canyie/pine

Hooking UpdateMethodsCode overwrites AddDeoptimizedMethod

Alhyoss opened this issue · 0 comments

The art::instrumentation::Instrumentation::UpdateMethodsCode method is hooked when using PineEnhances, regardless of the version of Android.
However, on Android 7 and above, this method only jumps to art::instrumentation::Instrumentation::UpdateMethodsCodeImpl, making the method only 4 bytes long when compiled.

The hook is placed using Dobby, which writes a 12 bytes long trampoline at the start of the method. Since the method here is smaller than 12 bytes, Dobby will overwrite the first 8 bytes of the next method in memory, namely art::instrumentation::Instrumentation::AddDeoptimizedMethod:

image

This will cause an obscure crash whenever the method is called, which is the case when calling art::instrumentation::Deoptimize.

Since UpdateMethodsCode only jumps to UpdateMethodsCodeImpl, I believe it will be ok to only hook it for Android < 7.