arm: handle unparseable instructions in recompileExceptionClearForArm#396
Open
0x00000003 wants to merge 1 commit into
Open
arm: handle unparseable instructions in recompileExceptionClearForArm#3960x00000003 wants to merge 1 commit into
0x00000003 wants to merge 1 commit into
Conversation
Align with the arm64 implementation by catching Instruction.parse() failures during block discovery. On some Android 14 ARM32 devices, branch targets in ExceptionClear lead to compiler-inserted padding (e.g. UDF traps after __stack_chk_fail) that cannot be parsed, causing "Error: invalid instruction" and preventing Java bridge initialization. Fixes: frida/frida#3567
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On some Android 14 ARM32 devices (observed on Sony BRAVIA TVs),
frida-serverstarts and attaches successfully, but Java bridge initialization fails whenJava.perform()/Java.use()is used.For example, calling a REPL-exported function that uses the Java bridge fails with:
Root cause:
recompileExceptionClearForArm()follows branch targets fromExceptionClear()and may encounter compiler-inserted padding bytes (UDF traps / data after noreturn calls like__stack_chk_fail) thatInstruction.parse()cannot decode.The arm64 implementation already handles this kind of case with a try-catch during block discovery. This PR adds equivalent handling for ARM32, where padding values are not necessarily zero.
Change: Wrap
Instruction.parse()in a try-catch during block discovery. Only suppress the error when we've already parsed at least one instruction in the current block, i.e. when we're past real code and likely into padding/data. If the first instruction fails to parse, the original error is still thrown.Tested with Frida 17.9.8 and frida-java-bridge 7.0.13 on:
Java.perform(),Java.use(), and method hooking all work after this fix.Fixes frida/frida#3567