Not compatible with Xposed on ART

[oleavr]

(Continuation of frida/frida#220.)

As described by @hedger:

I'm running Frida 9.1 with target device Wileyfox Swift (arch=a64) running Android 6.0.1 (CM13.1.5). It's on stock ROM with Xposed v87.

I can't make anything Java-related work.

[USB::Wileyfox Wileyfox Swift::com.android.phone]-> Java.available
false

I tried debugging what's happening on Java interface initialization, and found out that
_ZN3art6mirror6Object5CloneEPNS_6ThreadE (art::mirror::Object::Clone(art::Thread*))
is missing from libart.so, but instead there's a function called _ZN3art6mirror6Object5CloneEPNS_6ThreadEm, which demangles to art::mirror::Object::Clone(art::Thread*, unsigned long).
File containing initialization code is built into frida-server binary, so I can't easily debug and test it further.

[hedger]

Can you explain what's the problem with Xposed and had anyone tried resolving it?

[oleavr]

The problem, at least on the surface, is that Xposed changed the signature of art::mirror::Object::Clone(art::Thread*) to add a second argument specifying the size of the object being cloned. We only use this method to clone an ArtMethod object, but, due to the fragmented nature of Android it's pretty tricky to know the size of this object. We currently have some code that detects the offsets of a few fields inside of this struct, and we will have to extend that logic to also compute the size. All of that logic can be found here. So that's the theory, there might be more issues hiding under the surface. Interested in hacking on frida-java? :)

[hedger]

Yes, I'm very interested in making it work on Xposed.
I compared implementations of Object::Clone in ART & XposedART, and it seems that Xposed's version is backwards-compatible with default Android's one.
That is, it has a default value of 0 for num_target_bytes, that enables default ART's logic on determining required size, compared to vanilla code.

So, my opinion is that the only change required to support Xposed is adding a fallback for another export signature and passing 0 to second argument in that case.

[oleavr]

@hedger Awesome find! Could you try making that change to see how it works? Use frida-compile to build an agent for testing where you const Java = require('frida-java'); to use a local version of frida-java. (Run npm link in frida-java and npm link frida-java in your test project using frida-compile to use a local git version.) An example on how to use frida-compile can be found here. You essentially just need a package.json like that one, minus the mjolner dependency (you want frida-java instead), and one agent.js that you tell it to compile. Then just load that into an Android app using the Frida REPL, e.g.: frida -U -n Twitter -l _agent.js

[hedger]

OK thanks, I'll try it out and report if I succeed.

[hedger]

Initial testing shows promising results -- I managed to run patched frida-java and successfully called VM methods.

>frida -U com.android.phone -l myjava.js
     ____
    / _  |   Frida 9.1.0 - A world-class dynamic instrumentation framework
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/

[USB::Wileyfox Wileyfox Swift::com.android.phone]-> rpc.exports.hookJavaMethod()
{
    "_c": [],
    "_d": true,
    "_h": 0,
    "_n": true,
    "_s": 1
}
[USB::Wileyfox Wileyfox Swift::com.android.phone]-> rpc.exports.getHookTriggerCount()
0
[USB::Wileyfox Wileyfox Swift::com.android.phone]-> rpc.exports.callJavaMethod()
...1
...2
...3
...4
host=www.ikke.no
...5
{
    "_c": [],
    "_d": true,
    "_h": 0,
    "_n": true,
    "_s": 1
}
[USB::Wileyfox Wileyfox Swift::com.android.phone]-> rpc.exports.getHookTriggerCount()
1
[USB::Wileyfox Wileyfox Swift::com.android.phone]->

But, if I try to re-run that test on second attach to same process, Frida complains and sometimes even crashes target process.

[USB::Wileyfox Wileyfox Swift::com.android.phone]-> rpc.exports.callJavaMethod()
...1
...2
...3
Error: access violation accessing 0x38
    at getHost (input:1)
    at apply (native)
    at f (repl1.js:1449)
    at repl1.js:5591
    at call (native)
    at getHost (input:1)
{
    "_a": [],
    "_c": [],
    "_d": true,
    "_h": 0,
    "_n": true,
    "_s": 2,
    "_v": {
        "address": "0x7f96e109c4",
        "context": {
            "fp": "0x7f80b1a340",
            "lr": "0x7f969fa63c",
            "pc": "0x7f96e109c4",
            "sp": "0x7f80b1a340",
            "x0": "0x55603015e0",
            "x1": "0x0",
            "x10": "0x7f818692a4",
            "x11": "0x4000",
            "x12": "0x4001",
            "x13": "0x0",
            "x14": "0x1",
            "x15": "0x1000000",
            "x16": "0x7f7fd2c888",
            "x17": "0x0",
            "x18": "0x13",
            "x19": "0x8",
            "x2": "0x8",
            "x20": "0x55603015e0",
            "x21": "0x0",
            "x22": "0x706fe120",
            "x23": "0x7f80b1a578",
            "x24": "0x7f80b1a648",
            "x25": "0x7f80b1a668",
            "x26": "0x706fe120",
            "x27": "0x70d48be4",
            "x28": "0x7f80b1a3a0",
            "x3": "0x55603015e0",
            "x4": "0xffffffffffffffff",
            "x5": "0x7f80b18980",
            "x6": "0x0",
            "x7": "0x20020",
            "x8": "0x0",
            "x9": "0x27fe"
        },
        "memory": {
            "address": "0xb",
            "operation": "read"
        },
        "nativeContext": "0x0",
        "type": "access-violation"
    }
}
Unhandled promise rejection Error: access violation accessing 0xb

That happens on call to Java method.

  callJavaMethod() {
    return performOnJavaVM(() => {
      console.log("...1");
      const URL = Java.use('java.net.URL');

      console.log("...2");
      const url = URL.$new('http://www.ikke.no/');
      console.log("...3");
      const host = url.getHost();
      console.log("...4");
      console.log('host=' + host);
      console.log("...5");
    });
  },

[hedger]

Can you try running a similar test on a non-Xposed device to make out if that's Frida's issue or a problem with Xposed?

[hedger]

Here are my changes.
They should support both original ART and Xposed.
But still, I get crashes on re-attaching and calling Java methods.

[hedger]

I submitted a separate issue about those crashes, #11.
I tested it on another device running same firmware, but without Xposed.

[oleavr]

Thanks, that's awesome news!

[hedger]

I believe this can be closed now, crashes are a separate issue #11 .

[oleavr]

👍