hooking things in system_server crashes #8
Comments
|
I had the same issue with simple hook on the system_server...on the Note I I 4.4.2... |
|
I can post the example I wrote but it is simple to just try using the strmon example (known to work on applications) on system_server. Collin said that he suspects it might be a concurrency issue. The strmon hook will work several times but eventually crash system_server. Similarly, if you hook any method that is called frequently in system_server, a similar crash occurs. Fault address resolves the same each time, and the shared library is not in the backtrace. |
|
debuggerd snippet below from strmon: |
|
I think the issue is that the un-patching in I believe I've got it isolated in this sample ( If I'm right about the cause, I can think of fixes to try: a) forgo the un-patching and invoke the original method through Dalvik directly instead of JNI (assuming Dalvik itself can handle the method being not actually installed), b) find something that can be atomically patched (worst case might be a pointer to the entire class definition), c) reorder the patching/unpatching to try to minimize the severity of being interrupted, and recover from errors if they happen, d) patch Dalvik, or re-use existing features ("synchronized"?), to obtain a mutex on the method definition before reading or writing it. |
|
Here is a rough draft of a fix that works for me. It's mostly tested against my sample above, but at the end I ran strmon in system_server without crashing, at least not within the few minutes I let it run, which is much better than it is without that patch. I found that the JNI I made Side note: I can't inject system_server if it's been running awhile; the injection reports it worked but the native side of the library doesn't appear to be called. I had to kill it and then inject the replacement process. I assume this is another issue, maybe specific to system_server. |
|
The patch by @scintill seems to have addressed my issues and I tested it with various hooks in system_server. Unless anyone else has issues with the patch, I think it should be pulled in. |
|
To be pulled, I think it should at least free what it mallocs, be tested on static methods, and properly delete/move the code in dalvik_prepare() and _postcall() instead of returning. Also, I'm kind of nervous about the Method struct growing, and causing access violations or incorrect behavior when an incomplete copy is used by Dalvik, so it would be nice to find a clean way to know what the correct Has anyone hooked a static method? If it's not possible right now, then at least it's not a regression if my method doesn't work for that either. |
According to @odexcide on Twitter, when hooking things in system_server, ddi always crashes even with a pass through hook.
The conversation started here but moved to Collin's private email. The following is the part that precedes the move to private email.
<@odexcide> @jduck @collinrm Have u been able to hook system_server successfully w/ DDI? Always crashes even with a pass through hook for me.
<@collinrm> @odexcide @jduck what Android version?
<@odexcide> @collinrm @jduck 4.2.2 Galaxy Nexus
<@odexcide> @collinrm @jduck The crash doesn't have my lib in the back trace and looks like it is coming from JIT. The same hook in apps works fine.
<@collinrm> @odexcide @jduck hooking code in system_server works, 4.2.2 should also not be an issue. Does it crash when executing the hook? or earlier?
<@odexcide> @collinrm @jduck It will hook successfully but will crash later during exec. short after other times after a while. Same result in emulator.
<@jduck> @odexcide @collinrm maybe stuff is getting moved and pointers hard coded? I'm not familiar with the internals of ddi
<@collinrm> @odexcide @jduck does it ever execute or crash on the first try?
<@odexcide> @collinrm @jduck Executes sometimes but always crashes...getting some log and more info for you
The text was updated successfully, but these errors were encountered: