Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

STREX Rd cannot be Rt or Rn #36

Closed
czlee32 opened this issue Apr 20, 2023 · 6 comments
Closed

STREX Rd cannot be Rt or Rn #36

czlee32 opened this issue Apr 20, 2023 · 6 comments
Labels
bug Something isn't working

Comments

@czlee32
Copy link

czlee32 commented Apr 20, 2023 •
edited by canyie
Loading 

signal 4 (SIGILL), code 1 (ILL_ILLOPC), fault addr 0xe2601ca0
    r0  00000000  r1  1513fb78  r2  e1263490  r3  e2601c81
    r4  1513fb78  r5  ad593068  r6  ad593038  r7  0000000b
    r8  00000000  r9  e1c9ba00  r10 e1263880  r11 b44d9acc
    ip  e3d8b6f0  sp  ad593020  lr  e126c540  pc  e2601ca0

backtrace:
      #00 pc **00000ca0**  [anon:Pine CreateBridgeJumpTrampoline]

memory near r1 ([anon:dalvik-main space (region space)]):
    1513fb50 00000000 00000000 00000000 00000000  ................
    1513fb60 00000000 00000000 00000000 00000000  ................
    1513fb70 00000000 00000000 6fc1e090 00000000  ...........o....

memory near r2 (/apex/com.android.art/lib/libart.so):
    e1263470 d4d4d4d4 d4d4d4d4 d4d4d4d4 d4d4d4d4  ................
    e1263480 00000000 00000000 00000000 0000d1e4  ................
    e1263490 e24dca02 e59cc000 e92d4ff0 ed2d8a10  ..M......O-...-.

memory near r3 ([anon:Pine CreateBridgeJumpTrampoline]):
    e2601c60 f8df466b f8df0010 bf00f010 c727c074  kF..........t.'.
    e2601c70 e3ec9d40 d243baec e1263490 e152ec11  @.....C..4&...R.
    e2601c80 c068f8df bf184560 f070f8df c060f8df  ..h.`E....p...`.
    e2601c90 0f00e85c bf182801 f04fbf20 bf080000  \....(.. .O.....
    e2601ca0 0000e84c 2800bf08 f3bfd1f2 f8cc8f5f  L......(...._...
    e2601cb0 f8cc1004 f8cc2008 ed8c300c ed8c0b04  ..... ...0......
    e2601cc0 ed8c1b06 ed8c2b08 ed8c3b0a ed8c4b0c  .....+...;...K..
    e2601cd0 ed8c5b0e ed8c6b10 f8df7b12 46621010  .[...k...{....bF
    e2601ce0 f8df466b f8df0010 bf00f010 cd7e193c  kF..........<.~.
    e2601cf0 e3d8b6f0 d243babc e1263490 e1263490  ......C..4&..4&.
    e2601d00 c068f8df bf184560 f070f8df c060f8df  ..h.`E....p...`.
    e2601d10 0f00e85c bf182801 f04fbf20 bf080000  \....(.. .O.....
    e2601d20 0000e84c 2800bf08 f3bfd1f2 f8cc8f5f  L......(...._...
    e2601d30 f8cc1004 f8cc2008 ed8c300c ed8c0b04  ..... ...0......
    e2601d40 ed8c1b06 ed8c2b08 ed8c3b0a ed8c4b0c  .....+...;...K..
    e2601d50 ed8c5b0e ed8c6b10 f8df7b12 46621010  .[...k...{....bF

memory near sp ([anon:stack_and_tls:2555]):
    ad593000 6fd9a030 ad593068 ad593038 00001071  0..oh0Y.80Y.q...
    ad593010 00000000 e1263880 b44d9acc e1267134  .....8&...M.4q&.
    ad593020 c6dcfbfc 00000010 13a5c398 00000000  ................
    ad593030 b44d9acc ad59309c 15342ba8 00000000  ..M..0Y..+4.....
    ad593040 00000000 00000000 00000000 00000000  ................
    ad593050 00000000 00000000 00000000 00000000  ................
    ad593060 15342b98 1513fb78 15342ba8 00000000  .+4.x....+4.....
    ad593070 00000020 15342b08 e7f8e4c9 00000000   ....+4.........
    ad593080 00026964 00000000 00000001 00000002  di..............
    ad593090 15342b98 1513fb78 15342b08 00000000  .+4.x....+4.....
    ad5930a0 00000000 00000000 00000000 00000000  ................
    ad5930b0 00000000 00000000 00000000 00000000  ................
    ad5930c0 00000000 00000000 00000000 00000000  ................
    ad5930d0 00000000 00000000 00000000 b44d9a88  ..............M.
    ad5930e0 ad593124 ad593114 00002070 00000000  $1Y..1Y.p ......
    ad5930f0 e1c9ba00 e1263880 b44d9d40 e126cf84  .....8&.@.M...&.

memory near pc ([anon:Pine CreateBridgeJumpTrampoline]):
    e2601c80 c068f8df bf184560 f070f8df c060f8df  ..h.`E....p...`.
    e2601c90 0f00e85c bf182801 f04fbf20 bf080000  \....(.. .O.....
    **e2601ca0 0000e84c 2800bf08 f3bfd1f2 f8cc8f5f  L......(...._...**
    e2601cb0 f8cc1004 f8cc2008 ed8c300c ed8c0b04  ..... ...0......
    e2601cc0 ed8c1b06 ed8c2b08 ed8c3b0a ed8c4b0c  .....+...;...K..
    e2601cd0 ed8c5b0e ed8c6b10 f8df7b12 46621010  .[...k...{....bF
    e2601ce0 f8df466b f8df0010 bf00f010 cd7e193c  kF..........<.~.
    e2601cf0 e3d8b6f0 d243babc e1263490 e1263490  ......C..4&..4&.
    e2601d00 c068f8df bf184560 f070f8df c060f8df  ..h.`E....p...`.
    e2601d10 0f00e85c bf182801 f04fbf20 bf080000  \....(.. .O.....
    e2601d20 0000e84c 2800bf08 f3bfd1f2 f8cc8f5f  L......(...._...
    e2601d30 f8cc1004 f8cc2008 ed8c300c ed8c0b04  ..... ...0......
    e2601d40 ed8c1b06 ed8c2b08 ed8c3b0a ed8c4b0c  .....+...;...K..
    e2601d50 ed8c5b0e ed8c6b10 f8df7b12 46621010  .[...k...{....bF
    e2601d60 f8df466b f8df0010 bf00f010 cd7e1c0c  kF............~.
    e2601d70 acda6f10 d243babc e1263490 e1263490  .o....C..4&..4&.

-------------------- objdump ---------------------------

00007c70 <pine_thumb_bridge_jump_trampoline>:
    7c70:	f8df c068 	ldr.w	ip, [pc, #104]	; 7cdc <pine_thumb_bridge_jump_trampoline_target_method>
    7c74:	4560      	cmp	r0, ip
    7c76:	bf18      	it	ne
    7c78:	f8df f070 	ldrne.w	pc, [pc, #112]	; 7cec <pine_thumb_bridge_jump_trampoline_call_origin_entry>
    7c7c:	f8df c060 	ldr.w	ip, [pc, #96]	; 7ce0 <pine_thumb_bridge_jump_trampoline_extras>

00007c80 <acquire_lock>:
    7c80:	e85c 0f00 	ldrex	r0, [ip]
    7c84:	2801      	cmp	r0, #1
    7c86:	bf18      	it	ne
    7c88:	bf20      	wfene
    7c8a:	f04f 0000 	mov.w	r0, #0
    7c8e:	bf08      	it	eq
    **7c90:	e84c 0000 	strexeq	r0, r0, [ip]**
    7c94:	bf08      	it	eq
    7c96:	2800      	cmpeq	r0, #0
    7c98:	d1f2      	bne.n	7c80 <acquire_lock>
    7c9a:	f3bf 8f5f 	dmb	sy
    7c9e:	f8cc 1004 	str.w	r1, [ip, #4]
    7ca2:	f8cc 2008 	str.w	r2, [ip, #8]
    7ca6:	f8cc 300c 	str.w	r3, [ip, #12]
    7caa:	ed8c 0b04 	vstr	d0, [ip, #16]
    7cae:	ed8c 1b06 	vstr	d1, [ip, #24]
    7cb2:	ed8c 2b08 	vstr	d2, [ip, #32]
    7cb6:	ed8c 3b0a 	vstr	d3, [ip, #40]	; 0x28
    7cba:	ed8c 4b0c 	vstr	d4, [ip, #48]	; 0x30
    7cbe:	ed8c 5b0e 	vstr	d5, [ip, #56]	; 0x38
    7cc2:	ed8c 6b10 	vstr	d6, [ip, #64]	; 0x40
    7cc6:	ed8c 7b12 	vstr	d7, [ip, #72]	; 0x48
    7cca:	f8df 1010 	ldr.w	r1, [pc, #16]	; 7cdc <pine_thumb_bridge_jump_trampoline_target_method>
    7cce:	4662      	mov	r2, ip
    7cd0:	466b      	mov	r3, sp
    7cd2:	f8df 0010 	ldr.w	r0, [pc, #16]	; 7ce4 <pine_thumb_bridge_jump_trampoline_bridge_method>
    7cd6:	f8df f010 	ldr.w	pc, [pc, #16]	; 7ce8 <pine_thumb_bridge_jump_trampoline_bridge_entry>
    7cda:	bf00      	nop

00007cdc <pine_thumb_bridge_jump_trampoline_target_method>:
    7cdc:	00000000 	.word	0x00000000

00007ce0 <pine_thumb_bridge_jump_trampoline_extras>:
    7ce0:	00000000 	.word	0x00000000

00007ce4 <pine_thumb_bridge_jump_trampoline_bridge_method>:
    7ce4:	00000000 	.word	0x00000000

00007ce8 <pine_thumb_bridge_jump_trampoline_bridge_entry>:
    7ce8:	00000000 	.word	0x00000000

00007cec <pine_thumb_bridge_jump_trampoline_call_origin_entry>:
    7cec:	00000000 	.word	0x00000000
@canyie
Copy link
Owner

canyie commented Apr 20, 2023

Upload full logcat?

@czlee32
Copy link
Author

czlee32 commented Apr 25, 2023

logcat 不太方便发出来，strexeq r0, r0, [ip] 还有别的写法吗，
image 我这s23上 hook 了一个静态函数，但是 s21 没问题，都是 android 13，多跑了几次就报 ILL_ILLOPC，看上边的日志是不是这行报错的？

@canyie
Copy link
Owner

canyie commented Apr 25, 2023

也就是说，第一次跑没问题？那我怀疑不是 strexeq 的问题，是这里的内存被不知道谁改掉了。你确定崩溃的时候这里还是 strexeq 指令？我倾向于野指针破坏了这里的内存

@czlee32
Copy link
Author

czlee32 commented Apr 25, 2023

image

image

image

看着是这里呀，不知道对不对，我改了下不崩溃了，strexeq r4, r0, [ip]，r4 寄存器是不是也能在这里用？

@canyie
Copy link
Owner

canyie commented May 1, 2023 •
edited
Loading

我不确定，那段汇编我基本上是写下来就没管过，应该有三年了，调用约定全忘光了……
刚刚翻了一下 art 源码，R4 寄存器在 art 上在调用 jni 方法时被用了存储 “locking register” 和 “hidden argument” ，可能需要测试执行 synchonized 的 jni 方法时触发 SIGQUIT 信号产生 ANR dump 时会不会有问题

我其实觉得 r4 能用就没道理 r0 不能用，而且执行几次后才崩溃不像典型的非法指令，我怀疑可能是指令缓存之类的有问题

公司有一台 Pixel 4 XL 刷了 android 13，有空我去试一下

@canyie
Copy link
Owner

canyie commented Jun 3, 2023

能提供一下 hook 的是哪个方法吗，我这里没有复现出来

@zwkaku zwkaku mentioned this issue Oct 12, 2023
Closed
@canyie canyie added the bug Something isn't working label Dec 9, 2023
@canyie canyie changed the title samsung s23 android 13 ILL_ILLOPC STREX Rd cannot be Rt or Rn Dec 9, 2023
@canyie canyie closed this as completed in fd829cc Dec 10, 2023
@9c-x 9c-x mentioned this issue Feb 27, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@czlee32 @canyie