frida / frida-gum

Cross-platform instrumentation and introspection library written in C
https://frida.re
Other
752 stars 245 forks source link

Stalker crashes apparently on pthread_create #348

Open alvarofe opened 5 years ago

alvarofe commented 5 years ago

I have been playing with Stalker however it crashes always on my case on pthread_create. At first, I tried to stalk all threads but that crashes as well though it might reasonable to some extent - not familiar with Stalker API and how it works underneath. Therefore, I intercept a callback generated in the native layer of the application to stalk from there. Basically, the idea is to get all the basic blocks to print them on IDA.


const callback_offset = ;
const callback = Module.findBaseAddress('*****').add(callback_offset);
let thread_followed: number = 0; 

Interceptor.attach(callback, {
  onEnter(args) {
    if (this.threadId != thread_followed) {
      if (thread_followed != 0) {
        Stalker.unfollow(thread_followed);
        Stalker.flush();
      }
      console.log("[+] Following " + this.threadId);
      Stalker.follow(this.threadId, {
        events: {
          compile : true
        },
        onReceive(rawEvents) {
          const events = Stalker.parse(rawEvents, {annotate: false}) as StalkerCompileEventBare[];
          events.forEach(ev => {
            const blockstart = ev[0] as NativePointer;
          });
        }
      });
      thread_followed = this.threadId;
    }
  },
});

This is the backtrace

#00:  0xb7e7db18  (null)
#01:  0x0001f9e0  /system/lib64/libc.so  clone
#02:  0x0001f9e0  /system/lib64/libc.so  clone
#03:  0x0006d3fc  /system/lib64/libc.so  pthread_create
#04:  0x0006d3fc  /system/lib64/libc.so  pthread_create
#05:  0x001c5450  /data/app/com.******

I will spend some time to understand how stalker works. Although this is not my priority number one within the TODO I currently have I would like to fix it. Thus, If you have any idea what would be happening it would help me to fix this sooner.

Btw, running this on Android arm64

alvarofe commented 5 years ago

When stalking one thread that at the same time creates another thread, these two internally share for example the arm64writer failing the process of rewritting leading to a crash. Ideally, it should detect calls to clone to unfollow the child to run freely or stalk this new thread.