frida-java-bridge 6.3.2 → 6.3.4

package/lib/android.js

@@ -591,8 +591,9 @@ function _getArtRuntimeSpec (api) {
    * gc::Heap* heap_;                <-- we need to find this
    * std::unique_ptr<ArenaPool> jit_arena_pool_;     <----- API level >= 24
    * std::unique_ptr<ArenaPool> arena_pool_;             __
-   * std::unique_ptr<ArenaPool> low_4gb_arena_pool_; <--|__ API level >= 23
+   * std::unique_ptr<ArenaPool> low_4gb_arena_pool_/linear_alloc_arena_pool_; <--|__ API level >= 23
    * std::unique_ptr<LinearAlloc> linear_alloc_;         \_
+   * std::atomic<LinearAlloc*> startup_linear_alloc_;<----- API level >= 34
    * size_t max_spins_before_thin_lock_inflation_;
    * MonitorList* monitor_list_;
    * MonitorPool* monitor_pool_;
@@ -617,6 +618,7 @@ function _getArtRuntimeSpec (api) {
 
   const apiLevel = getAndroidApiLevel();
   const codename = getAndroidCodename();
+  const isApiLevel34OrApexEquivalent = Module.findExportByName('libart.so', '_ZN3art7AppInfo29GetPrimaryApkReferenceProfileEv') !== null;
 
   let spec = null;
 
@@ -644,7 +646,9 @@ function _getArtRuntimeSpec (api) {
         const threadListOffset = internTableOffset - pointerSize;
 
         let heapOffset;
-        if (apiLevel >= 24) {
+        if (isApiLevel34OrApexEquivalent) {
+          heapOffset = threadListOffset - (9 * pointerSize);
+        } else if (apiLevel >= 24) {
           heapOffset = threadListOffset - (8 * pointerSize);
         } else if (apiLevel >= 23) {
           heapOffset = threadListOffset - (7 * pointerSize);
@@ -1804,6 +1808,9 @@ on_leave_gc_concurrent_copying_copying_phase (GumInvocationContext * ic)
       Gc: {
         copyingPhase: {
           onLeave: cm.on_leave_gc_concurrent_copying_copying_phase
+        },
+        runFlip: {
+          onEnter: cm.on_leave_gc_concurrent_copying_copying_phase
         }
       }
     }
@@ -1881,15 +1888,23 @@ function ensureArtKnowsHowToHandleReplacementMethods (vm) {
 
   const apiLevel = getAndroidApiLevel();
 
-  let exportName = null;
-  if (apiLevel > 28) {
-    exportName = '_ZN3art2gc9collector17ConcurrentCopying12CopyingPhaseEv';
-  } else if (apiLevel > 22) {
-    exportName = '_ZN3art2gc9collector17ConcurrentCopying12MarkingPhaseEv';
-  }
+  const mayUseCollector = (apiLevel > 28)
+    ? new NativeFunction(Module.getExportByName('libart.so', '_ZNK3art2gc4Heap15MayUseCollectorENS0_13CollectorTypeE'), 'bool', ['pointer', 'int'])
+    : () => false;
+  const kCollectorTypeCMC = 3;
 
-  if (exportName !== null) {
-    Interceptor.attach(Module.getExportByName('libart.so', exportName), artController.hooks.Gc.copyingPhase);
+  if (mayUseCollector(getApi().artHeap, kCollectorTypeCMC)) {
+    Interceptor.attach(Module.getExportByName('libart.so', '_ZN3art6Thread15RunFlipFunctionEPS0_b'), artController.hooks.Gc.runFlip);
+  } else {
+    let exportName = null;
+    if (apiLevel > 28) {
+      exportName = '_ZN3art2gc9collector17ConcurrentCopying12CopyingPhaseEv';
+    } else if (apiLevel > 22) {
+      exportName = '_ZN3art2gc9collector17ConcurrentCopying12MarkingPhaseEv';
+    }
+    if (exportName !== null) {
+      Interceptor.attach(Module.getExportByName('libart.so', exportName), artController.hooks.Gc.copyingPhase);
+    }
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frida-java-bridge",
-  "version": "6.3.2",
+  "version": "6.3.4",
   "description": "Java runtime interop from Frida",
   "main": "index.js",
   "files": [