[Practice] Android5.1.1 source code, android5.1.1 source code

[Practice] Android5.1.1 source code, android5.1.1 source code
[Practice] Android5.1.1 source code-run an APP in interpreted Execution Mode Author: xunyu @ aliyunju SecurityPreface

The practices in this article modify the source code of Android5.1.1.

This article only briefly introduces the principle. The "practice" section describes the specific practices.

The content of this article involves the dex loading knowledge in the Art mode. If you want to learn more about this knowledge, you can go to Lao Luo's article:

Brief Introduction to ART and learning plan during Android Runtime

Analysis on how ART loads OAT files during Android Runtime

Process Analysis of ART loading classes and methods during Android Runtime

Process Analysis of ART execution methods during Android Runtime

 

This article involves zygote. If you do not know what zygote is, or are curious about how zygote can be started, you can read Lao Luo's article:
Source code analysis of the Startup Process of the Android system process Zygote

 

Lao Luo's article analyzes the source code of Android2.3, so the functions related to zygote mentioned below may not exist in Lao Luo's article, if you want to have a simple understanding of the functions related to zygote mentioned below, read my article: Android5.1.1 source code-how to downgrade permissions of sub-processes produced by zygote fork

 

Principles How to make the method explanation run

The ClassLinker: LinkCode function links the method code in dex. The function is defined in the file "art/runtime/class_linker.cc, the following is its source code (only the sections related to this Article are listed here ):

This function calls the NeedsInterpreter function to determine whether the current method needs to be interpreted and executed. If the returned value is true, the local variable enter_interpreter is assigned true, call the SetEntryPointFromQuickCompiledCode function in the ArtMethod class and pass in the returned value of GetQuickToInterpreterBridge (). The GetQuickToInterpreterBridge () function returns the entry address of the function used to explain execution. This entry function interprets the methods in dex.

 

Now let's look at the NeedsInterpreter function, which is defined in the file "art/runtime/class_linker.cc". The following is its source code:

 

When "Runtime: Current ()-> GetInstrumentation ()-> InterpretOnly ()" returns true and is not a local method or a proxy method, this function returns true, otherwise, false is returned.

 

The InterpretOnly function is a member function of the Instrumentation class. Its function is defined in the file "art/runtime/instrumentation. h". The following is its source code:

Interpret_only _ is a member variable of the Instrumentation class and a boolean type. It can be found that the InterpretOnly function only returns "interpret_only _". If interpret_only _ is set to true, all "non-local and non-proxy" methods will be interpreted and executed according to the above analysis.

 

So how to set interpret_only _ to true? There is a ForceInterpretOnly function in the Instrumentation class. The following is the source code of this function:

 

This function is a public member function of the Instrumentation class. Therefore, you can directly call this function to set interpret_only _ to true.

 

If you set interpret_only _ to true, the "non-local and non-proxy" method will be set to explain and executed when linking code. Will it affect other APP processes? No, because the ClassLinker: LinkCode function links methods in the memory of the APP process, this operation will not affect other processes.

Here is a section. When you execute the "Runtime: Current ()-> GetInstrumentation ()-> ForceInterpretOnly ()" statement, sets the interpret_only _ member variable of the Instrumentation object to true. If the method is a non-local and non-proxy method, the NeedsInterpreter function returns true. In the ClassLinker: LinkCode function, this method is set to interpreted for execution.
If you want to set all methods in the APP as interpreted execution, you need to execute "Runtime: Current ()-> GetInstrumentation ()" before linking the method code in dex of the APP () -> ForceInterpretOnly () "statement.

Time to call the ForceInterpretOnly Function

My solution is to call the ForceInterpretOnly function in the functions function. This section describes how Android executes the EnableDebugFeatures function, and then describes the benefits of calling the ForceInterpretOnly function in the EnableDebugFeatures function.

All Android APP processes are developed by zygote fork. The function call path for the fork APP process is as follows:

After the ForkAndSpecializeCommon function is called, the APP process is fork.

 

The ForkAndSpecializeCommon function is defined in the following source code in the file "frameworks/base/core/jni/com_android_internal_ OS _Zygote.cpp:

GCallPostForkChildHooks is a global variable that is initialized in the register_com_android_ OS _zygote.cpp function of the com_android_internal_ OS _zygote file.

Env-> CallStaticVoidMethod (...) The statement calls the Java method "Zygote. callPostForkChildHooks ".

 

The following is the source code of the Zygote. callPostForkChildHooks method. This method is in the file "frameworks/base/core/java/com/android/internal/OS/Zygote. java:

 

VM_HOOKS is a member variable of the Zygote class. Its definition is as follows:

 

VM_HOOKS.postForkChild calls the postForkChild member method in the ZygoteHooks class. This method is in the file "libcore/dalvik/src/main/java/dalvik/system/ZygoteHooks. java, the following is its source code:

 

This method calls the native function nativePostForkChild. The C-Layer Code of the nativePostForkChild function is in the file "/home/sowuy/android/system/art/runtime/native/dalvik_system_ZygoteHooks.cc, the following is its source code:

 

I will call the ForceInterpretOnly function in the EnableDebugFeatures function for three reasons:

 

Practice: modify the code in Zygote. java

The location of the Zygote. java file is frameworks/base/core/java/com/android/internal/OS/Zygote. java. Add a member variable to the Zygote class:

 

Add the following code at the beginning of the Zygote forkAndSpecialize method:

Modify the code in dalvik_system_ZygoteHooks.cc

The dalvik_system_ZygoteHooks.cc file is located at: art/runtime/native/dalvik_system_ZygoteHooks.cc. modify the code of the EnableDebugFeatures function in this file.

Add the following code to this function:

 

The complete code after the function is modified is as follows:

 

Author: xunyu @ Alibaba Cloud universal security. For more security technical articles, visit the Alibaba Cloud universal security blog.