/*
* Convert types and widen primitives. Puts the value of "arg" into
* "destPtr".
*
* Returns the width of the argument in 32-bit words (1 or 2), or -1 on error.
*/
int dvmConvertArgument(DataObject* arg, ClassObject* type, s4* destPtr)
{
int retVal;
if (dvmIsPrimitiveClass(type)) {
/* e.g.: "arg" is java/lang/Float instance, "type" is VM float class */
PrimitiveType srcType;
s4* valuePtr;
srcType = getBoxedType(arg);
if (srcType == PRIM_NOT) { // didn't pass a boxed primitive in
LOGVV("conv arg: type '%s' not boxed primitive",
arg->clazz->descriptor);
return -1;
}
/* assumes value is stored in first instance field */
valuePtr = (s4*) arg->instanceData;
retVal = dvmConvertPrimitiveValue(srcType, type->primitiveType,
valuePtr, destPtr);
} else {
/* verify object is compatible */
if ((arg == NULL) || dvmInstanceof(arg->clazz, type)) {
*destPtr = (s4) arg;
retVal = 1;
} else {
LOGVV("Arg %p (%s) not compatible with %s",
arg, arg->clazz->descriptor, type->descriptor);
retVal = -1;
}
}
return retVal;
}
/*
* Primitive field setters, e.g.:
* private void setIField(Object o, Class declaringClass,
* Class type, int slot, boolean noAccessCheck, int type_no, int value)
*
* The "type_no" is defined by the java.lang.reflect.Field class.
*/
static void Dalvik_java_lang_reflect_Field_setPrimitiveField(const u4* args,
JValue* pResult)
{
// ignore thisPtr in args[0]
Object* obj = (Object*) args[1];
ClassObject* declaringClass = (ClassObject*) args[2];
ClassObject* fieldType = (ClassObject*) args[3];
int slot = args[4];
bool noAccessCheck = (args[5] != 0);
int typeNum = args[6];
const s4* valuePtr = (s4*) &args[7];
PrimitiveType srcType = convPrimType(typeNum);
JValue* fieldPtr;
JValue value;
if (!dvmIsPrimitiveClass(fieldType)) {
dvmThrowException("Ljava/lang/IllegalArgumentException;",
"not a primitive field");
RETURN_VOID();
}
/* convert the 32/64-bit arg to a JValue matching the field type */
if (dvmConvertPrimitiveValue(srcType, fieldType->primitiveType,
valuePtr, &(value.i)) < 0)
{
dvmThrowException("Ljava/lang/IllegalArgumentException;",
"invalid primitive conversion");
RETURN_VOID();
}
/* get a pointer to the field's data; performs access checks */
fieldPtr = getFieldDataAddr(obj, declaringClass, slot, true, noAccessCheck);
if (fieldPtr == NULL)
RETURN_VOID();
/* store 4 or 8 bytes */
if (fieldType->primitiveType == PRIM_LONG ||
fieldType->primitiveType == PRIM_DOUBLE)
{
fieldPtr->j = value.j;
} else {
fieldPtr->i = value.i;
}
RETURN_VOID();
}
/*
* Primitive field getters, e.g.:
* private double getIField(Object o, Class declaringClass,
* Class type, int slot, boolean noAccessCheck, int type_no)
*
* The "type_no" is defined by the java.lang.reflect.Field class.
*/
static void Dalvik_java_lang_reflect_Field_getPrimitiveField(const u4* args,
JValue* pResult)
{
// ignore thisPtr in args[0]
Object* obj = (Object*) args[1];
ClassObject* declaringClass = (ClassObject*) args[2];
ClassObject* fieldType = (ClassObject*) args[3];
int slot = args[4];
bool noAccessCheck = (args[5] != 0);
int typeNum = args[6];
PrimitiveType targetType = convPrimType(typeNum);
const JValue* fieldPtr;
JValue value;
if (!dvmIsPrimitiveClass(fieldType)) {
dvmThrowException("Ljava/lang/IllegalArgumentException;",
"not a primitive field");
RETURN_VOID();
}
/* get a pointer to the field's data; performs access checks */
fieldPtr = getFieldDataAddr(obj, declaringClass, slot, false,noAccessCheck);
if (fieldPtr == NULL)
RETURN_VOID();
/* copy 4 or 8 bytes out */
if (fieldType->primitiveType == PRIM_LONG ||
fieldType->primitiveType == PRIM_DOUBLE)
{
value.j = fieldPtr->j;
} else {
value.i = fieldPtr->i;
}
/* retrieve value, performing a widening conversion if necessary */
if (dvmConvertPrimitiveValue(fieldType->primitiveType, targetType,
&(value.i), &(pResult->i)) < 0)
{
dvmThrowException("Ljava/lang/IllegalArgumentException;",
"invalid primitive conversion");
RETURN_VOID();
}
}
static void dexspyCallHandler(const u4* args, JValue* pResult, const Method* method, ::Thread* self) {
OriginalMethodsIt original = findOriginalMethod(method);
if (original == dexspyOriginalMethods.end()) {
dvmThrowNoSuchMethodError("could not find Dexspy original method - how did you even get here?");
return;
}
ThreadStatus oldThreadStatus = self->status;
JNIEnv* env = self->jniEnv;
// get java.lang.reflect.Method object for original method
jobject originalReflected = env->ToReflectedMethod(
(jclass)dexspyAddLocalReference(self, original->clazz),
(jmethodID)method,
true);
// convert/box arguments
const char* desc = &method->shorty[1]; // [0] is the return type.
Object* thisObject = NULL;
size_t srcIndex = 0;
size_t dstIndex = 0;
// for non-static methods determine the "this" pointer
if (!dvmIsStaticMethod(&(*original))) {
thisObject = (Object*) dexspyAddLocalReference(self, (Object*)args[0]);
srcIndex++;
}
jclass objectClass = env->FindClass("java/lang/Object");
jobjectArray argsArray = env->NewObjectArray(strlen(method->shorty) - 1, objectClass, NULL);
while (*desc != '\0') {
char descChar = *(desc++);
JValue value;
Object* obj;
switch (descChar) {
case 'Z':
case 'C':
case 'F':
case 'B':
case 'S':
case 'I':
value.i = args[srcIndex++];
obj = (Object*) dvmBoxPrimitive(value, dvmFindPrimitiveClass(descChar));
dvmReleaseTrackedAlloc(obj, NULL);
break;
case 'D':
case 'J':
value.j = dvmGetArgLong(args, srcIndex);
srcIndex += 2;
obj = (Object*) dvmBoxPrimitive(value, dvmFindPrimitiveClass(descChar));
dvmReleaseTrackedAlloc(obj, NULL);
break;
case '[':
case 'L':
obj = (Object*) args[srcIndex++];
break;
default:
ALOGE("Unknown method signature description character: %c\n", descChar);
obj = NULL;
srcIndex++;
}
env->SetObjectArrayElement(argsArray, dstIndex++, dexspyAddLocalReference(self, obj));
}
// call the Java handler function
jobject resultRef = env->CallStaticObjectMethod(
dexspyClass, dexspyHandleHookedMethod, originalReflected, thisObject, argsArray);
// exceptions are thrown to the caller
if (env->ExceptionCheck()) {
dvmChangeStatus(self, oldThreadStatus);
return;
}
// return result with proper type
Object* result = dvmDecodeIndirectRef(self, resultRef);
ClassObject* returnType = dvmGetBoxedReturnType(method);
if (returnType->primitiveType == PRIM_VOID) {
// ignored
} else if (result == NULL) {
if (dvmIsPrimitiveClass(returnType)) {
dvmThrowNullPointerException("null result when primitive expected");
}
pResult->l = NULL;
} else {
if (!dvmUnboxPrimitive(result, returnType, pResult)) {
dvmThrowClassCastException(result->clazz, returnType);
}
}
// set the thread status back to running. must be done after the last env->...()
dvmChangeStatus(self, oldThreadStatus);
}
/*
* This is the common message body for proxy methods.
*
* The method we're calling looks like:
* public Object invoke(Object proxy, Method method, Object[] args)
*
* This means we have to create a Method object, box our arguments into
* a new Object[] array, make the call, and unbox the return value if
* necessary.
*/
static void proxyInvoker(const u4* args, JValue* pResult,
const Method* method, Thread* self)
{
Object* thisObj = (Object*) args[0];
Object* methodObj = NULL;
ArrayObject* argArray = NULL;
Object* handler;
Method* invoke;
ClassObject* returnType;
int hOffset;
JValue invokeResult;
/*
* Retrieve handler object for this proxy instance.
*/
hOffset = dvmFindFieldOffset(thisObj->clazz, "h",
"Ljava/lang/reflect/InvocationHandler;");
if (hOffset < 0) {
LOGE("Unable to find 'h' in Proxy object\n");
dvmAbort();
}
handler = dvmGetFieldObject(thisObj, hOffset);
/*
* Find the invoke() method, looking in "this"s class. (Because we
* start here we don't have to convert it to a vtable index and then
* index into this' vtable.)
*/
invoke = dvmFindVirtualMethodHierByDescriptor(handler->clazz, "invoke",
"(Ljava/lang/Object;Ljava/lang/reflect/Method;[Ljava/lang/Object;)Ljava/lang/Object;");
if (invoke == NULL) {
LOGE("Unable to find invoke()\n");
dvmAbort();
}
LOGV("invoke: %s.%s, this=%p, handler=%s\n",
method->clazz->descriptor, method->name,
thisObj, handler->clazz->descriptor);
/*
* Create a java.lang.reflect.Method object for this method.
*
* We don't want to use "method", because that's the concrete
* implementation in the proxy class. We want the abstract Method
* from the declaring interface. We have a pointer to it tucked
* away in the "insns" field.
*
* TODO: this could be cached for performance.
*/
methodObj = dvmCreateReflectMethodObject((Method*) method->insns);
if (methodObj == NULL) {
assert(dvmCheckException(self));
goto bail;
}
/*
* Determine the return type from the signature.
*
* TODO: this could be cached for performance.
*/
returnType = dvmGetBoxedReturnType(method);
if (returnType == NULL) {
char* desc = dexProtoCopyMethodDescriptor(&method->prototype);
LOGE("Could not determine return type for '%s'\n", desc);
free(desc);
assert(dvmCheckException(self));
goto bail;
}
LOGV(" return type will be %s\n", returnType->descriptor);
/*
* Convert "args" array into Object[] array, using the method
* signature to determine types. If the method takes no arguments,
* we must pass null.
*/
argArray = boxMethodArgs(method, args+1);
if (dvmCheckException(self))
goto bail;
/*
* Call h.invoke(proxy, method, args).
*
* We don't need to repackage exceptions, so if one has been thrown
* just jump to the end.
*/
dvmCallMethod(self, invoke, handler, &invokeResult,
thisObj, methodObj, argArray);
if (dvmCheckException(self))
goto bail;
/*
* Unbox the return value. If it's the wrong type, throw a
* ClassCastException. If it's a null pointer and we need a
* primitive type, throw a NullPointerException.
*/
if (returnType->primitiveType == PRIM_VOID) {
LOGVV("+++ ignoring return to void\n");
} else if (invokeResult.l == NULL) {
if (dvmIsPrimitiveClass(returnType)) {
dvmThrowException("Ljava/lang/NullPointerException;",
"null result when primitive expected");
goto bail;
}
pResult->l = NULL;
} else {
if (!dvmUnwrapPrimitive(invokeResult.l, returnType, pResult)) {
dvmThrowExceptionWithClassMessage("Ljava/lang/ClassCastException;",
((Object*)invokeResult.l)->clazz->descriptor);
goto bail;
}
}
bail:
dvmReleaseTrackedAlloc(methodObj, self);
dvmReleaseTrackedAlloc((Object*)argArray, self);
}
static void xposedCallHandler(const u4* args, JValue* pResult,
const Method* method, ::Thread* self) {
if (!xposedIsHooked(method)) {
dvmThrowNoSuchMethodError(
"could not find Xposed original method - how did you even get here?");
return;
}
XposedHookInfo* hookInfo = (XposedHookInfo*) method->insns;
Method* original = (Method*) hookInfo;
Object* originalReflected = hookInfo->reflectedMethod;
Object* additionalInfo = hookInfo->additionalInfo;
// convert/box arguments
const char* desc = &method->shorty[1]; // [0] is the return type.
Object* thisObject = NULL;
size_t srcIndex = 0;
size_t dstIndex = 0;
// for non-static methods determine the "this" pointer
if (!dvmIsStaticMethod(original)) {
thisObject = (Object*) args[0];
srcIndex++;
}
ArrayObject* argsArray = dvmAllocArrayByClass(objectArrayClass,
strlen(method->shorty) - 1, ALLOC_DEFAULT);
if (argsArray == NULL) {
return;
}
while (*desc != '\0') {
char descChar = *(desc++);
JValue value;
Object* obj;
switch (descChar) {
case 'Z':
case 'C':
case 'F':
case 'B':
case 'S':
case 'I':
value.i = args[srcIndex++];
obj = (Object*) dvmBoxPrimitive(value,
dvmFindPrimitiveClass(descChar));
dvmReleaseTrackedAlloc(obj, self);
break;
case 'D':
case 'J':
value.j = dvmGetArgLong(args, srcIndex);
srcIndex += 2;
obj = (Object*) dvmBoxPrimitive(value,
dvmFindPrimitiveClass(descChar));
dvmReleaseTrackedAlloc(obj, self);
break;
case '[':
case 'L':
obj = (Object*) args[srcIndex++];
break;
default:
ALOGE("Unknown method signature description character: %c\n",
descChar);
obj = NULL;
srcIndex++;
}
xposedSetObjectArrayElement(argsArray, dstIndex++, obj);
}
// call the Java handler function
JValue result;
dvmCallMethod(self, xposedHandleHookedMethod, NULL, &result,
originalReflected, (int) original, additionalInfo, thisObject,
argsArray);
dvmReleaseTrackedAlloc(argsArray, self);
// exceptions are thrown to the caller
if (dvmCheckException(self)) {
return;
}
// return result with proper type
ClassObject* returnType = dvmGetBoxedReturnType(method);
if (returnType->primitiveType == PRIM_VOID) {
// ignored
} else if (result.l == NULL) {
if (dvmIsPrimitiveClass(returnType)) {
dvmThrowNullPointerException("null result when primitive expected");
}
pResult->l = NULL;
} else {
if (!dvmUnboxPrimitive(result.l, returnType, pResult)) {
dvmThrowClassCastException(result.l->clazz, returnType);
}
}
}
/*
* Primitive field setters, e.g.:
* private void setIField(Object o, Class declaringClass,
* Class type, int slot, boolean noAccessCheck, int type_no, int value)
*
* The "type_no" is defined by the java.lang.reflect.Field class.
*/
static void Dalvik_java_lang_reflect_Field_setPrimitiveField(const u4* args,
JValue* pResult)
{
// ignore thisPtr in args[0]
Object* obj = (Object*) args[1];
ClassObject* declaringClass = (ClassObject*) args[2];
ClassObject* fieldType = (ClassObject*) args[3];
int slot = args[4];
bool noAccessCheck = (args[5] != 0);
int typeNum = args[6];
const s4* valuePtr = (s4*) &args[7];
#ifdef WITH_TAINT_TRACKING
/* rtaint = args[8]
* thisPtr taint = args[9]
* obj taint = args[10]
* declaringClass taint = args[11]
* fieldType taint = args[12]
* slot taint = args[13]
* noAccessCheck taint = args[14]
* typeNum taint = args[15]
*/
u4 valueTaint = args[16];
#endif
PrimitiveType srcType = convPrimType(typeNum);
JValue* fieldPtr;
JValue value;
if (!dvmIsPrimitiveClass(fieldType)) {
dvmThrowException("Ljava/lang/IllegalArgumentException;",
"not a primitive field");
RETURN_VOID();
}
/* convert the 32/64-bit arg to a JValue matching the field type */
if (dvmConvertPrimitiveValue(srcType, fieldType->primitiveType,
valuePtr, &(value.i)) < 0)
{
dvmThrowException("Ljava/lang/IllegalArgumentException;",
"invalid primitive conversion");
RETURN_VOID();
}
/* get a pointer to the field's data; performs access checks */
fieldPtr = getFieldDataAddr(obj, declaringClass, slot, true, noAccessCheck);
if (fieldPtr == NULL)
RETURN_VOID();
/* store 4 or 8 bytes */
if (fieldType->primitiveType == PRIM_LONG ||
fieldType->primitiveType == PRIM_DOUBLE)
{
fieldPtr->j = value.j;
} else {
fieldPtr->i = value.i;
}
#ifdef WITH_TAINT_TRACKING
/* If we got this far, we know the fields is okay to access and there
* will not be a problem getting the field from the slot */
{
Field* field = dvmSlotToField(declaringClass, slot);
assert(field != NULL);
if (dvmIsStaticField(field)) {
StaticField* sfield = (StaticField*)field;
dvmSetStaticFieldTaint(sfield, valueTaint);
} else {
/* Note, getFieldDataAddr() already checked that
* obj is of type declaringClass, so no need to check here
*/
InstField* ifield = (InstField*)field;
if (fieldType->primitiveType == PRIM_LONG ||
fieldType->primitiveType == PRIM_DOUBLE) {
dvmSetFieldTaintWide(obj, ifield->byteOffset, valueTaint);
} else {
dvmSetFieldTaint(obj, ifield->byteOffset, valueTaint);
}
}
}
#endif
RETURN_VOID();
}
/*
* Primitive field getters, e.g.:
* private double getIField(Object o, Class declaringClass,
* Class type, int slot, boolean noAccessCheck, int type_no)
*
* The "type_no" is defined by the java.lang.reflect.Field class.
*/
static void Dalvik_java_lang_reflect_Field_getPrimitiveField(const u4* args,
JValue* pResult)
{
// ignore thisPtr in args[0]
Object* obj = (Object*) args[1];
ClassObject* declaringClass = (ClassObject*) args[2];
ClassObject* fieldType = (ClassObject*) args[3];
int slot = args[4];
bool noAccessCheck = (args[5] != 0);
int typeNum = args[6];
#ifdef WITH_TAINT_TRACKING
u4* rtaint = (u4*) &args[7]; /* return taint tag slot */
#endif
PrimitiveType targetType = convPrimType(typeNum);
const JValue* fieldPtr;
JValue value;
if (!dvmIsPrimitiveClass(fieldType)) {
dvmThrowException("Ljava/lang/IllegalArgumentException;",
"not a primitive field");
RETURN_VOID();
}
/* get a pointer to the field's data; performs access checks */
fieldPtr = getFieldDataAddr(obj, declaringClass, slot, false,noAccessCheck);
if (fieldPtr == NULL)
RETURN_VOID();
/* copy 4 or 8 bytes out */
if (fieldType->primitiveType == PRIM_LONG ||
fieldType->primitiveType == PRIM_DOUBLE)
{
value.j = fieldPtr->j;
} else {
value.i = fieldPtr->i;
}
/* retrieve value, performing a widening conversion if necessary */
if (dvmConvertPrimitiveValue(fieldType->primitiveType, targetType,
&(value.i), &(pResult->i)) < 0)
{
dvmThrowException("Ljava/lang/IllegalArgumentException;",
"invalid primitive conversion");
RETURN_VOID();
}
#ifdef WITH_TAINT_TRACKING
/* If we got this far, we know the fields is okay to access and there
* will not be a problem getting the field from the slot */
{
Field* field = dvmSlotToField(declaringClass, slot);
assert(field != NULL);
if (dvmIsStaticField(field)) {
StaticField* sfield = (StaticField*)field;
*rtaint = dvmGetStaticFieldTaint(sfield);
} else {
/* Note, getFieldDataAddr() already checked that
* obj is of type declaringClass, so no need to check here
*/
InstField* ifield = (InstField*)field;
if (fieldType->primitiveType == PRIM_LONG ||
fieldType->primitiveType == PRIM_DOUBLE) {
*rtaint = dvmGetFieldTaintWide(obj, ifield->byteOffset);
} else {
*rtaint = dvmGetFieldTaint(obj, ifield->byteOffset);
}
}
}
#endif
}
static void dalvik_dispatcher(const u4* args, jvalue* pResult,
const Method* method, void* self) {
ClassObject* returnType;
jvalue result;
ArrayObject* argArray;
LOGD("dalvik_dispatcher source method: %s %s", method->name,
method->shorty);
Method* meth = (Method*) method->insns;
meth->accessFlags = meth->accessFlags | ACC_PUBLIC;
LOGD("dalvik_dispatcher target method: %s %s", method->name,
method->shorty);
returnType = dvmGetBoxedReturnType_fnPtr(method);
if (returnType == NULL) {
assert(dvmCheckException_fnPtr(self));
goto bail;
}
LOGD("dalvik_dispatcher start call->");
if (!dvmIsStaticMethod(meth)) {
Object* thisObj = (Object*) args[0];
ClassObject* tmp = thisObj->clazz;
thisObj->clazz = meth->clazz;
argArray = boxMethodArgs(meth, args + 1);
if (dvmCheckException_fnPtr(self))
goto bail;
dvmCallMethod_fnPtr(self, (Method*) jInvokeMethod,
dvmCreateReflectMethodObject_fnPtr(meth), &result, thisObj,
argArray);
thisObj->clazz = tmp;
} else {
argArray = boxMethodArgs(meth, args);
if (dvmCheckException_fnPtr(self))
goto bail;
dvmCallMethod_fnPtr(self, (Method*) jInvokeMethod,
dvmCreateReflectMethodObject_fnPtr(meth), &result, NULL,
argArray);
}
if (dvmCheckException_fnPtr(self)) {
Object* excep = dvmGetException_fnPtr(self);
jni_env->Throw((jthrowable) excep);
goto bail;
}
if (returnType->primitiveType == PRIM_VOID) {
LOGD("+++ ignoring return to void");
} else if (result.l == NULL) {
if (dvmIsPrimitiveClass(returnType)) {
jni_env->ThrowNew(NPEClazz, "null result when primitive expected");
goto bail;
}
pResult->l = NULL;
} else {
if (!dvmUnboxPrimitive_fnPtr(result.l, returnType, pResult)) {
char msg[1024] = { 0 };
snprintf(msg, sizeof(msg) - 1, "%s!=%s\0",
((Object*) result.l)->clazz->descriptor,
returnType->descriptor);
jni_env->ThrowNew(CastEClazz, msg);
goto bail;
}
}
bail: dvmReleaseTrackedAlloc_fnPtr((Object*) argArray, self);
}