Skip to content

arm: handle unparseable instructions in recompileExceptionClearForArm#396

Open
0x00000003 wants to merge 1 commit into
frida:mainfrom
0x00000003:fix/arm-unparseable-instructions
Open

arm: handle unparseable instructions in recompileExceptionClearForArm#396
0x00000003 wants to merge 1 commit into
frida:mainfrom
0x00000003:fix/arm-unparseable-instructions

Conversation

@0x00000003
Copy link
Copy Markdown

On some Android 14 ARM32 devices (observed on Sony BRAVIA TVs), frida-server starts and attaches successfully, but Java bridge initialization fails when Java.perform() / Java.use() is used.

For example, calling a REPL-exported function that uses the Java bridge fails with:

Error: invalid instruction
    at value (/frida/runtime/core.js:457)
    at recompileExceptionClearForArm (node_modules/frida-java-bridge/lib/android.js:4546)
    at makeArtThreadStateTransitionImpl (node_modules/frida-java-bridge/lib/android.js:4304)
    at _getArtThreadStateTransitionImpl (node_modules/frida-java-bridge/lib/android.js:1515)
    at withRunnableArtThread (node_modules/frida-java-bridge/lib/android.js:1500)
    at use (node_modules/frida-java-bridge/lib/class-factory.js:158)
    at perform (node_modules/frida-java-bridge/index.js:377)
    at switchTab (debugHome.js:75)

Root cause: recompileExceptionClearForArm() follows branch targets from ExceptionClear() and may encounter compiler-inserted padding bytes (UDF traps / data after noreturn calls like __stack_chk_fail) that Instruction.parse() cannot decode.

The arm64 implementation already handles this kind of case with a try-catch during block discovery. This PR adds equivalent handling for ARM32, where padding values are not necessarily zero.

Change: Wrap Instruction.parse() in a try-catch during block discovery. Only suppress the error when we've already parsed at least one instruction in the current block, i.e. when we're past real code and likely into padding/data. If the first instruction fails to parse, the original error is still thrown.

Tested with Frida 17.9.8 and frida-java-bridge 7.0.13 on:

  • Sony BRAVIA 4K AE3, Android 14 (API 34), armeabi-v7a
  • Sony BRAVIA CT1, Android 14 (API 34), armeabi-v7a

Java.perform(), Java.use(), and method hooking all work after this fix.

Fixes frida/frida#3567

Align with the arm64 implementation by catching Instruction.parse()
failures during block discovery. On some Android 14 ARM32 devices,
branch targets in ExceptionClear lead to compiler-inserted padding
(e.g. UDF traps after __stack_chk_fail) that cannot be parsed,
causing "Error: invalid instruction" and preventing Java bridge
initialization.

Fixes: frida/frida#3567
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant