search

darvincisec / DetectFrida

Detect Frida for Android
MIT License
693 stars 138 forks source link

minSdkVersion 23 or above will crash app #21

Open patuoynageek opened 3 years ago

patuoynageek commented 3 years ago

The project's current gradle-5.4.1-all.zip and com.android.tools.build:gradle:3.5.0 works with minSdkVersion 23+

However upon updating to latest gradle i.e.

minSdkVersion 19 to 22 works but 23 and above would crash on native-lib.c file at free(filePaths[i]) https://github.com/darvincisec/DetectFrida/blob/master/app/src/main/c/native-lib.c#L92 the log below:

com.darvin.security A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0x10 in tid 2547 (darvin.security), pid 2547 (darvin.security)
? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
? A/DEBUG: Build fingerprint: 'google/bullhead/bullhead:8.1.0/OPM7.181205.001/5080180:user/release-keys'
? A/DEBUG: Revision: 'rev_1.0'
? A/DEBUG: ABI: 'arm64'
? A/DEBUG: pid: 2547, tid: 2547, name: darvin.security  >>> com.darvin.security <<<
? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x10
? A/DEBUG: Cause: null pointer dereference
? A/DEBUG:     x0   000000773a627208  x1   000000000000003f  x2   000000773a60d000  x3   0000000000000000
? A/DEBUG:     x4   0000000040100401  x5   a880000040404000  x6   0000000000000000  x7   7f7f7f7f7f7f7f7f
? A/DEBUG:     x8   ffffffffffffff98  x9   fffffffffffffff3  x10  0000000000000000  x11  0000000000080000
? A/DEBUG:     x12  0000000000000000  x13  0000000000000038  x14  ff00000000000000  x15  ffffffffffffffff
? A/DEBUG:     x16  00000077bc9d7ca8  x17  00000077bc9744b8  x18  f3b5ed4d78e7ce10  x19  000000000000003f
? A/DEBUG:     x20  000000773a627208  x21  000000773a60d000  x22  0000000000000000  x23  00000077bc9e28b8
? A/DEBUG:     x24  00000077bc9e2934  x25  00000077bf295000  x26  00000077bf262662  x27  0000000000000001
? A/DEBUG:     x28  000000772208bd1c  x29  0000007fdb3db690  x30  00000077bc9a08b8
? A/DEBUG:     sp   0000007fdb3db660  pc   00000077bc9a0364  pstate 0000000080000000
? A/DEBUG: backtrace:
? A/DEBUG:     #00 pc 0000000000094364  /system/lib64/libc.so (ifree+88)
? A/DEBUG:     #01 pc 00000000000948b4  /system/lib64/libc.so (je_free+120)
? A/DEBUG:     #02 pc 0000000000001c70  /data/app/com.darvin.security-vIupc0UTGDhYeuWaj9_R8A==/base.apk (offset 0x4000) (detectfrida+3924)
? A/DEBUG:     #03 pc 000000000002087c  /system/bin/linker64 (__dl__ZL10call_arrayIPFviPPcS1_EEvPKcPT_mbS5_+280)
? A/DEBUG:     #04 pc 0000000000020aa8  /system/bin/linker64 (__dl__ZN6soinfo17call_constructorsEv+396)
? A/DEBUG:     #05 pc 000000000000c19c  /system/bin/linker64 (__dl__Z9do_dlopenPKciPK17android_dlextinfoPKv+1788)
? A/DEBUG:     #06 pc 0000000000008dfc  /system/bin/linker64 (__dl__Z20__android_dlopen_extPKciPK17android_dlextinfoPKv+72)
? A/DEBUG:     #07 pc 000000000000120c  /system/lib64/libdl.so (android_dlopen_ext+12)
? A/DEBUG:     #08 pc 0000000000002ca0  /system/lib64/libnativeloader.so (android::OpenNativeLibrary(_JNIEnv*, int, char const*, _jobject*, _jstring*, bool*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>*)+376)
? A/DEBUG:     #09 pc 0000000000300d60  /system/lib64/libart.so (art::JavaVMExt::LoadNativeLibrary(_JNIEnv*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, _jobject*, _jstring*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>*)+2132)
? A/DEBUG:     #10 pc 00000000000041d0  /system/lib64/libopenjdkjvm.so (JVM_NativeLoad+268)
? A/DEBUG:     #11 pc 00000000002821c4  /system/framework/arm64/boot.oat (offset 0x1da000) (java.lang.Runtime.nativeLoad+228)
? A/DEBUG:     #12 pc 000000000054ae4c  /system/lib64/libart.so (art_quick_invoke_static_stub+604)
? A/DEBUG:     #13 pc 00000000000dc5d0  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+264)
? A/DEBUG:     #14 pc 000000000029b49c  /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
? A/DEBUG:     #15 pc 0000000000295a90  /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+700)
? A/DEBUG:     #16 pc 0000000000533f50  /system/lib64/libart.so (MterpInvokeStatic+264)
? A/DEBUG:     #17 pc 000000000053ca94  /system/lib64/libart.so (ExecuteMterpImpl+14612)
? A/DEBUG:     #18 pc 0000000000275c00  /system/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool)+444)
? A/DEBUG:     #19 pc 000000000027b7cc  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame*, art::JValue*)+216)
? A/DEBUG:     #20 pc 0000000000295a70  /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+668)
? A/DEBUG:     #21 pc 0000000000533d68  /system/lib64/libart.so (MterpInvokeDirect+356)
? A/DEBUG:     #22 pc 000000000053ca14  /system/lib64/libart.so (ExecuteMterpImpl+14484)
? A/DEBUG:     #23 pc 0000000000275c00  /system/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool)+444)
? A/DEBUG:     #24 pc 000000000027b7cc  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame*, art::JValue*)+216)
? A/DEBUG:     #25 pc 0000000000295a70  /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+668)
? A/DEBUG:     #26 pc 0000000000532ad8  /system/lib64/libart.so (MterpInvokeVirtual+652)
? A/DEBUG:     #27 pc 000000000053c914  /system/lib64/libart.so (ExecuteMterpImpl+14228)
? A/DEBUG:     #28 pc 0000000000275c00  /system/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool)+444)
? A/DEBUG:     #29 pc 000000000027b7cc  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame*, art::JValue*)+216)
? A/DEBUG:     #30 pc 0000000000295a70  /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+668)
? A/DEBUG:     #31 pc 0000000000533f50  /system/lib64/libart.so (MterpInvokeStatic+264)
? A/DEBUG:     #32 pc 000000000053ca94  /system/lib64/libart.so (ExecuteMterpImpl+14612)
? A/DEBUG:     #33 pc 0000000000275c00  /system/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool)+444)
? A/DEBUG:     #34 pc 0000000000525450  /system/lib64/libart.so (artQuickToInterpreterBridge+1052)
? A/DEBUG:     #35 pc 0000000000553d0c  /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)
? A/DEBUG:     #36 pc 000000000054ae4c  /system/lib64/libart.so (art_quick_invoke_static_stub+604)
? A/DEBUG:     #37 pc 00000000000dc5d0  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+264)
? A/DEBUG:     #38 pc 00000000001394d0  /system/lib64/libart.so (art::ClassLinker::InitializeClass(art::Thread*, art::Handle<art::mirror::Class>, bool, bool)+2740)
? A/DEBUG:     #39 pc 0000000000122bf4  /system/lib64/libart.so (art::ClassLinker::EnsureInitialized(art::Thread*, art::Handle<art::mirror::Class>, bool, bool)+184)
? A/DEBUG:     #40 pc 00000000003dee64  /system/lib64/libart.so (art::Class_newInstance(_JNIEnv*, _jobject*)+1152)
? A/DEBUG:     #41 pc 00000000001da2ac  /system/framework/arm64/boot.oat (offset 0x1da000) (java.lang.Object.internalClone [DEDUPED]+124)
? A/DEBUG:     #42 pc 000000000054ab88  /system/lib64/libart.so (art_quick_invoke_stub+584)
? A/DEBUG:     #43 pc 00000000000dc594  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+204)
? A/DEBUG:     #44 pc 000000000029b49c  /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
? A/DEBUG:     #45 pc 0000000000295a90  /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+700)
? A/DEBUG:     #46 pc 0000000000532ad8  /system/lib64/libart.so (MterpInvokeVirtual+652)
? A/DEBUG:     #47 pc 000000000053c914  /system/lib64/libart.so (ExecuteMterpImpl+14228)
? A/DEBUG:     #48 pc 0000000000275c00  /system/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool)+444)
? A/DEBUG:     #49 pc 000000000027b7cc  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame*, art::JValue*)+216)
? A/DEBUG:     #50 pc 0000000000295a70  /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+668)
? A/DEBUG:     #51 pc 0000000000532ad8  /system/lib64/libart.so (MterpInvokeVirtual+652)
? A/DEBUG:     #52 pc 000000000053c914  /system/lib64/libart.so (ExecuteMterpImpl+14228)
? A/DEBUG:     #53 pc 0000000000275c00  /system/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool)+444)
? A/DEBUG:     #54 pc 000000000027b7cc  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame*, art::JValue*)+216)
? A/DEBUG:     #55 pc 0000000000295a70  /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+668)
? A/DEBUG:     #56 pc 0000000000533d68  /system/lib64/libart.so (MterpInvokeDirect+356)
? A/DEBUG:     #57 pc 000000000053ca14  /system/lib64/libart.so (ExecuteMterpImpl+14484)
? A/DEBUG:     #58 pc 0000000000275c00  /system/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool)+444)
? A/DEBUG:     #59 pc 000000000027b7cc  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame*, art::JValue*)+216)
? A/DEBUG:     #60 pc 0000000000295a70  /system/lib64/libart.so (_ZN3art11interpreter6DoCallILb0ELb0EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtPNS_6JValueE+668)
? A/DEBUG:     #61 pc 0000000000533d68  /system/lib64/libart.so (MterpInvokeDirect+356)
? A/DEBUG:     #62 pc 000000000053ca14  /system/lib64/libart.so (ExecuteMterpImpl+14484)
? A/DEBUG:     #63 pc 0000000000275c00  /system/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::DexFile::CodeItem const*, art::ShadowFrame&, art::JValue, bool)+444)

I also tried com.android.tools.build:gradle:4.1.3' and gradle-6.7-all.zip resulting in same crash issue