search

frida / frida-java-bridge

Java runtime interop from Frida
324 stars 119 forks source link

Android 15, unable to perform state transition #336

Open matbrik opened 1 week ago

matbrik commented 1 week ago

Device Pixel 6 Android 15 beta AP31.240617.015 rooted with Magisk

 ./frida-inject-16.5.1-android-arm64 -p 1437 -i -s test.js                                                                                                                                                                                           
{"type":"error","description":"Error: Unable to perform state transition; please file a bug","stack":"Error: Unable to perform state transition; please file a bug
    at bt (frida/node_modules/frida-java-bridge/lib/android.js:578)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/class-model.js:115)
    at build (frida/node_modules/frida-java-bridge/lib/class-model.js:7)
    at _make (frida/node_modules/frida-java-bridge/lib/class-factory.js:168)
    at use (frida/node_modules/frida-java-bridge/lib/class-factory.js:62)
    at <anonymous> (frida/node_modules/frida-java-bridge/index.js:224)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:12)
    at _performPendingVmOpsWhenReady (frida/node_modules/frida-java-bridge/index.js:244)
    at perform (frida/node_modules/frida-java-bridge/index.js:204)
    at <eval> (/test.js:17)","fileName":"frida/node_modules/frida-java-bridge/lib/android.js","lineNumber":578,"columnNumber":1}

I get the same error using a frida-server

How can I debug this? I cannot match the line numbers in the stacktrace with a relevant code in the source files

pig837 commented 1 week ago

It's frida bug.

If the ROM is equipped with a Google Play System Update version before August 2024, the workaround in the link below can be applied. However, if the ROM is equipped after August 2024, the workaround may cannot be applied, and this is something that Frida developers need to fix.

https://github.com/frida/frida/issues/2958

matbrik commented 1 week ago

I found the issue and I've tested an "hardcoded" version of frida. Basically at https://github.com/frida/frida-java-bridge/blob/main/lib/android.js#L3929 frida looks for the address of ExceptionClear but the address found is wrong. Setting the correct address of ExceptionClear (found through diffing 2 libart) Frida works again. Next week I'll try to find the new offset in the vtable for exceptionclear and commit the fix