search

jmpews / Dobby

a lightweight, multi-platform, multi-architecture hook framework.
Apache License 2.0
3.89k stars 798 forks source link

crash in elf_ctx_init #133

Closed b14aa178 closed 3 years ago

b14aa178 commented 3 years ago

crashed thread backtrace:

 0000000000119f38  /data/app/com.storm.wind.xposed-UDmytYoi9UlRXbO7hUllOw==/base.apk!liblspd.so (offset 0x35f000) (elf_ctx_init(elf_ctx*, void*)+112) (BuildId: dfa32f68fb97e3eff372204ea10b9305f883f75d)
 000000000011a6d8  /data/app/com.storm.wind.xposed-UDmytYoi9UlRXbO7hUllOw==/base.apk!liblspd.so (offset 0x35f000) (resolve_elf_internal_symbol(char const*, char const*)+712) (BuildId: dfa32f68fb97e3eff372204ea10b9305f883f75d)
 000000000011ac04  /data/app/com.storm.wind.xposed-UDmytYoi9UlRXbO7hUllOw==/base.apk!liblspd.so (offset 0x35f000) (linker_get_solist()+92) (BuildId: dfa32f68fb97e3eff372204ea10b9305f883f75d)
 000000000011b0a0  /data/app/com.storm.wind.xposed-UDmytYoi9UlRXbO7hUllOw==/base.apk!liblspd.so (offset 0x35f000) (linker_iterate_soinfo+32) (BuildId: dfa32f68fb97e3eff372204ea10b9305f883f75d)

seems to crash when parse special apk. 

2021-03-27 22:48:40.469 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:216:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.469 19221-19221/com.storm.wind.xposed I/Dobby: [!] resolve_elf_internal_symbol /system/bin/linker64 __dl__Z15solist_get_headv
2021-03-27 22:48:40.486 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.486 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot.oat 0x74ab8b5000 3465928
2021-03-27 22:48:40.486 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.486 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-core-libart.oat 0x74abab3000 1376968
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-okhttp.oat 0x74fb13d000 250568
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-bouncycastle.oat 0x74fb154000 156360
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-apache-xml.oat 0x74fb1d3000 29312
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-QPerformance.oat 0x74fb1d5000 21120
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-UxPerformance.oat 0x74fb1d6000 17024
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-framework.oat 0x74ab04f000 12272328
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-ext.oat 0x74fb158000 139976
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-telephony-common.oat 0x74aba33000 1901256
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-voip-common.oat 0x74fb1d5000 21192
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-ims-common.oat 0x74fb167000 78536
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-android.test.base.oat 0x74fb1d6000 17024
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-oneplus_sdk_utils.oat 0x74fb1d6000 17024
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-oneplus_sdk_wrapper.oat 0x74fb1d6000 17024
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-oneplus-framework.oat 0x74fb1d5000 21120
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-tcmiface.oat 0x74fb1d6000 17024
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-telephony-ext.oat 0x74fb1d6000 17024
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-qcnvitems.oat 0x74fb1d6000 17024
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-WfdCommon.oat 0x74fb1d6000 17024
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/dalvik-cache/arm64/system@framework@boot-qcom.fmradio.oat 0x74fb1d5000 21120
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /system/bin/app_process64 0x74fb1d2000 33480
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] [D:/mywork/xposed_module_loader/mmp/core/src/main/cpp/external/Dobby/builtin-plugin/SymbolResolver/elf/dobby_symbol_resolver.cc:249:resolve_elf_internal_symbol]: 
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed I/Dobby: [!] file_mmap /data/app/com.storm.wind.xposed-UDmytYoi9UlRXbO7hUllOw==/base.apk 0x74ab6bb000 5541757
2021-03-27 22:48:40.487 19221-19221/com.storm.wind.xposed A/libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x726fa41ee01573 in tid 19221 (orm.wind.xposed), pid 19221 (orm.wind.xposed)
jmpews commented 3 years ago

Any example code that make it happen?

b14aa178 commented 3 years ago

enter elf_ctx_init function without a so file, and then pointer operations on non-elf file cause this crash. maybe we need add some forword check in elf_ctx_init to prevent crash.