handle CMC GC strategy

frida · Jul 11, 2024 · 1979b1e · 1979b1e
1 parent 5b32afc
commit 1979b1e
Showing 1 changed file with 15 additions and 6 deletions.
diff --git a/lib/android.js b/lib/android.js
@@ -225,7 +225,7 @@ function _getApi () {
               getInstances(instance, scope, hClass, useIsAssignableFrom, maxCount, instances);
             };
           },
-
+          
           _ZN3art12StackVisitorC2EPNS_6ThreadEPNS_7ContextENS0_13StackWalkKindEjb: ['art::StackVisitor::StackVisitor', 'void', ['pointer', 'pointer', 'pointer', 'uint', 'uint', 'bool']],
           _ZN3art12StackVisitorC2EPNS_6ThreadEPNS_7ContextENS0_13StackWalkKindEmb: ['art::StackVisitor::StackVisitor', 'void', ['pointer', 'pointer', 'pointer', 'uint', 'size_t', 'bool']],
           _ZN3art12StackVisitor9WalkStackILNS0_16CountTransitionsE0EEEvb: ['art::StackVisitor::WalkStack', 'void', ['pointer', 'bool']],
@@ -591,8 +591,9 @@ function _getArtRuntimeSpec (api) {
    * gc::Heap* heap_;                <-- we need to find this
    * std::unique_ptr<ArenaPool> jit_arena_pool_;     <----- API level >= 24
    * std::unique_ptr<ArenaPool> arena_pool_;             __
-   * std::unique_ptr<ArenaPool> low_4gb_arena_pool_; <--|__ API level >= 23
+   * std::unique_ptr<ArenaPool> low_4gb_arena_pool_/linear_alloc_arena_pool_; <--|__ API level >= 23
    * std::unique_ptr<LinearAlloc> linear_alloc_;         \_
+   * std::atomic<LinearAlloc*> startup_linear_alloc_;<----- API level >= 34
    * size_t max_spins_before_thin_lock_inflation_;
    * MonitorList* monitor_list_;
    * MonitorPool* monitor_pool_;
@@ -644,7 +645,9 @@ function _getArtRuntimeSpec (api) {
         const threadListOffset = internTableOffset - pointerSize;
 
         let heapOffset;
-        if (apiLevel >= 24) {
+        if (apiLevel >= 34) {
+          heapOffset = threadListOffset - (9 * pointerSize);
+        } else if (apiLevel >= 24) {
           heapOffset = threadListOffset - (8 * pointerSize);
         } else if (apiLevel >= 23) {
           heapOffset = threadListOffset - (7 * pointerSize);
@@ -1669,7 +1672,7 @@ find_replacement_method_from_quick_code (gpointer method,
   gpointer top_quick_frame;
   gpointer link_managed_stack;
   gpointer * link_top_quick_frame;
-
+  
   replacement_method = get_replacement_method (method);
   if (replacement_method == NULL)
     return NULL;
@@ -1882,7 +1885,13 @@ function ensureArtKnowsHowToHandleReplacementMethods (vm) {
   const apiLevel = getAndroidApiLevel();
 
   let exportName = null;
-  if (apiLevel > 28) {
+
+  const api = getApi();
+  const kCollectorTypeCMC = 3;
+  let mayUseCollector = new NativeFunction(Module.findExportByName('libart.so', "_ZNK3art2gc4Heap15MayUseCollectorENS0_13CollectorTypeE"), "int", ["pointer", "int"])
+  if (mayUseCollector(api.artHeap, kCollectorTypeCMC)){
+    exportName = '_ZN3art2gc9collector11MarkCompact15CompactionPhaseEv';
+  } else if (apiLevel > 28) {
     exportName = '_ZN3art2gc9collector17ConcurrentCopying12CopyingPhaseEv';
   } else if (apiLevel > 22) {
     exportName = '_ZN3art2gc9collector17ConcurrentCopying12MarkingPhaseEv';
@@ -3610,7 +3619,7 @@ function computeDalvikJniArgInfo (methodId) {
 
 function cloneArtMethod (method, vm) {
   const api = getApi();
-
+  
   if (getAndroidApiLevel() < 23) {
     const thread = api['art::Thread::CurrentFromGdb']();
     return api['art::mirror::Object::Clone'](method, thread);