c++在Andorid 11上hook android_dlopen_ext会崩溃 #30

tyrionchen · 2022-02-22T09:35:46Z

tyrionchen
Feb 22, 2022

感谢作者开源如此优秀的项目！

我在使用项目的过程中碰到如标题的崩溃，以下是相关信息

1.问题描述:
我在自己的热升级工程中引入bhook，想hook所有的dlopen和android_dlopen_ext实现so的重定向。
我的工程在Android 9上运行正常(hook dlopen)，但在Andorid 11上运行会出现崩溃。
我在bhook的sample工程里面也写了相同的hook逻辑，sample却能hook成功，两者代码逻辑相同，只是我的工程使用的是c++，sample中使用的是c语言。我也注意到了文档中提到的，使用c++时要注意BYTEHOOK_CALL_PREV的用法，以及c++要在代理函数前先调用BYTEHOOK_STACK_SCOPE，c语言要在代理函数return之前调用BYTEHOOK_POP_STACK.

2.崩溃堆栈
02-22 17:20:27.714 10324 10324 I 02-22 17:20:27.715 10324 10324 I 02-22 17:20:27.724 10324 10324 F DEBUG 02-22 17:20:27.724 10324 10324 F DEBUG 02-22 17:20:27.724 10324 10324 F DEBUG 02-22 17:20:27.724 10324 10324 F DEBUG 02-22 17:20:27.724 10324 10324 F DEBUG 02-22 17:20:27.724 10324 10324 F DEBUG 02-22 17:20:27.724 10324 10324 F DEBUG 02-22 17:20:27.724 10324 10324 F DEBUG 02-22 17:20:27.724 10324 10324 F DEBUG 02-22 17:20:27.724 10324 10324 F DEBUG : 02-22 17:20:27.724 10324 10324 F DEBUG : 02-22 17:20:27.724 10324 10324 F DEBUG : 02-22 17:20:27.724 10324 10324 F DEBUG : 02-22 17:20:27.724 10324 10324 F DEBUG : 02-22 17:20:27.724 10324 10324 F DEBUG : 02-22 17:20:27.724 10324 10324 F DEBUG : 02-22 17:20:27.724 10324 10324 F DEBUG : 02-22 17:20:27.724 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.823 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : 02-22 17:20:27.824 10324 10324 F DEBUG : crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstone
crash_dump64: performing dump of process 9832 (target tid = 9832)
: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
: Build fingerprint: 'samsung/beyond2qltezc/beyond2q:11/RP1A.200720.012/G9750ZCS5FUE4:user/release-keys'
: Revision: '17'
: ABI: 'arm64'
: Timestamp: 2022-02-22 17:20:27+0800
: pid: 9832, tid: 9832, name: .UnityHotUpdate >>> com.testHU.UnityHotUpdate <<<
: uid: 15104
: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x1
: Cause: null pointer dereference
x0 0000007c552b79b0 x1 0000000000000000 x2 fffffffffffffff0 x3 0000007c553503d0
x4 0000007c55350400 x5 0000007c553503f7 x6 6964616f6c202d20 x7 6c20646e6120676e
x8 00000000ffffeef8 x9 0000000000000008 x10 0000000000000000 x11 0000007946106040
x12 000000000000fa0c x13 000000000003150c x14 000000000003150c x15 000010048b953b17
x16 0000007c565eb3f0 x17 0000007c565bddf0 x18 0000007c56336000 x19 0000000000000001
x20 0000000000000002 x21 00000079bebbd4b0 x22 0000007c55399250 x23 0000007c552b79b0
x24 0000007c55350180 x25 0000000000000000 x26 0000000000000080 x27 0000007fe50bb930
x28 0000007c565ef898 x29 0000007fe50bba20
lr 0000007c5652a780 sp 0000007fe50ba8f0 pc 0000007c5652a934 pst 0000000040000000
: backtrace:
NOTE: Function names and BuildId information is missing for some frames due
NOTE: to unreadable libraries. For unwinds of apps, only shared libraries
NOTE: found under the lib/ directory are readable.
#00 pc 0000000000034934 /apex/com.android.runtime/bin/linker64 (__dl__Z9do_dlopenPKciPK17android_dlextinfoPKv+988) (BuildId: 14e4f7c3a987c01b47ee17cc5aa77135)
#1 pc 00000000000300e4 /apex/com.android.runtime/bin/linker64 (__loader_android_dlopen_ext+80) (BuildId: 14e4f7c3a987c01b47ee17cc5aa77135)
#2 pc 0000000000005650 /data/app/~~LsiHOd_FSmJbq-SSP7PHvA==/com.testHU.UnityHotUpdate-YYnePFdQ5JcfcZrQKbgM9A==/lib/arm64/libbytehook.so (BuildId: 18c1050856b1067cc7d3f202858a45eda49eccd7)
#03 pc 00000000000010b8 /apex/com.android.runtime/lib64/bionic/libdl.so (android_dlopen_ext+12) (BuildId: 2d9a3bc477f6477aad024f334662e2ce)
#4 pc 000000000000fa08 /data/app/~~LsiHOd_FSmJbq-SSP7PHvA==/com.testHU.UnityHotUpdate-YYnePFdQ5JcfcZrQKbgM9A==/lib/arm64/libhook.so (BuildId: 3a08223a890ee619c8272e246dd1846fed1054b9)
#05 pc 000000000001ac04 /apex/com.android.art/lib64/libnativeloader.so (android::NativeLoaderNamespace::Load(char const*) const+192) (BuildId: 70d4c953bb1489017528077acb0edcd6)
#6 pc 000000000000d708 /apex/com.android.art/lib64/libnativeloader.so (OpenNativeLibraryInNamespace+64) (BuildId: 70d4c953bb1489017528077acb0edcd6)
#07 pc 000000000000d2cc /apex/com.android.art/lib64/libnativeloader.so (OpenNativeLibrary+132) (BuildId: 70d4c953bb1489017528077acb0edcd6)
#8 pc 0000000000376434 /apex/com.android.art/lib64/libart.so (art::JavaVMExt::LoadNativeLibrary(_JNIEnv*, std::__1::basic_string<char, std::__1::char_traits, std::__1::allocator > const&, _jobject*, _jclass*, std::__1::basic_string<char, std::__1::char_traits, std::__1::allocator >)+2096) (BuildId: e14503791ca790aee59797b668187c00)
#9 pc 0000000000005130 /apex/com.android.art/lib64/libopenjdkjvm.so (JVM_NativeLoad+416) (BuildId: 375393490f7011c45690bc79b5a6fa2a)
#10 pc 0000000000081a24 /apex/com.android.art/javalib/arm64/boot.oat (art_jni_trampoline+228) (BuildId: 6f9ff290bb1f57d3f6d08d1d26898736989e8371)
#11 pc 000000000009a5a8 /apex/com.android.art/javalib/arm64/boot.oat (java.lang.Runtime.loadLibrary0+328) (BuildId: 6f9ff290bb1f57d3f6d08d1d26898736989e8371)
#12 pc 000000000009b9b4 /apex/com.android.art/javalib/arm64/boot.oat (java.lang.Runtime.loadLibrary0+180) (BuildId: 6f9ff290bb1f57d3f6d08d1d26898736989e8371)
#13 pc 000000000009f260 /apex/com.android.art/javalib/arm64/boot.oat (java.lang.System.loadLibrary+96) (BuildId: 6f9ff290bb1f57d3f6d08d1d26898736989e8371)
#14 pc 00000000001347e8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: e14503791ca790aee59797b668187c00)
#15 pc 0000000000198eb0 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread, unsigned int*, unsigned int, art::JValue*, char const*)+232) (BuildId: e14503791ca790aee59797b668187c00)
#16 pc 000000000030c228 /apex/com.android.art/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+376) (BuildId: e14503791ca790aee59797b668187c00)
#17 pc 0000000000307340 /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+884) (BuildId: e14503791ca790aee59797b668187c00)
#18 pc 000000000063de30 /apex/com.android.art/lib64/libart.so (MterpInvokeStatic+548) (BuildId: e14503791ca790aee59797b668187c00)
#19 pc 000000000012e994 /apex/com.android.art/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: e14503791ca790aee59797b668187c00)
#20 pc 000000000009ed24 /data/user/0/com.testHU.UnityHotUpdate/tinker/patch-40572dfe/dex/tinker_classN.apk (com.unity3d.player.UnityPlayer.+20)
#21 pc 00000000002fed1c /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.llvm.2255279045661746555)+268) (BuildId: e14503791ca790aee59797b668187c00)
#22 pc 0000000000629a58 /apex/com.android.art/lib64/libart.so (artQuickToInterpreterBridge+796) (BuildId: e14503791ca790aee59797b668187c00)
#23 pc 000000000013dff8 /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: e14503791ca790aee59797b668187c00)
#24 pc 00000000001347e8 /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: e14503791ca790aee59797b668187c00)
#25 pc 0000000000198eb0 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232) (BuildId: e14503791ca790aee59797b668187c00)
#26 pc 00000000001cc910 /apex/com.android.art/lib64/libart.so (art::ClassLinker::InitializeClass(art::Thread*, art::Handleart::mirror::Class, bool, bool)+2820) (BuildId: e14503791ca790aee59797b668187c00)
#27 pc 00000000001a9484 /apex/com.android.art/lib64/libart.so (art::ClassLinker::EnsureInitialized(art::Thread*, art::Handleart::mirror::Class, bool, bool)+156) (BuildId: e14503791ca790aee59797b668187c00)
#28 pc 0000000000617824 /apex/com.android.art/lib64/libart.so (artAllocObjectFromCodeResolvedRegionTLAB+420) (BuildId: e14503791ca790aee59797b668187c00)
#29 pc 000000000013ca88 /apex/com.android.art/lib64/libart.so (art_quick_alloc_object_resolved_region_tlab+104) (BuildId: e14503791ca790aee59797b668187c00)
#30 pc 0000000000021334 /data/user/0/com.testHU.UnityHotUpdate/tinker/patch-40572dfe/dex/oat/arm64/tinker_classN.odex

3.崩溃代码
以下是出现崩溃的代码（代理函数)

static void* new_dlopen_ext(const char* cPath,int flags){ BYTEHOOK_STACK_SCOPE(); DEBUG("new_dlopen_ext path:%s", cPath); void* result = BYTEHOOK_CALL_PREV(new_dlopen_ext, cPath, flags); return result; }

以下是注册逻辑

bytehook_hook_partial(NULL, nullptr, nullptr, "android_dlopen_ext", reinterpret_cast<void *>(new_dlopen_ext), NULL, NULL);

4.崩溃设备信息
设备名称: SAMSUNG 三星S10+
设备model号: SM-G9750
系统版本: 11

5.在sample中不会出现崩溃的代码
代理函数
`
static void* new_dlopen_ext(const char* cPath,int flags){
void* result;
result = BYTEHOOK_CALL_PREV(new_dlopen_ext, strlen_t, cPath, flags);

LOG("new_dlopen %s ", cPath);
BYTEHOOK_POP_STACK();
return result;

}
`

以下是注册逻辑
bytehook_hook_partial(NULL, NULL, NULL, "android_dlopen_ext", (void*)new_dlopen_ext, NULL, NULL);

caikelun · 2022-02-22T09:53:41Z

caikelun
Feb 22, 2022
Maintainer

android从7.0开始对dlopen / android_dlopen_ext做了权限限制，你如果直接hook这两个函数，会导致如果hook到的调用试图打开的so是app没有权限的，那你在proxy函数中也就无法调用原函数了。可能有以下的几种方式能处理：

类似bytehook源码中 DL monitor 的处理方式，针对不同android版本分别处理。但是实现起来比较复杂。
如果只是监听dlopen行为，不修改参数和返回值，可以用 bytehook_add_dlopen_callback。https://github.com/bytedance/bhook/blob/main/doc/native_manual.zh-CN.md#hook-dlopen-%E5%92%8C-android_dlopen_ext
inlinehook linker 内部的 do_dlopen，分版本分别hook：__dl__Z9do_dlopenPKciPK17android_dlextinfo, __dl__Z9do_dlopenPKciPK17android_dlextinfoPv, __dl__Z9do_dlopenPKciPK17android_dlextinfoPKv。线上稳定的inlinehook方案推荐用我们开源的 shadowhook：https://github.com/bytedance/android-inline-hook

具体到你的场景，我个人倾向于用第三种方式。

0 replies

tyrionchen · 2022-02-22T12:02:56Z

tyrionchen
Feb 22, 2022
Author

android从7.0开始对dlopen / android_dlopen_ext做了权限限制，你如果直接hook这两个函数，会导致如果hook到的调用试图打开的so是app没有权限的，那你在proxy函数中也就无法调用原函数了。可能有以下的几种方式能处理：

类似bytehook源码中 DL monitor 的处理方式，针对不同android版本分别处理。但是实现起来比较复杂。

如果只是监听dlopen行为，不修改参数和返回值，可以用 bytehook_add_dlopen_callback。https://github.com/bytedance/bhook/blob/main/doc/native_manual.zh-CN.md#hook-dlopen-%E5%92%8C-android_dlopen_ext

inlinehook linker 内部的 do_dlopen，分版本分别hook：__dl__Z9do_dlopenPKciPK17android_dlextinfo, __dl__Z9do_dlopenPKciPK17android_dlextinfoPv, __dl__Z9do_dlopenPKciPK17android_dlextinfoPKv。线上稳定的inlinehook方案推荐用我们开源的 shadowhook：https://github.com/bytedance/android-inline-hook

具体到你的场景，我个人倾向于用第三种方式。

感谢解答！
我看到Native API文档(https://github.com/bytedance/bhook/blob/main/doc/native_manual.zh-CN.md) 里有提到如果用自动模式，可以用BYTEHOOK_CALL_PREV调用原函数，请问下如果选择自动模式这个能否使用呢?

另外比较奇怪的一点，我在sample里面增加的hook android_dlopen_ext，这个似乎跑起来是正常的，但如果在android_dlopen_ext的代理函数中，在BYTEHOOK_CALL_PREV调用之前打印任何内容，就会出现崩溃。

HookC.zip

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

c++在Andorid 11上hook android_dlopen_ext会崩溃 #30

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

c++在Andorid 11上hook android_dlopen_ext会崩溃 #30

Uh oh!

Uh oh!

tyrionchen Feb 22, 2022

Replies: 2 comments

Uh oh!

caikelun Feb 22, 2022 Maintainer

Uh oh!

Uh oh!

tyrionchen Feb 22, 2022 Author

tyrionchen
Feb 22, 2022

caikelun
Feb 22, 2022
Maintainer

tyrionchen
Feb 22, 2022
Author