C-HOST TRACE - FULL ORDERED TRACE, BOTH PROGRAMS
1. HASH CHECK
NONE FOUND. None of 0xc3a34da5, 0x3af8c39e, 0x65cbd482, 0x0bbd0c56, 0x65b53621, 0x809e,
0xd9fcb04e (or decimal forms) appear in dex_members.tsv, member_slots.tsv, dispatch_64.json,
handler_*.json, or ghidra_interpreter_map.json. They are runtime hashes/handles.
2. WHERE THE TRACE RUNS (EVIDENCE)
The table is called through the dcvm C host, not unidbg's Java JNI fake.
- Copied the C++ source to /tmp/tools/dcvm-src (repo untouched) and built
/tmp/opencode/dc-build/dcvm-trace.so (5.3 MB).
- JniTableHost::runtimeString logs every string to the trace sink: DCVM_STR ...
- JniTableHost::invoke stubs every CallXMethodA / Set*Field / array / monitor slot: logs
offset, args, 8 jvalues, returns 0, and NEVER calls the real JNIEnv for those slots.
- Evidence: the trace file contains DCVM_STR, DCVM_JVALUE, DCVM_STUB, and the jni off= lines
from the same C host. The old unidbg BackendException at CallObjectMethodA /
CallBooleanMethodA is gone - those slots are stubbed in C.
3. FULL ORDERED TRACE
Program 1 - dm1.OooOO0O:
isa pc=0x00 op=0x9e
DCVM_STR com/cmaster/cloner/dm1
jni off=0x030 a=0x40111000 b=0x0 c=0x0 d=0x0
DCVM_STR OooO0oo
DCVM_STR Landroid/content/Intent;
jni off=0x2f0 a=0xc3a34da5 b=0x40112000 c=0x40113000 d=0x0
isa pc=0x04 op=0x9b
isa pc=0x06 op=0x9b
isa pc=0x08 op=0x59
isa pc=0x40 op=0x1e
jni off=0x100 a=0x3af8c39e b=0x809e c=0x0 d=0x0
DCVM_STUB off=0x100 a=0x3af8c39e b=0x809e c=0x0
isa pc=0x44 op=0x0e
RUN status=2
DIAG stopped at pc=0x44 opcode=0x0e
Program 2 - o0O00OOO.OooO:
isa pc=0x00 op=0x9e
DCVM_STR com/cmaster/cloner/o0O00OOO
jni off=0x030 a=0x40111000 b=0x0 c=0x0 d=0x0
DCVM_STR OooOOO
DCVM_STR Lcom/cmaster/cloner/dm1;
jni off=0x2f0 a=0x65cbd482 b=0x40112000 c=0x40113000 d=0x0
isa pc=0x04 op=0x78
isa pc=0x08 op=0x9e
DCVM_STR com/cmaster/cloner/dm1
jni off=0x030 a=0x40114000 b=0x0 c=0x0 d=0x0
DCVM_STR OooOOOO
DCVM_STR Ljava/util/ArrayList;
jni off=0x2f0 a=0xc3a34da5 b=0x40115000 c=0x40116000 d=0x0
isa pc=0x0c op=0x04
DCVM_STR java/util/ArrayList
jni off=0x030 a=0x40117000 b=0x0 c=0x0 d=0x0
DCVM_STR remove
DCVM_STR (L)Z
jni off=0x108 a=0xbbd0c56 b=0x40118000 c=0x40119000 d=0x0
jni off=0x138 a=0xffffffffd9fcb04e b=0x65b53621 c=0xbfffe950 d=0x0
DCVM_JVALUE [0..7]=0x0
DCVM_STUB off=0x138 ...
isa pc=0x12 op=0x04
DCVM_STR isEmpty
DCVM_STR ()Z
jni off=0x108 a=0xbbd0c56 b=0x4011a000 c=0x4011b000 d=0x0
jni off=0x138 a=0xffffffffd9fcb04e b=0x3c9d6c7e c=0xbfffe950 d=0x0
DCVM_JVALUE [0..7]=0x0
DCVM_STUB off=0x138 ...
isa pc=0x18 op=0x64
isa pc=0x1a op=0x78
isa pc=0x28 op=0x04
DCVM_STR OooO0Oo
DCVM_STR ()I
jni off=0x108 a=0xc3a34da5 b=0x4011c000 c=0x4011d000 d=0x0
jni off=0x198 a=0x7affaa6f b=0x72c447ef c=0xbfffe950 d=0x0
DCVM_JVALUE [0..7]=0x0
RUN status=2
DIAG stopped at pc=0x28 opcode=0x04
4. SLOT -> CLASS.METHOD -> ARGS
Slot Class.method Args Status
0x030 com/cmaster/cloner/dm1 (FindClass) class name RESOLVED
0x2f0 dm1.OooO0oo (GetFieldID) class, field name, Landroid/content/Intent; RESOLVED
0x100 UNRESOLVED (method ID 0x3af8c39e) obj, jvalue* UNRESOLVED
0x370/0x380 dm1.OooO0oo set long/double field ID, value RESOLVED (field from 0x9e)
0x030 com/cmaster/cloner/o0O00OOO (FindClass) class name RESOLVED
0x2f0 o0O00OOO.OooOOO (GetFieldID) class, field name, Lcom/cmaster/cloner/dm1; RESOLVED
0x030 com/cmaster/cloner/dm1 (FindClass) class name RESOLVED
0x2f0 dm1.OooOOOO (GetFieldID) class, field name, Ljava/util/ArrayList; RESOLVED
0x030 java/util/ArrayList (FindClass) class name RESOLVED
0x108 ArrayList.remove (GetMethodID) class, method name, (L)Z RESOLVED
0x138 ArrayList.remove (CallBooleanMethodA) method ID, jvalue* RESOLVED (name from 0x108)
0x108 ArrayList.isEmpty (GetMethodID) class, method name, ()Z RESOLVED
0x138 ArrayList.isEmpty (CallBooleanMethodA) method ID, jvalue* RESOLVED (name from 0x108)
0x108 dm1.OooO0Oo (GetMethodID) class, method name, ()I RESOLVED
0x198 dm1.OooO0Oo (CallIntMethodA) method ID, jvalue* RESOLVED (name from 0x108)
5. DIFFERENCES FROM THE STATIC DECODE
- The engine executed the decoded opcodes (9e, 9b, 59, 1e, 0e / 9e, 78, 9e, 04, 64, 78, 04).
- The class/field/method names are now RESOLVED at runtime (the C-host string log).
- The 0x0e (field set) and 0x28/0x04 (invoke) are REAL OPCODE FAULTS (RUN status=2), not JNI
errors.
- NO MATCH IS CLAIMED PAST 0x0e / 0x28 - execution stopped there.
6. NOT RUN
- The bytecode after the 0x0e / 0x28 fault.
- The 0x100 method name (UNRESOLVED).
- Any device/Frida trace (no device).
CONTEXT.md and ~/results/ updated (out1.log, out2.log, cp.txt, dcvm-trace2.log).
No app code, no CloneRunner changes, no commit/push.