[Android 13] Constant soft-loops on Pixel 7 Pro with stock ROM

[enovella]

Problem

Frida produces constant soft-loops on Android 13 & Pixel 7 Pro. There are so many soft-loops all the time to the point of not being able to use it for hooking.

Setup

Device

• Frida server : 16.1.11
• Android OS: 13
• Device: Pixel 7 Pro
• Device Fingerprint: google/cheetah/cheetah:13/TQ3A.230605.012/10204971:user/release-keys
• Root: KernelSU with no modules loaded (Magisk should work in the same manner)

Host

• Macbook Pro M1 with latest software & Frida over USB
• Windows 10/11 under WSL2 & Frida over TCP/IP

Reproduce

• Switch off device
• Turn it on again
• Run logcat in a shell
• Run Frida server as root in another shell (via USB or TCP/IP)
• Wait for the soft-loop, if it wouldn't occur, just spawn an app
• Observe the logs

Note that Frida crashes even more regularly when using Magisk modules that also inject into Zygote: Magisk built-in Zygisk (NativeBridge- and LD_PRELOAD-based zygote injection) / KernelSU ZygiskNext (ptrace-based zygote injection)

$ adb shell
cheetah:/data/local/tmp # ./frida-server-16.1.11-android-arm64 -D

$ frida-trace -U -f com.google.android.calendar -i open
$ frida-trace -H 127.0.0.1:27042 -f com.google.android.calendar -i open

Logs

F zygote64: runtime.cc:782] Failed to reach single-threaded state
F zygote64: runtime.cc:691] Runtime aborting...
F zygote64: runtime.cc:691] Skipping all-threads dump as locks are held: thread_suspend_count_lock
F zygote64: runtime.cc:691] Aborting thread:
F zygote64: runtime.cc:691] "main" prio=5 tid=1 Native
F zygote64: runtime.cc:691]   | group="" sCount=0 ucsCount=0 flags=0 obj=0x71b70008 self=0xb400007615a39010
F zygote64: runtime.cc:691]   | sysTid=821 nice=0 cgrp=system sched=0/0 handle=0x77615504f8
F zygote64: runtime.cc:691]   | state=R schedstat=( 2922795758 2167895107 3551 ) utm=63 stm=228 core=5 HZ=100
F zygote64: runtime.cc:691]   | stack=0x7ff8bc2000-0x7ff8bc4000 stackSize=8188KB
F zygote64: runtime.cc:691]   | held mutexes= "abort lock" "thread list lock" "mutator lock"(shared held)
F zygote64: runtime.cc:691]   native: #00 pc 004bca80  /apex/com.android.art/lib64/libart.so (art::DumpNativeStack+108) (BuildId: 735f12f804f88d62a2cb437261076ff7)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#1 pc 004b0dd4  /apex/com.android.art/lib64/libart.so (art::Thread::DumpStack const+388) (BuildId: 735f12f804f88d62a2cb437261076ff7)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#2 pc 00779c60  /apex/com.android.art/lib64/libart.so (art::AbortState::DumpThread const+104) (BuildId: 735f12f804f88d62a2cb437261076ff7)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#3 pc 007720c8  /apex/com.android.art/lib64/libart.so (art::Runtime::Abort+2384) (BuildId: 735f12f804f88d62a2cb437261076ff7)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#4 pc 000357d0  /apex/com.google.mainline.primary.libs@341177000/lib64/libbase.so/75d3253827fcfd7a8d7b02ad45991611ec4ca424c0278e13e8acfad4d14e597a3ecff6c0caa2b785c73838528ee6e9c2b313240ff895f50ee39b1d7bc10f390a/libbase.so (android::base::SetAborter::$_0::__invoke+80) (BuildId: 6f67f69ff36b970d0b831cfdab3b578d)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#5 pc 00034d58  /apex/com.google.mainline.primary.libs@341177000/lib64/libbase.so/75d3253827fcfd7a8d7b02ad45991611ec4ca424c0278e13e8acfad4d14e597a3ecff6c0caa2b785c73838528ee6e9c2b313240ff895f50ee39b1d7bc10f390a/libbase.so (android::base::LogMessage::~LogMessage+352) (BuildId: 6f67f69ff36b970d0b831cfdab3b578d)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#6 pc 004e6304  /apex/com.android.art/lib64/libart.so (art::Runtime::PreZygoteFork+1824) (BuildId: 735f12f804f88d62a2cb437261076ff7)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#7 pc 004e5b50  /apex/com.android.art/lib64/libart.so (art::ZygoteHooks_nativePreFork +56) (BuildId: 735f12f804f88d62a2cb437261076ff7)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#8 pc 00303cf0  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (art_jni_trampoline+112)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#9 pc 005a69b0  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (dalvik.system.ZygoteHooks.preFork+128)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#10 pc 00c577d0  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (com.android.internal.os.ZygoteConnection.processCommand+960)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#11 pc 00c5ece8  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (com.android.internal.os.ZygoteServer.runSelectLoop+2968)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#12 pc 00c5a388  /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (com.android.internal.os.ZygoteInit.main+3288)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#13 pc 0033f080  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+640) (BuildId: 735f12f804f88d62a2cb437261076ff7)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#14 pc 004e1ea8  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeWithVarArgs<_jmethodID*>+728) (BuildId: 735f12f804f88d62a2cb437261076ff7)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#15 pc 0057b930  /apex/com.android.art/lib64/libart.so (art::JNI<true>::CallStaticVoidMethodV+156) (BuildId: 735f12f804f88d62a2cb437261076ff7)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#16 pc 000bcce8  /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod+120) (BuildId: 48435380059f74cde3db281c74576169)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#17 pc 000c8bf8  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start+840) (BuildId: 48435380059f74cde3db281c74576169)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#18 pc 00002560  /system/bin/app_process64 (main+1280) (BuildId: 6f97a590777bd06f31784c7272763a35)
F zygote64: runtime.cc:691]   native: frida/frida-java-bridge#19 pc 0004b600  /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+96) (BuildId: dc4001c2ef2dfc23467040797a96840c)
F zygote64: runtime.cc:691]   at dalvik.system.ZygoteHooks.nativePreFork(Native method)
F zygote64: runtime.cc:691]   at dalvik.system.ZygoteHooks.preFork(ZygoteHooks.java:164)
F zygote64: runtime.cc:691]   at com.android.internal.os.ZygoteConnection.processCommand(ZygoteConnection.java:286)
F zygote64: runtime.cc:691]   at com.android.internal.os.ZygoteServer.runSelectLoop(ZygoteServer.java:552)
F zygote64: runtime.cc:691]   at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:923)
F zygote64: runtime.cc:691]
W main    : type=1400 audit(0.0:26604): avc: denied { sys_nice } for capability=23 scontext=u:r:zygote:s0 tcontext=u:r:zygote:s0 tclass=capability permissive=0
W zigqm   : type=1400 audit(0.0:26605): avc: denied { sys_nice } for capability=23 scontext=u:r:zygote:s0 tcontext=u:r:zygote:s0 tclass=capability permissive=0
--------- beginning of crash
F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
F DEBUG   : Build fingerprint: 'google/cheetah/cheetah:13/TQ3A.230605.012/10204971:user/release-keys'
F DEBUG   : Revision: 'MP1.0'
F DEBUG   : ABI: 'arm64'
F DEBUG   : Timestamp: 2024-01-15 10:04:40.344992218+0000
F DEBUG   : Process uptime: 311s
F DEBUG   : Cmdline: zygote64
F DEBUG   : pid: 821, tid: 821, name: main  >>> zygote64 <<<
F DEBUG   : uid: 0
F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
F DEBUG   : Abort message: 'Failed to reach single-threaded state'
F DEBUG   :     x0  0000000000000000  x1  0000000000000335  x2  0000000000000006  x3  0000007ff93be020
F DEBUG   :     x4  00000000000008b1  x5  00000000000008b1  x6  00000000000008b1  x7  00000000000008b1
F DEBUG   :     x8  00000000000000f0  x9  000000775c7909e0  x10 0000000000000001  x11 000000775c7d2370
F DEBUG   :     x12 000000000000388c  x13 000000007fffffff  x14 000000000002650e  x15 00000001de478f6a
F DEBUG   :     x16 000000775c83fd50  x17 000000775c81aeb0  x18 0000007760518000  x19 0000000000000335
F DEBUG   :     x20 0000000000000335  x21 00000000ffffffff  x22 b400007565a6a7f0  x23 00000074a44a3439
F DEBUG   :     x24 0000000000000004  x25 0000000000000001  x26 0000000000000000  x27 00000074a5016000
F DEBUG   :     x28 b4000074c5a51b60  x29 0000007ff93be0a0
F DEBUG   :     lr  000000775c7c21c8  sp  0000007ff93be000  pc  000000775c7c21f4  pst 0000000000001000
F DEBUG   : backtrace:
F DEBUG   :       #00 pc 00000000000531f4  /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) (BuildId: dc4001c2ef2dfc23467040797a96840c)
F DEBUG   :       frida/frida-java-bridge#1 pc 0000000000000108  <anonymous:7758cef000>
W NativeCrashListener: Couldn't find ProcessRecord for pid 821
E crash_dump64: AM data write failed: Broken pipe
E tombstoned: Tombstone written to: tombstone_25
E NativeTombstoneManager: Tombstone's UID (0) not an app, ignoring
E NativeTombstoneManager: Tombstone's UID (0) not an app, ignoring
E ZygoteProcess: IO Exception while communicating with Zygote - java.io.EOFException
E ZygoteProcess: Starting VM process through Zygote failed
E ActivityManager: Failure starting process com.google.android.calendar
E ActivityManager: java.lang.RuntimeException: Starting VM process through Zygote failed
E ActivityManager:       at android.os.ZygoteProcess.start(ZygoteProcess.java:381)
E ActivityManager:       at android.os.Process.start(Process.java:734)
E ActivityManager:       at android.os.Process.start(Native Method)
E ActivityManager:       at com.android.server.am.ProcessList.startProcess(ProcessList.java:2318)
E ActivityManager:       at com.android.server.am.ProcessList.lambda$handleProcessStart$1(ProcessList.java:1972)
E ActivityManager:       at com.android.server.am.ProcessList.$r8$lambda$yAUAM7lp-U4rR1kIWsGK9Z-eFWc(Unknown Source:0)
E ActivityManager:       at com.android.server.am.ProcessList$$ExternalSyntheticLambda4.run(Unknown Source:22)
E ActivityManager:       at com.android.server.am.ProcessList.handlePredecessorProcDied(ProcessList.java:2059)
E ActivityManager:       at com.android.server.am.ProcessList.-$$Nest$mhandlePredecessorProcDied(Unknown Source:0)
E ActivityManager:       at com.android.server.am.ProcessList$ProcStartHandler.handleMessage(ProcessList.java:2035)
E ActivityManager:       at android.os.Handler.dispatchMessage(Handler.java:106)
E ActivityManager:       at android.os.Looper.loopOnce(Looper.java:201)
E ActivityManager:       at android.os.Looper.loop(Looper.java:288)
E ActivityManager:       at android.os.HandlerThread.run(HandlerThread.java:67)
E ActivityManager:       at com.android.server.ServiceThread.run(ServiceThread.java:44)
E ActivityManager: Caused by: android.os.ZygoteStartFailedEx: java.io.EOFException
E ActivityManager:       at android.os.ZygoteProcess.attemptZygoteSendArgsAndGetResult(ZygoteProcess.java:488)
E ActivityManager:       at android.os.ZygoteProcess.zygoteSendArgsAndGetResult(ZygoteProcess.java:460)
E ActivityManager:       at android.os.ZygoteProcess.startViaZygote(ZygoteProcess.java:787)
E ActivityManager:       at android.os.ZygoteProcess.start(ZygoteProcess.java:372)
E ActivityManager:       ... 14 more
E ActivityManager: Caused by: java.io.EOFException
E ActivityManager:       at java.io.DataInputStream.readFully(DataInputStream.java:205)
E ActivityManager:       at java.io.DataInputStream.readInt(DataInputStream.java:394)
E ActivityManager:       at android.os.ZygoteProcess.attemptZygoteSendArgsAndGetResult(ZygoteProcess.java:476)
E ActivityManager:       ... 17 more
I ActivityManager: Force stopping com.google.android.calendar appid=10199 user=0: start failure
I WindowManager:   Force removing ActivityRecord{dc93827 u0 com.google.android.calendar/com.android.calendar.AllInOneActivity} t7}
W UsageStatsService: Unexpected activity event reported! (com.google.android.calendar/com.android.calendar.event.LaunchInfoActivity event : 23 instanceId : 160799462)
D vold    : Aborting fuse connection entry /sys/fs/fuse/connections/114/abort
W vold    : Skip fsync /sys/fs/fuse/connections/114/abort on a file system does not support synchronization: Invalid argument
W AudioSystem: AudioFlinger server died!
W AudioSystem: AudioPolicyService server died!

Another

F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
F DEBUG   : Build fingerprint: 'google/cheetah/cheetah:13/TQ3A.230605.012/10204971:user/release-keys'
F DEBUG   : Revision: 'MP1.0'
F DEBUG   : ABI: 'arm64'
W GoogleTagManager: Exception sending hit: UnknownHostException
F DEBUG   : Timestamp: 2024-01-15 10:58:08.377753467+0000
F DEBUG   : Process uptime: 1545s
W GoogleTagManager: Unable to resolve host "www.googleadservices.com": No address associated with hostname
F DEBUG   : Cmdline: zygote64
F DEBUG   : pid: 17462, tid: 17462, name: main  >>> zygote64 <<<
F DEBUG   : uid: 0
F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
F DEBUG   : Abort message: 'Failed to reach single-threaded state'
F DEBUG   :     x0  0000000000000000  x1  0000000000004436  x2  0000000000000006  x3  0000007ffec9c100
F DEBUG   :     x4  0000000000000a6e  x5  0000000000000a6e  x6  0000000000000a6e  x7  0000000000000a6e
F DEBUG   :     x8  00000000000000f0  x9  00000075164a69e0  x10 0000000000000001  x11 00000075164e8370
F DEBUG   :     x12 0000000000004a7e  x13 000000007fffffff  x14 00000000000d4222  x15 0000000b23585ac4
F DEBUG   :     x16 0000007516555d50  x17 0000007516530eb0  x18 000000751c184000  x19 0000000000004436
F DEBUG   :     x20 0000000000004436  x21 00000000ffffffff  x22 b40000732be64770  x23 00000072666a3439
F DEBUG   :     x24 000000000000000b  x25 0000000000000001  x26 0000000000000000  x27 0000007267216000
F DEBUG   :     x28 b40000728be466e0  x29 0000007ffec9c180
F DEBUG   :     lr  00000075164d81c8  sp  0000007ffec9c0e0  pc  00000075164d81f4  pst 0000000000001000
F DEBUG   : backtrace:
F DEBUG   :       #00 pc 00000000000531f4  /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) (BuildId: dc4001c2ef2dfc23467040797a96840c)
F DEBUG   :       frida/frida-java-bridge#1 pc 0000000000000108  <anonymous:750fb23000>
E AppZygote: Error connecting to app zygote
E AppZygote: java.lang.RuntimeException: Starting child-zygote through Zygote failed
E AppZygote:     at android.os.ZygoteProcess.startChildZygote(ZygoteProcess.java:1325)
E AppZygote:     at android.os.AppZygote.connectToZygoteIfNeededLocked(AppZygote.java:114)
E AppZygote:     at android.os.AppZygote.getProcess(AppZygote.java:79)
E AppZygote:     at com.android.server.am.ProcessList.startProcess(ProcessList.java:2308)
E AppZygote:     at com.android.server.am.ProcessList.lambda$handleProcessStart$1(ProcessList.java:1972)
E AppZygote:     at com.android.server.am.ProcessList.$r8$lambda$yAUAM7lp-U4rR1kIWsGK9Z-eFWc(Unknown Source:0)
E AppZygote:     at com.android.server.am.ProcessList$$ExternalSyntheticLambda4.run(Unknown Source:22)
E AppZygote:     at com.android.server.am.ProcessList.handleProcessStart(ProcessList.java:1998)
E AppZygote:     at com.android.server.am.ProcessList.lambda$startProcessLocked$0(ProcessList.java:1938)
E AppZygote:     at com.android.server.am.ProcessList.$r8$lambda$oBmDYaH718rbQmtZhkdQqDR_vGQ(Unknown Source:0)
E AppZygote:     at com.android.server.am.ProcessList$$ExternalSyntheticLambda2.run(Unknown Source:22)
E AppZygote:     at android.os.Handler.handleCallback(Handler.java:942)
E AppZygote:     at android.os.Handler.dispatchMessage(Handler.java:99)
E AppZygote:     at android.os.Looper.loopOnce(Looper.java:201)
E AppZygote:     at android.os.Looper.loop(Looper.java:288)
E AppZygote:     at android.os.HandlerThread.run(HandlerThread.java:67)
E AppZygote:     at com.android.server.ServiceThread.run(ServiceThread.java:44)
E AppZygote: Caused by: android.os.ZygoteStartFailedEx: java.io.EOFException
E AppZygote:     at android.os.ZygoteProcess.attemptZygoteSendArgsAndGetResult(ZygoteProcess.java:488)
E AppZygote:     at android.os.ZygoteProcess.zygoteSendArgsAndGetResult(ZygoteProcess.java:460)
E AppZygote:     at android.os.ZygoteProcess.startViaZygote(ZygoteProcess.java:787)
E AppZygote:     at android.os.ZygoteProcess.startChildZygote(ZygoteProcess.java:1315)
E AppZygote:     ... 16 more
E AppZygote: Caused by: java.io.EOFException
E AppZygote:     at java.io.DataInputStream.readFully(DataInputStream.java:205)
E AppZygote:     at java.io.DataInputStream.readInt(DataInputStream.java:394)
E AppZygote:     at android.os.ZygoteProcess.attemptZygoteSendArgsAndGetResult(ZygoteProcess.java:476)
E AppZygote:     ... 19 more

[k0ngoz]

I'm fighting the same error, across two different devices now. Any progress on your end?

[enovella]

Hi @k0ngoz,

I also found the same error in many other devices. Could you please describe your setup as I did above? Olé is aware of this ticket, hopefully we can fix it soon. Thanks for your help!

[LicketySpliket]

Also getting these soft-loops on google/bramble/bramble:14/UP1A.231105.001/10817346:user/release-keys with a Mac M1.

01-23 16:59:12.475 15189 15189 F DEBUG   : Build fingerprint: 'google/bramble/bramble:14/UP1A.231105.001/10817346:user/release-keys'
01-23 16:59:12.475 15189 15189 F DEBUG   : Revision: 'MP1.0'
01-23 16:59:12.475 15189 15189 F DEBUG   : ABI: 'arm64'
01-23 16:59:12.475 15189 15189 F DEBUG   : Timestamp: 2024-01-23 16:59:12.236285681-0500
01-23 16:59:12.475 15189 15189 F DEBUG   : Process uptime: 145s
01-23 16:59:12.475 15189 15189 F DEBUG   : Cmdline: zygote64
01-23 16:59:12.475 15189 15189 F DEBUG   : pid: 6563, tid: 6563, name: main  >>> zygote64 <<<
01-23 16:59:12.475 15189 15189 F DEBUG   : uid: 0
01-23 16:59:12.475 15189 15189 F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
01-23 16:59:12.475 15189 15189 F DEBUG   : Abort message: 'Failed to reach single-threaded state'
01-23 16:59:12.475 15189 15189 F DEBUG   :     x0  0000000000000000  x1  00000000000019a3  x2  0000000000000006  x3  0000007fc313d520
01-23 16:59:12.475 15189 15189 F DEBUG   :     x4  0000000000000a6e  x5  0000000000000a6e  x6  0000000000000a6e  x7  7f7f7f7f7f7f7f7f
01-23 16:59:12.475 15189 15189 F DEBUG   :     x8  00000000000000f0  x9  000000727dad4090  x10 0000000000000001  x11 000000727db1a058
01-23 16:59:12.475 15189 15189 F DEBUG   :     x12 0000000000005179  x13 000000000000025b  x14 0000007fc313c330  x15 0000000000000000
01-23 16:59:12.475 15189 15189 F DEBUG   :     x16 000000727db7ed08  x17 000000727db5be90  x18 00000072843ba000  x19 00000000000019a3
01-23 16:59:12.475 15189 15189 F DEBUG   :     x20 00000000000019a3  x21 00000000ffffffff  x22 b4000070d99926b0  x23 0000006fc5111439
01-23 16:59:12.475 15189 15189 F DEBUG   :     x24 0000000000000004  x25 0000000000000001  x26 0000000000000000  x27 0000006fc5c84000
01-23 16:59:12.475 15189 15189 F DEBUG   :     x28 b40000707996f6a0  x29 0000007fc313d5a0
01-23 16:59:12.475 15189 15189 F DEBUG   :     lr  000000727db0b9b8  sp  0000007fc313d500  pc  000000727db0b9e4  pst 0000000000001000
01-23 16:59:12.475 15189 15189 F DEBUG   : 2 total frames
01-23 16:59:12.475 15189 15189 F DEBUG   : backtrace:
01-23 16:59:12.475 15189 15189 F DEBUG   :       #00 pc 00000000000599e4  /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) (BuildId: c74277f481a383c87215b672f6465e24)
01-23 16:59:12.475 15189 15189 F DEBUG   :       frida/frida-java-bridge#1 pc 0000000000000208  <anonymous:727d3fd000>

[enovella]

Older Frida version frida-server-16.0.18-android-arm64 produces this log:

ERROR: Java API only partially available; please file a bug. Missing: _ZNK3art6Thread13DecodeJObjectEP8_jobject
ERROR: Cannot spawn: Java API only partially available; please file a bug. Missing: _ZNK3art6Thread13DecodeJObjectEP8_jobject

Frida versions frida-server >= 16.1.3 produces either the same log mentioned above or just reboot.

Conclusion, we can use older Frida versions so we'd dig deeper into this issue.

[Ch0pin]

same here...

[enovella]

same here...

Could you also share your setup?

[Ch0pin]

Device
Frida server : 16.1.11
Android OS: 13 (same issue in version 12 too)
Device: Pixel 7
Device Fingerprint: [google/barbet/barbet:13/TQ3A.230901.001/10750268:user/release-keys]
Root: KernelSU with no modules loaded

Host
Macbook Pro M1 with latest software & Frida over USB