frida-java-bridge 5.2.2 → 5.3.0

package/index.js

@@ -5,6 +5,7 @@ const {
   withRunnableArtThread,
   makeArtClassVisitor,
   makeArtClassLoaderVisitor,
+  backtrace,
   deoptimizeEverything,
   deoptimizeBootImage,
   deoptimizeMethod
@@ -478,6 +479,10 @@ class Runtime {
     return this.classFactory.array(type, elements);
   }
 
+  backtrace (options) {
+    return backtrace(this.vm, options);
+  }
+
   // Reference: http://stackoverflow.com/questions/2848575/how-to-detect-ui-thread-on-android
   isMainThread () {
     const Looper = this.classFactory.use('android.os.Looper');

package/lib/android.js

@@ -285,7 +285,9 @@ function _getApi () {
 
           // Android >= 11
           _ZN3art3jni12JniIdManager14DecodeMethodIdEP10_jmethodID: ['art::jni::JniIdManager::DecodeMethodId', 'pointer', ['pointer', 'pointer']],
-          _ZN3art11interpreter18GetNterpEntryPointEv: ['art::interpreter::GetNterpEntryPoint', 'pointer', []]
+          _ZN3art11interpreter18GetNterpEntryPointEv: ['art::interpreter::GetNterpEntryPoint', 'pointer', []],
+
+          _ZN3art7Monitor17TranslateLocationEPNS_9ArtMethodEjPPKcPi: ['art::Monitor::TranslateLocation', 'void', ['pointer', 'uint32', 'pointer', 'pointer']]
         },
         variables: {
           _ZN3art3Dbg9gRegistryE: function (address) {
@@ -337,7 +339,8 @@ function _getApi () {
           '_ZN3art3Dbg20ManageDeoptimizationEv',
           '_ZN3art3Dbg9gRegistryE',
           '_ZN3art3jni12JniIdManager14DecodeMethodIdEP10_jmethodID',
-          '_ZN3art11interpreter18GetNterpEntryPointEv'
+          '_ZN3art11interpreter18GetNterpEntryPointEv',
+          '_ZN3art7Monitor17TranslateLocationEPNS_9ArtMethodEjPPKcPi'
         ]
       }]
     : [{
@@ -1812,6 +1815,89 @@ function translateMethod (methodId) {
   return artController.replacedMethods.translate(methodId);
 }
 
+class BacktraceVisitor extends ArtStackVisitor {
+  constructor (thread, limit) {
+    const api = getApi();
+
+    super(thread, api['art::Thread::GetLongJumpContext'](thread), 'include-inlined-frames');
+
+    this.frames = [];
+    this.limit = limit;
+
+    this._translateLocation = api['art::Monitor::TranslateLocation'];
+  }
+
+  visitFrame () {
+    this._collectFrame(this.describeLocation());
+
+    return this.frames.length < this.limit;
+  }
+
+  _collectFrame (location) {
+    if (location === 'upcall') {
+      return;
+    }
+
+    const tokens = location.split(/['"]/, 3);
+    const rawMethodSignature = tokens[1];
+    if (rawMethodSignature.startsWith('<')) {
+      return;
+    }
+    const details = tokens[2];
+
+    const separatorIndex = rawMethodSignature.indexOf(' ');
+    const returnType = rawMethodSignature.substring(0, separatorIndex);
+    const rest = rawMethodSignature.substring(separatorIndex + 1);
+    const argsStartIndex = rest.indexOf('(');
+    const argsEndIndex = rest.indexOf(')', argsStartIndex + 1);
+    const rawArgumentTypes = rest.substring(argsStartIndex + 1, argsEndIndex);
+    const argumentTypes = (rawArgumentTypes !== '') ? rawArgumentTypes.split(', ') : [];
+
+    const classAndMethodName = rest.substring(0, argsStartIndex);
+    const methodNameStartIndex = classAndMethodName.lastIndexOf('.');
+    const className = classAndMethodName.substring(0, methodNameStartIndex);
+    const methodName = classAndMethodName.substring(methodNameStartIndex + 1);
+    let dexPc = parseInt(details.substring(13), 16);
+
+    const actualMethod = this.getMethod();
+    const translatedMethod = translateMethod(actualMethod);
+    if (!translatedMethod.equals(actualMethod)) {
+      dexPc = 0;
+    }
+    const fileNamePtr = Memory.alloc(16);
+    const lineNumberPtr = fileNamePtr.add(8);
+    this._translateLocation(translatedMethod, dexPc, fileNamePtr, lineNumberPtr);
+    const fileName = fileNamePtr.readPointer().readUtf8String();
+    const lineNumber = lineNumberPtr.readS32();
+
+    this.frames.push({
+      method: {
+        handle: translatedMethod,
+        name: methodName,
+        returnType,
+        argumentTypes
+      },
+      className,
+      fileName,
+      lineNumber
+    });
+  }
+}
+
+function backtrace (vm, options = {}) {
+  const { limit = 16 } = options;
+
+  let frames = null;
+
+  withRunnableArtThread(vm, vm.getEnv(), thread => {
+    const visitor = new BacktraceVisitor(thread, limit);
+    visitor.walkStack(true);
+    frames = visitor.frames;
+  });
+
+  return frames;
+}
+
 function revertGlobalPatches () {
   patchedClasses.forEach(entry => {
     entry.vtablePtr.writePointer(entry.vtable);
@@ -4065,6 +4151,7 @@ module.exports = {
   ArtMethod,
   makeMethodMangler,
   translateMethod,
+  backtrace,
   revertGlobalPatches,
   deoptimizeEverything,
   deoptimizeBootImage,

package/lib/jvm.js

@@ -811,8 +811,8 @@ function _getJvmMethodSpec () {
 
   const getAdapterPointer = adapterInConstMethod
     ? function (method, constMethod) {
-        return constMethod.add(constantPoolOffset + 2 * pointerSize);
-      }
+      return constMethod.add(constantPoolOffset + 2 * pointerSize);
+    }
     : function (method, constMethod) {
       return method.add(i2iEntryOffset + pointerSize);
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frida-java-bridge",
-  "version": "5.2.2",
+  "version": "5.3.0",
   "description": "Java runtime interop from Frida",
   "main": "index.js",
   "files": [