frida-java-bridge 6.2.1 → 6.2.3

package/index.js

@@ -440,9 +440,13 @@ class Runtime {
         handleBindApplication.apply(this, arguments);
       };
 
-      const getPackageInfoNoCheck = ActivityThread.getPackageInfoNoCheck;
-      getPackageInfoNoCheck.implementation = function (appInfo) {
-        const apk = getPackageInfoNoCheck.apply(this, arguments);
+      const getPackageInfoCandidates = ActivityThread.getPackageInfo.overloads
+        .map(m => [m.argumentTypes.length, m])
+        .sort(([arityA,], [arityB,]) => arityB - arityA)
+        .map(([_, method]) => method);
+      const getPackageInfo = getPackageInfoCandidates[0];
+      getPackageInfo.implementation = function (...args) {
+        const apk = getPackageInfo.call(this, ...args);
 
         if (!initialized && hookpoint === 'early') {
           initialized = true;

package/lib/android.js

@@ -30,7 +30,6 @@ const kAccSkipAccessChecks = 0x00080000;
 const kAccSingleImplementation = 0x08000000;
 const kAccNterpEntryPointFastPathFlag = 0x00100000;
 const kAccNterpInvokeFastPathFlag = 0x00200000;
-const kAccCompileDontBother = 0x02000000;
 const kAccPublicApi = 0x10000000;
 const kAccXposedHookedMethod = 0x10000000;
 
@@ -82,7 +81,6 @@ const SOCK_STREAM = 1;
 
 const getArtRuntimeSpec = memoize(_getArtRuntimeSpec);
 const getArtInstrumentationSpec = memoize(_getArtInstrumentationSpec);
-const getArtClassLinkerSpec = memoize(_getArtClassLinkerSpec);
 const getArtMethodSpec = memoize(_getArtMethodSpec);
 const getArtThreadSpec = memoize(_getArtThreadSpec);
 const getArtManagedStackSpec = memoize(_getArtManagedStackSpec);
@@ -104,6 +102,7 @@ const nativeFunctionOptions = {
 const artThreadStateTransitions = {};
 
 let cachedApi = null;
+let cachedArtClassLinkerSpec = null;
 let MethodMangler = null;
 let artController = null;
 const inlineHooks = [];
@@ -435,9 +434,22 @@ function _getApi () {
   temporaryApi.vm = vms.readPointer();
 
   if (isArt) {
+    const apiLevel = getAndroidApiLevel();
+
+    let kAccCompileDontBother;
+    if (apiLevel >= 27) {
+      kAccCompileDontBother = 0x02000000;
+    } else if (apiLevel >= 24) {
+      kAccCompileDontBother = 0x01000000;
+    } else {
+      kAccCompileDontBother = 0;
+    }
+    temporaryApi.kAccCompileDontBother = kAccCompileDontBother;
+
     const artRuntime = temporaryApi.vm.add(pointerSize).readPointer();
     temporaryApi.artRuntime = artRuntime;
-    const runtimeOffset = getArtRuntimeSpec(temporaryApi).offset;
+    const runtimeSpec = getArtRuntimeSpec(temporaryApi);
+    const runtimeOffset = runtimeSpec.offset;
     const instrumentationOffset = runtimeOffset.instrumentation;
     temporaryApi.artInstrumentation = (instrumentationOffset !== null) ? artRuntime.add(instrumentationOffset) : null;
 
@@ -452,7 +464,7 @@ function _getApi () {
      */
     const classLinker = artRuntime.add(runtimeOffset.classLinker).readPointer();
 
-    const classLinkerOffsets = getArtClassLinkerSpec(temporaryApi).offset;
+    const classLinkerOffsets = getArtClassLinkerSpec(artRuntime, runtimeSpec).offset;
     const quickResolutionTrampoline = classLinker.add(classLinkerOffsets.quickResolutionTrampoline).readPointer();
     const quickImtConflictTrampoline = classLinker.add(classLinkerOffsets.quickImtConflictTrampoline).readPointer();
     const quickGenericJniTrampoline = classLinker.add(classLinkerOffsets.quickGenericJniTrampoline).readPointer();
@@ -602,49 +614,57 @@ function _getArtRuntimeSpec (api) {
   const endOffset = startOffset + (100 * pointerSize);
 
   const apiLevel = getAndroidApiLevel();
+  const codename = getAndroidCodename();
 
   let spec = null;
 
   for (let offset = startOffset; offset !== endOffset; offset += pointerSize) {
     const value = runtime.add(offset).readPointer();
     if (value.equals(vm)) {
-      let classLinkerOffset = null;
+      let classLinkerOffsets;
       let jniIdManagerOffset = null;
-      if (apiLevel >= 33 || getAndroidCodename() === 'Tiramisu') {
-        classLinkerOffset = offset - (4 * pointerSize);
+      if (apiLevel >= 33 || codename === 'Tiramisu') {
+        classLinkerOffsets = [offset - (4 * pointerSize)];
         jniIdManagerOffset = offset - pointerSize;
-      } else if (apiLevel >= 30 || getAndroidCodename() === 'R') {
-        classLinkerOffset = offset - (3 * pointerSize);
+      } else if (apiLevel >= 30 || codename === 'R') {
+        classLinkerOffsets = [offset - (3 * pointerSize), offset - (4 * pointerSize)];
         jniIdManagerOffset = offset - pointerSize;
       } else if (apiLevel >= 29) {
-        classLinkerOffset = offset - (2 * pointerSize);
+        classLinkerOffsets = [offset - (2 * pointerSize)];
       } else if (apiLevel >= 27) {
-        classLinkerOffset = offset - STD_STRING_SIZE - (3 * pointerSize);
+        classLinkerOffsets = [offset - STD_STRING_SIZE - (3 * pointerSize)];
       } else {
-        classLinkerOffset = offset - STD_STRING_SIZE - (2 * pointerSize);
+        classLinkerOffsets = [offset - STD_STRING_SIZE - (2 * pointerSize)];
       }
 
-      const internTableOffset = classLinkerOffset - pointerSize;
-      const threadListOffset = internTableOffset - pointerSize;
+      for (const classLinkerOffset of classLinkerOffsets) {
+        const internTableOffset = classLinkerOffset - pointerSize;
+        const threadListOffset = internTableOffset - pointerSize;
 
-      let heapOffset;
-      if (apiLevel >= 24) {
-        heapOffset = threadListOffset - (8 * pointerSize);
-      } else if (apiLevel >= 23) {
-        heapOffset = threadListOffset - (7 * pointerSize);
-      } else {
-        heapOffset = threadListOffset - (4 * pointerSize);
-      }
+        let heapOffset;
+        if (apiLevel >= 24) {
+          heapOffset = threadListOffset - (8 * pointerSize);
+        } else if (apiLevel >= 23) {
+          heapOffset = threadListOffset - (7 * pointerSize);
+        } else {
+          heapOffset = threadListOffset - (4 * pointerSize);
+        }
 
-      spec = {
-        offset: {
-          heap: heapOffset,
-          threadList: threadListOffset,
-          internTable: internTableOffset,
-          classLinker: classLinkerOffset,
-          jniIdManager: jniIdManagerOffset
+        const candidate = {
+          offset: {
+            heap: heapOffset,
+            threadList: threadListOffset,
+            internTable: internTableOffset,
+            classLinker: classLinkerOffset,
+            jniIdManager: jniIdManagerOffset
+          }
+        };
+        if (tryGetArtClassLinkerSpec(runtime, candidate) !== null) {
+          spec = candidate;
+          break;
         }
-      };
+      }
+
       break;
     }
   }
@@ -822,7 +842,19 @@ function _getArtInstrumentationSpec () {
   };
 }
 
-function _getArtClassLinkerSpec (api) {
+function getArtClassLinkerSpec (runtime, runtimeSpec) {
+  const spec = tryGetArtClassLinkerSpec(runtime, runtimeSpec);
+  if (spec === null) {
+    throw new Error('Unable to determine ClassLinker field offsets');
+  }
+  return spec;
+}
+
+function tryGetArtClassLinkerSpec (runtime, runtimeSpec) {
+  if (cachedArtClassLinkerSpec !== null) {
+    return cachedArtClassLinkerSpec;
+  }
+
   /*
    * On Android 5.x:
    *
@@ -851,11 +883,9 @@ function _getArtClassLinkerSpec (api) {
    * }
    */
 
-  const runtime = api.artRuntime;
-  const runtimeSpec = getArtRuntimeSpec(api);
-
-  const classLinker = runtime.add(runtimeSpec.offset.classLinker).readPointer();
-  const internTable = runtime.add(runtimeSpec.offset.internTable).readPointer();
+  const { classLinker: classLinkerOffset, internTable: internTableOffset } = runtimeSpec.offset;
+  const classLinker = runtime.add(classLinkerOffset).readPointer();
+  const internTable = runtime.add(internTableOffset).readPointer();
 
   const startOffset = (pointerSize === 4) ? 100 : 200;
   const endOffset = startOffset + (100 * pointerSize);
@@ -900,8 +930,8 @@ function _getArtClassLinkerSpec (api) {
     }
   }
 
-  if (spec === null) {
-    throw new Error('Unable to determine ClassLinker field offsets');
+  if (spec !== null) {
+    cachedArtClassLinkerSpec = spec;
   }
 
   return spec;
@@ -3314,6 +3344,8 @@ class ArtMethodMangler {
   }
 
   replace (impl, isInstanceMethod, argTypes, vm, api) {
+    const { kAccCompileDontBother, artNterpEntryPoint } = api;
+
     this.originalMethod = fetchArtMethod(this.methodId, vm);
 
     const originalFlags = this.originalMethod.accessFlags;
@@ -3351,8 +3383,6 @@ class ArtMethodMangler {
 
     // Replace Nterp quick entrypoints with art_quick_to_interpreter_bridge to force stepping out
     // of ART's next-generation interpreter and use the quick stub instead.
-    const { artNterpEntryPoint } = api;
-
     if (artNterpEntryPoint !== undefined && quickCode.equals(artNterpEntryPoint)) {
       patchArtMethod(hookedMethodId, {
         quickCode: api.artQuickToInterpreterBridge

package/lib/class-model.js

@@ -390,7 +390,10 @@ model_add_method (Model * self,
   gchar * key, type;
   const gchar * value;
 
-  key = g_strdup (name);
+  if (name[0] == '$')
+    key = g_strdup_printf ("_%s", name);
+  else
+    key = g_strdup (name);
 
   type = (modifiers & kAccStatic) != 0 ? 's' : 'i';
 
@@ -410,7 +413,10 @@ model_add_field (Model * self,
   GHashTable * members = self->members;
   gchar * key, type;
 
-  key = g_strdup (name);
+  if (name[0] == '$')
+    key = g_strdup_printf ("_%s", name);
+  else
+    key = g_strdup (name);
   while (g_hash_table_contains (members, key))
   {
     gchar * new_key = g_strdup_printf ("_%s", key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frida-java-bridge",
-  "version": "6.2.1",
+  "version": "6.2.3",
   "description": "Java runtime interop from Frida",
   "main": "index.js",
   "files": [