TRACING PASS - FULL ORDERED TRACE, BOTH PROGRAMS
1. DEPS ADDED
Same 19 jars as before (unidbg 0.9.8 + transitives, slf4j 1.7.36, gson 2.10.1,
commons-io, etc.). nativelib still not needed.
2. COMMANDS AND EXIT CODES
javac /tmp/tools/src/EngineRun.java (tracing copy) -> 0
EngineRun program 1 (31ebe, 187) -> 0
EngineRun program 2 (32636, 130) -> 0
copy logs/cp.txt to ~/results/ -> 0
3. REAL OUTPUT
Program 1:
PATH 00:9e 04:9b 06:9b 08:59 40:1e
DIAG stopped at pc=0x40 opcode=0x1e
RESULT: engine executed inside the runtime
Program 2:
PATH 00:9e 04:78 08:9e 0c:04
DIAG stopped at pc=0xc opcode=0x04
RESULT: engine executed inside the runtime
4. FULL ORDERED CALL TRACE
Program 1:
pc opcode JNI off Name Strings Args Stub
0x00 0x9e 0x030 FindClass a=0x40111000 (unreadable) a=0x40111000, b=0 -
0x00 0x9e 0x2f0 GetFieldID b=0x40112000 (unreadable) a=0xc3a34da5, b=0x40112000, c=0x40113000 -
0x40 0x1e 0x100 CallObjectMethodA - a=0x3af8c39e, b=0x809e none (BackendException)
Program 2:
pc opcode JNI off Name Strings Args Stub
0x00 0x9e 0x030 FindClass a=0x40114000 (unreadable) a=0x40114000, b=0 -
0x00 0x9e 0x2f0 GetFieldID b=0x40115000 (unreadable) a=0x65cbd482, b=0x40115000, c=0x40116000 -
0x08 0x9e 0x030 FindClass a=0x40117000 (unreadable) a=0x40117000, b=0 -
0x08 0x9e 0x2f0 GetFieldID b=0x40118000 (unreadable) a=0xc3a34da5, b=0x40118000, c=0x40119000 -
0x0c 0x04 0x108 GetMethodID b=0x40118000 (unreadable) a=0xbbd0c56, b=0x40118000, c=0x40119000 -
0x0c 0x04 0x138 CallBooleanMethodA - a=0xffffffffd9fcb04e, b=0x65b53621, c=0xbfffe950 none (BackendException)
5. SLOT -> CLASS.METHOD -> ARGS
Slot JNI method (custom table) Args
0x030 FindClass class-name ptr (fake host handle, unreadable)
0x2f0 GetFieldID class handle, field-name ptr (fake)
0x108 GetMethodID class handle, method-name ptr (fake), args ptr
0x100 CallObjectMethodA method ID, jvalue ptr
0x138 CallBooleanMethodA method ID, jvalue ptr
The target app's class/method names were NOT resolved. The 0x030/0x2f0/0x108 name strings are
the dcvm host's fake pointers (mem_read fails); the JNI names above come from vm/host.h, not
from the guest strings.
6. DIFFERENCES FROM THE STATIC DECODE
- Same opcodes executed (9e, 9b, 59, 1e / 9e, 78, 9e, 04).
- UNIMPL count=0 - no unimplemented opcodes.
- The engine still stops at the JNI invoke (0x100/0x138) with BackendException; it is NOT an
opcode fault.
- Wrapper table is CUSTOM (host.h), not standard JNIEnv:
0x138 = CallBooleanMethodA (member_slots.tsv says CallDoubleMethodA - MISLABELED).
0x100 = CallObjectMethodA (not IsInstanceOf).
0x030 FindClass, 0x108 GetMethodID, 0x2f0 GetFieldID, 0x388 GetStaticMethodID,
0x480 GetStaticFieldID.
- The call*MethodV overrides were never reached: unidbg's DalvikVM64 throws on CallXMethodA
before the AbstractJni method.
- NO MATCH IS CLAIMED PAST THE JNI CALL - the rest of the program was not executed.
7. NOT RUN
- The bytecode after the first JNI invoke in both programs.
- The real target class/method names (needs a real device or the JniTableHost trace).
- Any call trace beyond the first CallXMethodA.
CONTEXT.md and ~/results/ updated. No app code, no CloneRunner changes, no commit/push.