Hooking UpdateMethodsCode overwrites AddDeoptimizedMethod
Alhyoss opened this issue · 0 comments
The art::instrumentation::Instrumentation::UpdateMethodsCode
method is hooked when using PineEnhances, regardless of the version of Android.
However, on Android 7 and above, this method only jumps to art::instrumentation::Instrumentation::UpdateMethodsCodeImpl
, making the method only 4 bytes long when compiled.
The hook is placed using Dobby, which writes a 12 bytes long trampoline at the start of the method. Since the method here is smaller than 12 bytes, Dobby will overwrite the first 8 bytes of the next method in memory, namely art::instrumentation::Instrumentation::AddDeoptimizedMethod
:
![image](https://private-user-images.githubusercontent.com/11006297/274887664-42f71cb1-66e4-4701-a8a1-969c938ee396.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTQ5NDcwMjgsIm5iZiI6MTcxNDk0NjcyOCwicGF0aCI6Ii8xMTAwNjI5Ny8yNzQ4ODc2NjQtNDJmNzFjYjEtNjZlNC00NzAxLWE4YTEtOTY5YzkzOGVlMzk2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA1MDUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNTA1VDIyMDUyOFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQ0M2IzNzhiMGM5NTgxOGQ5ZTNiNWYzYzhlNTc1NDJhZjk0N2QyODVkYzAyMmUwZGM1NGIwZTQ0ZjdlZjFmZDYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.zgGOULlNjWWwsaDE7hmpc0Fc_6yj2AP1HR6nD1SDeGA)
This will cause an obscure crash whenever the method is called, which is the case when calling art::instrumentation::Deoptimize
.
Since UpdateMethodsCode
only jumps to UpdateMethodsCodeImpl
, I believe it will be ok to only hook it for Android < 7.