Repository navigation
linux: Fix attach when /proc/<pid>/maps has non-UTF-8 bytes - #1284
Merged
Merged
Conversation
Mapping names are not always valid UTF-8: file paths may hold any bytes, and on Android kernels before 5.17 an anonymous mapping's name is read from a user pointer whenever the maps are read, so a name whose string got unmapped shows up as random bytes. We hit this with Magisk's Zygisk, where apps inherit [anon:System property context nodes] from zygote with a garbage name. GRegex rejects a subject that is not valid UTF-8 unless the pattern is raw, so one such line made ProcMapsIter yield no mappings at all. The injector then could not find libc in the target, and attach failed.
Gum.Linux.enumerate_ranges() gives paths as they appear in the maps, like "/memfd:jit-zygote-cache (deleted)", so the "memfd:" prefix check from 72a9622 never matched. When libc could not be found in the target, the code swap then picked ART's read-only JIT zygote cache and the first write failed with "unable to perform ptrace pokedata: I/O error".
Contributor
Author
|
With the raw-bytes parse, a |
Member
|
Thanks! 🙌 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On a rooted Galaxy S10+ running LineageOS 23.2 (Android 16, kernel 4.14), attach failed with
unable to perform ptrace pokedata: I/O errorwhenever a line of the target's/proc/<pid>/mapswas not valid UTF-8. Two bugs chain here:ProcMapsItermatches with a GRegex that isn'tRAW, and GRegex rejects the whole subject over one invalid byte. So no mappings were seen at all, no libc was found in the target, and attach fell back to the code swap. Such lines do occur: file paths can hold any bytes, and on Android kernels before 5.17 an anonymous mapping's name is read from a user pointer on every read, so a name whose string went away reads as garbage. This showed up in apps while Magisk's built-in Zygisk was enabled: their[anon:System property context nodes]mapping showed random bytes. The zymbiote heap scan had the same regex issue.memfd:, but Gum reports paths like/memfd:jit-zygote-cache (deleted). So it never matched, and the code swap wrote into ART's read-only JIT cache. That's the failure analysed in how to resolve error message unable to perform ptrace pokedata frida#2782.Tested with deskclock and calculator2, after naming an anonymous page in the app with
prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, addr, len, name)from a script and then overwriting the name's bytes with\xff\xfe\x80:mainwith both commits behaves the same.The new Linux test injects into a labrat started from a path ending in a 0xff byte. On main it fails with "Unable to find libc.so.6 in the target process" (linux-arm64), and it passes with the fix, along with the other injector tests.