pjlantz / droidbox

Dynamic analysis of Android apps
759 stars 221 forks source link

the application crashes when it includes native code #2

Open zyqu1990 opened 9 years ago

zyqu1990 commented 9 years ago

Hi,

Nice work! Thank you for sharing! I tried to analyze some applications with native code included. However, all of them crashed on the device with the following logs. And I tried to verify them against both a physical device and emulator without system modification; they did not crash.

Thanks

java.lang.ExceptionInInitializerError E/AndroidRuntime( 1248): at com.bangcle.protect.Util.CopyBinaryFile(Util.java:558) E/AndroidRuntime( 1248): at com.bangcle.protect.Util.runAll(Util.java:751) E/AndroidRuntime( 1248): at cow.draw.animaltattoo.tools.MApplication.onCreate(ApplicationTemplate.java:50) E/AndroidRuntime( 1248): at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:999) E/AndroidRuntime( 1248): at android.app.ActivityThread.handleBindApplication(ActivityThread.java:4151) E/AndroidRuntime( 1248): at android.app.ActivityThread.access$1300(ActivityThread.java:130) E/AndroidRuntime( 1248): at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1255) E/AndroidRuntime( 1248): at android.os.Handler.dispatchMessage(Handler.java:99) E/AndroidRuntime( 1248): at android.os.Looper.loop(Looper.java:137) E/AndroidRuntime( 1248): at android.app.ActivityThread.main(ActivityThread.java:4745) E/AndroidRuntime( 1248): at java.lang.reflect.Method.invokeNative(Native Method) E/AndroidRuntime( 1248): at java.lang.reflect.Method.invoke(Method.java:511) E/AndroidRuntime( 1248): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:786) E/AndroidRuntime( 1248): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:553) E/AndroidRuntime( 1248): at dalvik.system.NativeStart.main(Native Method) E/AndroidRuntime( 1248): Caused by: java.lang.UnsatisfiedLinkError: unknown failure E/AndroidRuntime( 1248): at java.lang.Runtime.loadLibrary(Runtime.java:370) E/AndroidRuntime( 1248): at java.lang.System.loadLibrary(System.java:535) E/AndroidRuntime( 1248): at com.bangcle.protect.ACall.(ACall.java:30) E/AndroidRuntime( 1248): ... 15 more

pjlantz commented 9 years ago

Thanks.

The problem is that Taintdroid which Droidbox is based on modified the native loader to not load native libraries. I was looking through the source code and the following changes to the Dalvik source code enables it:

https://github.com/TaintDroid/android_platform_dalvik/blob/taintdroid-4.1.1_r6/vm/ Native.cpp

in the function dvmLoadLibraryCode at line 318.

at line 332 to 342 they simply check if the native code belongs to the system and not a third-party app. If it is a third-party native code then the check fails. Removing the lines 332 to 342 and then you should be able to run apps with native code.

2015-08-20 20:32 GMT+02:00 zyqu1990 notifications@github.com:

Hi,

Nice work! Thank you for sharing! I tried to analyze some applications with native code included. However, all of them crashed on the device with the following logs. And I tried to verify them against both a physical device and emulator without system modification; they did not crash.

Thanks

java.lang.ExceptionInInitializerError E/AndroidRuntime( 1248): at com.bangcle.protect.Util.CopyBinaryFile(Util.java:558) E/AndroidRuntime( 1248): at com.bangcle.protect.Util.runAll(Util.java:751) E/AndroidRuntime( 1248): at cow.draw.animaltattoo.tools.MApplication.onCreate(ApplicationTemplate.java:50) E/AndroidRuntime( 1248): at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:999) E/AndroidRuntime( 1248): at android.app.ActivityThread.handleBindApplication(ActivityThread.java:4151) E/AndroidRuntime( 1248): at android.app.ActivityThread.access$1300(ActivityThread.java:130) E/AndroidRuntime( 1248): at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1255) E/AndroidRuntime( 1248): at android.os.Handler.dispatchMessage(Handler.java:99) E/AndroidRuntime( 1248): at android.os.Looper.loop(Looper.java:137) E/AndroidRuntime( 1248): at android.app.ActivityThread.main(ActivityThread.java:4745) E/AndroidRuntime( 1248): at java.lang.reflect.Method.invokeNative(Native Method) E/AndroidRuntime( 1248): at java.lang.reflect.Method.invoke(Method.java:511) E/AndroidRuntime( 1248): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:786) E/AndroidRuntime( 1248): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:553) E/AndroidRuntime( 1248): at dalvik.system.NativeStart.main(Native Method) E/AndroidRuntime( 1248): Caused by: java.lang.UnsatisfiedLinkError: unknown failure E/AndroidRuntime( 1248): at java.lang.Runtime.loadLibrary(Runtime.java:370) E/AndroidRuntime( 1248): at java.lang.System.loadLibrary(System.java:535) E/AndroidRuntime( 1248): at com.bangcle.protect.ACall.(ACall.java:30) E/AndroidRuntime( 1248): ... 15 more

— Reply to this email directly or view it on GitHub https://github.com/pjlantz/droidbox/issues/2.