It is not able to hook early code in MIUI13(Android12) both spawn mode and gadget mode
superabiliter opened this issue · 0 comments
I get the callstack when the script is perfrom in spawn mode. And result is
java.lang.Exception at android.app.ActivityThread.getPackageInfoNoCheck(Native Method) at android.app.ActivityThread$ActivityClientRecord.<init>(ActivityThread.java:677) at android.app.servertransaction.LaunchActivityItem.preExecute(LaunchActivityItem.java:85) at android.app.servertransaction.ClientTransaction.preExecute(ClientTransaction.java:117) at android.app.ClientTransactionHandler.scheduleTransaction(ClientTransactionHandler.java:50) at android.app.ActivityThread$ApplicationThread.scheduleTransaction(ActivityThread.java:1844) at android.app.IApplicationThread$Stub.onTransact(IApplicationThread.java:1295) at android.os.Binder.execTransactInternal(Binder.java:1187) at android.os.Binder.execTransact(Binder.java:1146)
I think in this scene frida inject the so too late.
In gadget mode, I loadlibrary in first line of MyApplication->attachBaseContext. And I found the script will execute when getPackageInfoNoCheck was called. I saw your code in this repo, and found perform script(initialize factory) has 3 types: hooking getPackageInfoNoCheck、makeApplication and the time loading the .so.
Maybe frida need two improves:
- ".so file" might inject to the process more earlier in new version of Android.
- We can find a way to initialize the factory and perform the script instead of waiting for hooking timing. (Maybe searching the application context object in memory?)