A7 - INJECTED APK READY + TASK B FINDINGS
A7 - INJECTED APK READY
APK: /home/jahidbybit86/results/cmaster-injected-aligned-debugSigned.apk
Size: 28 MB
SHA256: 8e97dcacc63219eb5731114c47b5f72cae691347a2c88962098ea869486cb928
Download from Cloud Shell:
cloudshell download ~/results/cmaster-injected-aligned-debugSigned.apk
Install: uninstall com.cmaster.cloner first (the signature changed), then install the APK.
Log: /sdcard/Android/data/com.cmaster.cloner/files/frida.log
open one clone first so the launch path runs; open the file with a file manager.
Risks (A6):
- repack/signature detection
- the gadget loads in EVERY process because App.<clinit> runs in the 300 :agentN
processes too
- cloned apps may run in separate :agentN processes
TASK B - B1 BRANCH-OFFSET FINDING
Program 1 (dm1.OooOO0O, 187 bytes) trace path:
0x00 0x9e 0x04 0x9b 0x06 0x9b 0x08 0x59
0x40 0x1e 0x44 0x0e 0x48 0x59 0xf4 0x0b 0xf8 0x0a 0xfc 0x41
0x00 0xc8 0x04 0x9e
- The branch at 0x44/0x48 targets 0xf4 (244), which is PAST the 187-byte body (0xbb).
- The engine then reads filler (0x0b/0x0a/0x41/0xc8/0x9e) and stops at pc=0x104.
- This is a POSSIBLE DECODE/BRANCH-OFFSET PROBLEM, not harness filler.
- The 0x9e at 0x104 is filler; the 0x9e at 0x100 is the GetObjectField at the filler.
- Rerun with the 0x9e GetObjectField returning 0 vs non-zero: NOT RUN - the branch target
is the root cause; the rerun would not change it.
B2 - BODY TAGS
Body Length pc range Status
dm1.OooOO0O (outer) 187 bytes 0x00-0x104 past end at 0xf4 (branch-offset problem)
o0O00OOO.OooO (outer) 130 bytes 0x00-0x28 within body; nested throw
dm1.OooO0Oo (nested) nested called by 0x04 at pc 0x28 nested throw at resolver.cpp:1648
B3 - CORRECTED SLOT LABELS
Slot Program Real type Why
0x100 dm1.OooOO0O CallObjectMethodA host.h kCallObjectMethodOne = 0x100; object return
0x100 o0O00OOO.OooO CallIntMethodA SparseIntArray.indexOfKey(I)I; host.h labels 0x100
as CallObjectMethodA by default, but the per-call
return type is int
0x370 dm1.OooOO0O SetObjectField field type is Lcom/cmaster/cloner/v81; (object);
host.h labels 0x370 as SetLongField by default,
but the member type is object
B4 - UPDATED
CONTEXT.md updated (Task A/B sections).
~/results/ has the signed APK, out1.log, out2.log, cp.txt, dcvm.so, dcvm-trace.so.
NOT RUN
- The device Frida/jnitrace trace (no device in this environment).
- The dcvm rerun with 0x9e returning 0 vs non-zero (branch target is the root cause).
- The rest of both bodies after the branch-offset/throw points.