frida-java-bridge 6.3.3 → 6.3.5

package/lib/android.js

@@ -187,7 +187,11 @@ function _getApi () {
           },
           // Android >= 6
           _ZN3art9JavaVMExt12DecodeGlobalEPNS_6ThreadEPv: ['art::JavaVMExt::DecodeGlobal', 'pointer', ['pointer', 'pointer', 'pointer']],
-          // Android < 6: makeDecodeGlobalFallbackForAndroid5() fallback uses:
+
+          // makeDecodeGlobalFallback() uses:
+          // Android >= 15
+          _ZNK3art6Thread19DecodeGlobalJObjectEP8_jobject: ['art::Thread::DecodeJObject', 'pointer', ['pointer', 'pointer']],
+          // Android < 6
           _ZNK3art6Thread13DecodeJObjectEP8_jobject: ['art::Thread::DecodeJObject', 'pointer', ['pointer', 'pointer']],
 
           // Android >= 6
@@ -314,6 +318,7 @@ function _getApi () {
           '_ZN3art9JavaVMExt12AddGlobalRefEPNS_6ThreadEPNS_6mirror6ObjectE',
           '_ZN3art9JavaVMExt12DecodeGlobalEPv',
           '_ZN3art9JavaVMExt12DecodeGlobalEPNS_6ThreadEPv',
+          '_ZNK3art6Thread19DecodeGlobalJObjectEP8_jobject',
           '_ZNK3art6Thread13DecodeJObjectEP8_jobject',
           '_ZN3art10ThreadList10SuspendAllEPKcb',
           '_ZN3art10ThreadList10SuspendAllEv',
@@ -489,7 +494,7 @@ function _getApi () {
       temporaryApi['art::JavaVMExt::AddGlobalRef'] = makeAddGlobalRefFallbackForAndroid5(temporaryApi);
     }
     if (temporaryApi['art::JavaVMExt::DecodeGlobal'] === undefined) {
-      temporaryApi['art::JavaVMExt::DecodeGlobal'] = makeDecodeGlobalFallbackForAndroid5(temporaryApi);
+      temporaryApi['art::JavaVMExt::DecodeGlobal'] = makeDecodeGlobalFallback(temporaryApi);
     }
     if (temporaryApi['art::ArtMethod::PrettyMethod'] === undefined) {
       temporaryApi['art::ArtMethod::PrettyMethod'] = temporaryApi['art::ArtMethod::PrettyMethodNullSafe'];
@@ -618,6 +623,7 @@ function _getArtRuntimeSpec (api) {
 
   const apiLevel = getAndroidApiLevel();
   const codename = getAndroidCodename();
+  const isApiLevel34OrApexEquivalent = Module.findExportByName('libart.so', '_ZN3art7AppInfo29GetPrimaryApkReferenceProfileEv') !== null;
 
   let spec = null;
 
@@ -645,7 +651,7 @@ function _getArtRuntimeSpec (api) {
         const threadListOffset = internTableOffset - pointerSize;
 
         let heapOffset;
-        if (apiLevel >= 34) {
+        if (isApiLevel34OrApexEquivalent) {
           heapOffset = threadListOffset - (9 * pointerSize);
         } else if (apiLevel >= 24) {
           heapOffset = threadListOffset - (8 * pointerSize);
@@ -1807,6 +1813,9 @@ on_leave_gc_concurrent_copying_copying_phase (GumInvocationContext * ic)
       Gc: {
         copyingPhase: {
           onLeave: cm.on_leave_gc_concurrent_copying_copying_phase
+        },
+        runFlip: {
+          onEnter: cm.on_leave_gc_concurrent_copying_copying_phase
         }
       }
     }
@@ -1884,19 +1893,22 @@ function ensureArtKnowsHowToHandleReplacementMethods (vm) {
 
   const apiLevel = getAndroidApiLevel();
 
-  let exportName = null;
-  if (apiLevel > 28) {
-    exportName = '_ZN3art2gc9collector17ConcurrentCopying12CopyingPhaseEv';
-  } else if (apiLevel > 22) {
-    exportName = '_ZN3art2gc9collector17ConcurrentCopying12MarkingPhaseEv';
-  }
-
-  if (exportName !== null) {
-    Interceptor.attach(Module.getExportByName('libart.so', exportName), artController.hooks.Gc.copyingPhase);
+  const mayUseCollector = (apiLevel > 28)
+    ? new NativeFunction(Module.getExportByName('libart.so', '_ZNK3art2gc4Heap15MayUseCollectorENS0_13CollectorTypeE'), 'bool', ['pointer', 'int'])
+    : () => false;
+  const kCollectorTypeCMC = 3;
 
-    const collectorCMC = Module.findExportByName('libart.so', '_ZN3art2gc9collector11MarkCompact15CompactionPhaseEv');
-    if (collectorCMC !== null) {
-      Interceptor.attach(collectorCMC, artController.hooks.Gc.copyingPhase);
+  if (mayUseCollector(getApi().artHeap, kCollectorTypeCMC)) {
+    Interceptor.attach(Module.getExportByName('libart.so', '_ZN3art6Thread15RunFlipFunctionEPS0_b'), artController.hooks.Gc.runFlip);
+  } else {
+    let exportName = null;
+    if (apiLevel > 28) {
+      exportName = '_ZN3art2gc9collector17ConcurrentCopying12CopyingPhaseEv';
+    } else if (apiLevel > 22) {
+      exportName = '_ZN3art2gc9collector17ConcurrentCopying12MarkingPhaseEv';
+    }
+    if (exportName !== null) {
+      Interceptor.attach(Module.getExportByName('libart.so', exportName), artController.hooks.Gc.copyingPhase);
     }
   }
 }
@@ -3841,8 +3853,15 @@ function makeAddGlobalRefFallbackForAndroid5 (api) {
   };
 }
 
-function makeDecodeGlobalFallbackForAndroid5 (api) {
+function makeDecodeGlobalFallback (api) {
+  /*
+   * Fallback for art::JavaVMExt::DecodeGlobal, which is
+   * unavailable in Android versions <= 5 and >= 15.
+   */
   const decode = api['art::Thread::DecodeJObject'];
+  if (decode === undefined) {
+    throw new Error('art::Thread::DecodeJObject is not available; please file a bug');
+  }
 
   return function (vm, thread, ref) {
     return decode(thread, ref);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frida-java-bridge",
-  "version": "6.3.3",
+  "version": "6.3.5",
   "description": "Java runtime interop from Frida",
   "main": "index.js",
   "files": [