frida-java-bridge icon indicating copy to clipboard operation
frida-java-bridge copied to clipboard

Multiple calls to create_script() containing Java.perform leads to process termination

Open pandasauce opened this issue 4 years ago • 0 comments

Steps to reproduce:

  1. Create two files containing just this line: Java.perform(function() { });, justBreakFrida1.js and justBreakFrida2.js
  2. frida -U -f my.awesome.app -l justBreakFrida1.js
  3. frida -U -n my.awesome.app -l justBreakFrida2.js
  4. Resume script 1, observe: Process terminated

The actual use case where I ran into this: attaching these scripts via session.create_script(script.get_script_content()) when spawn gating:

# loop over queued scripts for the process
script_handle = session.create_script(script.get_script_content())
script.set_frida_handle(script_handle)
script_handle.on("message", self._on_message)
script_handle.load()
# eventually reaching
self._device.resume(spawn.pid)

It was causing an infinite spawn-crash-respawn loop:

Spawned pid: 15351
Hooking my.awesome.app(15351)
Spawned pid: 15381
Hooking my.awesome.app(15381)
Spawned pid: 15412
Hooking my.awesome.app(15412)
Detached 15351: process-terminated
Spawned pid: 15445
Hooking my.awesome.app(15445)
Detached 15381: process-terminated
Spawned pid: 15475
Hooking my.awesome.app(15475)
Detached 15412: process-terminated

Expected behaviour:

All scripts get attached and execute either in parallel each in their own thread or in the order they were attached in.

Odd workaround:

Having a single .js with multiple calls to Java.perform() works fine in both the Python-based spawn gating and CLI approaches.

pandasauce avatar Apr 30 '21 16:04 pandasauce