How to start an application by dynamorio on android

[bob li]

Hello

I am trying to  application on Android devices through dynamorio, such as settings, camera, etc. I follow the https://dynamorio.org/page_deploy.html#android_deploy , created the wrapper script. Now I can start ls through this script. The command is as follows

./wrap.sh ls

But now I don't know how to start an application. I don't know what parameters to pass in

./wrap.sh path/to/apk   or

./wrap.sh com.android.camera ,

or something else? If I want to start the camera application through dynamorio and get the number of instructions in the running process of the camera, what parameters should I pass into this script?

[Derek Bruening]

The setprop command to use logwrapper should cause the script to be invoked when the application is started through the launcher.

--
You received this message because you are subscribed to the Google Groups "DynamoRIO Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dynamorio-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dynamorio-users/6937ac5d-1dc1-41df-8d74-aa92f71036dbn%40googlegroups.com.

[bob li]

I used setprop command like this:

setprop wrap.com.android.settings "logwrapper /data/local/tmp/wrap.sh"

and getprop show :

when I use am start com.android.settings, the application starts normally, but the script seemed not to be invoked

The wrap.sh is located in the /data/local/tmp location and is as follows

#!/system/bin/sh
echo hello
export TMPDIR=/data/data/com.android.settings
exec /data/local/tmp/dynamorio-test/bin64/drrun -- $@

Am I missing any steps? 

Thanks for your reply.

[bob li]

And the logcat also can't find the dynamorio or wrap.sh, my phone in the root.

[Derek Bruening]

I haven't done this myself in a long time so maybe recent Android versions have changed.  Maybe someone more familiar with newer versions can help.  Or if you investigate and discover that a different technique is needed, please consider sending a PR to update the docs and contribute to Android support.

To view this discussion on the web visit https://groups.google.com/d/msgid/dynamorio-users/bf5a43a0-0280-4db4-ab8c-0de5d06c2343n%40googlegroups.com.

[bob li]

Seems to be a problem with the system firmware, now wrapper works fine. But I failed when launching the app with drrun, without client.

The wrap_self.sh is as 

#!/system/bin/sh
echo hello
export TMPDIR=/data/data/com.ss.android.article.news
echo $@
exec /data/local/tmp/dynamorio-test/bin64/drrun -- $@ 

the logcat show dynamorio crash after the "class_init is effectively a no-op"

I want to use debug to find the propblem, but the dynamorio cannot find it. I make dynamorio follow this : Building from Source (dynamorio.org)

So, I added the option -DDEBUG=ON when make dynamorio, but now the output is as follows:

I don't know what the debug output means, it doesn't seem to be normal, how can I use dynamorio on android correctly? I really want to know the reason why dynamorio crashes during app startup.

Thanks！

[bob li]

Busybox can run normally in dynamorio, but the android application crashes, when I start the app with wrapper, the final output before dynamorio crashes is as follows，

10-07 22:33:54.119  4841  4841 I wrap_self.sh: <cluster length assert: ret_bb cluster=227 vs 192, cap=4097, entries=2224>
10-07 22:33:54.140  4841  4841 I wrap_self.sh: <CURIOSITY : (0) && "table collision cluster is too large" in file /home/lhx6355/benchmark/dynamorio/core/hashtablex.h line 877
10-07 22:33:54.140  4841  4841 I wrap_self.sh: version 8.0.0, custom build
10-07 22:33:54.140  4841  4841 I wrap_self.sh: -no_dynamic_options -code_api -stack_size 56K -signal_stack_size 32K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007627bd7a40 0x00000076ebb97624
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007627bd7bf0 0x00000076ebbb118c
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007627bd7c50 0x00000076ebbb1fe4
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007627bd7cf0 0x00000076ebc12c28
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007627bd7e10 0x00000076ebc12b18
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007627bd7e80 0x00000076ebc0ddf8
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007627bd7f40 0x00000075766341b8
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007fc7686480 0x0000007576633f68
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007fc7686590 0x0000007576633bc0
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007fc76865f0 0x00000075766127a0
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007fc7686660 0x000000757660e26c
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007fc7690b70 0x0000007576896e7c
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007fc7690c70 0x0000007576896d5c
10-07 22:33:54.140  4841  4841 I wrap_self.sh: 0x0000007fc7690d00 0x00000075768d24b8
10-07 22:33:54.141  4841  4841 I wrap_self.sh: 0x0000007fc7690d40 0x000000757678bcf4>

10-07 22:34:00.986  4841  4841 I wrap_self.sh: <Application /system/bin/app_process64 (4842).  Internal Error: DynamoRIO debug check failure: /home/lhx6355/benchmark/dynamorio/core/unix/memcache.c:421 found
10-07 22:34:00.987  4841  4841 I wrap_self.sh: (Error occurred @33673 frags)
10-07 22:34:00.987  4841  4841 I wrap_self.sh: version 8.0.0, custom build
10-07 22:34:00.987  4841  4841 I wrap_self.sh: -no_dynamic_options -code_api -stack_size 56K -signal_stack_size 32K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007627bd7680 0x00000076ebc295b4
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007627bd7820 0x00000076ebea3ea4
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007627bd7a70 0x00000076ebe79d00
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007627bd7af0 0x00000076ebe79db8
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007627bd7b10 0x00000076ebe72ae0
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007627bd7b70 0x00000076ebc1b69c
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007627bd7d90 0x00000076ebc12718
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007627bd7e80 0x00000076ebc0ddf8
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007627bd7f40 0x00000075768f8078
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007fc7690760 0x00000075765de628
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007fc7690820 0x00000075765dcd10
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007fc76908e0 0x00000075765db270
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007fc7690990 0x00000075768d35e0
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007fc7690ce0 0x00000075768d25b8
10-07 22:34:00.987  4841  4841 I wrap_self.sh: 0x0000007fc7690d40 0x000000757678bd00>
10-07 22:34:00.995  4841  4841 I wrap_self.sh: wrap_self.sh terminated by exit(255)

[Nahome Bete]

Can you clarify the DR version you are using (8.0.0?) and if this issue is reproducible on the latest release?

[bob li]

Yes,  I'm sure the version is 8.0.0. And I tried it under 9.0.0 and the result is different and I am not clear about the meaning of the debug output format, like " 0x00000070791df3e0 0x00000072bd2881e0"

Without -DDUG=ON  && busybox :  It's fine

OP5209L1:/data/local/tmp # dynamorio-test/bin64/drrun -- ls
dynamorio-test   wrap_self.sh  wrap.sh

Have -DDUB=ON && busybox: It's fails 

Dynamorio crash, I don't understand why it fails to run after add -debug option?

OP5209L1:/data/local/tmp # dynamorio-test/bin64/drrun -debug -- ls

<Starting application /system/bin/toybox (22552)>
<Initial options = -no_dynamic_options -code_api -stack_size 56K -signal_stack_size 32K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct >
<Paste into GDB to debug DynamoRIO clients:
set confirm off
add-symbol-file '/data/local/tmp/dynamorio-test/lib64/debug/libdynamorio.so' 0x00000072bd1d2730
>
<get_memory_info mismatch! (can happen if os combines entries in /proc/pid/maps)
    os says: 0x00000072bda7a000-0x00000072bda85000 prot=0x0000000b
    cache says: 0x00000072bda7e000-0x00000072bda7f000 prot=0x0000000b
>
<Application /system/bin/toybox (22552).  Internal Error: DynamoRIO debug check failure: /home/lhx6355/benchmark/dynamorio/core/vmareas.c:948 !(start < v->buf[i].end && end > v->buf[i].start) || !TEST(VECTOR_NEVER_OVERLAP, v->flags)
(Error occurred @3808 frags in tid 22552)
version 9.0.19080, custom build

-no_dynamic_options -code_api -stack_size 56K -signal_stack_size 32K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct

0x00000070791df3e0 0x00000072bd2881e0
0x00000070791df580 0x00000072bd341888
0x00000070791df800 0x00000072bd346f34
0x00000070791df930 0x00000072bd374d48
0x00000070791df970 0x00000072bd577a44
0x00000070791df9b0 0x00000072bd3749e4
0x00000070791dfa40 0x00000072bd3750b8
0x00000070791dfa90 0x00000072bd554da0
0x00000070791dfaf0 0x00000072bd555254
0x00000070791dfc20 0x00000072bd555fb4
0x00000070791dfca0 0x00000072bd27ace4
0x00000070791dfe50 0x00000072bd270d88
0x00000070791dfe80 0x00000072bd26c1c8
0x00000070791dff40 0x00000072bd99b938
0x0000007fc573ae00 0x00502272bd99c894
/data/local/tmp/dynamorio-test/lib64/debug/libdynamorio.so=0x00000072bd1be000>

Have -DDUG=ON  && busybox : It's fails, the result is the same as the Dynamorio8.0.0

wrap_self.sh: <Startg applatn /system/b/app_process64 (631)>
wrap_self.sh: <l optns = -no_dynam_optns -code_ap-stack_se 56K -snal_stack_se 32K -max_ele_jmp 0 -max_ele_call 0 -early_ject -emulate_brk -no_le_nored_syscalls -nate_exec_default_lt '' -no_nate_exec_managed_code -no_dcall2dect >

wrap_self.sh: <get_memory_fo mmatch! (can happen  os combes entrs  /proc/p/maps)
wrap_self.sh:     os says: 0x0000007601a9a000-0x0000007601aa5000 prot=0x0000000b
wrap_self.sh:     cache says: 0x0000007601a9e000-0x0000007601a9f000 prot=0x0000000b
wrap_self.sh: >

wrap_self.sh: <(1+x) Handlg our fault  a TRY at 0x00000076014e59f4>

wrap_self.sh: <CURSY : (0) && "crashed whe walkg dynam header"  fe /home/lhx6355/benchmark/dynamor/core/un/module_elf.c le 326
wrap_self.sh: versn 9.0.19080, custom bud
wrap_self.sh: -no_dynam_optns -code_ap-stack_se 56K -snal_stack_se 32K -max_ele_jmp 0 -max_ele_call 0 -early_ject -emulate_brk -no_le_nored_syscalls -nate_exec_default_lt '' -no_nate_exec_managed_code -no_dcall2dect
wrap_self.sh: 0x00000073bd1fd780 0x000000760152a138
wrap_self.sh: 0x00000073bd1fd910 0x000000760152acc0
wrap_self.sh: 0x00000073bd1fda70 0x00000076014f97fc
wrap_self.sh: 0x00000073bd1fdaf0 0x00000076014f5c28
wrap_self.sh: 0x00000073bd1fdb50 0x000000760121ef48
wrap_self.sh: 0x00000073bd1fdd90 0x0000007601215dd4
wrap_self.sh: 0x00000073bd1fde80 0x00000076012111c8
wrap_self.sh: 0x00000073bd1fdf40 0x00000076019bd8f4
wrap_self.sh: 0x0000007ff644f660 0x0013d176019bd1c0
wrap_self.sh: 0x0000007ff644f6d0 0x0011a3f6019a9b30
wrap_self.sh: 0x0000007ff644f720 0x006211f6019a92f4
wrap_self.sh: 0x0000007ff644f970 0x000641f6019abeb0
wrap_self.sh: 0x0000007ff6450af0 0x006057f6019a71fc
wrap_self.sh: 0x0000007ff6450b50 0x0063f1f5fdf59034
wrap_self.sh: 0x0000007ff6450b90 0x005220f31a21a8a0
wrap_self.sh: /data/local/tmp/dynamor-test/l64/debug/ldynamor.so=0x0000007601163000>

wrap_self.sh: <cluster length assert: ret_bb cluster=227 vs 192, cap=4097, entrs=2228>
wrap_self.sh: <CURSY : (0) && "table colln cluster  too large"  fe /home/lhx6355/benchmark/dynamor/core/hashtablex.h le 877
wrap_self.sh: versn 9.0.19080, custom bud
wrap_self.sh: -no_dynam_optns -code_ap-stack_se 56K -snal_stack_se 32K -max_ele_jmp 0 -max_ele_call 0 -early_ject -emulate_brk -no_le_nored_syscalls -nate_exec_default_lt '' -no_nate_exec_managed_code -no_dcall2dect
wrap_self.sh: 0x00000073bd1fda40 0x0000007601199f58
wrap_self.sh: 0x00000073bd1fdbf0 0x00000076011b4680
wrap_self.sh: 0x00000073bd1fdc50 0x00000076011b5520
wrap_self.sh: 0x00000073bd1fdcf0 0x0000007601216304
wrap_self.sh: 0x00000073bd1fde10 0x00000076012161e4
wrap_self.sh: 0x00000073bd1fde80 0x00000076012111c8
wrap_self.sh: 0x00000073bd1fdf40 0x0000007315c341b8
wrap_self.sh: 0x0000007ff64462b0 0x0000007315c33f68
wrap_self.sh: 0x0000007ff64463c0 0x0000007315c33bc0
wrap_self.sh: 0x0000007ff6446420 0x0000007315c127a0
wrap_self.sh: 0x0000007ff6446490 0x0000007315c0e26c
wrap_self.sh: 0x0000007ff64509a0 0x0000007315e96e7c
wrap_self.sh: 0x0000007ff6450aa0 0x0000007315e96d5c
wrap_self.sh: 0x0000007ff6450b30 0x0000007315ed24b8
wrap_self.sh: 0x0000007ff6450b70 0x0000007315d8bcf4
wrap_self.sh: /data/local/tmp/dynamor-test/l64/debug/ldynamor.so=0x0000007601163000>

wrap_self.sh: <Applatn /system/b/app_process64 (631).  ternal Error: DynamoR debug check faure: /home/lhx6355/benchmark/dynamor/core/un/memcache.c:422 found
wrap_self.sh: (Error occurred @33648 frags  t 631)
wrap_self.sh: versn 9.0.19080, custom bud
wrap_self.sh: -no_dynam_optns -code_ap-stack_se 56K -snal_stack_se 32K -max_ele_jmp 0 -max_ele_call 0 -early_ject -emulate_brk -no_le_nored_syscalls -nate_exec_default_lt '' -no_nate_exec_managed_code -no_dcall2dect
wrap_self.sh: 0x00000073bd1fd650 0x000000760122d1e0
wrap_self.sh: 0x00000073bd1fd7f0 0x0000007601528900
wrap_self.sh: 0x00000073bd1fda50 0x00000076014fe154
wrap_self.sh: 0x00000073bd1fdad0 0x00000076014fe20c
wrap_self.sh: 0x00000073bd1fdaf0 0x00000076014f64f0
wrap_self.sh: 0x00000073bd1fdb50 0x000000760121ef48
wrap_self.sh: 0x00000073bd1fdd90 0x0000007601215dd4
wrap_self.sh: 0x00000073bd1fde80 0x00000076012111c8
wrap_self.sh: 0x00000073bd1fdf40 0x0000007315ef8078
wrap_self.sh: 0x0000007ff6450590 0x0000007315bde628
wrap_self.sh: 0x0000007ff6450650 0x0000007315bdcd10
wrap_self.sh: 0x0000007ff6450710 0x0000007315bdb270
wrap_self.sh: 0x0000007ff64507c0 0x0000007315ed35e0
wrap_self.sh: 0x0000007ff6450b10 0x0000007315ed25b8
wrap_self.sh: 0x0000007ff6450b70 0x0000007315d8bd00
wrap_self.sh: /data/local/tmp/dynamor-test/l64/debug/ldynamor.so=0x0000007601163000>
wrap_self.sh: wrap_self.sh termated by ex(255)

[Derek Bruening]

Unfortunately Android support has languished: new volunteers are needed from the open source community to help improve Android support.

If you would like to help there are a number of filed issues in the tracker, including setting up Github Actions testing https://github.com/DynamoRIO/dynamorio/issues/4639.

There is a proposed plan to solve the recent Linux private loader issues which may help Android in that area.

> I am not clear about the meaning of the debug output format, like " 0x00000070791df3e0 0x00000072bd2881e0"

That's a call stack: frame pointer and return address.  It can be symbolized offline but if a problem is reproducible it is generally easier to reproduce inside the debugger and get the symbolized callstack there.

To view this discussion on the web visit https://groups.google.com/d/msgid/dynamorio-users/85b6493f-b5e0-4b37-b7c7-68f4bc2f42f1n%40googlegroups.com.