frida-il2cpp-bridge: dlopen hook fails on Android 12 (gadget)

I’m back with another fun debugging problem. This time it seems the library doesn’t play well with Samsung Galaxy S22 ultra devices.

Just to make sure it’s not a Frida issue I got a user to run the following in a Frida Gadget script

'use strict';

console.log("Waiting for Java..");

Java.perform(function () {
  var Log = Java.use("android.util.Log");
  Log.v("frida-lief", "Have fun!");
});

Which logs as expected. Good. So lets try the library now

'use strict';
import "frida-il2cpp-bridge";

console.log("Waiting for Java..");

Il2Cpp.perform(() => {
    Java.perform(function () {
        var Log = Java.use("android.util.Log");
        Log.v("frida-lief", "Have fun!");
    });
});

Crashes immediately after booting.

While I wait for them to come online and test a new version I created to try and narrow down exactly where the crash occurs, I figured I’d come here and see if you may have any insight on what we should try to narrow this down. The only big obvious difference I see right now is the Galaxy S22 runs the Armv9 architecture while most newer devices are on Armv8.

EDIT: The crash doesn’t happen if initialize() is commented out EDIT2: Reverted the fix done in #95 and it still didn’t open so it’s unrelated EDIT 3: commenting out https://github.com/vfsfitvnm/frida-il2cpp-bridge/blob/b49a0c642d4d741551f700bd55f644d9883e015c/src/il2cpp/base.ts#L148 stops the crash

About this issue

Original URL
State: closed
Created 2 years ago
Comments: 18 (10 by maintainers)

Most upvoted comments

I want to fix this one so bad, can you guys help me out? The thing I don’t really get is why it crashed on Gadget - would you describe the exact way (steps, tools, script and so on) to built the APK?

i try this,it will not crash

function hook_sigaction()
{
	var sigaction = Module.findExportByName(null, "sigaction");
	if (sigaction)
	{
		var before = Process.findRangeByAddress(sigaction);
		//console.log("before:", JSON.stringify(before, null, 4));
		var after = Memory.protect(sigaction, 4096, 'rwx');
		//console.log("after:", after);
	}
	myfun()
}

function myfun() 
{
    Il2Cpp.perform(() =>
    {
		console.log("succ.....");
	}
	
}
setImmediate(hook_sigaction);

350030173 on Apr 27, 2023