Frida Internal - Part 3: Java Bridge 与 ART hook

_tryInitialize () {
    // ...
    this.api = getApi();
    this.vm = new VM(api);

    ClassFactory._initialize(vm, api);
    this.classFactory = new ClassFactory();
}

let { getApi, getAndroidVersion } = require('./android');
try {
  getAndroidVersion();
} catch (e) {
  getApi = require('./jvm').getApi;
}
module.exports = getApi;

const vms = Memory.alloc(pointerSize);
const vmCount = Memory.alloc(jsizeSize);
temporaryApi.JNI_GetCreatedJavaVMs(vms, 1, vmCount);
if (vmCount.readInt() === 0)
  return null;
temporaryApi.vm = vms.readPointer();

jint JNI_GetCreatedJavaVMs(JavaVM **vmBuf, jsize bufLen, jsize *nVMs);

struct _JavaVM {
    const struct JNIInvokeInterface* functions;
}

class JavaVMExt : public JavaVM {
public:
// 一些函数 ...
Runtime* const runtime_;
}

(gdb) ptype /o JavaVM
type = struct _JavaVM {
/*    0      |     8 */    const struct JNIInvokeInterface *functions;

                           /* total size (bytes):    8 */
                         }

(gdb) ptype /o art::JavaVMExt
/* offset    |  size */  type = class art::JavaVMExt : public JavaVM {
                         private:
/*    8      |     8 */    class art::Runtime * const runtime_;
...

class Runtime {
// ...
gc::Heap* heap_;                // <-- we need to find this
std::unique_ptr<ArenaPool> jit_arena_pool_;    //  <----- API level >= 24
std::unique_ptr<ArenaPool> arena_pool_;        //      __
std::unique_ptr<ArenaPool> low_4gb_arena_pool_;//  <--|__ API level >= 23
std::unique_ptr<LinearAlloc> linear_alloc_;    //      \_
size_t max_spins_before_thin_lock_inflation_;
MonitorList* monitor_list_;
MonitorPool* monitor_pool_;
ThreadList* thread_list_;        // <--- and these
InternTable* intern_table_;      // <--/
ClassLinker* class_linker_;      // <-/
SignalCatcher* signal_catcher_;
std::unique_ptr<jni::JniIdManager> jni_id_manager_; // <- API level >= 30 or Android R Developer Preview
bool use_tombstoned_traces_;     // <-------------------- API level 27/28
std::string stack_trace_file_;   // <-------------------- API level <= 28
JavaVMExt* java_vm_;             // <-- so we find this then calculate our way backwards
// ...
}

extern "C" size_t MterpHandleException(Thread* self, ShadowFrame* shadow_frame)
    REQUIRES_SHARED(Locks::mutator_lock_) {
  DCHECK(self->IsExceptionPending());
  const instrumentation::Instrumentation* const instrumentation =
      Runtime::Current()->GetInstrumentation();
  return MoveToExceptionHandler(self, *shadow_frame, instrumentation);
}

const instrumentationOffsetParsers = {
  ia32: parsex86InstrumentationOffset,
  x64: parsex86InstrumentationOffset,
  arm: parseArmInstrumentationOffset,
  arm64: parseArm64InstrumentationOffset
};

(gdb) disassemble MterpHandleException
Dump of assembler code for function MterpHandleException(art::Thread*, art::ShadowFrame*):
   0x00000000007551ac <+0>:     stp     x29, x30, [sp, #-16]!
   0x00000000007551b0 <+4>:     mov     x29, sp
   0x00000000007551b4 <+8>:     adrp    x8, 0xa17000 <_ZN3art2gc9allocator8RosAlloc27dedicated_full_run_storage_E+3464>
   0x00000000007551b8 <+12>:    ldr     x8, [x8, #3280]
   0x00000000007551bc <+16>:    add     x2, x8, #0x2b8 // <-- 这里即为所求偏移！
   0x00000000007551c0 <+20>:    bl      0x3e1170 <art::interpreter::MoveToExceptionHandler(art::Thread*, art::ShadowFrame&, art::instrumentation::Instrumentation const*)>
   0x00000000007551c4 <+24>:    and     x0, x0, #0x1
   0x00000000007551c8 <+28>:    ldp     x29, x30, [sp], #16
   0x00000000007551cc <+32>:    ret
End of assembler dump.

function parseArm64InstrumentationOffset (insn) {
  if (insn.mnemonic !== 'add') {
    return null;
  }

  const ops = insn.operands;
  if (ops.length !== 3) {
    return null;
  }

  const op2 = ops[2];
  if (op2.type !== 'imm') {
    return null;
  }

  return op2.value;
}

class ClassLinker {
...
InternTable* intern_table_;                        // <-- We find this then calculate our way forwards
const void* quick_resolution_trampoline_;
const void* quick_imt_conflict_trampoline_;
const void* quick_generic_jni_trampoline_;         // <-- ...to this
const void* quick_to_interpreter_bridge_trampoline_;
...
}

void init (void) {
  g_mutex_init (&lock);
  methods = g_hash_table_new_full (NULL, NULL, NULL, NULL);
  replacements = g_hash_table_new_full (NULL, NULL, NULL, NULL);
}

void set_replacement_method (gpointer original_method, gpointer replacement_method) {
  g_mutex_lock (&lock);
  g_hash_table_insert (methods, original_method, replacement_method);
  g_hash_table_insert (replacements, replacement_method, original_method);
  g_mutex_unlock (&lock);
}

function initialize () {
  const vtable = handle.readPointer();
  const options = {
    exceptions: 'propagate'
  };
  attachCurrentThread = new NativeFunction(vtable.add(4 * pointerSize).readPointer(), 'int32', ['pointer', 'pointer', 'pointer'], options);
  detachCurrentThread = new NativeFunction(vtable.add(5 * pointerSize).readPointer(), 'int32', ['pointer'], options);
  getEnv = new NativeFunction(vtable.add(6 * pointerSize).readPointer(), 'int32', ['pointer', 'pointer', 'int32'], options);
}

#ifdef __cplusplus
typedef JavaVM_ JavaVM;
#else
typedef const struct JNIInvokeInterface_ *JavaVM;
#endif
struct JavaVM_ {
    const struct JNIInvokeInterface_ *functions;
#ifdef __cplusplus

    jint DestroyJavaVM() {
        return functions->DestroyJavaVM(this);
    }
    jint AttachCurrentThread(void **penv, void *args) {
        return functions->AttachCurrentThread(this, penv, args);
    }
    jint DetachCurrentThread() {
        return functions->DetachCurrentThread(this);
    }

    jint GetEnv(void **penv, jint version) {
        return functions->GetEnv(this, penv, version);
    }
    jint AttachCurrentThreadAsDaemon(void **penv, void *args) {
        return functions->AttachCurrentThreadAsDaemon(this, penv, args);
    }
#endif
};

struct JNIInvokeInterface_ {
    void *reserved0;
    void *reserved1;
    void *reserved2;

    jint (JNICALL *DestroyJavaVM)(JavaVM *vm);
    jint (JNICALL *AttachCurrentThread)(JavaVM *vm, void **penv, void *args);
    jint (JNICALL *DetachCurrentThread)(JavaVM *vm);
    jint (JNICALL *GetEnv)(JavaVM *vm, void **penv, jint version);
    jint (JNICALL *AttachCurrentThreadAsDaemon)(JavaVM *vm, void **penv, void *args);
};

use (className, options = {}) {
  const allowCached = options.cache !== 'skip';

  let C = allowCached ? this._getUsedClass(className) : undefined;
  if (C === undefined) {
    try {
      const env = vm.getEnv();

      const { _loader: loader } = this;
      const getClassHandle = (loader !== null)
        ? makeLoaderClassHandleGetter(className, loader, env)
        : makeBasicClassHandleGetter(className);

      C = this._make(className, getClassHandle, env);
    } finally {
      if (allowCached) {
        this._setUsedClass(className, C);
      }
    }
  }

  return C;
}

function makeBasicClassHandleGetter (className) {
  const canonicalClassName = className.replace(/\./g, '/');

  return function (env) {
    const tid = getCurrentThreadId();
    ignore(tid);
    try {
      return env.findClass(canonicalClassName);
    } finally {
      unignore(tid);
    }
  };
}

_make (name, getClassHandle, env) {
  const C = makeClassWrapperConstructor();
  const proto = Object.create(Wrapper.prototype, { ... });
  C.prototype = proto;

  const classWrapper = new C(null);
  proto.$w = classWrapper;

  const h = classWrapper.$borrowClassHandle(env);
  const classHandle = h.value;

  ensureClassInitialized(env, classHandle);
  proto.$l = ClassModel.build(classHandle, env);

  return classWrapper;
}

function ensureClassInitialized (env, classRef) {
  const api = getApi();
  if (api.flavor !== 'art') {
    return;
  }

  env.getFieldId(classRef, 'x', 'Z');
  env.exceptionClear();
}

static void SomeFunc(JNIEnv *env, jclass javaClass) {
    ScopedObjectAccess soa(env);
    ObjPtr<mirror::Class> c = soa.Decode<mirror::Class>(javaClass);
}

// C++ mirror of java.lang.Class
class MANAGED Class final : public Object {
  // ...
  uint64_t ifields_;
  uint64_t methods_;
  uint64_t sfields_;
  uint32_t access_flags_;
  // ...
  uint16_t copied_methods_offset_;
}

class Model {
  static build (handle, env) {
    ensureInitialized(env);

    return unwrap(handle, env, object => {
      return new Model(cm.new(handle, object, env));
    });
  }
}

Model * model_new (jclass class_handle, gpointer class_object, JNIEnv * env) {
  model = g_new (Model, 1);

  members = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, g_free);
  model->members = members;

  elements = read_art_array (class_object, art_api.class_offset_methods, sizeof (gsize), NULL);
  n = *(guint16 *) (class_object + art_api.class_offset_copied_methods_offset);
  // 读取方法
  for (i = 0; i != n; i++) {
    jmethodID id;
    guint32 access_flags;
    jboolean is_static;
    jobject method, name;
    const char * name_str;
    jint modifiers;

    id = elements + (i * art_api.method_size);

    access_flags = *(guint32 *) (id + art_api.method_offset_access_flags);
    if ((access_flags & kAccConstructor) != 0)
      continue;
    is_static = (access_flags & kAccStatic) != 0;
    method = to_reflected_method (env, class_handle, id, is_static);
    name = call_object_method (env, method, java_api.method.get_name);
    name_str = get_string_utf_chars (env, name, NULL);
    modifiers = access_flags & 0xffff;

    model_add_method (model, name_str, id, modifiers);

  }
  // 读取属性
  for (field_array_cursor = 0; field_array_cursor != G_N_ELEMENTS (field_arrays); field_array_cursor++) {
    // ...
    model_add_field (model, name_str, id, modifiers);
  }
  return model;
}

const Activity = Java.use("com.evilpan.MainActivity");
Activity.onCreate.implementation = function(bundle) {
    console.log("We're in!");
    return this.onCreate(bundle);
}

methodPrototype = Object.create(Function.prototype, {
    methodName: {
        enumerable: true,
        get () {
        return this._p[0];
        }
    },
    // holder: {},
    // type: {},
    // handle: {},
    implementation: {
        enumerable: true,
        get () {
            const replacement = this._r;
            return (replacement !== undefined) ? replacement : null;
        },
        set (fn) {
            const params = this._p;
            const holder = params[1];
            const type = params[2];

            if (type === CONSTRUCTOR_METHOD) {
                throw new Error('Reimplementing $new is not possible; replace implementation of $init instead');
            }

            const existingReplacement = this._r;
            if (existingReplacement !== undefined) {
                holder.$f._patchedMethods.delete(this);

                const mangler = existingReplacement._m;
                mangler.revert(vm);

                this._r = undefined;
            }

            if (fn !== null) {
                const [methodName, classWrapper, type, methodId, retType, argTypes] = params;

                const replacement = implement(methodName, classWrapper, type, retType, argTypes, fn, this);
                const mangler = makeMethodMangler(methodId);
                replacement._m = mangler;
                this._r = replacement;

                mangler.replace(replacement, type === INSTANCE_METHOD, argTypes, vm, api);

                holder.$f._patchedMethods.add(this);
            }
        }
    },
    // returnType: {},
    // argumentTypes: {},
    // canInvokeWith: {},
    // clone: {},
    // invoke: {}
});

template <typename ArtType> ArtType* JniIdManager::DecodeGenericId(uintptr_t t) {
  if (Runtime::Current()->GetJniIdType() == JniIdType::kIndices && (t % 2) == 1) {
    ReaderMutexLock mu(Thread::Current(), *Locks::jni_id_lock_);
    size_t index = IdToIndex(t);
    DCHECK_GT(GetGenericMap<ArtType>().size(), index);
    return GetGenericMap<ArtType>().at(index);
  } else {
    DCHECK_EQ((t % 2), 0u) << "id: " << t;
    return reinterpret_cast<ArtType*>(t);
  }
}

ArtMethod* JniIdManager::DecodeMethodId(jmethodID method) {
  return DecodeGenericId<ArtMethod>(reinterpret_cast<uintptr_t>(method));
}

void ArtMethod::Invoke(Thread* self, uint32_t* args, uint32_t args_size, JValue* result, const char* shorty) {
    if (UNLIKELY(!runtime->IsStarted() || (self->IsForceInterpreter() && !IsNative() && !IsProxyMethod() && IsInvokable()))) {
        if (IsStatic()) {
            art::interpreter::EnterInterpreterFromInvoke(
                self, this, nullptr, args, result, /*stay_in_interpreter=*/ true);
        } else {
            mirror::Object* receiver = reinterpret_cast<StackReference<mirror::Object>*>(&args[0])->AsMirrorPtr();
            art::interpreter::EnterInterpreterFromInvoke(self, this, receiver, args + 1, result, /*stay_in_interpreter=*/ true);
        }
  } else {
    if (!IsStatic()) {
        (*art_quick_invoke_stub)(this, args, args_size, self, result, shorty);
    } else {
        (*art_quick_invoke_static_stub)(this, args, args_size, self, result, shorty);
    }
  }
}

class ArtMethod final {
// ...
struct PtrSizedFields {
    // Depending on the method type, the data is
    //   - native method: pointer to the JNI function registered to this method
    //                    or a function to resolve the JNI function,
    //   - resolution method: pointer to a function to resolve the method and
    //                        the JNI function for @CriticalNative.
    //   - conflict method: ImtConflictTable,
    //   - abstract/interface method: the single-implementation if any,
    //   - proxy method: the original interface method or constructor,
    //   - other methods: during AOT the code item offset, at runtime a pointer
    //                    to the code item.
    void* data_;

    // Method dispatch from quick compiled code invokes this pointer which may cause bridging into
    // the interpreter.
    void* entry_point_from_quick_compiled_code_;
} ptr_sized_fields_;
// ...
};

.macro INVOKE_STUB_CALL_AND_RETURN

    REFRESH_MARKING_REGISTER
    REFRESH_SUSPEND_CHECK_REGISTER

    // load method-> METHOD_QUICK_CODE_OFFSET
    ldr x9, [x0, #ART_METHOD_QUICK_CODE_OFFSET_64]
    // Branch to method.
    blr x9

    // Pop the ArtMethod* (null), arguments and alignment padding from the stack.
    mov sp, xFP
    // ...
.endm

ASM_DEFINE(ART_METHOD_QUICK_CODE_OFFSET_64,
           art::ArtMethod::EntryPointFromQuickCompiledCodeOffset(art::PointerSize::k64).Int32Value())

static constexpr MemberOffset EntryPointFromQuickCompiledCodeOffset(PointerSize pointer_size) {
  return MemberOffset(PtrSizedFieldsOffset(pointer_size) + OFFSETOF_MEMBER(
      PtrSizedFields, entry_point_from_quick_compiled_code_) / sizeof(void*)
          * static_cast<size_t>(pointer_size));
}

class ArtMethodMangler {
  constructor (opaqueMethodId) {
    const methodId = unwrapMethodId(opaqueMethodId);

    this.methodId = methodId;
    this.originalMethod = null;
    this.hookedMethodId = methodId;
    this.replacementMethodId = null;

    this.interceptor = null;
  }

patchArtMethod(replacementMethodId, {
    jniCode: impl,
    accessFlags: ((originalFlags & ~(kAccCriticalNative | kAccFastNative | kAccNterpEntryPointFastPathFlag)) | kAccNative) >>> 0,
    quickCode: api.artClassLinker.quickGenericJniTrampoline,
    interpreterCode: api.artInterpreterToCompiledCodeBridge
}, vm);

let hookedMethodRemovedFlags = kAccFastInterpreterToInterpreterInvoke | kAccSingleImplementation | kAccNterpEntryPointFastPathFlag;
if ((originalFlags & kAccNative) === 0) {
  hookedMethodRemovedFlags |= kAccSkipAccessChecks;
}

patchArtMethod(hookedMethodId, {
  accessFlags: (originalFlags & ~(hookedMethodRemovedFlags)) >>> 0
}, vm);

const { artNterpEntryPoint } = api;

if (artNterpEntryPoint !== undefined && quickCode.equals(artNterpEntryPoint)) {
  patchArtMethod(hookedMethodId, {
    quickCode: api.artQuickToInterpreterBridge
  }, vm);
}

Memory.patchCode(trampoline, 256, code => {
  const writer = new Arm64Writer(code, { pc: trampoline });
  const relocator = new Arm64Relocator(target, writer);

  // Save FPRs.
  writer.putPushRegReg('d0', 'd1');
  writer.putPushRegReg('d2', 'd3');
  writer.putPushRegReg('d4', 'd5');
  writer.putPushRegReg('d6', 'd7');

  // Save core args, callee-saves & LR.
  writer.putPushRegReg('x1', 'x2');
  writer.putPushRegReg('x3', 'x4');
  writer.putPushRegReg('x5', 'x6');
  writer.putPushRegReg('x7', 'x20');
  writer.putPushRegReg('x21', 'x22');
  writer.putPushRegReg('x23', 'x24');
  writer.putPushRegReg('x25', 'x26');
  writer.putPushRegReg('x27', 'x28');
  writer.putPushRegReg('x29', 'lr');

  // Save ArtMethod* + alignment padding.
  writer.putSubRegRegImm('sp', 'sp', 16);
  writer.putStrRegRegOffset('x0', 'sp', 0);

  writer.putCallAddressWithArguments(artController.replacedMethods.findReplacementFromQuickCode, ['x0', 'x19']);

  // 保存调用结果，恢复寄存器 ...
}