- Sponsor
-
Notifications
You must be signed in to change notification settings - Fork 130
Comparing changes
Open a pull request
base repository: frida/frida-java-bridge
base: 889b2d0be9348cd058c147fd485d394de26622af
head repository: frida/frida-java-bridge
compare: 65abf81c5f3105ab46c1c8d7e232b05541632074
Commits on Feb 4, 2019
-
Apps targeting older Android versions are subject to the old behavior.
Configuration menu - View commit details
-
Copy full SHA for 7fe0e72 - Browse repository at this point
Copy the full SHA 7fe0e72View commit details -
Configuration menu - View commit details
-
Copy full SHA for cc8e375 - Browse repository at this point
Copy the full SHA cc8e375View commit details -
Configuration menu - View commit details
-
Copy full SHA for c2d9f1b - Browse repository at this point
Copy the full SHA c2d9f1bView commit details -
Configuration menu - View commit details
-
Copy full SHA for 304f237 - Browse repository at this point
Copy the full SHA 304f237View commit details -
Configuration menu - View commit details
-
Copy full SHA for 57facf9 - Browse repository at this point
Copy the full SHA 57facf9View commit details
Commits on Mar 12, 2019
-
Fix Android 9 method hooking reliability
The new kAccPublicApi flag got confused with kAccXposedHookedMethod. Kudos to @giantpune for reporting.
Configuration menu - View commit details
-
Copy full SHA for ffd29ca - Browse repository at this point
Copy the full SHA ffd29caView commit details -
Configuration menu - View commit details
-
Copy full SHA for 5bd1aa8 - Browse repository at this point
Copy the full SHA 5bd1aa8View commit details
Commits on Mar 13, 2019
-
Configuration menu - View commit details
-
Copy full SHA for fe21877 - Browse repository at this point
Copy the full SHA fe21877View commit details -
Configuration menu - View commit details
-
Copy full SHA for 87d6a7e - Browse repository at this point
Copy the full SHA 87d6a7eView commit details
Commits on Mar 18, 2019
-
Fix method hooking reliability
By deoptimizing everything when the first method is hooked. This is essential on newer versions of Android where optimizations are more aggressive. It is however a performance regression, but we can always optimize this later by hooking the optimized native code. Kudos to @giantpune for helping track this one down.
Configuration menu - View commit details
-
Copy full SHA for 063f0ce - Browse repository at this point
Copy the full SHA 063f0ceView commit details -
Configuration menu - View commit details
-
Copy full SHA for f7c03b8 - Browse repository at this point
Copy the full SHA f7c03b8View commit details -
Configuration menu - View commit details
-
Copy full SHA for d9224e9 - Browse repository at this point
Copy the full SHA d9224e9View commit details
Commits on Mar 20, 2019
-
Add Java.deoptimizeEverything()
And revert the automatic deoptimization behavior that was recently introduced. For now we'll leave it up to users to enable it when needed. Also improve portability.
Configuration menu - View commit details
-
Copy full SHA for 47a7a13 - Browse repository at this point
Copy the full SHA 47a7a13View commit details -
Configuration menu - View commit details
-
Copy full SHA for 6bbe8e3 - Browse repository at this point
Copy the full SHA 6bbe8e3View commit details
Commits on Mar 21, 2019
-
Configuration menu - View commit details
-
Copy full SHA for cb5da52 - Browse repository at this point
Copy the full SHA cb5da52View commit details -
Configuration menu - View commit details
-
Copy full SHA for fbc2398 - Browse repository at this point
Copy the full SHA fbc2398View commit details
Commits on May 1, 2019
-
Rewrite Java.deoptimizeEverything() using art::Dbg
Accomplishing this using the underlying Instrumentation API directly means we'd have to deal with a lot of internals to be able to do so safely. It also makes it tricky in case a debugger is already present. Using the higher level Dbg API sidesteps these issues, at the expense of being a bit more intrusive considering the listening socket being opened. But we can always instrument that away later.
Configuration menu - View commit details
-
Copy full SHA for afc030b - Browse repository at this point
Copy the full SHA afc030bView commit details -
Configuration menu - View commit details
-
Copy full SHA for f6dc756 - Browse repository at this point
Copy the full SHA f6dc756View commit details -
Configuration menu - View commit details
-
Copy full SHA for 00d222f - Browse repository at this point
Copy the full SHA 00d222fView commit details
Commits on May 6, 2019
-
Configuration menu - View commit details
-
Copy full SHA for 04acb04 - Browse repository at this point
Copy the full SHA 04acb04View commit details -
Configuration menu - View commit details
-
Copy full SHA for bc65d22 - Browse repository at this point
Copy the full SHA bc65d22View commit details -
Configuration menu - View commit details
-
Copy full SHA for bbe78be - Browse repository at this point
Copy the full SHA bbe78beView commit details
Commits on May 14, 2019
-
Fix invalid instruction crash on arm64
The logic that recompiles ExceptionClear() did not stop parsing after the noreturn call to __stack_chk_fail(), which typically falls through to the next function. That meant we recompiled a lot more code than we needed to. That was however the best-case scenario, because turns out there was another scenario where alignment padding was inserted before the next function, and Instruction.parse() would choke on that. The ideal solution would have been to recognize the call to __stack_chk_fail(), but given how complex that is, we instead look out for a sudden fall-through to the next function, or an unexpected zero- padding word. Kudos to @giantpune for helping track this one down.
Configuration menu - View commit details
-
Copy full SHA for e7d563b - Browse repository at this point
Copy the full SHA e7d563bView commit details -
Configuration menu - View commit details
-
Copy full SHA for 09f3cfc - Browse repository at this point
Copy the full SHA 09f3cfcView commit details
Commits on May 17, 2019
-
Add workaround for ART exception delivery bug
One particular code-path in the exception delivery logic assumes there is always at least one Java stack frame on the current art::Thread. Kudos to @giantpune for helping track this one down.
Configuration menu - View commit details
-
Copy full SHA for e4027e1 - Browse repository at this point
Copy the full SHA e4027e1View commit details -
Configuration menu - View commit details
-
Copy full SHA for 071adc6 - Browse repository at this point
Copy the full SHA 071adc6View commit details -
Improve the recompilation logic
To also avoid falling into the next function on non-arm64.
Configuration menu - View commit details
-
Copy full SHA for 0a1ea87 - Browse repository at this point
Copy the full SHA 0a1ea87View commit details -
Fix ART internals parsing in JNI checked mode
Try resolving using symbols and fall back to the vtable, like before.
Configuration menu - View commit details
-
Copy full SHA for 361af39 - Browse repository at this point
Copy the full SHA 361af39View commit details -
Configuration menu - View commit details
-
Copy full SHA for 2bba8fe - Browse repository at this point
Copy the full SHA 2bba8feView commit details -
Configure JDWP to use ADB as transport
As not all apps are able to open a TCP listening port.
Configuration menu - View commit details
-
Copy full SHA for bf66cbc - Browse repository at this point
Copy the full SHA bf66cbcView commit details
Commits on May 18, 2019
-
Configuration menu - View commit details
-
Copy full SHA for 269b18c - Browse repository at this point
Copy the full SHA 269b18cView commit details -
Configuration menu - View commit details
-
Copy full SHA for 8d106a9 - Browse repository at this point
Copy the full SHA 8d106a9View commit details -
Add proper support for JNI checked mode
Without relying on debug symbols.
Configuration menu - View commit details
-
Copy full SHA for f112382 - Browse repository at this point
Copy the full SHA f112382View commit details -
Configuration menu - View commit details
-
Copy full SHA for c8ae2bb - Browse repository at this point
Copy the full SHA c8ae2bbView commit details
Commits on May 26, 2019
-
Useful for stack exploration. For now we only cover the underlying C++ API partially.
Configuration menu - View commit details
-
Copy full SHA for fdbbe1e - Browse repository at this point
Copy the full SHA fdbbe1eView commit details -
Fix intermittent crash during ART exception delivery
Turns out ART may get the frame size of hooked methods wrong during exception delivery. All we need to do to correct this little mix-up is to ensure that ArtMethod's GetOatQuickMethodHeader() always returns nullptr for hooked methods.
Configuration menu - View commit details
-
Copy full SHA for e546e74 - Browse repository at this point
Copy the full SHA e546e74View commit details
Commits on May 27, 2019
-
Partially stub out the ADB JDWP transport
To ensure we always succeed in starting it. This also makes it possible to impersonate the debugger, which might be worth exploring as a way to use ART's instrumentation APIs through a stable wire protocol.
Configuration menu - View commit details
-
Copy full SHA for e88ddbb - Browse repository at this point
Copy the full SHA e88ddbbView commit details -
Configuration menu - View commit details
-
Copy full SHA for df695b7 - Browse repository at this point
Copy the full SHA df695b7View commit details -
Port ART exception delivery fix to 32-bit targets
Where the GetOatQuickMethodHeader() signature is slightly different, due to uintptr_t obviously being a different type.
Configuration menu - View commit details
-
Copy full SHA for 77c2975 - Browse repository at this point
Copy the full SHA 77c2975View commit details -
Configuration menu - View commit details
-
Copy full SHA for cd25aba - Browse repository at this point
Copy the full SHA cd25abaView commit details
Commits on May 28, 2019
-
Speed up the GetOatQuickMethodHeader() hook
Turns out this function is quite hot when running the VM in interpreter- only mode. E.g. it's called close to 8 million times when launching the Dropbox app from start to login screen. We speed things up by emitting a little bit of machine code that looks at the ArtMethod and avoids the context-switch into JS for methods that are definitely not hooked.
Configuration menu - View commit details
-
Copy full SHA for db05c57 - Browse repository at this point
Copy the full SHA db05c57View commit details -
Configuration menu - View commit details
-
Copy full SHA for ab7edfa - Browse repository at this point
Copy the full SHA ab7edfaView commit details
Commits on May 30, 2019
-
Configuration menu - View commit details
-
Copy full SHA for abe1ee2 - Browse repository at this point
Copy the full SHA abe1ee2View commit details -
There could be more than one script using frida-java, so we cannot assume that: A) We know of all the hooked methods. B) GetOatQuickMethodHeader() hasn't already been replaced. The challenge with A) is that ArtMethod doesn't have any unused bits we can use to tag the patched instances. We mitigate A) by detecting the entrypoint of Frida's libffi closures, which is going to be the same assuming agent and gadget aren't loaded at the same time and both using frida-java. For now we gracefully handle B) by assuming that the first script stays around for as long as the other scripts depending on this. It's not ideal, but it will have to do for now.
Configuration menu - View commit details
-
Copy full SHA for 176100f - Browse repository at this point
Copy the full SHA 176100fView commit details -
Configuration menu - View commit details
-
Copy full SHA for d5ed5ac - Browse repository at this point
Copy the full SHA d5ed5acView commit details
Commits on Jun 1, 2019
-
Configuration menu - View commit details
-
Copy full SHA for 8e671ad - Browse repository at this point
Copy the full SHA 8e671adView commit details -
Configuration menu - View commit details
-
Copy full SHA for ff404fc - Browse repository at this point
Copy the full SHA ff404fcView commit details -
Configuration menu - View commit details
-
Copy full SHA for a69c471 - Browse repository at this point
Copy the full SHA a69c471View commit details -
Configuration menu - View commit details
-
Copy full SHA for 07c26f3 - Browse repository at this point
Copy the full SHA 07c26f3View commit details
Commits on Jun 9, 2019
-
Fix ART internals parsing for 32-bit ARM
Code generation was using the wrong register name.
Configuration menu - View commit details
-
Copy full SHA for 6f3fea0 - Browse repository at this point
Copy the full SHA 6f3fea0View commit details
There are no files selected for viewing