zsshen / probedroid Goto Github PK

I try to use your approach to hook some Android APIs in Android 8. I have made some version adjustment. But the Android API cannot be hooked successfully after entry_point_from_quick_compiled_code_ is modified to be ArtQuickInstrumentTrampoline. Before hooking, I checked the value of entry_point_from_quick_compiled_code_ in an ArtMethod and found it points to art_quick_to_interpreter_bridge which could mean that my system is running in interpreter mode. Do you know how to solve the problem?

The instrument dex file name contains some bad character, e.g. "/data/data/it.polictf2015/instrument/app-debug((�.dex".
As the result, the jni will crashes and the app ends.
The related log is list below:

04-28 15:47:05.242 3426-3426/? W/linker: libProbeDroid.so has text relocations. This is wasting memory and prevents security hardening. Please fix.
04-28 15:47:05.242 3426-3426/? D/ProbeDroid: (I) [/home/re/ProbeDroid/engine/jni/boot.cc:451] Instrument Bootstrap, pid=3426
04-28 15:47:05.244 3426-3439/? D/ProbeDroid: (E) [/home/re/ProbeDroid/engine/jni/boot.cc:224] idx_bgn a635205b
04-28 15:47:05.244 3426-3439/? D/ProbeDroid: (E) [/home/re/ProbeDroid/engine/jni/boot.cc:225] idx_end a6352063
04-28 15:47:05.244 3426-3439/? D/ProbeDroid: (E) [/home/re/ProbeDroid/engine/jni/boot.cc:226] idx_bgn app-debug((�
04-28 15:47:05.254 938-938/? I/art: Explicit concurrent mark sweep GC freed 5(160B) AllocSpace objects, 0(0B) LOS objects, 90% free, 110KB/1134KB, paused 23.817ms total 33.020ms
04-28 15:47:05.272 3426-3439/? A/art: art/runtime/check_jni.cc:65] JNI DETECTED ERROR IN APPLICATION: input is not valid Modified UTF-8: illegal start byte 0xa6
04-28 15:47:05.272 3426-3439/? A/art: art/runtime/check_jni.cc:65] string: '/data/data/it.polictf2015/instrument/app-debug((�.dex'
04-28 15:47:05.272 3426-3439/? A/art: art/runtime/check_jni.cc:65] in call to NewStringUTF
04-28 15:47:05.272 3426-3439/? A/art: art/runtime/check_jni.cc:65] "Thread-330" prio=5 tid=9 Runnable
04-28 15:47:05.272 3426-3439/? A/art: art/runtime/check_jni.cc:65] | group="main" sCount=0 dsCount=0 obj=0x12c59080 self=0xad48b000
04-28 15:47:05.272 3426-3439/? A/art: art/runtime/check_jni.cc:65] | sysTid=3439 nice=0 cgrp=apps sched=0/0 handle=0xb4556a80
04-28 15:47:05.272 3426-3439/? A/art: art/runtime/check_jni.cc:65] | state=R schedstat=( 0 0 0 ) utm=0 stm=0 core=0 HZ=100
04-28 15:47:05.273 3426-3439/? A/art: art/runtime/check_jni.cc:65] | stack=0xa6187000-0xa6189000 stackSize=1012KB
04-28 15:47:05.273 3426-3439/? A/art: art/runtime/check_jni.cc:65] | held mutexes= "mutator lock"(shared held)

The instrument apk generated by Android Studio 2.0 with default settings is quite bloated,

which includes some unnecessary supporting libraries.

Also, the new instant run feature will produce apk with a stub class to load the real content of apk.

Such stub class cannot be recognized by ProbeDroid engine.

For this issue, I will list down the correct build steps to:

1. Turn off instant run.
2. Shrink the package size.

For ARM eabi-v7a,

r9 should hold the pointer to TLS.

But it seems to store meaningless information in the AVD.

Thus ProbeDroid will crash when it tries to resolve TLS for some exception deliver methods.

On OS X, I try to build the libProbeDroid.so
Everything is fine until the linker get error

[x86] Compile : ProbeDroid <= debug.c ... [x86] Compile++ : ProbeDroid <= org_probedroid_instrument.cc [x86] SharedLibrary : libProbeDroid.so /IGNORED_PATH/../../../../i686-linux-android/bin/ld: warning: shared library text segment is not shareable /IGNORED_PATH/i686-linux-android/bin/ld: error: treating warnings as errors collect2: error: ld returned 1 exit status make: *** [/..../ProbeDroid/engine/obj/local/x86/libProbeDroid.so] Error 1

Some one suggested that adding
LOCAL_LDFLAGS := --no-warn-shared-textrel

However, it is not helpful under my environment. I am using ndk-r11, and get the following message

[x86] SharedLibrary : libProbeDroid.so i686-linux-android-g++: error: unrecognized command line option '--no-warn-shared-textrel' make: *** [/.../ProbeDroid/engine/obj/local/x86/libProbeDroid.so] Error 1

Should the compile flag add -fPIC ? or any idea?