dexlib2 exception when parsing method instructions

[mingyuan-xia]

Encounter dexlib2 exception when reading through method instructions.

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 27700
    at org.jf.dexlib2.builder.MutableMethodImplementation.mapCodeAddressToIndex(MutableMethodImplementation.java:476)
    at org.jf.dexlib2.builder.MutableMethodImplementation.newLabel(MutableMethodImplementation.java:530)
    at org.jf.dexlib2.builder.MutableMethodImplementation.newBuilderInstruction22t(MutableMethodImplementation.java:792)
    at org.jf.dexlib2.builder.MutableMethodImplementation.convertAndSetInstruction(MutableMethodImplementation.java:608)
    at org.jf.dexlib2.builder.MutableMethodImplementation.<init>(MutableMethodImplementation.java:94)

This is caused by an illegal if instruction which tries to jump to a place far beyond the end of the function.

.class public La/_;
.super Ljava/lang/Object;
.source "a.java"


# virtual methods
.method public a()V
    .registers 2

    .prologue
    .line 5
    or-int/2addr v0, p11

    if-gt p4, p14, :cond_6c34

    .line 6
    .local v0, "i":I
    nop

    nop

    .line 7
    return-void
    :cond_6c34
.end method

The exception can be reproduced on dexlib2 2.1.0 and the latest 2.1.2.
If needed I can provide the APK sample.

[JesusFreke]

Does the rest of the file disassemble correctly though? Or does this error cause disassembly to abort early, so the rest doesn't get disassembled?

[JesusFreke]

Oh, you're using dexlib2 directly, nevermind.

This seems mostly WAI. The class is invalid and can't be used on android. It's common for obfuscators to include nonsense classes like this, which aren't (and can't be) actually used for anything. You should ignore classes that are not able to be processed like this. (e.g. this is what baksmali does)

The "real" solution here is to implement full verification of the dex file, so that more meaningful errors can be returned. It's on my list, but not very high on it :). It will be a huge amount of work to fully verify a dex file.

It would be possible to check for this specific condition and provide a better error of course, but without full verification, there are a nearly limitless variety of these kinds of errors, and it would just be a game of whack-a-mole.

[mingyuan-xia]

Thanks a lot for the quick response. We suspect the problem is with obfuscators too. We are working on a binary rewriter based on dexlib2 now. Now we just spill out all method instructions if one of them happens to be invalid.
I guess we would have quite a lot further questions to bother you =P.