FAULT DIAGNOSIS + FINAL SLOT TABLE - VM C-HOST TRACE
FAULT DIAGNOSIS (each RUN status=2)
Program 1 - dm1.OooOO0O:
requestThrow() at engine.cpp:124 (fid == 0).
The 0x9e is at pc=0x104 (260) - PAST THE END of the 187-byte body. The bytes there are
filler (0x9e followed by zeros), so the field ID is 0.
This is a HARNESS OUT-OF-BOUNDS (the engine read past the body), NOT a real program fault.
Program 2 - o0O00OOO.OooO:
requestThrow() at resolver.cpp:1648 (nested.ran && nested.threw).
The nested body (dm1.OooO0Oo / ArrayList.get) threw.
This is a NESTED-BODY throw, not a null/stub 0x04 fault.
(L)Z
REAL, not a log artifact. It is the engine's signature string from runtimeString; the full
DEX signature is (Ljava/lang/Object;)Z, and the engine shortened the object type to L.
traceLine prints the whole string with %s.
SLOT -> CLASS.METHOD -> ARGS (RESOLVED only when linked by ID)
PROGRAM 1
slot class.method args status
0x030 com/cmaster/cloner/dm1 (FindClass) class name RESOLVED (ID 0x2000)
0x2f0 dm1.OooO0oo (GetFieldID) class 0x2000, field OooO0oo, RESOLVED (ID 0x2001)
Landroid/content/Intent;
0x100 - (method ID 0x809e) obj, jvalue* UNRESOLVED (not in ID map)
0x370 v81.OooO0o (SetLongField) field 0x2003, value RESOLVED (ID 0x2003)
0x030 <guest ptr 0xbffff4b9> (FindClass) class name ptr RESOLVED (ID 0x2004; name not in host cache)
0x9e filler (pc 0x104) field 0 OUT-OF-BOUNDS (harness)
PROGRAM 2
slot class.method args status
0x030 com/cmaster/cloner/o0O00OOO (FindClass) class name RESOLVED (ID 0x2000)
0x2f0 o0O00OOO.OooOOO (GetFieldID) class 0x2000, field OooOOO, RESOLVED (ID 0x2001)
Lcom/cmaster/cloner/dm1;
0x030 com/cmaster/cloner/dm1 (FindClass) class name RESOLVED (ID 0x2002)
0x2f0 dm1.OooOOOO (GetFieldID) class 0x2002, field OooOOOO, RESOLVED (ID 0x2003)
Ljava/util/ArrayList;
0x030 java/util/ArrayList (FindClass) class name RESOLVED (ID 0x2004)
0x108 ArrayList.remove (GetMethodID) class 0x2004, remove, (L)Z RESOLVED (ID 0x2005)
0x138 ArrayList.remove (CallBooleanMethodA) method 0x2005, jvalue* RESOLVED (ID 0x2005)
0x108 ArrayList.isEmpty (GetMethodID) class 0x2006, isEmpty, ()Z RESOLVED (ID 0x2007)
0x138 ArrayList.isEmpty (CallBooleanMethodA) method 0x2007, jvalue* RESOLVED (ID 0x2007)
0x108 dm1.OooO0Oo (GetMethodID) class 0x2008, OooO0Oo, ()I RESOLVED (ID 0x2009)
0x198 dm1.OooO0Oo (CallIntMethodA) method 0x2009, jvalue* RESOLVED (ID 0x2009)
0x108 ArrayList.size (GetMethodID) class 0x200c, size, ()I RESOLVED (ID 0x200d)
0x198 ArrayList.size (CallIntMethodA) method 0x200d, jvalue* RESOLVED (ID 0x200d)
0x108 ArrayList.get (GetMethodID) class 0x200e, get, (I)L RESOLVED (ID 0x200f)
0x120 ArrayList.get (CallObjectMethodA) method 0x200f, jvalue* RESOLVED (ID 0x200f)
0x030 android/util/SparseIntArray (FindClass) class name RESOLVED (ID 0x2010)
0x108 SparseIntArray.indexOfKey (GetMethodID) class 0x2010, indexOfKey, (I)I RESOLVED (ID 0x2011)
0x100 SparseIntArray.indexOfKey (CallIntMethodA) method 0x2011, jvalue* RESOLVED (ID 0x2011)
0x030 com/cmaster/cloner/tl0 (FindClass) class name RESOLVED (ID 0x2012)
0x108 tl0.OooO00o (GetMethodID) class 0x2012, OooO00o, ()Z RESOLVED (ID 0x2013)
0x138 tl0.OooO00o (CallBooleanMethodA) method 0x2013, jvalue* RESOLVED (ID 0x2013)
0x030 com/cmaster/cloner/tl0 (FindClass) class name RESOLVED (ID 0x2014)
0x2f0 tl0.OooO0Oo (GetFieldID) class 0x2014, field OooO0Oo, I RESOLVED (ID 0x2015)
0x320 tl0.OooO0Oo (GetIntField) obj 0x100000, field 0x2015 RESOLVED (ID 0x2015)
0x04 nested body throw - NESTED THROW
The 0x370 row is in the trace:
DCVM_SET off=0x370 id=0x2003 name=com/cmaster/cloner/v81.OooO0oLcom/cmaster/cloner/v81;
The 0x380 row is NOT in the trace - removed.
HOW FAR EACH PROGRAM GOT
- Program 1: pc 0x104 (260) of a 187-byte body - PAST THE END (read filler).
- Program 2: pc 0x28 (40) of a 130-byte body - within the body; nested throw.
NOT RUN
- The body after the program-1 out-of-bounds (filler).
- The body after the program-2 nested throw.
- The 0x100 method name (UNRESOLVED).
- Any device/Frida trace (no device).
CONTEXT.md updated. ~/results/ has p1-0.log, p2-0.log, trace-p1-0.log, trace-p2-0.log,
cp.txt, dcvm.so, dcvm-trace.so. No app code, no CloneRunner changes, no commit/push.