Skip to content

Fix early LoadedApk class loader initialization #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mumingluan wants to merge 1 commit into
base: master
Choose a base branch
from
+35 −19
Open

Fix early LoadedApk class loader initialization #115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 23 additions & 1 deletion patch-loader/src/main/java/org/lsposed/lspatch/loader/LSPApplication.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.lang.ref.Reference;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.nio.charset.StandardCharsets;
Expand Down Expand Up @@ -283,7 +284,28 @@ private static Context createLoadedApkWithContext() {
stubLoadedApk = (LoadedApk) XposedHelpers.getObjectField(mBoundApplication, "info");
var appInfo = (ApplicationInfo) XposedHelpers.getObjectField(mBoundApplication, "appInfo");
var compatInfo = (CompatibilityInfo) XposedHelpers.getObjectField(mBoundApplication, "compatInfo");
var baseClassLoader = stubLoadedApk.getClassLoader();
var stubFactory = Class.forName(
"org.lsposed.lspatch.metaloader.LSPAppComponentFactoryStub",
false,
LSPApplication.class.getClassLoader());
var baseClassLoader = stubFactory.getClassLoader();

// Some Android variants invoke LoadedApk.getClassLoader() from a hot-patch hook before
// handleBindApplication publishes AppBindData.info. The LoadedApk being initialized has
// already been registered in ActivityThread.mPackages, though, and the factory class was
// defined by its loader. Recover that exact object rather than dereferencing a transient
// null or recursively calling getClassLoader() while it is still creating the factory.
if (stubLoadedApk == null) {
var mPackages = (Map<?, ?>) XposedHelpers.getObjectField(activityThread, "mPackages");
var holder = mPackages.get(appInfo.packageName);
var candidate = holder instanceof Reference<?> reference ? reference.get() : holder;
if (!(candidate instanceof LoadedApk)) {
throw new IllegalStateException(
"Stub LoadedApk is not available for " + appInfo.packageName);
}
stubLoadedApk = (LoadedApk) candidate;
Log.i(TAG, "Recovered stub LoadedApk during early class-loader initialization");
}

try (var is = baseClassLoader.getResourceAsStream(CONFIG_ASSET_PATH)) {
BufferedReader streamReader = new BufferedReader(new InputStreamReader(is, StandardCharsets.UTF_8));
Expand Down
30 changes: 12 additions & 18 deletions patch-loader/src/main/jni/src/patch_loader.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,25 +38,19 @@ using namespace vector::native;
namespace lspd {

void PatchLoader::LoadDex(JNIEnv* env, Context::PreloadedDex&& dex) {
auto class_activity_thread = JNI_FindClass(env, "android/app/ActivityThread");
auto class_activity_thread_app_bind_data =
JNI_FindClass(env, "android/app/ActivityThread$AppBindData");
auto class_loaded_apk = JNI_FindClass(env, "android/app/LoadedApk");

auto mid_current_activity_thread = JNI_GetStaticMethodID(
env, class_activity_thread, "currentActivityThread", "()Landroid/app/ActivityThread;");
auto class_class = JNI_FindClass(env, "java/lang/Class");
auto stub =
JNI_FindClass(env, "org/lsposed/lspatch/metaloader/LSPAppComponentFactoryStub");
auto mid_get_classloader =
JNI_GetMethodID(env, class_loaded_apk, "getClassLoader", "()Ljava/lang/ClassLoader;");
auto fid_m_bound_application = JNI_GetFieldID(env, class_activity_thread, "mBoundApplication",
"Landroid/app/ActivityThread$AppBindData;");
auto fid_info =
JNI_GetFieldID(env, class_activity_thread_app_bind_data, "info", "Landroid/app/LoadedApk;");

auto activity_thread =
JNI_CallStaticObjectMethod(env, class_activity_thread, mid_current_activity_thread);
auto m_bound_application = JNI_GetObjectField(env, activity_thread, fid_m_bound_application);
auto info = JNI_GetObjectField(env, m_bound_application, fid_info);
auto stub_classloader = JNI_CallObjectMethod(env, info, mid_get_classloader);
JNI_GetMethodID(env, class_class, "getClassLoader", "()Ljava/lang/ClassLoader;");

// Loading the AppComponentFactory can be re-entrant. In particular, some Android variants call
// LoadedApk.getClassLoader() from an early hot-patch hook before ActivityThread has published
// mBoundApplication.info. Reading the stub LoadedApk through ActivityThread at that point used a
// null receiver in CallObjectMethod and CheckJNI aborted the process. JNI_OnLoad is invoked from
// the already-defined factory class, so its defining loader is both available here and the exact
// parent the in-memory framework loader needs.
auto stub_classloader = JNI_CallObjectMethod(env, stub, mid_get_classloader);

if (!stub_classloader) [[unlikely]] {
LOGE("getStubClassLoader failed!!!");
Expand Down