ByteHook v1.1.2

Announcement

1. Added compatibility with Android 17.

• Supported Android OS versions: Android 4.1 - 17 QPR1 Beta 4.

Bug Fixes

1. Fixed a bug where threads could not enter the shared-mode proxy function after executing pthread_key_clean_all().

• In the bionic pthread implementation, pthread_exit() is called during thread termination; this invokes pthread_key_clean_all(), which performs four rounds of TLS cleanup. After pthread_key_clean_all() returns, pthread_exit() proceeds to call functions like munmap().
• Automatic-mode proxy functions rely on TLS to store context information, but bytehook's own TLS data was being cleared during the first round of pthread_key_clean_all(). If the proxy function was entered after this point, the original automatic-mode logic could no longer function correctly. To minimize potential side effects, the previous approach was to skip the "proxy function" and call the "original function" directly.
• Scope of impact: In addition to the munmap() call within pthread_exit(), this also covers functions called by any TLS destructor functions executed during the final three rounds of TLS cleanup.

2. Fixed a bug causing occasional crashes during unhooking.

• This bug was caused by a use-after-free issue in the bh_switch module; although the timing window was extremely narrow, crashes did occur.

3. Fixed a bug that could cause the entire bytehook functionality to fail.

• In previous versions, calling bytehook_add_dlopen_callback() before bytehook initialization would fail, but it would corrupt internal global state values, causing subsequent hooking attempts to fail even after bytehook was initialized.

Improvements

1. Optimized specific atomic operations and memory ordering.

• In previous versions, the implementation of certain atomic operations and memory ordering was imprecise; in isolated cases, this could theoretically lead to issues on the arm64 architecture.

公告

1. 兼容 Android 17。

• 支持的 Android OS 版本：Android 4.1 - 17 QPR1 Beta 4。

Bugs 修复

1. 修复了线程执行 pthread_key_clean_all() 之后无法进入 shared 模式代理函数的 bug。

• 在 bionic pthread 实现中，线程退出过程中会执行 pthread_exit()，其中会调用 pthread_key_clean_all()，这个函数中会执行 4 轮清理 TLS 的操作。pthread_key_clean_all() 返回后，pthread_exit() 还会继续调用 munmap() 等操作。
• automatic 模式的代理函数需要通过 TLS 保存上下文信息，bytehook 自身的 TLS 会在 pthread_key_clean_all() 的第 1 轮就被清理掉。此时如果再进入代理函数，automatic 模式的原有逻辑已经不可继续，为了最小化可能产生的副作用，之前的做法是跳过“代理函数”直接调用“原函数”。
• 影响范围：除了 pthread_exit() 中的 munmap() 以外，还包括 TLS 的后 3 轮清理中调用的所有 TLS 销毁函数（destructor function）中调用的其他函数。

2. 修复了一个 unhook 时偶发的崩溃 bug。

• 这个 bug 是 bh_switch 模块中的 use-after-free 问题导致的，虽然时间窗口极小，但是确实会发生崩溃。

3. 修复了一个可能导致 bytehook 整体功能失效的 bug。

• 在之前的版本中，如果在 bytehook 初始化之前调用 bytehook_add_dlopen_callback()，这个调用显然不会成功，但是却污染了 bytehook 内部的一些全局状态的值，导致之后 bytehook 初始化后再 hook 也都会失败。

改进

1. 优化了部分 atomic 操作以及 memory order。

• 在之前的版本中，部分 atomic 操作以及 memory order 是不严谨了，个别在 arm64 中理论上会存在问题。