Segmentation fault when inject into victim

[InnotSagg]

I did a some modify to prepare inject into a app, get this Segmentation fault 👍

10-11 18:11:45.546  1221  1599 D WifiStateMachine: updateCapabilities for config:LTTfalse,false
10-11 18:11:46.472  1892  1983 W QCNEJ   : |CORE| CNE received unexpected action: android.intent.action.BATTERY_CHANGED
10-11 18:11:46.935 17598 17598 I magiskd : type=1400 audit(0.0:427): avc: denied { associate } for name="UNIX" dev="sockfs" ino=164041 scontext=u:object_r:magisk_file:s0 tcontext=u:object_r:sockfs:s0 tclass=filesystem permissive=1
10-11 18:11:47.805   328   328 I auditd  : type=1403 audit(0.0:428): policy loaded auid=4294967295 ses=4294967295
10-11 18:11:48.554  1838  1838 D wpa_supplicant: wlan0: Control interface command 'SIGNAL_POLL'
10-11 18:11:48.557  1838  1838 D wpa_supplicant: CTRL-DEBUG: global_ctrl_sock-sendto: sock=9 sndbuf=229376 outq=768 send_len=48
10-11 18:11:48.890 17591 17591 F libc    : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x7f89e54108 in tid 17591 (victim)
10-11 18:11:48.891   330   330 W         : debuggerd: handling request: pid=17591 uid=10071 gid=10071 tid=17591
10-11 18:11:48.885   330   330 I debuggerd64: type=1400 audit(0.0:429): avc: denied { read } for name="victim" dev="mmcblk0p49" ino=527666 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file permissive=1
10-11 18:11:48.885   330   330 I debuggerd64: type=1400 audit(0.0:430): avc: denied { open } for path="/data/data/com.termux/files/home/test/victim" dev="mmcblk0p49" ino=527666 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file permissive=1
10-11 18:11:48.885 17614 17614 I debuggerd64: type=1400 audit(0.0:431): avc: denied { getattr } for path="/data/data/com.termux/files/home/test/victim" dev="mmcblk0p49" ino=527666 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file permissive=1
10-11 18:11:48.906 17614 17614 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
10-11 18:11:48.906 17614 17614 F DEBUG   : LineageOS Version: '14.1-20180307-UNOFFICIAL-rolex'
10-11 18:11:48.906 17614 17614 F DEBUG   : Build fingerprint: 'Xiaomi/rolex/rolex:6.0.1/MMB29M/V8.5.1.0.MCCMIED:user/release-keys'
10-11 18:11:48.907 17614 17614 F DEBUG   : Revision: '0'
10-11 18:11:48.907 17614 17614 F DEBUG   : ABI: 'arm64'
10-11 18:11:48.907 17614 17614 F DEBUG   : pid: 17591, tid: 17591, name: victim  >>> ./victim <<<
10-11 18:11:48.907 17614 17614 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x7f89e54108
10-11 18:11:48.907 17614 17614 F DEBUG   :     x0   0000007f89e540e0  x1   0000007fc4cc6648  x2   0000007fc4cc6748  x3   0000007fc4cc67d0
10-11 18:11:48.907 17614 17614 F DEBUG   :     x4   000000559476d6ef  x5   0000007f8648d01e  x6   000000000000000a  x7   000000000000000a
10-11 18:11:48.907 17614 17614 F DEBUG   :     x8   0000000000000000  x9   000000559476d6fb  x10  0000000000004001  x11  0000000000000000
10-11 18:11:48.907 17614 17614 F DEBUG   :     x12  000000000ccccccc  x13  000000008000002f  x14  0000007f869a3fd8  x15  0000007f869a3c7c
10-11 18:11:48.907 17614 17614 F DEBUG   :     x16  0000007f89e41000  x17  0000007f89e540e0  x18  0000007f87965e92  x19  0000007fc4cc6648
10-11 18:11:48.908 17614 17614 F DEBUG   :     x20  0000007f89e540e0  x21  0000007fc4cc67d0  x22  0000007fc4cc6878  x23  0000000000000000
10-11 18:11:48.908 17614 17614 F DEBUG   :     x24  0000000000000000  x25  0000000000000000  x26  0000000000000000  x27  0000000000000000
10-11 18:11:48.908 17614 17614 F DEBUG   :     x28  0000007f89e54108  x29  0000007fc4cc6630  x30  0000007f89e41070
10-11 18:11:48.908 17614 17614 F DEBUG   :     sp   0000007fc4cc65a0  pc   0000007f8627f0f8  pstate 0000000000000000
10-11 18:11:48.910 17614 17614 F DEBUG   : 
10-11 18:11:48.910 17614 17614 F DEBUG   : backtrace:
10-11 18:11:48.910 17614 17614 F DEBUG   :     #00 pc 00000000001d20f8  /data/local/tmp/libhello.so (offset 0x188000)
10-11 18:11:48.910 17614 17614 F DEBUG   :     #01 pc 000000000000006c  <anonymous:0000007f89e41000>

Is there a way to debug the victim process ? what cause this Segmentation fault?

[InnotSagg]

more info to debug:

readelf -d /data/local/tmp/libhello.so 

Dynamic section at offset 0x2200b0 contains 27 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [liblog.so]
 0x0000000000000001 (NEEDED)             Shared library: [libandroid.so]
 0x0000000000000001 (NEEDED)             Shared library: [libm.so]
 0x0000000000000001 (NEEDED)             Shared library: [libdl.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so]
 0x000000000000000e (SONAME)             Library soname: [libagent.so]
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW
 0x0000000000000007 (RELA)               0x1e80
 0x0000000000000008 (RELASZ)             79632 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000006ffffff9 (RELACOUNT)          3299
 0x0000000000000017 (JMPREL)             0x15590
 0x0000000000000002 (PLTRELSZ)           3552 (bytes)
 0x0000000000000003 (PLTGOT)             0x220630
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000006 (SYMTAB)             0x308
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000005 (STRTAB)             0x17f8
 0x000000000000000a (STRSZ)              1671 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x1310
 0x0000000000000004 (HASH)               0x1330
 0x0000000000000019 (INIT_ARRAY)         0x220090
 0x000000000000001b (INIT_ARRAYSZ)       32 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x220080
 0x000000000000001c (FINI_ARRAYSZ)       16 (bytes)
 0x0000000000000000 (NULL)               0x1278

nm -D /data/local/tmp/libhello.so 
00000000000f10d4 T JNI_OnLoad
                 U __android_log_write
                 U __assert2
                 U __ctype_get_mb_cur_max
                 U __cxa_atexit
                 U __cxa_finalize
                 U __errno
                 U __memcpy_chk
                 U __memmove_chk
                 U __memset_chk
                 U __sF
                 U __stack_chk_fail
                 U __strcat_chk
                 U __strchr_chk
                 U __strcpy_chk
                 U __strlen_chk
                 U __strncat_chk
                 U __strncpy_chk
                 U __strncpy_chk2
                 U __system_property_get
                 U __vsnprintf_chk
                 U _exit
                 U abort
                 U access
                 U arc4random_buf
                 U atoi
                 U bsearch
                 U calloc
                 U clock_gettime
                 U close
                 U dl_iterate_phdr
                 U dlclose
                 U dlopen
                 U dlsym
                 U environ
                 U eventfd
                 U fclose
                 U fcntl
                 U fdopen
                 U feof
                 U ferror
                 U fflush
                 U fgets
                 U fileno
                 U fopen
                 U fprintf
                 U fputs
                 U fread
                 U free
                 U frexp
                 U frexpl
                 U fscanf
                 U fstat
                 U fwrite
                 U getauxval
                 U getc
                 U getenv
                 U getpid
                 U getrusage
                 U gettimeofday
                 U getuid
                 U isatty
                 U isdigit
                 U localtime
                 U lseek
                 U lstat
                 U madvise
                 U malloc
                 U mbrtowc
                 U memchr
                 U memcmp
                 U memcpy
                 U memmove
                 U memrchr
                 U memset
                 U mmap
                 U mprotect
                 U mremap
                 U munmap
                 U open
                 U opendir
                 U pipe
                 U pipe2
                 U poll
                 U posix_memalign
                 U pread
                 U pthread_attr_destroy
                 U pthread_attr_init
                 U pthread_attr_setstacksize
                 U pthread_create
                 U pthread_detach
                 U pthread_getspecific
                 U pthread_key_create
                 U pthread_key_delete
                 U pthread_mutex_destroy
                 U pthread_mutex_init
                 U pthread_mutex_lock
                 U pthread_mutex_unlock
                 U pthread_mutexattr_destroy
                 U pthread_mutexattr_init
                 U pthread_mutexattr_settype
                 w pthread_once
                 U pthread_rwlock_destroy
                 U pthread_rwlock_init
                 U pthread_rwlock_rdlock
                 U pthread_rwlock_unlock
                 U pthread_rwlock_wrlock
                 U pthread_self
                 U pthread_setname_np
                 U pthread_setspecific
                 U pthread_sigmask
                 U raise
                 U read
                 U realloc
                 U sched_yield
                 U setenv
                 U setlocale
                 U sigfillset
                 U snprintf
                 U sprintf
                 U sscanf
                 U stat
                 U stpcpy
                 U strcasecmp
                 U strcat
                 U strchr
                 U strcmp
                 U strcpy
                 U strerror
                 U strerror_r
                 U strftime
                 U strlen
                 U strncmp
                 U strncpy
                 U strnlen
                 U strpbrk
                 U strrchr
                 U strspn
                 U strstr
                 U strtol
                 U syscall
                 U sysconf
                 U time
                 U tolower
                 U toupper
                 U ungetc
                 U vsnprintf
                 U waitpid
                 U wcrtomb
                 U wcslen
                 U write

The entry is JNI_OnLoad

--------- beginning of crash
10-13 01:19:22.790  6257  6291 F libc    : Fatal signal 13 (SIGPIPE), code 0 in tid 6291 (victim)
10-13 01:19:22.783   498   498 I debuggerd64: type=1400 audit(0.0:400): avc: denied { read } for name="victim" dev="mmcblk0p49" ino=131454 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file permissive=1
10-13 01:19:22.783   498   498 I debuggerd64: type=1400 audit(0.0:401): avc: denied { open } for path="/data/data/com.termux/files/home/victim" dev="mmcblk0p49" ino=131454 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file permissive=1
10-13 01:19:22.791   498   498 I DEBUG   : property debug.db.uid not set; NOT waiting for gdb.
10-13 01:19:22.791   498   498 I DEBUG   : HINT: adb shell setprop debug.db.uid 100000
10-13 01:19:22.791   498   498 I DEBUG   : HINT: adb forward tcp:5039 tcp:5039
10-13 01:19:22.800  2103  2103 D wpa_supplicant: wlan0: Control interface command 'SIGNAL_POLL'
10-13 01:19:22.802  2103  2103 D wpa_supplicant: CTRL-DEBUG: global_ctrl_sock-sendto: sock=12 sndbuf=229376 outq=0 send_len=48
10-13 01:19:22.833   498   498 I debuggerd64: type=1400 audit(0.0:402): avc: denied { getattr } for path="/data/data/com.termux/files/home/victim" dev="mmcblk0p49" ino=131454 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file permissive=1
10-13 01:19:22.843   498   498 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
10-13 01:19:22.843   498   498 F DEBUG   : LineageOS Version: '13.0-20171205-UNOFFICIAL-rolex'
10-13 01:19:22.843   498   498 F DEBUG   : Build fingerprint: 'Xiaomi/rolex/rolex:6.0.1/MMB29M/V8.5.1.0.MCCMIED:user/release-keys'
10-13 01:19:22.843   498   498 F DEBUG   : Revision: '0'
10-13 01:19:22.844   498   498 F DEBUG   : ABI: 'arm64'
10-13 01:19:22.844   498   498 F DEBUG   : pid: 6257, tid: 6291, name: victim  >>> ./victim <<<
10-13 01:19:22.844   498   498 F DEBUG   : signal 13 (SIGPIPE), code 0 (SI_USER), fault addr --------
--------- beginning of system
10-13 01:19:22.846  1371  1765 W NativeCrashListener: Couldn't find ProcessRecord for pid 6257
10-13 01:19:22.850   498   498 F DEBUG   :     x0   ffffffffffffffe0  x1   0000007f9cf6b3e0  x2   0000000000000001  x3   0000007f9cf6b3dc
10-13 01:19:22.851   498   498 E DEBUG   : AM write failed: Broken pipe
10-13 01:19:22.851   498   498 F DEBUG   :     x4   0000000000000000  x5   0000000000000003  x6   0000000000000000  x7   0000000000000000
10-13 01:19:22.851   498   498 F DEBUG   :     x8   0000000000000040  x9   000000000000002d  x10  0000007f9cf6ad8c  x11  0000007f9cf6adc8
10-13 01:19:22.851   498   498 F DEBUG   :     x12  0000007f9cf6aca0  x13  000000000000002b  x14  0000007f9cf6af20  x15  0000000000000000
10-13 01:19:22.851   498   498 F DEBUG   :     x16  0000007fa01b1a58  x17  0000000000000000  x18  0000007fa00effd8  x19  0000007f9cf973e8
10-13 01:19:22.851   498   498 F DEBUG   :     x20  0000007f9cf6d000  x21  0000000000000003  x22  0000000000000001  x23  00000000000ff000
10-13 01:19:22.851   498   498 F DEBUG   :     x24  0000000000000002  x25  0000007f9cf6d000  x26  0000007fa0170000  x27  0000007f9cf6d470
10-13 01:19:22.851   498   498 F DEBUG   :     x28  0000000000001000  x29  0000007f9cf6b410  x30  0000007f9cf6c140
10-13 01:19:22.851   498   498 F DEBUG   :     sp   0000007f9cf6b3e0  pc   0000007fa0173904  pstate 0000000060000000
10-13 01:19:22.852   498   498 F DEBUG   : 
10-13 01:19:22.852   498   498 F DEBUG   : backtrace:
10-13 01:19:22.852   498   498 F DEBUG   :     #00 pc 000000000004b904  /system/lib64/libc.so (offset 0x20000)
10-13 01:19:22.852   498   498 F DEBUG   :     #01 pc 000000000000013c  <unknown>
10-13 01:19:22.903   498   498 F DEBUG   : 
10-13 01:19:22.903   498   498 F DEBUG   : Tombstone written to: /data/tombstones/tombstone_08

[InnotSagg]

I made a new test example:

tests_java_agent is a aarch64 android example, the code is like victim.c, instead inject libagent.so, it link with libagent.so and call JNI_OnLoad after first sleep.

the output:

ldd ./tests_java_agent.exe 
libagent.so
libm.so
libdl.so
libc.so

./tests_java_agent.exe 
0...
1...
open("/etc/hosts", 0x1)
2...
open("/etc/hosts", 0x1)

I can see the hook is work. but if I inject libagent.so into victim, I get this crash.

And I can not use gdb with the inject process, how can I tell what is wrong here?

a.zip

from the crash log, backtrace some time look like this:

10-13 02:04:35.546   498   498 F DEBUG   : backtrace:
10-13 02:04:35.547   498   498 F DEBUG   :     #00 pc 00000000001f8fe4  /data/local/tmp/inject (offset 0x1cb000)
10-13 02:04:35.547   498   498 F DEBUG   :     #01 pc 00000000001f8fdc  /data/local/tmp/inject (offset 0x1cb000)

or like this:

10-13 02:07:03.797   498   498 F DEBUG   : backtrace:
10-13 02:07:03.797   498   498 F DEBUG   :     #00 pc 000000000004b904  /system/lib64/libc.so (offset 0x20000)
10-13 02:07:03.797   498   498 F DEBUG   :     #01 pc 000000000000013c  <unknown>

[hacksysteam]

@InnotSagg I had the same issue, this is because the entry point was not provided or wrong. Try providing an entry point and see if it still crashes. After providing an entry point, I didn't get crashes.