frida-java-bridge 6.3.5 → 6.3.7

package/index.js

@@ -214,29 +214,23 @@ class Runtime {
     const { vm, api } = this;
     const env = vm.getEnv();
 
-    const classHandles = [];
     const addGlobalReference = api['art::JavaVMExt::AddGlobalRef'];
     const { vm: vmHandle } = api;
     withRunnableArtThread(vm, env, thread => {
       const collectClassHandles = makeArtClassVisitor(klass => {
-        classHandles.push(addGlobalReference(vmHandle, thread, klass));
+        const handle = addGlobalReference(vmHandle, thread, klass);
+        try {
+          const className = env.getClassName(handle);
+          callbacks.onMatch(className, handle);
+        } finally {
+          env.deleteGlobalRef(handle);
+        }
         return true;
       });
 
       api['art::ClassLinker::VisitClasses'](api.artClassLinker.address, collectClassHandles);
     });
 
-    try {
-      classHandles.forEach(handle => {
-        const className = env.getClassName(handle);
-        callbacks.onMatch(className, handle);
-      });
-    } finally {
-      classHandles.forEach(handle => {
-        env.deleteGlobalRef(handle);
-      });
-    }
-
     callbacks.onComplete();
   }
 

package/lib/android.js

@@ -139,13 +139,20 @@ function _getApi () {
 
   const temporaryApi = {
     module: vmModule,
+    find (name) {
+      const { module } = this;
+      let address = module.findExportByName(name);
+      if (address === null) {
+        address = module.findSymbolByName(name);
+      }
+      return address;
+    },
     flavor,
     addLocalReference: null
   };
 
   const pending = isArt
-    ? [{
-        module: vmModule.path,
+    ? {
         functions: {
           JNI_GetCreatedJavaVMs: ['JNI_GetCreatedJavaVMs', 'int', ['pointer', 'int', 'pointer']],
 
@@ -312,7 +319,7 @@ function _getApi () {
             this.isDebuggerActive = () => !!address.readU8();
           }
         },
-        optionals: [
+        optionals: new Set([
           'artInterpreterToCompiledCodeBridge',
           '_ZN3art9JavaVMExt12AddGlobalRefEPNS_6ThreadENS_6ObjPtrINS_6mirror6ObjectEEE',
           '_ZN3art9JavaVMExt12AddGlobalRefEPNS_6ThreadEPNS_6mirror6ObjectE',
@@ -360,10 +367,9 @@ function _getApi () {
           '_ZN3art3jni12JniIdManager14DecodeMethodIdEP10_jmethodID',
           '_ZN3art11interpreter18GetNterpEntryPointEv',
           '_ZN3art7Monitor17TranslateLocationEPNS_9ArtMethodEjPPKcPi'
-        ]
-      }]
-    : [{
-        module: vmModule.path,
+        ])
+      }
+    : {
         functions: {
           _Z20dvmDecodeIndirectRefP6ThreadP8_jobject: ['dvmDecodeIndirectRef', 'pointer', ['pointer', 'pointer']],
           _Z15dvmUseJNIBridgeP6MethodPv: ['dvmUseJNIBridge', 'void', ['pointer', 'pointer']],
@@ -380,52 +386,41 @@ function _getApi () {
             this.gDvm = address;
           }
         }
-      }];
+      };
+
+  const {
+    functions = {},
+    variables = {},
+    optionals = new Set()
+  } = pending;
 
   const missing = [];
 
-  pending.forEach(function (api) {
-    const functions = api.functions || {};
-    const variables = api.variables || {};
-    const optionals = new Set(api.optionals || []);
-
-    const exportByName = Module
-      .enumerateExports(api.module)
-      .reduce(function (result, exp) {
-        result[exp.name] = exp;
-        return result;
-      }, {});
-
-    Object.keys(functions)
-      .forEach(function (name) {
-        const exp = exportByName[name];
-        if (exp !== undefined && exp.type === 'function') {
-          const signature = functions[name];
-          if (typeof signature === 'function') {
-            signature.call(temporaryApi, exp.address);
-          } else {
-            temporaryApi[signature[0]] = new NativeFunction(exp.address, signature[1], signature[2], nativeFunctionOptions);
-          }
-        } else {
-          if (!optionals.has(name)) {
-            missing.push(name);
-          }
-        }
-      });
+  for (const [name, signature] of Object.entries(functions)) {
+    const address = temporaryApi.find(name);
+    if (address !== null) {
+      if (typeof signature === 'function') {
+        signature.call(temporaryApi, address);
+      } else {
+        temporaryApi[signature[0]] = new NativeFunction(address, signature[1], signature[2], nativeFunctionOptions);
+      }
+    } else {
+      if (!optionals.has(name)) {
+        missing.push(name);
+      }
+    }
+  }
 
-    Object.keys(variables)
-      .forEach(function (name) {
-        const exp = exportByName[name];
-        if (exp !== undefined && exp.type === 'variable') {
-          const handler = variables[name];
-          handler.call(temporaryApi, exp.address);
-        } else {
-          if (!optionals.has(name)) {
-            missing.push(name);
-          }
-        }
-      });
-  });
+  for (const [name, handler] of Object.entries(variables)) {
+    const address = temporaryApi.find(name);
+    if (address !== null) {
+      handler.call(temporaryApi, address);
+    } else {
+      if (!optionals.has(name)) {
+        missing.push(name);
+      }
+    }
+  }
 
   if (missing.length > 0) {
     throw new Error('Java API only partially available; please file a bug. Missing: ' + missing.join(', '));
@@ -501,9 +496,11 @@ function _getApi () {
     }
     if (temporaryApi['art::interpreter::GetNterpEntryPoint'] !== undefined) {
       temporaryApi.artNterpEntryPoint = temporaryApi['art::interpreter::GetNterpEntryPoint']();
+    } else {
+      temporaryApi.artNterpEntryPoint = temporaryApi.find('ExecuteNterpImpl');
     }
 
-    artController = makeArtController(vm);
+    artController = makeArtController(temporaryApi, vm);
 
     fixupArtQuickDeliverExceptionBug(temporaryApi);
 
@@ -518,7 +515,7 @@ function _getApi () {
     });
   }
 
-  const cxxImports = Module.enumerateImports(vmModule.path)
+  const cxxImports = vmModule.enumerateImports()
     .filter(imp => imp.name.indexOf('_Z') === 0)
     .reduce((result, imp) => {
       result[imp.name] = imp.address;
@@ -536,8 +533,11 @@ function tryGetEnvJvmti (vm, runtime) {
   let env = null;
 
   vm.perform(() => {
-    const ensurePluginLoaded = new NativeFunction(
-      Module.getExportByName('libart.so', '_ZN3art7Runtime18EnsurePluginLoadedEPKcPNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEE'),
+    const ensurePluginLoadedAddr = getApi().find('_ZN3art7Runtime18EnsurePluginLoadedEPKcPNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEE');
+    if (ensurePluginLoadedAddr === null) {
+      return;
+    }
+    const ensurePluginLoaded = new NativeFunction(ensurePluginLoadedAddr,
       'bool',
       ['pointer', 'pointer', 'pointer']);
     const errorPtr = Memory.alloc(pointerSize);
@@ -623,7 +623,8 @@ function _getArtRuntimeSpec (api) {
 
   const apiLevel = getAndroidApiLevel();
   const codename = getAndroidCodename();
-  const isApiLevel34OrApexEquivalent = Module.findExportByName('libart.so', '_ZN3art7AppInfo29GetPrimaryApkReferenceProfileEv') !== null;
+  const isApiLevel34OrApexEquivalent = api.find('_ZN3art7AppInfo29GetPrimaryApkReferenceProfileEv') !== null ||
+    api.find('_ZN3art6Thread15RunFlipFunctionEPS0_') !== null;
 
   let spec = null;
 
@@ -685,7 +686,7 @@ function _getArtRuntimeSpec (api) {
   }
 
   spec.offset.instrumentation = tryDetectInstrumentationOffset(api);
-  spec.offset.jniIdsIndirection = tryDetectJniIdsIndirectionOffset();
+  spec.offset.jniIdsIndirection = tryDetectJniIdsIndirectionOffset(api);
 
   return spec;
 }
@@ -771,8 +772,8 @@ const jniIdsIndirectionOffsetParsers = {
   arm64: parseArm64JniIdsIndirectionOffset
 };
 
-function tryDetectJniIdsIndirectionOffset () {
-  const impl = Module.findExportByName('libart.so', '_ZN3art7Runtime12SetJniIdTypeENS_9JniIdTypeE');
+function tryDetectJniIdsIndirectionOffset (api) {
+  const impl = api.find('_ZN3art7Runtime12SetJniIdTypeENS_9JniIdTypeE');
   if (impl === null) {
     return null;
   }
@@ -1568,7 +1569,7 @@ function notifyArtMethodHooked (method, vm) {
   ensureArtKnowsHowToHandleReplacementMethods(vm);
 }
 
-function makeArtController (vm) {
+function makeArtController (api, vm) {
   const threadOffsets = getArtThreadSpec(vm).offset;
   const managedStackOffsets = getArtManagedStackSpec().offset;
 
@@ -1776,10 +1777,9 @@ on_leave_gc_concurrent_copying_copying_phase (GumInvocationContext * ic)
   const replacements = methods.add(methodsSize);
   const lastSeenArtMethod = replacements.add(replacementsSize);
 
-  const getOatQuickMethodHeaderImpl = Module.findExportByName('libart.so',
-    (pointerSize === 4)
-      ? '_ZN3art9ArtMethod23GetOatQuickMethodHeaderEj'
-      : '_ZN3art9ArtMethod23GetOatQuickMethodHeaderEm');
+  const getOatQuickMethodHeaderImpl = api.find((pointerSize === 4)
+    ? '_ZN3art9ArtMethod23GetOatQuickMethodHeaderEj'
+    : '_ZN3art9ArtMethod23GetOatQuickMethodHeaderEm');
 
   const cm = new CModule(code, {
     lock,
@@ -1864,8 +1864,9 @@ function instrumentArtMethodInvocationFromInterpreter () {
     artInterpreterDoCallExportRegex = /^_ZN3art11interpreter6DoCallILb[0-1]EEEbPNS_9ArtMethodEPNS_6ThreadERNS_11ShadowFrameEPKNS_11InstructionEtbPNS_6JValueE$/;
   }
 
-  for (const exp of Module.enumerateExports('libart.so').filter(exp => artInterpreterDoCallExportRegex.test(exp.name))) {
-    Interceptor.attach(exp.address, artController.hooks.Interpreter.doCall);
+  const art = getApi().module;
+  for (const entry of [...art.enumerateExports(), ...art.enumerateSymbols()].filter(entry => artInterpreterDoCallExportRegex.test(entry.name))) {
+    Interceptor.attach(entry.address, artController.hooks.Interpreter.doCall);
   }
 }
 
@@ -1893,23 +1894,24 @@ function ensureArtKnowsHowToHandleReplacementMethods (vm) {
 
   const apiLevel = getAndroidApiLevel();
 
-  const mayUseCollector = (apiLevel > 28)
-    ? new NativeFunction(Module.getExportByName('libart.so', '_ZNK3art2gc4Heap15MayUseCollectorENS0_13CollectorTypeE'), 'bool', ['pointer', 'int'])
-    : () => false;
-  const kCollectorTypeCMC = 3;
+  let copyingPhase = null;
+  const api = getApi();
+  if (apiLevel > 28) {
+    copyingPhase = api.find('_ZN3art2gc9collector17ConcurrentCopying12CopyingPhaseEv');
+  } else if (apiLevel > 22) {
+    copyingPhase = api.find('_ZN3art2gc9collector17ConcurrentCopying12MarkingPhaseEv');
+  }
+  if (copyingPhase !== null) {
+    Interceptor.attach(copyingPhase, artController.hooks.Gc.copyingPhase);
+  }
 
-  if (mayUseCollector(getApi().artHeap, kCollectorTypeCMC)) {
-    Interceptor.attach(Module.getExportByName('libart.so', '_ZN3art6Thread15RunFlipFunctionEPS0_b'), artController.hooks.Gc.runFlip);
-  } else {
-    let exportName = null;
-    if (apiLevel > 28) {
-      exportName = '_ZN3art2gc9collector17ConcurrentCopying12CopyingPhaseEv';
-    } else if (apiLevel > 22) {
-      exportName = '_ZN3art2gc9collector17ConcurrentCopying12MarkingPhaseEv';
-    }
-    if (exportName !== null) {
-      Interceptor.attach(Module.getExportByName('libart.so', exportName), artController.hooks.Gc.copyingPhase);
-    }
+  let runFlip = null;
+  runFlip = api.find('_ZN3art6Thread15RunFlipFunctionEPS0_');
+  if (runFlip === null) {
+    runFlip = api.find('_ZN3art6Thread15RunFlipFunctionEPS0_b');
+  }
+  if (runFlip !== null) {
+    Interceptor.attach(runFlip, artController.hooks.Gc.runFlip);
   }
 }
 
@@ -3408,7 +3410,7 @@ class ArtMethodMangler {
 
     // Replace Nterp quick entrypoints with art_quick_to_interpreter_bridge to force stepping out
     // of ART's next-generation interpreter and use the quick stub instead.
-    if (artNterpEntryPoint !== undefined && quickCode.equals(artNterpEntryPoint)) {
+    if (artNterpEntryPoint !== null && quickCode.equals(artNterpEntryPoint)) {
       patchArtMethod(hookedMethodId, {
         quickCode: api.artQuickToInterpreterBridge
       }, vm);
@@ -3919,9 +3921,24 @@ const threadStateTransitionRecompilers = {
 };
 
 function makeArtThreadStateTransitionImpl (vm, env, callback) {
+  const api = getApi();
   const envVtable = env.handle.readPointer();
-  const exceptionClearImpl = envVtable.add(ENV_VTABLE_OFFSET_EXCEPTION_CLEAR).readPointer();
-  const nextFuncImpl = envVtable.add(ENV_VTABLE_OFFSET_FATAL_ERROR).readPointer();
+
+  let exceptionClearImpl;
+  const innerExceptionClearImpl = api.find('_ZN3art3JNIILb1EE14ExceptionClearEP7_JNIEnv');
+  if (innerExceptionClearImpl !== null) {
+    exceptionClearImpl = innerExceptionClearImpl;
+  } else {
+    exceptionClearImpl = envVtable.add(ENV_VTABLE_OFFSET_EXCEPTION_CLEAR).readPointer();
+  }
+
+  let nextFuncImpl;
+  const innerNextFuncImpl = api.find('_ZN3art3JNIILb1EE10FatalErrorEP7_JNIEnvPKc');
+  if (innerNextFuncImpl !== null) {
+    nextFuncImpl = innerNextFuncImpl;
+  } else {
+    nextFuncImpl = envVtable.add(ENV_VTABLE_OFFSET_FATAL_ERROR).readPointer();
+  }
 
   const recompile = threadStateTransitionRecompilers[Process.arch];
   if (recompile === undefined) {

package/lib/class-factory.js

@@ -16,6 +16,8 @@ const {
   makeJniObjectTypeName
 } = require('./types');
 
+const kAccStatic = 0x0008;
+
 const CONSTRUCTOR_METHOD = 1;
 const STATIC_METHOD = 2;
 const INSTANCE_METHOD = 3;
@@ -450,6 +452,9 @@ class ClassFactory {
             impl = methodValue;
           }
         } else {
+          if (methodValue.isStatic) {
+            type = STATIC_METHOD;
+          }
           returnType = this._getType(methodValue.returnType || 'void');
           argumentTypes = (methodValue.argumentTypes || []).map(name => this._getType(name));
           impl = methodValue.implementation;
@@ -479,7 +484,7 @@ class ClassFactory {
         const argumentTypeNames = argumentTypes.map(t => t.name);
         const signature = '(' + argumentTypeNames.join('') + ')' + returnTypeName;
 
-        dexMethods.push([name, returnTypeName, argumentTypeNames, thrownTypeNames]);
+        dexMethods.push([name, returnTypeName, argumentTypeNames, thrownTypeNames, (type === STATIC_METHOD) ? kAccStatic : 0]);
         implMethods.push([name, signature, type, returnType, argumentTypes, impl]);
       });
 
@@ -566,15 +571,16 @@ class ClassFactory {
     const JVMTI_HEAP_OBJECT_EITHER = 3;
 
     const h = classWrapper.$borrowClassHandle(env);
+    const tag = int64(h.value.toString());
     try {
       const heapObjectCallback = new NativeCallback((classTag, size, tagPtr, userData) => {
-        tagPtr.writePointer(h.value);
+        tagPtr.writeS64(tag);
         return JVMTI_ITERATION_CONTINUE;
-      }, 'int', ['long', 'long', 'pointer', 'pointer']);
+      }, 'int', ['int64', 'int64', 'pointer', 'pointer']);
       jvmti.iterateOverInstancesOfClass(h.value, JVMTI_HEAP_OBJECT_EITHER, heapObjectCallback, h.value);
 
-      const tagPtr = Memory.alloc(pointerSize);
-      tagPtr.writePointer(h.value);
+      const tagPtr = Memory.alloc(8);
+      tagPtr.writeS64(tag);
       const countPtr = Memory.alloc(jsizeSize);
       const objectsPtr = Memory.alloc(pointerSize);
       jvmti.getObjectsWithTags(1, tagPtr, countPtr, objectsPtr, NULL);

package/lib/jvm.js

@@ -51,184 +51,226 @@ function _getApi () {
     flavor: 'jvm'
   };
 
-  const pending = [{
-    module: vmModule.path,
-    functions: {
-      JNI_GetCreatedJavaVMs: ['JNI_GetCreatedJavaVMs', 'int', ['pointer', 'int', 'pointer']],
-
-      _ZN6Method4sizeEb: ['Method::size', 'int', ['int']],
-      _ZN6Method19set_native_functionEPhb: ['Method::set_native_function', 'void', ['pointer', 'pointer', 'int']],
-      _ZN6Method21clear_native_functionEv: ['Method::clear_native_function', 'void', ['pointer']],
-      // JDK >= 17
-      _ZN6Method24restore_unshareable_infoEP10JavaThread: ['Method::restore_unshareable_info', 'void', ['pointer', 'pointer']],
-      // JDK < 17
-      _ZN6Method24restore_unshareable_infoEP6Thread: ['Method::restore_unshareable_info', 'void', ['pointer', 'pointer']],
-      _ZN6Method10jmethod_idEv: ['Method::jmethod_id', 'pointer', ['pointer']],
-      _ZN6Method10clear_codeEv: function (address) {
-        const clearCode = new NativeFunction(address, 'void', ['pointer'], nativeFunctionOptions);
-        this['Method::clear_code'] = function (thisPtr) {
-          clearCode(thisPtr);
-        };
-      },
-      _ZN6Method10clear_codeEb: function (address) {
-        const clearCode = new NativeFunction(address, 'void', ['pointer', 'int'], nativeFunctionOptions);
-        const lock = 0;
-        this['Method::clear_code'] = function (thisPtr) {
-          clearCode(thisPtr, lock);
-        };
-      },
-
-      // JDK >= 13
-      _ZN18VM_RedefineClasses19mark_dependent_codeEP13InstanceKlass: ['VM_RedefineClasses::mark_dependent_code', 'void', ['pointer', 'pointer']],
-      _ZN18VM_RedefineClasses20flush_dependent_codeEv: ['VM_RedefineClasses::flush_dependent_code', 'void', []],
-      // JDK < 13
-      _ZN18VM_RedefineClasses20flush_dependent_codeEP13InstanceKlassP6Thread: ['VM_RedefineClasses::flush_dependent_code', 'void', ['pointer', 'pointer', 'pointer']],
-      // JDK < 10
-      _ZN18VM_RedefineClasses20flush_dependent_codeE19instanceKlassHandleP6Thread: ['VM_RedefineClasses::flush_dependent_code', 'void', ['pointer', 'pointer', 'pointer']],
-
-      _ZN19ResolvedMethodTable21adjust_method_entriesEPb: ['ResolvedMethodTable::adjust_method_entries', 'void', ['pointer']],
-      // JDK < 10
-      _ZN15MemberNameTable21adjust_method_entriesEP13InstanceKlassPb: ['MemberNameTable::adjust_method_entries', 'void', ['pointer', 'pointer', 'pointer']],
-
-      _ZN17ConstantPoolCache21adjust_method_entriesEPb: function (address) {
-        const adjustMethod = new NativeFunction(address, 'void', ['pointer', 'pointer'], nativeFunctionOptions);
-        this['ConstantPoolCache::adjust_method_entries'] = function (thisPtr, holderPtr, tracePtr) {
-          adjustMethod(thisPtr, tracePtr);
-        };
-      },
-      // JDK < 13
-      _ZN17ConstantPoolCache21adjust_method_entriesEP13InstanceKlassPb: function (address) {
-        const adjustMethod = new NativeFunction(address, 'void', ['pointer', 'pointer', 'pointer'], nativeFunctionOptions);
-        this['ConstantPoolCache::adjust_method_entries'] = function (thisPtr, holderPtr, tracePtr) {
-          adjustMethod(thisPtr, holderPtr, tracePtr);
-        };
-      },
-
-      _ZN20ClassLoaderDataGraph10classes_doEP12KlassClosure: ['ClassLoaderDataGraph::classes_do', 'void', ['pointer']],
-      _ZN20ClassLoaderDataGraph22clean_deallocate_listsEb: ['ClassLoaderDataGraph::clean_deallocate_lists', 'void', ['int']],
-
-      _ZN10JavaThread27thread_from_jni_environmentEP7JNIEnv_: ['JavaThread::thread_from_jni_environment', 'pointer', ['pointer']],
-
-      _ZN8VMThread7executeEP12VM_Operation: ['VMThread::execute', 'void', ['pointer']],
-
-      _ZN11OopMapCache22flush_obsolete_entriesEv: ['OopMapCache::flush_obsolete_entries', 'void', ['pointer']],
-
-      _ZN14NMethodSweeper11force_sweepEv: ['NMethodSweeper::force_sweep', 'void', []],
-      _ZN14NMethodSweeper16sweep_code_cacheEv: ['NMethodSweeper::sweep_code_cache', 'void', []],
-      _ZN14NMethodSweeper17sweep_in_progressEv: ['NMethodSweeper::sweep_in_progress', 'bool', []],
-
-      JVM_Sleep: ['JVM_Sleep', 'void', ['pointer', 'pointer', 'long']]
-    },
-    variables: {
-      // JDK <= 9
-      _ZN18VM_RedefineClasses14_the_class_oopE: function (address) {
-        this.redefineClass = address;
-      },
-      // 9 < JDK < 13
-      _ZN18VM_RedefineClasses10_the_classE: function (address) {
-        this.redefineClass = address;
-      },
-      // JDK < 13
-      _ZN18VM_RedefineClasses25AdjustCpoolCacheAndVtable8do_klassEP5Klass: function (address) {
-        this.doKlass = address;
-      },
-      // JDK >= 13
-      _ZN18VM_RedefineClasses22AdjustAndCleanMetadata8do_klassEP5Klass: function (address) {
-        this.doKlass = address;
-      },
-      _ZTV18VM_RedefineClasses: function (address) {
-        this.vtableRedefineClasses = address;
-      },
-      _ZN18VM_RedefineClasses4doitEv: function (address) {
-        this.redefineClassesDoIt = address;
-      },
-      _ZN18VM_RedefineClasses13doit_prologueEv: function (address) {
-        this.redefineClassesDoItPrologue = address;
-      },
-      _ZN18VM_RedefineClasses13doit_epilogueEv: function (address) {
-        this.redefineClassesDoItEpilogue = address;
-      },
-      _ZN18VM_RedefineClassesD0Ev: function (address) {
-        this.redefineClassesDispose0 = address;
-      },
-      _ZN18VM_RedefineClassesD1Ev: function (address) {
-        this.redefineClassesDispose1 = address;
-      },
-      _ZNK18VM_RedefineClasses26allow_nested_vm_operationsEv: function (address) {
-        this.redefineClassesAllow = address;
-      },
-      _ZNK18VM_RedefineClasses14print_on_errorEP12outputStream: function (address) {
-        this.redefineClassesOnError = address;
-      },
-
-      // JDK >= 17
-      _ZN13InstanceKlass33create_new_default_vtable_indicesEiP10JavaThread: function (address) {
-        this.createNewDefaultVtableIndices = address;
-      },
-      // JDK < 17
-      _ZN13InstanceKlass33create_new_default_vtable_indicesEiP6Thread: function (address) {
-        this.createNewDefaultVtableIndices = address;
-      },
-
-      _ZN19Abstract_VM_Version19jre_release_versionEv: function (address) {
-        const getVersion = new NativeFunction(address, 'pointer', [], nativeFunctionOptions);
-        const versionS = getVersion().readCString();
-        this.version = versionS.startsWith('1.8')
-          ? 8
-          : versionS.startsWith('9.')
-            ? 9
-            : parseInt(versionS.slice(0, 2), 10);
-        this.versionS = versionS;
-      },
-
-      _ZN14NMethodSweeper11_traversalsE: function (address) {
-        this.traversals = address;
-      },
-      _ZN14NMethodSweeper21_sweep_fractions_leftE: function (address) {
-        this.fractions = address;
-      },
-      _ZN14NMethodSweeper13_should_sweepE: function (address) {
-        this.shouldSweep = address;
-      }
-    },
-    optionals: [
-      '_ZN6Method24restore_unshareable_infoEP10JavaThread',
-      '_ZN6Method24restore_unshareable_infoEP6Thread',
-      '_ZN6Method10clear_codeEv',
-      '_ZN6Method10clear_codeEb',
+  const pending = Process.platform === 'windows'
+    ? [{
+        module: vmModule.path,
+        functions: {
+          JNI_GetCreatedJavaVMs: ['JNI_GetCreatedJavaVMs', 'int', ['pointer', 'int', 'pointer']],
+          JVM_Sleep: ['JVM_Sleep', 'void', ['pointer', 'pointer', 'long']],
+          'VMThread::execute': ['VMThread::execute', 'void', ['pointer']],
+          'Method::size': ['Method::size', 'int', ['int']],
+          'Method::set_native_function': ['Method::set_native_function', 'void', ['pointer', 'pointer', 'int']],
+          'Method::clear_native_function': ['Method::clear_native_function', 'void', ['pointer']],
+          'Method::jmethod_id': ['Method::jmethod_id', 'pointer', ['pointer']],
+          'ClassLoaderDataGraph::classes_do': ['ClassLoaderDataGraph::classes_do', 'void', ['pointer']],
+          'NMethodSweeper::sweep_code_cache': ['NMethodSweeper::sweep_code_cache', 'void', []],
+          'OopMapCache::flush_obsolete_entries': ['OopMapCache::flush_obsolete_entries', 'void', ['pointer']]
+        },
+        variables: {
+          'VM_RedefineClasses::`vftable\'': function (address) {
+            this.vtableRedefineClasses = address;
+          },
+          'VM_RedefineClasses::doit': function (address) {
+            this.redefineClassesDoIt = address;
+          },
+          'VM_RedefineClasses::doit_prologue': function (address) {
+            this.redefineClassesDoItPrologue = address;
+          },
+          'VM_RedefineClasses::doit_epilogue': function (address) {
+            this.redefineClassesDoItEpilogue = address;
+          },
+          'VM_RedefineClasses::allow_nested_vm_operations': function (address) {
+            this.redefineClassesAllow = address;
+          },
+          'NMethodSweeper::_traversals': function (address) {
+            this.traversals = address;
+          },
+          'NMethodSweeper::_should_sweep': function (address) {
+            this.shouldSweep = address;
+          }
+        },
+        optionals: [
+        ]
+      }]
+  // If platform is not Windows
+    : [{
+        module: vmModule.path,
+        functions: {
+          JNI_GetCreatedJavaVMs: ['JNI_GetCreatedJavaVMs', 'int', ['pointer', 'int', 'pointer']],
+
+          _ZN6Method4sizeEb: ['Method::size', 'int', ['int']],
+          _ZN6Method19set_native_functionEPhb: ['Method::set_native_function', 'void', ['pointer', 'pointer', 'int']],
+          _ZN6Method21clear_native_functionEv: ['Method::clear_native_function', 'void', ['pointer']],
+          // JDK >= 17
+          _ZN6Method24restore_unshareable_infoEP10JavaThread: ['Method::restore_unshareable_info', 'void', ['pointer', 'pointer']],
+          // JDK < 17
+          _ZN6Method24restore_unshareable_infoEP6Thread: ['Method::restore_unshareable_info', 'void', ['pointer', 'pointer']],
+          _ZN6Method10jmethod_idEv: ['Method::jmethod_id', 'pointer', ['pointer']],
+          _ZN6Method10clear_codeEv: function (address) {
+            const clearCode = new NativeFunction(address, 'void', ['pointer'], nativeFunctionOptions);
+            this['Method::clear_code'] = function (thisPtr) {
+              clearCode(thisPtr);
+            };
+          },
+          _ZN6Method10clear_codeEb: function (address) {
+            const clearCode = new NativeFunction(address, 'void', ['pointer', 'int'], nativeFunctionOptions);
+            const lock = 0;
+            this['Method::clear_code'] = function (thisPtr) {
+              clearCode(thisPtr, lock);
+            };
+          },
+
+          // JDK >= 13
+          _ZN18VM_RedefineClasses19mark_dependent_codeEP13InstanceKlass: ['VM_RedefineClasses::mark_dependent_code', 'void', ['pointer', 'pointer']],
+          _ZN18VM_RedefineClasses20flush_dependent_codeEv: ['VM_RedefineClasses::flush_dependent_code', 'void', []],
+          // JDK < 13
+          _ZN18VM_RedefineClasses20flush_dependent_codeEP13InstanceKlassP6Thread: ['VM_RedefineClasses::flush_dependent_code', 'void', ['pointer', 'pointer', 'pointer']],
+          // JDK < 10
+          _ZN18VM_RedefineClasses20flush_dependent_codeE19instanceKlassHandleP6Thread: ['VM_RedefineClasses::flush_dependent_code', 'void', ['pointer', 'pointer', 'pointer']],
+
+          _ZN19ResolvedMethodTable21adjust_method_entriesEPb: ['ResolvedMethodTable::adjust_method_entries', 'void', ['pointer']],
+          // JDK < 10
+          _ZN15MemberNameTable21adjust_method_entriesEP13InstanceKlassPb: ['MemberNameTable::adjust_method_entries', 'void', ['pointer', 'pointer', 'pointer']],
+
+          _ZN17ConstantPoolCache21adjust_method_entriesEPb: function (address) {
+            const adjustMethod = new NativeFunction(address, 'void', ['pointer', 'pointer'], nativeFunctionOptions);
+            this['ConstantPoolCache::adjust_method_entries'] = function (thisPtr, holderPtr, tracePtr) {
+              adjustMethod(thisPtr, tracePtr);
+            };
+          },
+          // JDK < 13
+          _ZN17ConstantPoolCache21adjust_method_entriesEP13InstanceKlassPb: function (address) {
+            const adjustMethod = new NativeFunction(address, 'void', ['pointer', 'pointer', 'pointer'], nativeFunctionOptions);
+            this['ConstantPoolCache::adjust_method_entries'] = function (thisPtr, holderPtr, tracePtr) {
+              adjustMethod(thisPtr, holderPtr, tracePtr);
+            };
+          },
+
+          _ZN20ClassLoaderDataGraph10classes_doEP12KlassClosure: ['ClassLoaderDataGraph::classes_do', 'void', ['pointer']],
+          _ZN20ClassLoaderDataGraph22clean_deallocate_listsEb: ['ClassLoaderDataGraph::clean_deallocate_lists', 'void', ['int']],
+
+          _ZN10JavaThread27thread_from_jni_environmentEP7JNIEnv_: ['JavaThread::thread_from_jni_environment', 'pointer', ['pointer']],
+
+          _ZN8VMThread7executeEP12VM_Operation: ['VMThread::execute', 'void', ['pointer']],
+
+          _ZN11OopMapCache22flush_obsolete_entriesEv: ['OopMapCache::flush_obsolete_entries', 'void', ['pointer']],
+
+          _ZN14NMethodSweeper11force_sweepEv: ['NMethodSweeper::force_sweep', 'void', []],
+          _ZN14NMethodSweeper16sweep_code_cacheEv: ['NMethodSweeper::sweep_code_cache', 'void', []],
+          _ZN14NMethodSweeper17sweep_in_progressEv: ['NMethodSweeper::sweep_in_progress', 'bool', []],
+
+          JVM_Sleep: ['JVM_Sleep', 'void', ['pointer', 'pointer', 'long']]
+        },
+        variables: {
+          // JDK <= 9
+          _ZN18VM_RedefineClasses14_the_class_oopE: function (address) {
+            this.redefineClass = address;
+          },
+          // 9 < JDK < 13
+          _ZN18VM_RedefineClasses10_the_classE: function (address) {
+            this.redefineClass = address;
+          },
+          // JDK < 13
+          _ZN18VM_RedefineClasses25AdjustCpoolCacheAndVtable8do_klassEP5Klass: function (address) {
+            this.doKlass = address;
+          },
+          // JDK >= 13
+          _ZN18VM_RedefineClasses22AdjustAndCleanMetadata8do_klassEP5Klass: function (address) {
+            this.doKlass = address;
+          },
+          _ZTV18VM_RedefineClasses: function (address) {
+            this.vtableRedefineClasses = address;
+          },
+          _ZN18VM_RedefineClasses4doitEv: function (address) {
+            this.redefineClassesDoIt = address;
+          },
+          _ZN18VM_RedefineClasses13doit_prologueEv: function (address) {
+            this.redefineClassesDoItPrologue = address;
+          },
+          _ZN18VM_RedefineClasses13doit_epilogueEv: function (address) {
+            this.redefineClassesDoItEpilogue = address;
+          },
+          _ZN18VM_RedefineClassesD0Ev: function (address) {
+            this.redefineClassesDispose0 = address;
+          },
+          _ZN18VM_RedefineClassesD1Ev: function (address) {
+            this.redefineClassesDispose1 = address;
+          },
+          _ZNK18VM_RedefineClasses26allow_nested_vm_operationsEv: function (address) {
+            this.redefineClassesAllow = address;
+          },
+          _ZNK18VM_RedefineClasses14print_on_errorEP12outputStream: function (address) {
+            this.redefineClassesOnError = address;
+          },
+
+          // JDK >= 17
+          _ZN13InstanceKlass33create_new_default_vtable_indicesEiP10JavaThread: function (address) {
+            this.createNewDefaultVtableIndices = address;
+          },
+          // JDK < 17
+          _ZN13InstanceKlass33create_new_default_vtable_indicesEiP6Thread: function (address) {
+            this.createNewDefaultVtableIndices = address;
+          },
+
+          _ZN19Abstract_VM_Version19jre_release_versionEv: function (address) {
+            const getVersion = new NativeFunction(address, 'pointer', [], nativeFunctionOptions);
+            const versionS = getVersion().readCString();
+            this.version = versionS.startsWith('1.8')
+              ? 8
+              : versionS.startsWith('9.')
+                ? 9
+                : parseInt(versionS.slice(0, 2), 10);
+            this.versionS = versionS;
+          },
+
+          _ZN14NMethodSweeper11_traversalsE: function (address) {
+            this.traversals = address;
+          },
+          _ZN14NMethodSweeper21_sweep_fractions_leftE: function (address) {
+            this.fractions = address;
+          },
+          _ZN14NMethodSweeper13_should_sweepE: function (address) {
+            this.shouldSweep = address;
+          }
+        },
+        optionals: [
+          '_ZN6Method24restore_unshareable_infoEP10JavaThread',
+          '_ZN6Method24restore_unshareable_infoEP6Thread',
+          '_ZN6Method10clear_codeEv',
+          '_ZN6Method10clear_codeEb',
 
-      '_ZN18VM_RedefineClasses19mark_dependent_codeEP13InstanceKlass',
-      '_ZN18VM_RedefineClasses20flush_dependent_codeEv',
-      '_ZN18VM_RedefineClasses20flush_dependent_codeEP13InstanceKlassP6Thread',
-      '_ZN18VM_RedefineClasses20flush_dependent_codeE19instanceKlassHandleP6Thread',
+          '_ZN18VM_RedefineClasses19mark_dependent_codeEP13InstanceKlass',
+          '_ZN18VM_RedefineClasses20flush_dependent_codeEv',
+          '_ZN18VM_RedefineClasses20flush_dependent_codeEP13InstanceKlassP6Thread',
+          '_ZN18VM_RedefineClasses20flush_dependent_codeE19instanceKlassHandleP6Thread',
 
-      '_ZN19ResolvedMethodTable21adjust_method_entriesEPb',
-      '_ZN15MemberNameTable21adjust_method_entriesEP13InstanceKlassPb',
+          '_ZN19ResolvedMethodTable21adjust_method_entriesEPb',
+          '_ZN15MemberNameTable21adjust_method_entriesEP13InstanceKlassPb',
 
-      '_ZN17ConstantPoolCache21adjust_method_entriesEPb',
-      '_ZN17ConstantPoolCache21adjust_method_entriesEP13InstanceKlassPb',
+          '_ZN17ConstantPoolCache21adjust_method_entriesEPb',
+          '_ZN17ConstantPoolCache21adjust_method_entriesEP13InstanceKlassPb',
 
-      '_ZN20ClassLoaderDataGraph22clean_deallocate_listsEb',
+          '_ZN20ClassLoaderDataGraph22clean_deallocate_listsEb',
 
-      '_ZN10JavaThread27thread_from_jni_environmentEP7JNIEnv_',
+          '_ZN10JavaThread27thread_from_jni_environmentEP7JNIEnv_',
 
-      '_ZN14NMethodSweeper11force_sweepEv',
-      '_ZN14NMethodSweeper17sweep_in_progressEv',
+          '_ZN14NMethodSweeper11force_sweepEv',
+          '_ZN14NMethodSweeper17sweep_in_progressEv',
 
-      '_ZN18VM_RedefineClasses14_the_class_oopE',
-      '_ZN18VM_RedefineClasses10_the_classE',
-      '_ZN18VM_RedefineClasses25AdjustCpoolCacheAndVtable8do_klassEP5Klass',
-      '_ZN18VM_RedefineClasses22AdjustAndCleanMetadata8do_klassEP5Klass',
-      '_ZN18VM_RedefineClassesD0Ev',
-      '_ZN18VM_RedefineClassesD1Ev',
-      '_ZNK18VM_RedefineClasses14print_on_errorEP12outputStream',
+          '_ZN18VM_RedefineClasses14_the_class_oopE',
+          '_ZN18VM_RedefineClasses10_the_classE',
+          '_ZN18VM_RedefineClasses25AdjustCpoolCacheAndVtable8do_klassEP5Klass',
+          '_ZN18VM_RedefineClasses22AdjustAndCleanMetadata8do_klassEP5Klass',
+          '_ZN18VM_RedefineClassesD0Ev',
+          '_ZN18VM_RedefineClassesD1Ev',
+          '_ZNK18VM_RedefineClasses14print_on_errorEP12outputStream',
 
-      '_ZN13InstanceKlass33create_new_default_vtable_indicesEiP10JavaThread',
-      '_ZN13InstanceKlass33create_new_default_vtable_indicesEiP6Thread',
+          '_ZN13InstanceKlass33create_new_default_vtable_indicesEiP10JavaThread',
+          '_ZN13InstanceKlass33create_new_default_vtable_indicesEiP6Thread',
 
-      '_ZN14NMethodSweeper21_sweep_fractions_leftE'
-    ]
-  }];
+          '_ZN14NMethodSweeper21_sweep_fractions_leftE'
+        ]
+      }];
 
   const missing = [];
 
@@ -294,10 +336,17 @@ function _getApi () {
   }
   temporaryApi.vm = vms.readPointer();
 
-  const allocatorFunctions = {
-    $new: ['_Znwm', 'pointer', ['ulong']],
-    $delete: ['_ZdlPv', 'void', ['pointer']]
-  };
+  const allocatorFunctions = Process.platform === 'windows'
+    ? {
+        $new: ['??2@YAPEAX_K@Z', 'pointer', ['ulong']],
+        $delete: ['??3@YAXPEAX@Z', 'void', ['pointer']]
+      }
+  // If platform is not Windows
+    : {
+        $new: ['_Znwm', 'pointer', ['ulong']],
+        $delete: ['_ZdlPv', 'void', ['pointer']]
+      };
+
   for (const [name, [rawName, retType, argTypes]] of Object.entries(allocatorFunctions)) {
     let address = Module.findExportByName(null, rawName);
     if (address === null) {

package/lib/mkdex.js

@@ -530,7 +530,7 @@ function computeModel (classes) {
     }
 
     klass.methods.forEach(method => {
-      const [methodName, retType, argTypes, thrownTypes = []] = method;
+      const [methodName, retType, argTypes, thrownTypes = [], accessFlags] = method;
 
       strings.add(methodName);
 
@@ -563,13 +563,13 @@ function computeModel (classes) {
         strings.add('value');
       }
 
-      methods.push([klass.name, protoId, methodName, throwsAnnotationId]);
+      methods.push([klass.name, protoId, methodName, throwsAnnotationId, accessFlags]);
 
       if (methodName === '<init>') {
         superConstructors.add(name + '|' + protoId);
         const superConstructorId = superClass + '|' + protoId;
         if (javaConstructors.has(name) && !superConstructors.has(superConstructorId)) {
-          methods.push([superClass, protoId, methodName, null]);
+          methods.push([superClass, protoId, methodName, null, 0]);
           superConstructors.add(superConstructorId);
         }
       }
@@ -658,12 +658,13 @@ function computeModel (classes) {
   fieldItems.sort(compareFieldItems);
 
   const methodItems = methods.map(method => {
-    const [klass, protoId, name, annotationsId] = method;
+    const [klass, protoId, name, annotationsId, accessFlags] = method;
     return [
       typeToIndex[klass],
       protoToIndex[protoId],
       stringToIndex[name],
-      annotationsId
+      annotationsId,
+      accessFlags
     ];
   });
   methodItems.sort(compareMethodItems);
@@ -719,9 +720,9 @@ function computeModel (classes) {
     const sourceFileIndex = stringToIndex[klass.sourceFileName];
 
     const classMethods = methodItems.reduce((result, method, index) => {
-      const [holder, protoIndex, name, annotationsId] = method;
+      const [holder, protoIndex, name, annotationsId, accessFlags] = method;
       if (holder === classIndex) {
-        result.push([index, name, annotationsId, protoIndex]);
+        result.push([index, name, annotationsId, protoIndex, accessFlags]);
       }
       return result;
     }, []);
@@ -771,8 +772,8 @@ function computeModel (classes) {
       });
     const virtualMethods = compressClassMethodIndexes(classMethods
       .filter(([, name]) => name !== constructorNameIndex)
-      .map(([index]) => {
-        return [index, kAccPublic | kAccNative];
+      .map(([index, , , , accessFlags]) => {
+        return [index, accessFlags | kAccPublic | kAccNative];
       }));
 
     const classData = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frida-java-bridge",
-  "version": "6.3.5",
+  "version": "6.3.7",
   "description": "Java runtime interop from Frida",
   "main": "index.js",
   "files": [