frida-java-bridge 6.2.2 → 6.2.3

package/index.js

@@ -440,9 +440,13 @@ class Runtime {
         handleBindApplication.apply(this, arguments);
       };
 
-      const getPackageInfoNoCheck = ActivityThread.getPackageInfoNoCheck;
-      getPackageInfoNoCheck.implementation = function (appInfo) {
-        const apk = getPackageInfoNoCheck.apply(this, arguments);
+      const getPackageInfoCandidates = ActivityThread.getPackageInfo.overloads
+        .map(m => [m.argumentTypes.length, m])
+        .sort(([arityA,], [arityB,]) => arityB - arityA)
+        .map(([_, method]) => method);
+      const getPackageInfo = getPackageInfoCandidates[0];
+      getPackageInfo.implementation = function (...args) {
+        const apk = getPackageInfo.call(this, ...args);
 
         if (!initialized && hookpoint === 'early') {
           initialized = true;

package/lib/android.js

@@ -81,7 +81,6 @@ const SOCK_STREAM = 1;
 
 const getArtRuntimeSpec = memoize(_getArtRuntimeSpec);
 const getArtInstrumentationSpec = memoize(_getArtInstrumentationSpec);
-const getArtClassLinkerSpec = memoize(_getArtClassLinkerSpec);
 const getArtMethodSpec = memoize(_getArtMethodSpec);
 const getArtThreadSpec = memoize(_getArtThreadSpec);
 const getArtManagedStackSpec = memoize(_getArtManagedStackSpec);
@@ -103,6 +102,7 @@ const nativeFunctionOptions = {
 const artThreadStateTransitions = {};
 
 let cachedApi = null;
+let cachedArtClassLinkerSpec = null;
 let MethodMangler = null;
 let artController = null;
 const inlineHooks = [];
@@ -448,7 +448,8 @@ function _getApi () {
 
     const artRuntime = temporaryApi.vm.add(pointerSize).readPointer();
     temporaryApi.artRuntime = artRuntime;
-    const runtimeOffset = getArtRuntimeSpec(temporaryApi).offset;
+    const runtimeSpec = getArtRuntimeSpec(temporaryApi);
+    const runtimeOffset = runtimeSpec.offset;
     const instrumentationOffset = runtimeOffset.instrumentation;
     temporaryApi.artInstrumentation = (instrumentationOffset !== null) ? artRuntime.add(instrumentationOffset) : null;
 
@@ -463,7 +464,7 @@ function _getApi () {
      */
     const classLinker = artRuntime.add(runtimeOffset.classLinker).readPointer();
 
-    const classLinkerOffsets = getArtClassLinkerSpec(temporaryApi).offset;
+    const classLinkerOffsets = getArtClassLinkerSpec(artRuntime, runtimeSpec).offset;
     const quickResolutionTrampoline = classLinker.add(classLinkerOffsets.quickResolutionTrampoline).readPointer();
     const quickImtConflictTrampoline = classLinker.add(classLinkerOffsets.quickImtConflictTrampoline).readPointer();
     const quickGenericJniTrampoline = classLinker.add(classLinkerOffsets.quickGenericJniTrampoline).readPointer();
@@ -613,49 +614,57 @@ function _getArtRuntimeSpec (api) {
   const endOffset = startOffset + (100 * pointerSize);
 
   const apiLevel = getAndroidApiLevel();
+  const codename = getAndroidCodename();
 
   let spec = null;
 
   for (let offset = startOffset; offset !== endOffset; offset += pointerSize) {
     const value = runtime.add(offset).readPointer();
     if (value.equals(vm)) {
-      let classLinkerOffset = null;
+      let classLinkerOffsets;
       let jniIdManagerOffset = null;
-      if (apiLevel >= 33 || getAndroidCodename() === 'Tiramisu') {
-        classLinkerOffset = offset - (4 * pointerSize);
+      if (apiLevel >= 33 || codename === 'Tiramisu') {
+        classLinkerOffsets = [offset - (4 * pointerSize)];
         jniIdManagerOffset = offset - pointerSize;
-      } else if (apiLevel >= 30 || getAndroidCodename() === 'R') {
-        classLinkerOffset = offset - (3 * pointerSize);
+      } else if (apiLevel >= 30 || codename === 'R') {
+        classLinkerOffsets = [offset - (3 * pointerSize), offset - (4 * pointerSize)];
         jniIdManagerOffset = offset - pointerSize;
       } else if (apiLevel >= 29) {
-        classLinkerOffset = offset - (2 * pointerSize);
+        classLinkerOffsets = [offset - (2 * pointerSize)];
       } else if (apiLevel >= 27) {
-        classLinkerOffset = offset - STD_STRING_SIZE - (3 * pointerSize);
+        classLinkerOffsets = [offset - STD_STRING_SIZE - (3 * pointerSize)];
       } else {
-        classLinkerOffset = offset - STD_STRING_SIZE - (2 * pointerSize);
+        classLinkerOffsets = [offset - STD_STRING_SIZE - (2 * pointerSize)];
       }
 
-      const internTableOffset = classLinkerOffset - pointerSize;
-      const threadListOffset = internTableOffset - pointerSize;
+      for (const classLinkerOffset of classLinkerOffsets) {
+        const internTableOffset = classLinkerOffset - pointerSize;
+        const threadListOffset = internTableOffset - pointerSize;
 
-      let heapOffset;
-      if (apiLevel >= 24) {
-        heapOffset = threadListOffset - (8 * pointerSize);
-      } else if (apiLevel >= 23) {
-        heapOffset = threadListOffset - (7 * pointerSize);
-      } else {
-        heapOffset = threadListOffset - (4 * pointerSize);
-      }
+        let heapOffset;
+        if (apiLevel >= 24) {
+          heapOffset = threadListOffset - (8 * pointerSize);
+        } else if (apiLevel >= 23) {
+          heapOffset = threadListOffset - (7 * pointerSize);
+        } else {
+          heapOffset = threadListOffset - (4 * pointerSize);
+        }
 
-      spec = {
-        offset: {
-          heap: heapOffset,
-          threadList: threadListOffset,
-          internTable: internTableOffset,
-          classLinker: classLinkerOffset,
-          jniIdManager: jniIdManagerOffset
+        const candidate = {
+          offset: {
+            heap: heapOffset,
+            threadList: threadListOffset,
+            internTable: internTableOffset,
+            classLinker: classLinkerOffset,
+            jniIdManager: jniIdManagerOffset
+          }
+        };
+        if (tryGetArtClassLinkerSpec(runtime, candidate) !== null) {
+          spec = candidate;
+          break;
         }
-      };
+      }
+
       break;
     }
   }
@@ -833,7 +842,19 @@ function _getArtInstrumentationSpec () {
   };
 }
 
-function _getArtClassLinkerSpec (api) {
+function getArtClassLinkerSpec (runtime, runtimeSpec) {
+  const spec = tryGetArtClassLinkerSpec(runtime, runtimeSpec);
+  if (spec === null) {
+    throw new Error('Unable to determine ClassLinker field offsets');
+  }
+  return spec;
+}
+
+function tryGetArtClassLinkerSpec (runtime, runtimeSpec) {
+  if (cachedArtClassLinkerSpec !== null) {
+    return cachedArtClassLinkerSpec;
+  }
+
   /*
    * On Android 5.x:
    *
@@ -862,11 +883,9 @@ function _getArtClassLinkerSpec (api) {
    * }
    */
 
-  const runtime = api.artRuntime;
-  const runtimeSpec = getArtRuntimeSpec(api);
-
-  const classLinker = runtime.add(runtimeSpec.offset.classLinker).readPointer();
-  const internTable = runtime.add(runtimeSpec.offset.internTable).readPointer();
+  const { classLinker: classLinkerOffset, internTable: internTableOffset } = runtimeSpec.offset;
+  const classLinker = runtime.add(classLinkerOffset).readPointer();
+  const internTable = runtime.add(internTableOffset).readPointer();
 
   const startOffset = (pointerSize === 4) ? 100 : 200;
   const endOffset = startOffset + (100 * pointerSize);
@@ -911,8 +930,8 @@ function _getArtClassLinkerSpec (api) {
     }
   }
 
-  if (spec === null) {
-    throw new Error('Unable to determine ClassLinker field offsets');
+  if (spec !== null) {
+    cachedArtClassLinkerSpec = spec;
   }
 
   return spec;

package/lib/class-model.js

@@ -390,7 +390,10 @@ model_add_method (Model * self,
   gchar * key, type;
   const gchar * value;
 
-  key = g_strdup (name);
+  if (name[0] == '$')
+    key = g_strdup_printf ("_%s", name);
+  else
+    key = g_strdup (name);
 
   type = (modifiers & kAccStatic) != 0 ? 's' : 'i';
 
@@ -410,7 +413,10 @@ model_add_field (Model * self,
   GHashTable * members = self->members;
   gchar * key, type;
 
-  key = g_strdup (name);
+  if (name[0] == '$')
+    key = g_strdup_printf ("_%s", name);
+  else
+    key = g_strdup (name);
   while (g_hash_table_contains (members, key))
   {
     gchar * new_key = g_strdup_printf ("_%s", key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frida-java-bridge",
-  "version": "6.2.2",
+  "version": "6.2.3",
   "description": "Java runtime interop from Frida",
   "main": "index.js",
   "files": [