search

frida / frida-java-bridge

Java runtime interop from Frida
330 stars 125 forks source link

Android 15, unable to perform state transition #336

Open matbrik opened 2 months ago

matbrik commented 2 months ago

Device Pixel 6 Android 15 beta AP31.240617.015 rooted with Magisk

 ./frida-inject-16.5.1-android-arm64 -p 1437 -i -s test.js                                                                                                                                                                                           
{"type":"error","description":"Error: Unable to perform state transition; please file a bug","stack":"Error: Unable to perform state transition; please file a bug
    at bt (frida/node_modules/frida-java-bridge/lib/android.js:578)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/class-model.js:115)
    at build (frida/node_modules/frida-java-bridge/lib/class-model.js:7)
    at _make (frida/node_modules/frida-java-bridge/lib/class-factory.js:168)
    at use (frida/node_modules/frida-java-bridge/lib/class-factory.js:62)
    at <anonymous> (frida/node_modules/frida-java-bridge/index.js:224)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:12)
    at _performPendingVmOpsWhenReady (frida/node_modules/frida-java-bridge/index.js:244)
    at perform (frida/node_modules/frida-java-bridge/index.js:204)
    at <eval> (/test.js:17)","fileName":"frida/node_modules/frida-java-bridge/lib/android.js","lineNumber":578,"columnNumber":1}

I get the same error using a frida-server

How can I debug this? I cannot match the line numbers in the stacktrace with a relevant code in the source files

pig837 commented 2 months ago

It's frida bug.

If the ROM is equipped with a Google Play System Update version before August 2024, the workaround in the link below can be applied. However, if the ROM is equipped after August 2024, the workaround may cannot be applied, and this is something that Frida developers need to fix.

https://github.com/frida/frida/issues/2958

matbrik commented 2 months ago

I found the issue and I've tested an "hardcoded" version of frida. Basically at https://github.com/frida/frida-java-bridge/blob/main/lib/android.js#L3929 frida looks for the address of ExceptionClear but the address found is wrong. Setting the correct address of ExceptionClear (found through diffing 2 libart) Frida works again. Next week I'll try to find the new offset in the vtable for exceptionclear and commit the fix

QingShiLuoGu commented 1 month ago

@matbrik same issue, have you solved it?

Hamza-Megahed commented 4 days ago

This temporary solution https://github.com/frida/frida/issues/2958#issuecomment-2488844579 worked for me on android 15