search

frida / frida

Clone this repo to build Frida
https://frida.re
Other
15.72k stars 1.63k forks source link

with WSA - Windows Subsystem for Android - running frida to launch app returns Process crashed: Bad access due to invalid address #1987

Open coinzdude opened 2 years ago

coinzdude commented 2 years ago

On WSA, Windows 11, attempting to launch frida responds with an error: "Process crashed: Bad access due to invalid address"

More details, this is LSPosed github WSA which includes magisk: https://github.com/LSPosed/MagiskOnWSA/

Command is below:

frida -U --codeshare pcipolloni/universal-android-ssl-pinning-bypass-with-frida -f com.twitter.android

Error details are below:

     ____

    / _  |   Frida 15.1.1 - A world-class dynamic instrumentation toolkit

   | (_| |

    > _  |   Commands:

   /_/ |_|       help      -> Displays the help system

   . . . .       object?   -> Display information about 'object'

   . . . .       exit/quit -> Exit

   . . . .

   . . . .   More info at https://frida.re/docs/home/

Spawned `com.twitter.android`. Use %resume to let the main thread start executing!

Process crashed: Bad access due to invalid address

***

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

Build fingerprint: 'google/redfin/redfin:11/RD2A.211001.002/eng.latteu.20211111.210152:user/release-keys'

Revision: '0'

ABI: 'x86_64'

Timestamp: 2022-01-12 20:13:11-0500

pid: 5886, tid: 5909, name: Thread-2  >>> com.twitter.android <<<

uid: 10068

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xb5d8ed32

    rax 000070bcc67cf6e0  rbx 000070bbb5afa0a8  rcx 54a07175d3ac76b5  rdx 000000000000123d

    r8  0000000000000002  r9  0000000000000000  r10 00000000703096b0  r11 0000000000000000

    r12 000000000000123d  r13 00000000b5d8ed2e  r14 00000000702a7438  r15 000070bc867cea10

    rdi 000070bc867cea10  rsi 000000007031da00

    rbp 000070bbad9fb020  rsp 000070bbad9faf50  rip 000070bbb67556da

backtrace:

      #00 pc 000000000078a6da  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x643000) (MterpInvokeVirtual+218) (BuildId: d0a458400cb956a162aabaef91898b45)

      #01 pc 0000000000163099  /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+25) (BuildId: d0a458400cb956a162aabaef91898b45)

      #02 pc 00000000000fa0a8  /apex/com.android.art/javalib/core-oj.jar (java.lang.reflect.Method.getGenericReturnType)

      #03 pc 0000000000392c7f  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x2cc000) (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.17079065513659061432)+335) (BuildId: d0a458400cb956a162aabaef91898b45)

      #04 pc 000000000077672f  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x643000) (artQuickToInterpreterBridge+1103) (BuildId: d0a458400cb956a162aabaef91898b45)

      #05 pc 000000000018434c  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x183000) (art_quick_to_interpreter_bridge+140) (BuildId: d0a458400cb956a162aabaef91898b45)

      #06 pc 000070bb12d46330  <unknown>

***

[Pixel 5::com.twitter.android]->
coinzdude commented 2 years ago

logcat here:

01-12 20:52:45.786  1861  2249 I Metrics:BatchTransmitte: QueuePusher.sendBatches - Drained batch queue.; Number of HIGH_ANONYMOUS queue batches sent: 0

01-12 20:52:45.953  1861  2250 I Metrics:BatchTransmitte: QueuePusher.sendBatches - Drained batch queue.; Number of HIGH_NON_ANONYMOUS queue batches sent: 0

01-12 20:52:46.871   313  4730 I ActivityManager: Force stopping com.twitter.android appid=10068 user=0: from pid 313

01-12 20:52:46.871   313  4730 I ActivityManager: Killing 7070:com.twitter.android/u0a68 (adj -10000): stop com.twitter.android due to from pid 313

01-12 20:52:46.872   313   342 I libprocessgroup: Successfully killed process cgroup uid 10068 pid 7070 in 0ms

01-12 20:52:46.873   313  4730 I WindowManager:   Force finishing activity ActivityRecord{67c7285 u0 com.twitter.android/.StartActivity t199}

01-12 20:52:46.880   313  4730 W InputDispatcher: Focused display #0 does not have a focused window.

01-12 20:52:46.898   313   335 W WindowManager: Cannot find window which accessibility connection is added to

01-12 20:52:46.933   313   335 W WindowManager: Failed looking up window session=Session{380e948 313:1000} callers=com.android.server.wm.WindowManagerService.windowForClientLocked:5435 com.android.server.wm.WindowManagerService.removeWindow:1898 com.android.server.wm.Session.remove:193

01-12 20:52:46.943   142   257 D librcm  : SocketClient connected to host port 22469

01-12 20:52:46.946   142   257 D goldfish-address-space: allocate: Ask for block of size 0x76c1ec

01-12 20:52:46.946   142   257 D goldfish-address-space: allocate: allocate returned phys_addr 0x1cfe7d000 offset 0x2e7d000 size 0x76c1ec

01-12 20:52:46.947   313  4730 W ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.startActivity:993 android.content.ContextWrapper.startActivity:403 <bottom of call stack> <bottom of call stack> <bottom of call stack>

01-12 20:52:46.947   313  4730 W ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.startActivity:1005 android.app.ContextImpl.startActivity:994 android.content.ContextWrapper.startActivity:403 <bottom of call stack> <bottom of call stack>

01-12 20:52:46.962   313  4730 I ActivityTaskManager: START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10000000 pkg=com.twitter.android cmp=com.twitter.android/.StartActivity} from uid 1000

01-12 20:52:47.001   313  4730 I DisplayManagerService: Display device added: DisplayDeviceInfo{"com.twitter.android:15": uniqueId="virtual:com.microsoft.windows.systemapp:com.twitter.android:15", 1543 x 1261, modeId 32, defaultModeId 32, supportedModes [{id=32, width=1543, height=1261, fps=60.0}], colorMode 0, supportedColorModes [0], HdrCapabilities null, allmSupported false, gameContentTypeSupported false, density 360, 360.0 x 360.0 dpi, appVsyncOff 0, presDeadline 16666666, touch VIRTUAL, rotation 0, type VIRTUAL, deviceProductInfo null, state OFF, owner com.microsoft.windows.systemapp (uid 1000), FLAG_ROTATES_WITH_CONTENT, FLAG_SECURE, FLAG_OWN_CONTENT_ONLY}

01-12 20:52:47.010   142   257 D librcm  : SocketClient connected to host port 22469

01-12 20:52:47.011   142   257 D goldfish-address-space: allocate: Ask for block of size 0x76c1ec

01-12 20:52:47.012   142   257 D goldfish-address-space: allocate: allocate returned phys_addr 0x1cd000000 offset 0x0 size 0x76c1ec

01-12 20:52:47.022   142   257 D librcm  : SocketClient connected to host port 22469

01-12 20:52:47.023   142   257 D goldfish-address-space: allocate: Ask for block of size 0x76c1ec

01-12 20:52:47.023   142   257 D goldfish-address-space: allocate: allocate returned phys_addr 0x1cd76d000 offset 0x76d000 size 0x76c1ec

01-12 20:52:47.023   313  4730 I WindowManager: Override config changes=20005df8 {0.0 ?mcc?mnc ?localeList ?layoutDir sw560dp w685dp h560dp 360dpi lrg land ?uimode ?night finger qwerty/v/v -nav/h winConfig={ mBounds=Rect(0, 0 - 1543, 1261) mAppBounds=Rect(0, 0 - 1543, 1261) mWindowingMode=fullscreen mDisplayWindowingMode=fullscreen mActivityType=undefined mAlwaysOnTop=undefined mRotation=ROTATION_0}} for displayId=15

01-12 20:52:47.026   453   453 W DisplayController: Skipping Display Configuration change on non-added display.

01-12 20:52:47.033   313   327 W TaskListener: No top stack on display 15

01-12 20:52:47.034   313  4730 I ActivityTaskManager: START u0 {flg=0x18000000 cmp=com.microsoft.windows.userapp/.PlaceholderActivity} from uid 1000

01-12 20:52:47.044   313  4730 W ActivityTaskManager: Tried to set launchTime (0) < mLastActivityLaunchTime (4305910)

01-12 20:52:47.046   313  4730 W InputDispatcher: Focused display #15 does not have a focused window.

01-12 20:52:47.046   313  4730 E InputDispatcher: But another display has a focused window:

01-12 20:52:47.046   313  4730 E InputDispatcher: Display #0 has focused window: 'Window{46fc6ab u0 com.microsoft.windows.userapp/com.microsoft.windows.home.Home}'

01-12 20:52:47.082   313   334 I InputManager-JNI: Viewport [0] to add: local:0, isActive: true

01-12 20:52:47.082   313   334 I InputManager-JNI: Viewport [1] to add: virtual:com.microsoft.windows.systemapp:com.teslacoilsw.launcher:4, isActive: true

01-12 20:52:47.082   313   334 I InputManager-JNI: Viewport [2] to add: virtual:com.microsoft.windows.systemapp:com.twitter.android:14, isActive: true

01-12 20:52:47.082   313   334 I InputManager-JNI: Viewport [3] to add: virtual:com.microsoft.windows.systemapp:com.twitter.android:15, isActive: true

01-12 20:52:47.083   313   380 I InputReader: Reconfiguring input devices, changes=DISPLAY_INFO |

01-12 20:52:47.092   142   257 D librcm  : SocketClient connected to host port 22469

01-12 20:52:47.094   142   257 D goldfish-address-space: allocate: Ask for block of size 0x76c1ec

01-12 20:52:47.094   142   257 D goldfish-address-space: allocate: allocate returned phys_addr 0x1cd000000 offset 0x0 size 0x76c1ec

01-12 20:52:47.100   313  5403 I ActivityTaskManager: moveTaskToBack: Task{9fac16d #202 visible=false type=standard mode=fullscreen translucent=true I=com.microsoft.windows.userapp/.PlaceholderActivity U=0 StackId=202 sz=1}

01-12 20:52:47.108   313   334 I DisplayManagerService: Display device changed state: "com.twitter.android:15", ON

01-12 20:52:47.122   313   332 D ActivityTaskManager: awakeFromSleepingLocked: previously pausing activity didn't pause

01-12 20:52:47.133   313  6975 W TaskListener: No top stack on display 14

01-12 20:52:47.137   313  6975 I DisplayManagerService: Display device removed: DisplayDeviceInfo{"com.twitter.android:14": uniqueId="virtual:com.microsoft.windows.systemapp:com.twitter.android:14", 1543 x 1261, modeId 31, defaultModeId 31, supportedModes [{id=31, width=1543, height=1261, fps=60.0}], colorMode 0, supportedColorModes [0], HdrCapabilities null, allmSupported false, gameContentTypeSupported false, density 360, 360.0 x 360.0 dpi, appVsyncOff 0, presDeadline 16666666, touch VIRTUAL, rotation 0, type VIRTUAL, deviceProductInfo null, state OFF, owner com.microsoft.windows.systemapp (uid 1000), FLAG_ROTATES_WITH_CONTENT, FLAG_SECURE, FLAG_OWN_CONTENT_ONLY}

01-12 20:52:47.163   313   334 I InputManager-JNI: Viewport [0] to add: local:0, isActive: true

01-12 20:52:47.164   313   334 I InputManager-JNI: Viewport [1] to add: virtual:com.microsoft.windows.systemapp:com.teslacoilsw.launcher:4, isActive: true

01-12 20:52:47.164   313   334 I InputManager-JNI: Viewport [2] to add: virtual:com.microsoft.windows.systemapp:com.twitter.android:15, isActive: true

01-12 20:52:47.164   313   380 I InputReader: Reconfiguring input devices, changes=DISPLAY_INFO |

01-12 20:52:47.185   119   119 D Zygote  : Forked child process 7117

01-12 20:52:47.190   313   341 I ActivityManager: Start proc 7117:com.twitter.android/u0a68 for pre-top-activity {com.twitter.android/com.twitter.android.StartActivity}

01-12 20:52:47.209  7117  7117 W twitter.androi: Unexpected CPU variant for X86 using defaults: x86_64

01-12 20:52:47.213   313   341 W ActivityManager: Slow operation: 72ms so far, now at startProcess: done updating pids map

01-12 20:52:47.215   313   334 W DisplayManagerService: Attempted to change non-existent display device: DisplayDeviceInfo{"com.twitter.android:14": uniqueId="virtual:com.microsoft.windows.systemapp:com.twitter.android:14", 1543 x 1261, modeId 31, defaultModeId 31, supportedModes [{id=31, width=1543, height=1261, fps=60.0}], colorMode 0, supportedColorModes [0], HdrCapabilities null, allmSupported false, gameContentTypeSupported false, density 360, 360.0 x 360.0 dpi, appVsyncOff 0, presDeadline 16666666, touch VIRTUAL, rotation 0, type VIRTUAL, deviceProductInfo null, state OFF, owner com.microsoft.windows.systemapp (uid 1000), FLAG_ROTATES_WITH_CONTENT, FLAG_SECURE, FLAG_OWN_CONTENT_ONLY}

01-12 20:52:47.216   313   334 W DisplayManagerService: Attempted to change non-existent display device: DisplayDeviceInfo{"com.twitter.android:14": uniqueId="virtual:com.microsoft.windows.systemapp:com.twitter.android:14", 1543 x 1261, modeId 31, defaultModeId 31, supportedModes [{id=31, width=1543, height=1261, fps=60.0}], colorMode 0, supportedColorModes [0], HdrCapabilities null, allmSupported false, gameContentTypeSupported false, density 360, 360.0 x 360.0 dpi, appVsyncOff 0, presDeadline 16666666, touch VIRTUAL, rotation 0, type VIRTUAL, deviceProductInfo null, state OFF, owner com.microsoft.windows.systemapp (uid 1000), FLAG_ROTATES_WITH_CONTENT, FLAG_SECURE, FLAG_OWN_CONTENT_ONLY}

01-12 20:52:47.219   313   313 W WindowManager: removeWindowToken: Attempted to remove token: android.os.Binder@5bf78da for non-exiting displayId=14

01-12 20:52:47.231  7117  7117 E twitter.androi: Not starting debugger since process cannot load the jdwp agent.

01-12 20:52:48.054  7117  7140 F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xb5d8ed32 in tid 7140 (Thread-2), pid 7117 (twitter.android)

01-12 20:52:48.091  7145  7145 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstone

01-12 20:52:48.091    89    89 I tombstoned: received crash request for pid 7140

01-12 20:52:48.092  7145  7145 I crash_dump64: performing dump of process 7117 (target tid = 7140)

01-12 20:52:48.096  7145  7145 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

01-12 20:52:48.096  7145  7145 F DEBUG   : Build fingerprint: 'google/redfin/redfin:11/RD2A.211001.002/eng.latteu.20211111.210152:user/release-keys'

01-12 20:52:48.096  7145  7145 F DEBUG   : Revision: '0'

01-12 20:52:48.096  7145  7145 F DEBUG   : ABI: 'x86_64'

01-12 20:52:48.096  7145  7145 F DEBUG   : Timestamp: 2022-01-12 20:52:48-0500

01-12 20:52:48.096  7145  7145 F DEBUG   : pid: 7117, tid: 7140, name: Thread-2  >>> com.twitter.android <<<

01-12 20:52:48.096  7145  7145 F DEBUG   : uid: 10068

01-12 20:52:48.096  7145  7145 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xb5d8ed32

01-12 20:52:48.096  7145  7145 F DEBUG   :     rax 000070bcc67cf6e0  rbx 000070bbb5afa0a8  rcx 54a07175d3ac76b5  rdx 000000000000123d

01-12 20:52:48.096  7145  7145 F DEBUG   :     r8  0000000000000002  r9  0000000000000000  r10 00000000703096b0  r11 0000000000000000

01-12 20:52:48.096  7145  7145 F DEBUG   :     r12 000000000000123d  r13 00000000b5d8ed2e  r14 00000000702a7438  r15 000070bc867cea10

01-12 20:52:48.096  7145  7145 F DEBUG   :     rdi 000070bc867cea10  rsi 000000007031da00

01-12 20:52:48.096  7145  7145 F DEBUG   :     rbp 000070bbae4f6020  rsp 000070bbae4f5f50  rip 000070bbb67556da

01-12 20:52:48.207  7145  7145 F DEBUG   : backtrace:

01-12 20:52:48.207  7145  7145 F DEBUG   :       #00 pc 000000000078a6da  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x643000) (MterpInvokeVirtual+218) (BuildId: d0a458400cb956a162aabaef91898b45)

01-12 20:52:48.207  7145  7145 F DEBUG   :       #01 pc 0000000000163099  /apex/com.android.art/lib64/libart.so (mterp_op_invoke_virtual+25) (BuildId: d0a458400cb956a162aabaef91898b45)

01-12 20:52:48.207  7145  7145 F DEBUG   :       #02 pc 00000000000fa0a8  /apex/com.android.art/javalib/core-oj.jar (java.lang.reflect.Method.getGenericReturnType)

01-12 20:52:48.208  7145  7145 F DEBUG   :       #03 pc 0000000000392c7f  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x2cc000) (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.17079065513659061432)+335) (BuildId: d0a458400cb956a162aabaef91898b45)

01-12 20:52:48.208  7145  7145 F DEBUG   :       #04 pc 000000000077672f  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x643000) (artQuickToInterpreterBridge+1103) (BuildId: d0a458400cb956a162aabaef91898b45)

01-12 20:52:48.208  7145  7145 F DEBUG   :       #05 pc 000000000018434c  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x183000) (art_quick_to_interpreter_bridge+140) (BuildId: d0a458400cb956a162aabaef91898b45)

01-12 20:52:48.208  7145  7145 F DEBUG   :       #06 pc 000070bb12d46330  <unknown>

01-12 20:52:48.449    89    89 E tombstoned: Tombstone written to: /data/tombstones/tombstone_03

01-12 20:52:48.449   253   268 I diagnostics_service: found file tombstone_03

01-12 20:52:48.449   253   268 I diagnostics_service: transmitFile tombstone_03

01-12 20:52:48.451   313  7149 I DropBoxManagerService: add tag=data_app_native_crash isTagEnabled=true flags=0x2

01-12 20:52:48.461   313   347 I BootReceiver: Copying /data/tombstones/tombstone_03 to DropBox (SYSTEM_TOMBSTONE)

01-12 20:52:48.464   313   347 I DropBoxManagerService: add tag=SYSTEM_TOMBSTONE isTagEnabled=true flags=0x2

01-12 20:52:48.494   313   340 W BroadcastQueue: Background execution not allowed: receiving Intent { act=android.intent.action.DROPBOX_ENTRY_ADDED flg=0x10 (has extras) } to com.google.android.gms/.stats.service.DropBoxEntryAddedReceiver

01-12 20:52:48.494   313   340 W BroadcastQueue: Background execution not allowed: receiving Intent { act=android.intent.action.DROPBOX_ENTRY_ADDED flg=0x10 (has extras) } to com.google.android.gms/.chimera.GmsIntentOperationService$PersistentTrustedReceiver

01-12 20:52:48.546   313   340 W BroadcastQueue: Background execution not allowed: receiving Intent { act=android.intent.action.DROPBOX_ENTRY_ADDED flg=0x10 (has extras) } to com.google.android.gms/.stats.service.DropBoxEntryAddedReceiver

01-12 20:52:48.547   313   340 W BroadcastQueue: Background execution not allowed: receiving Intent { act=android.intent.action.DROPBOX_ENTRY_ADDED flg=0x10 (has extras) } to com.google.android.gms/.chimera.GmsIntentOperationService$PersistentTrustedReceiver

01-12 20:52:48.566   253   268 I diagnostics_service: transmitFile completed successfullytombstone_03

01-12 20:52:48.567   119   119 I Zygote  : Process 7117 exited due to signal 11 (Segmentation fault)

01-12 20:52:48.580   719   719 D BoundBrokerSvc: onBind: Intent { act=com.google.android.gms.udc.service.START cmp=com.google.android.gms/.chimera.PersistentApiService }

01-12 20:52:48.580   719   719 D BoundBrokerSvc: Loading bound service for intent: Intent { act=com.google.android.gms.udc.service.START cmp=com.google.android.gms/.chimera.PersistentApiService }

01-12 20:52:56.890   313   334 W ActivityTaskManager: Launch timeout has expired, giving up wake lock!

01-12 20:53:00.013   453   674 D EGL_emulation: app_time_stats: avg=59981.93ms min=59981.93ms max=59981.93ms count=1

01-12 20:53:03.704   719   719 D BoundBrokerSvc: onUnbind: Intent { act=com.google.android.gms.udc.service.START cmp=com.google.android.gms/.chimera.PersistentApiService }

01-12 20:53:34.173   313   324 W System  : A resource failed to call release.

01-12 20:53:36.120   803  1764 V ClipboardRedirectionHandler: Receive ClipboardMessage SetServerClipboardContent

01-12 20:53:36.120   803  1764 V ClipboardContentHelper: Creating new ClipData with size of: 1

01-12 20:53:36.124   803  1764 V ClipboardRedirectionHandler: Receive ClipboardMessage SetServerClipboardContent

01-12 20:53:36.124   803  1764 V ClipboardContentHelper: Creating new ClipData with size of: 1

01-12 20:53:34.173   313   324 W System  : A resource failed to call release.

01-12 20:53:45.827  1861  2249 I Metrics:BatchTransmitte: QueuePusher.sendBatches - Drained batch queue.; Number of HIGH_ANONYMOUS queue batches sent: 0

01-12 20:53:45.994  1861  2250 I Metrics:BatchTransmitte: QueuePusher.sendBatches - Drained batch queue.; Number of HIGH_NON_ANONYMOUS queue batches sent: 0

01-12 20:54:00.049   453   674 D EGL_emulation: app_time_stats: avg=60035.54ms min=60035.54ms max=60035.54ms count=1