Running dex2oat on the host

[Ryan Riley]

Hello,

I'm working on a research project that involves analyzing the native code output from dex2oat.

Right now our procedure for getting the compiled native code for an apk is as follows:

1. Install APK on a nexus 5 with Android 5.1.1, this causes the phone to run dex2oat and produce the native code

2. Grab the .dex file produced and load it onto a computer

3. Use oatdump on the .dex file to disassemble the code and get the assembly instructions.

This worked fine for 300-400 apps, but now we want to do this at scale (10,000 apps) and obviously step 1 is a huge bottleneck.  I'd like to run dex2oat on the host in order to produce the native code.  I can successfully build it without problem, but I can't figure out what arguments to pass it to get it to successfully compile an apk.  (I also can't run any of the tests in art/test)

Does anyone have any tips or thoughts?

Thanks

Ryan

[Dave Smith]

The dex2oat binary is designed to run on the device, because it requires the presence of the target environment in order to properly compile the code for the appropriate ABI (armv7, armv8, x86, and so on). It's not clear whether your project is meant to take the ABI variations into account as well, but using a single device won't allow you to analyze that piece of the puzzle.

The best option to "scale" your operation would be to construct a setup that uses emulators instead of a physical device (you can use --no-window to start an emulator without a graphical view). Even the main AOSP build system does this, both with the previous dexopt and the current dex2oat, an emulator environment for the target ABI is used to execute the compilation step for all prebuilt system applications.

Cheers,

--

Dave Smith, PE

@devunwired

[Ryan Riley]

Thanks a lot, this is a huge help and works great! 

Just to make the problem more complex (for you or anyone else to answer) any idea how to do it and produce ARM binaries instead of x86?

Thanks
Ryan

On 10/26/2015 05:38 PM, Andrew Reiter wrote:

Hi,

I was fuzzing dex2oat awhile back and so was running on host.  I managed to get it running with the tree as of mid-May, but when I upgraded August 4th to master, my patch to the build system failed and I did not easily get things going again and so I stopped the fuzzing work. So, the below is going off of that slightly outdated bit of information:

After ‘make build-art-host’, 

$ export ANDROID_DATA=/path/to/Android-Sources/android-5.1.1_r4/out/host/datadir/dalvik-cache/x86_64

$ export ANDROID_ROOT=out/host/linux-x86

$ mkdir -p $ANDROID_DATA

$ out/host/linux-x86/bin/dex2oat --runtime-arg -classpath --runtime-arg $1 --instruction-set=x86 \

  --runtime-arg -Xrelocate --host --boot-image=/path/to/Android-Sources/android-5.1.1_r4/out/host/linux-x86/framework/core.art \

  --dex-file=$1 --oat-file=$ANDROID_DATA/out1.oat

I hope this helps you out!

Cheers,

Andrew

From: Ryan Riley <rril...@gmail.com>
Reply-To: "android-...@googlegroups.com" <android-...@googlegroups.com>
Date: Monday, October 26, 2015 at 1:57 AM
To: android-platform <android-...@googlegroups.com>
Subject: Running dex2oat on the host

Hello,

I'm working on a research project that involves analyzing the native code output from dex2oat.

Right now our procedure for getting the compiled native code for an apk is as follows:

1. Install APK on a nexus 5 with Android 5.1.1, this causes the phone to run dex2oat and produce the native code

2. Grab the .dex file produced and load it onto a computer

3. Use oatdump on the .dex file to disassemble the code and get the assembly instructions.

This worked fine for 300-400 apps, but now we want to do this at scale (10,000 apps) and obviously step 1 is a huge bottleneck.  I'd like to run dex2oat on the host in order to produce the native code.  I can successfully build it without problem, but I can't figure out what arguments to pass it to get it to successfully compile an apk.  (I also can't run any of the tests in art/test)

Does anyone have any tips or thoughts?

Thanks

Ryan

--
You received this message because you are subscribed to the Google Groups "android-platform" group.
To unsubscribe from this group and stop receiving emails from it, send an email to android-platfo...@googlegroups.com.
To post to this group, send email to android-...@googlegroups.com.
Visit this group at http://groups.google.com/group/android-platform.
For more options, visit https://groups.google.com/d/optout.

[Andrew Reiter]

Hi,

I was fuzzing dex2oat awhile back and so was running on host.  I managed to get it running with the tree as of mid-May, but when I upgraded August 4th to master, my patch to the build system failed and I did not easily get things going again and so I stopped the fuzzing work. So, the below is going off of that slightly outdated bit of information:

After ‘make build-art-host’, 

$ export ANDROID_DATA=/path/to/Android-Sources/android-5.1.1_r4/out/host/datadir/dalvik-cache/x86_64

$ export ANDROID_ROOT=out/host/linux-x86

$ mkdir -p $ANDROID_DATA

$ out/host/linux-x86/bin/dex2oat --runtime-arg -classpath --runtime-arg $1 --instruction-set=x86 \

  --runtime-arg -Xrelocate --host --boot-image=/path/to/Android-Sources/android-5.1.1_r4/out/host/linux-x86/framework/core.art \

  --dex-file=$1 --oat-file=$ANDROID_DATA/out1.oat

I hope this helps you out!

Cheers,

Andrew

From: Ryan Riley <rril...@gmail.com>
Reply-To: "android-...@googlegroups.com" <android-...@googlegroups.com>
Date: Monday, October 26, 2015 at 1:57 AM
To: android-platform <android-...@googlegroups.com>
Subject: Running dex2oat on the host

[Andrew Reiter]

Not answering your question, oops, ..

…but just a side note to others: the $1 in the dex2oat lines is meant to be the dex file path.

[Ryan Riley]

I figured it out based on Andrew's original help.  Here it is in case others search the list later and want the solution.  Just a note, this does produce oat files with the correct type of native code in them, but I haven't verified whether they can run, what they are linked to, etc.  (I'm going to use them for static analysis.)

I've put the scripts up as a gist, but included them here so it will be archived with the list:

x86: https://gist.github.com/rriley/ce38ab20532c1d7a2667

ARM:  https://gist.github.com/rriley/a0b5eb36a093a66e86a8

How to use ART to compile x86 oat files on the host

  - Get source code according to https://source.android.com/source/downloading.html

  - source build/envsetup.sh

  - mm build-art

  - Use the following script in the root of the source directory:

######

CWD=`pwd`

export ANDROID_DATA="${CWD}/out/host/datadir/dalvik-cache/x86_64"

export ANDROID_ROOT="${CWD}/out/host/linux-x86"

BOOT_IMAGE="${CWD}/out/host/linux-x86/framework/core.art"

OUTPUT="${CWD}/out/oatfiles/x86"

mkdir -p $OUTPUT

mkdir -p $ANDROID_DATA

out/host/linux-x86/bin/dex2oat --runtime-arg -classpath --runtime-arg $1 --instruction-set=x86 --runtime-arg -Xrelocate --host --boot-image=$BOOT_IMAGE --dex-file=$1 --oat-file=$OUTPUT/$1.oat

######

How to use ART to compile ARM oat files on the host

  - Get source code according to https://source.android.com/source/downloading.html

  - mm build-art

  - Build the full android image for aosp_arm-eng

    (Follow the directions at https://source.android.com/source/building.html)

  - Use the following script in the root of the source directory:

######

CWD=`pwd`

export ANDROID_DATA="${CWD}/out/host/datadir/dalvik-cache/x86_64"

export ANDROID_ROOT="${CWD}/out/host/linux-x86"

BOOT_IMAGE="${CWD}/out/target/product/generic/system/framework/boot.art"

OUTPUT="${CWD}/out/oatfiles/arm"

mkdir -p $OUTPUT

mkdir -p $ANDROID_DATA

out/host/linux-x86/bin/dex2oat --runtime-arg -classpath --runtime-arg $1 --instruction-set=arm --runtime-arg -Xrelocate --host --boot-image=$BOOT_IMAGE --dex-file=$1 --oat-file=$OUTPUT/$1.oat

######

[Andrew Reiter]

I did some things awhile back while trying to understand the ART setup.. And I found this little bit from my notes. It likely will not directly help, but it might help you find the trick:

$ mkdir -p com/foo
$ vi com/foo/Foo.java
$ cat ~/com/foo/Foo.java
package com.foo;
public class Foo {
        public static void main(String[] args) {
                System.out.println("What's up\n");
        }
}
$ cd com/foo && javac Foo.java
$ jar cf foo.jar com
$ android-sdk-linux/build-tools/android-4.4W/dx --dex --output=mine.dex foo.jar
$ linux-x86/bin/art --32 -classpath ~/mine.dex com.foo.Foo
art I 18572 18572 art/runtime/gc/space/image_space.cc:270] RelocateImage: /home/areiter/Android-Sources/l-p2/out/host/linux-x86/bin/../bin/patchoat --input-image-location=/home/areiter/Android-Sources/l-p2/out/host/linux-x86/bin/../framework/core.art --output-image-file=/home/areiter/Android-Sources/l-p2/out/host/android-data18564/dalvik-cache/x86/home@areiter@Android-Sources@l-p2@out@host@linux-x86@bin@..@fram...@core.art --input-oat-location=/home/areiter/Android-Sources/l-p2/out/host/linux-x86/bin/../framework/core.oat --output-oat-file=/home/areiter/Android-Sources/l-p2/out/host/android-data18564/dalvik-cache/x86/home@areiter@Android-Sources@l-p2@out@host@linux-x86@bin@..@fram...@core.oat --instruction-set=x86 --base-offset-delta=1875968
dex2oat I 18574 18574 art/dex2oat/dex2oat.cc:1262] /home/areiter/Android-Sources/l-p2/out/host/linux-x86/bin/../bin/dex2oat --runtime-arg -classpath --runtime-arg /home/areiter/mine.dex --instruction-set=x86 --instruction-set-features=none --runtime-arg -Xrelocate --host --boot-image=/home/areiter/Android-Sources/l-p2/out/host/linux-x86/bin/../framework/core.art --dex-file=/home/areiter/mine.dex --oat-fd=3 --oat-location=/home/areiter/Android-Sources/l-p2/out/host/android-data18564/dalvik-cache/x86/home@areiter@mine.dex
dex2oat I 18574 18574 art/dex2oat/dex2oat.cc:292] dex2oat took 242.693ms (threads: 8)
What's up
 
$

Note my specifying the main() containing class. Note that this also combines the patch oat and dex2oat steps.  I did nothing further with this as my goal at the time was just to run dex2oat.

I hope this helps you,

Andrew

[James tao]

Hi Ryan

Do you have any further step on this issue? I' m working and android TV(base on android 6.0), and I also trouble with booting time when  the first boot time.

1) android has give a way by useing .odex as below build option.
      .WITH_DEXPREOPT := true
    but it will case the system.img too large.

2) using .dex file produced on host PC and  then reload to device. Do you have successed on the way?

Thanks!

在 2015年10月26日星期一 UTC+8下午10:01:26，Ryan Riley写道：

[Ryan Riley]

Hello,

I never tried that putting the compiled dex files onto a device and running them.  Sorry!

Thanks

Ryan