cc0
432 ms |- void**           : 0x7fceef4ca8
432 ms |:     0x7df82e8460
432 ms |- void*            : 0x0
432 ms |= jint             : 0

432 ms ----------------------------Backtrace----------------------------
432 ms |->       0x7dd54e1858: JNI_OnLoad+0x1c (libmain.so:0x7dd54e1000)

       /* TID 7713 */
437 ms [+] JNIEnv->FindClass
437 ms |- JNIEnv*          : 0x7df82e8460
437 ms |- char*            : 0x7dd54e1b28
437 ms |:     com/unity3d/player/NativeLoader
437 ms |= jclass           : 0x91    { com/unity3d/player/NativeLoader }

437 ms ----------------------------Backtrace----------------------------
437 ms |->       0x7dd54e1870: JNI_OnLoad+0x34 (libmain.so:0x7dd54e1000)

       /* TID 7713 */
443 ms [+] JNIEnv->RegisterNatives
443 ms |- JNIEnv*          : 0x7df82e8460
443 ms |- jclass           : 0x91    { com/unity3d/player/NativeLoader }
443 ms |- JNINativeMethod* : 0x7dd54f1fa0
443 ms |:     0x7dd54e18cc - load(Ljava/lang/String;)Z
443 ms |:     0x7dd54e1a9c - unload()Z
443 ms |- jint             : 2
443 ms |= jint             : 0

443 ms ----------------------------Backtrace----------------------------
443 ms |->       0x7dd54e1894: JNI_OnLoad+0x58 (libmain.so:0x7dd54e1000)

       /* TID 7713 */
453 ms [+] JNIEnv->GetStringUTFLength
453 ms |- JNIEnv*          : 0x7df82e8460
453 ms |- jstring          : 0x7fceef5668
453 ms |= jsize            : 66

453 ms -----------------------------Backtrace-----------------------------
453 ms |->       0x7dd54e1904: libmain.so!0x904 (libmain.so:0x7dd54e1000)

       /* TID 7713 */
457 ms [+] JNIEnv->GetStringUTFChars
457 ms |- JNIEnv*          : 0x7df82e8460
457 ms |- jstring          : 0x7fceef5668
457 ms |- jboolean*        : 0x0
457 ms |= char*            : 0x7df823b750

457 ms -----------------------------Backtrace-----------------------------
457 ms |->       0x7dd54e1930: libmain.so!0x930 (libmain.so:0x7dd54e1000)

       /* TID 7713 */
462 ms [+] JNIEnv->ReleaseStringUTFChars
462 ms |- JNIEnv*          : 0x7df82e8460
462 ms |- jstring          : 0x7df823b750
462 ms |- char*            : 0x7df823b750
462 ms |:     /data/app/com.boundless.jawaker-h3IBeFROAGcy8xvbmPRpuw==/lib/arm64

462 ms -----------------------------Backtrace-----------------------------
462 ms |->       0x7dd54e195c: libmain.so!0x95c (libmain.so:0x7dd54e1000)

       /* TID 7713 */
466 ms [+] JNIEnv->GetJavaVM
466 ms |- JNIEnv*          : 0x7df82e8460
466 ms |- JavaVM**         : 0x7fceef4a00
466 ms |:     0x7df82c8cc0
466 ms |= jint             : 0

466 ms -----------------------------Backtrace-----------------------------
466 ms |->       0x7dd54e197c: libmain.so!0x97c (libmain.so:0x7dd54e1000)

ERROR: {'type': 'error', 'description': 'Error: abort was called', 'stack': 'Error: abort was called\n at InvocationContext. (node_modules/jnitrace-engine/dist/jni/jni_env_interceptor.js:260:23)', 'fileName': 'node_modules/jnitrace-engine/dist/jni/jni_env_interceptor.js', 'lineNumber': 260, 'columnNumber': 23}

chame1eon commented 4 years ago

Hi,

Thanks very much for your comments and suggestions.

I've tried to reproduce the error you were experiencing but have been unable to. I am using the same application and a 64 bit ARM Android 8 device. I got the same output as you up until the error you were seeing, the application seemed to work okay for me. Any chance you can provide a bit more information on what were you were doing on the application to cause the issue?

It might also be helpful to try targeting a smaller set of libraries to see if we can narrow down the one that is the causing the issue.

Thanks also for your feature suggestion. I think that would be a useful idea, especially in trying to help work around this issue. I'll have a look at implementing the feature you suggested.

PeterParker369 commented 4 years ago

Using Xiaomi Mi A3 (arm64, Android 9). Tried my Windows VM and Linux VM with device. Tried frida 12.8.20 and 12.9.3. Error is the same. I'm not using any scripts before or after calling jnitrace, just executing the command:

jnitrace -l * -m spawn com.boundless.jawaker
jnitrace -l * com.boundless.jawaker                      - gives the same error

Also tried: Start an app and immediately execute 'jnitrace -l * -m attach com.boundless.jawaker'. Jnitrace prints some info to console (the image below), app's loading progress bar freezes and nothing happens. Waited for long. If I press 'Enter' in console the app stops.

e1

Also as You advised to target a smaller set of libraries. I tried to execute jnitrace with only one library name. Iterated all library names. Tried spawn/attach arguments. The result is that app closes and alert window is showed 'Sorry. The application has stopped unexpectedly. Bla bla bla..'

As I see the main difference in Android version. Maybe something has been changed.

Any recommendations?:)

chame1eon commented 4 years ago

Sorry for the delay in getting back to you on this. Have you tried with other applications? I wonder if the issue is caused by custom library that your device is loading that my device does not have.

Let me know if it happens with other applications. If it does it should narrow the problem down to the app or the device.

chame1eon commented 4 years ago

Closing this as no updates in last four weeks.