frida-java-bridge 5.1.0 → 5.3.0

package/index.js

@@ -5,6 +5,7 @@ const {
   withRunnableArtThread,
   makeArtClassVisitor,
   makeArtClassLoaderVisitor,
+  backtrace,
   deoptimizeEverything,
   deoptimizeBootImage,
   deoptimizeMethod
@@ -478,6 +479,10 @@ class Runtime {
     return this.classFactory.array(type, elements);
   }
 
+  backtrace (options) {
+    return backtrace(this.vm, options);
+  }
+
   // Reference: http://stackoverflow.com/questions/2848575/how-to-detect-ui-thread-on-android
   isMainThread () {
     const Looper = this.classFactory.use('android.os.Looper');

package/lib/android.d.ts

@@ -0,0 +1,33 @@
+export function getApi(): Api;
+export function withRunnableArtThread(vm: VM, env: Env, callback: (thread: Thread) => void): void;
+export function translateMethod(methodId: NativePointerValue): NativePointer;
+
+export class ArtStackVisitor {
+    constructor(thread: Thread, context: Context, walkKind: WalkKind, numFrames?: number, checkSuspended?: boolean);
+    walkStack(includeTransitions?: boolean): void;
+    getMethod(): ArtMethod | null;
+    getCurrentQuickFramePc(): NativePointer;
+    getCurrentQuickFrame(): NativePointer;
+    getCurrentShadowFrame(): NativePointer;
+    describeLocation(): string;
+    getCurrentOatQuickMethodHeader(): NativePointer;
+    getCurrentQuickFrameInfo(): QuickFrameInfo;
+}
+
+export type WalkKind = "include-inlined-frames" | "skip-inlined-frames";
+
+export interface ArtMethod extends ObjectWrapper {
+    prettyMethod(withSignature?: boolean): string;
+}
+
+export interface QuickFrameInfo {
+    frameSizeInBytes: number;
+    coreSpillMask: number;
+    fpSpillMask: number;
+}
+
+export type Api = any;
+export type VM = any;
+export type Env = any;
+export type Thread = any;
+export type Context = any;

package/lib/android.js

@@ -285,7 +285,9 @@ function _getApi () {
 
           // Android >= 11
           _ZN3art3jni12JniIdManager14DecodeMethodIdEP10_jmethodID: ['art::jni::JniIdManager::DecodeMethodId', 'pointer', ['pointer', 'pointer']],
-          _ZN3art11interpreter18GetNterpEntryPointEv: ['art::interpreter::GetNterpEntryPoint', 'pointer', []]
+          _ZN3art11interpreter18GetNterpEntryPointEv: ['art::interpreter::GetNterpEntryPoint', 'pointer', []],
+
+          _ZN3art7Monitor17TranslateLocationEPNS_9ArtMethodEjPPKcPi: ['art::Monitor::TranslateLocation', 'void', ['pointer', 'uint32', 'pointer', 'pointer']]
         },
         variables: {
           _ZN3art3Dbg9gRegistryE: function (address) {
@@ -337,7 +339,8 @@ function _getApi () {
           '_ZN3art3Dbg20ManageDeoptimizationEv',
           '_ZN3art3Dbg9gRegistryE',
           '_ZN3art3jni12JniIdManager14DecodeMethodIdEP10_jmethodID',
-          '_ZN3art11interpreter18GetNterpEntryPointEv'
+          '_ZN3art11interpreter18GetNterpEntryPointEv',
+          '_ZN3art7Monitor17TranslateLocationEPNS_9ArtMethodEjPPKcPi'
         ]
       }]
     : [{
@@ -1541,7 +1544,7 @@ set_replacement_method (gpointer original_method,
   g_mutex_lock (&lock);
 
   g_hash_table_insert (methods, original_method, replacement_method);
-  g_hash_table_add (replacements, replacement_method);
+  g_hash_table_insert (replacements, replacement_method, original_method);
 
   g_mutex_unlock (&lock);
 }
@@ -1563,6 +1566,20 @@ delete_replacement_method (gpointer original_method)
   g_mutex_unlock (&lock);
 }
 
+gpointer
+translate_method (gpointer method)
+{
+  gpointer translated_method;
+
+  g_mutex_lock (&lock);
+
+  translated_method = g_hash_table_lookup (replacements, method);
+
+  g_mutex_unlock (&lock);
+
+  return (translated_method != NULL) ? translated_method : method;
+}
+
 gpointer
 find_replacement_method_from_quick_code (gpointer method,
                                          gpointer thread)
@@ -1691,6 +1708,7 @@ on_leave_gc_concurrent_copying_copying_phase (GumInvocationContext * ic)
       get: new NativeFunction(cm.get_replacement_method, 'pointer', ['pointer'], fastOptions),
       set: new NativeFunction(cm.set_replacement_method, 'void', ['pointer', 'pointer'], fastOptions),
       delete: new NativeFunction(cm.delete_replacement_method, 'void', ['pointer'], fastOptions),
+      translate: new NativeFunction(cm.translate_method, 'pointer', ['pointer'], fastOptions),
       findReplacementFromQuickCode: cm.find_replacement_method_from_quick_code
     },
     getOatQuickMethodHeaderImpl,
@@ -1793,6 +1811,93 @@ function makeMethodMangler (methodId) {
   return new MethodMangler(methodId);
 }
 
+function translateMethod (methodId) {
+  return artController.replacedMethods.translate(methodId);
+}
+
+class BacktraceVisitor extends ArtStackVisitor {
+  constructor (thread, limit) {
+    const api = getApi();
+
+    super(thread, api['art::Thread::GetLongJumpContext'](thread), 'include-inlined-frames');
+
+    this.frames = [];
+    this.limit = limit;
+
+    this._translateLocation = api['art::Monitor::TranslateLocation'];
+  }
+
+  visitFrame () {
+    this._collectFrame(this.describeLocation());
+
+    return this.frames.length < this.limit;
+  }
+
+  _collectFrame (location) {
+    if (location === 'upcall') {
+      return;
+    }
+
+    const tokens = location.split(/['"]/, 3);
+    const rawMethodSignature = tokens[1];
+    if (rawMethodSignature.startsWith('<')) {
+      return;
+    }
+    const details = tokens[2];
+
+    const separatorIndex = rawMethodSignature.indexOf(' ');
+    const returnType = rawMethodSignature.substring(0, separatorIndex);
+    const rest = rawMethodSignature.substring(separatorIndex + 1);
+    const argsStartIndex = rest.indexOf('(');
+    const argsEndIndex = rest.indexOf(')', argsStartIndex + 1);
+    const rawArgumentTypes = rest.substring(argsStartIndex + 1, argsEndIndex);
+    const argumentTypes = (rawArgumentTypes !== '') ? rawArgumentTypes.split(', ') : [];
+
+    const classAndMethodName = rest.substring(0, argsStartIndex);
+    const methodNameStartIndex = classAndMethodName.lastIndexOf('.');
+    const className = classAndMethodName.substring(0, methodNameStartIndex);
+    const methodName = classAndMethodName.substring(methodNameStartIndex + 1);
+    let dexPc = parseInt(details.substring(13), 16);
+
+    const actualMethod = this.getMethod();
+    const translatedMethod = translateMethod(actualMethod);
+    if (!translatedMethod.equals(actualMethod)) {
+      dexPc = 0;
+    }
+    const fileNamePtr = Memory.alloc(16);
+    const lineNumberPtr = fileNamePtr.add(8);
+    this._translateLocation(translatedMethod, dexPc, fileNamePtr, lineNumberPtr);
+    const fileName = fileNamePtr.readPointer().readUtf8String();
+    const lineNumber = lineNumberPtr.readS32();
+
+    this.frames.push({
+      method: {
+        handle: translatedMethod,
+        name: methodName,
+        returnType,
+        argumentTypes
+      },
+      className,
+      fileName,
+      lineNumber
+    });
+  }
+}
+
+function backtrace (vm, options = {}) {
+  const { limit = 16 } = options;
+
+  let frames = null;
+
+  withRunnableArtThread(vm, vm.getEnv(), thread => {
+    const visitor = new BacktraceVisitor(thread, limit);
+    visitor.walkStack(true);
+    frames = visitor.frames;
+  });
+
+  return frames;
+}
+
 function revertGlobalPatches () {
   patchedClasses.forEach(entry => {
     entry.vtablePtr.writePointer(entry.vtable);
@@ -4045,6 +4150,8 @@ module.exports = {
   ArtStackVisitor,
   ArtMethod,
   makeMethodMangler,
+  translateMethod,
+  backtrace,
   revertGlobalPatches,
   deoptimizeEverything,
   deoptimizeBootImage,

package/lib/jvm.js

@@ -811,8 +811,8 @@ function _getJvmMethodSpec () {
 
   const getAdapterPointer = adapterInConstMethod
     ? function (method, constMethod) {
-        return constMethod.add(constantPoolOffset + 2 * pointerSize);
-      }
+      return constMethod.add(constantPoolOffset + 2 * pointerSize);
+    }
     : function (method, constMethod) {
       return method.add(i2iEntryOffset + pointerSize);
     };

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "frida-java-bridge",
-  "version": "5.1.0",
+  "version": "5.3.0",
   "description": "Java runtime interop from Frida",
   "main": "index.js",
   "files": [
     "/index.js",
-    "/lib/**/*.js"
+    "/lib/**/*.js",
+    "/lib/**/*.d.ts"
   ],
   "repository": {
     "type": "git",