search

sensepost / objection

📱 objection - runtime mobile exploration
GNU General Public License v3.0
7.54k stars 855 forks source link

Error with Unity #90

Closed jsicherm closed 6 years ago

jsicherm commented 6 years ago

Objection 1.2.8 Frida 11.0.11 arm64-v8a

When running a patched APK on my Android device for a Unity3D app, I instantly get an error dialog with the header "Failure to initialize!" with the message "Your hardware does not support this application, sorry!" before terminating the app.

There were no errors when patching. Anyone know what may be causing this?

leonjza commented 6 years ago

Anything interesting in the adb logcat output?

jsicherm commented 6 years ago

I decompiled to apk to see what causes the error dialog to show. In the adb logcat, I get a Unity error "Unable to find main", which is generated by the following:

try { System.loadLibrary(str); return true; } catch (UnsatisfiedLinkError e) { ... }

Looks like the main library is missing after using Objection.

Sure enough, deobfuscating the .objection.apk, there is a new folder in /lib... /armv64-v8a. Previously I had an /x86 and an /armeabi-v7a. The libraries from those latter folders are missing in the new folder (which contains the Frida gadget).

[EDIT] Copying the library files from /armeabi-v7a to the /armv64-v8a folder (the one with the Frida gadget) didn't help my link error... It still results in the same UnsatisfiedLinkError and still crashes the program...

[EDIT 2] Running objection with the architecture flag for armeabi-v7a fixed my issue! I guess running Objection on a detected architecture doesn't work so well when the app packages libraries for older hardware.

leonjza commented 6 years ago

Thanks for the feedback. The architecture is determined here by running adb shell getprop ro.product.cpu.abi. Was there anything in the way you used the patcher that could have caused objection to get this wrong? Is the device you are using a different architecture than armeabi-v7a ?

jsicherm commented 6 years ago

I patched the app without specifying the architecture and Objection correctly detected it as arm64-v8a. It was entirely correct. However, the libraries for the app I was patching didn't explicitly support this architecture; instead it only had x64 and armeabi-v7a. The latter happens to be backwards compatible with the newer arm64-v8a (which allows the unpatched apk to run). When patched using a v8a Frida gadget, the v7a libraries were not found.

I don't think Objection did anything wrong at all. Perhaps it could make the check automatically for arm64-v8a devices to fallback on armeabi-v7a if the app only packs armeabi-v7a libraries? But I'm not sure how fruitful that would be.

Anyways, my issue is solved so I'll close this :)