Problem with Android API uprobes

[ceddie]

Hello,

I use BPFroid to attach uprobes to Base64.decode(java.lang.String, int) and Location.getLatitude(). I also made a small App (Kotlin) that invokes those methods when pressing a button.

Unfortunately, the uprobes never get triggered. How do you check if the aot-compiled code in the oat-files is actually used? Do I miss something?

Great project anyway,
ceddie

BPFroid output

root@localhost:/bpfonandroid/dist# ./tracee
Extracting oat files and offsets from zygote process...
Found zygote64 pid: 334
+ /apex/com.android.art/javalib/x86_64/boot.oat base: 0x70578000, oatdata offset: 0x1000
+ /apex/com.android.art/javalib/x86_64/boot-core-libart.oat base: 0x70a0f000, oatdata offset: 0x1000
+ /apex/com.android.art/javalib/x86_64/boot-okhttp.oat base: 0x70a73000, oatdata offset: 0x1000
+ /apex/com.android.art/javalib/x86_64/boot-bouncycastle.oat base: 0x70ac3000, oatdata offset: 0x1000
+ /system/framework/x86_64/boot-framework.oat base: 0x71b34000, oatdata offset: 0x1000
+ /system/framework/x86_64/boot-ext.oat base: 0x724b5000, oatdata offset: 0x1000
+ /system/framework/x86_64/boot-voip-common.oat base: 0x724e4000, oatdata offset: 0x1000
+ /system/framework/x86_64/boot-core-icu4j.oat base: 0x724f3000, oatdata offset: 0x1000
Using cached hooks from /bpfonandroid/dist/api_hooks.cache

Attaching Android API uprobes:
+ android.util.Base64.decode(java.lang.String, int) 
  in file: /system/framework/x86_64/boot-framework.oat, offset: 0x666f40
+ android.util.Base64.decode(byte[], int) 
  in file: /system/framework/x86_64/boot-framework.oat, offset: 0x666fa0
+ android.util.Base64.decode(byte[], int, int, int) 
  in file: /system/framework/x86_64/boot-framework.oat, offset: 0x666ff0
+ android.location.Location.getLatitude() 
  in file: /system/framework/x86_64/boot-framework.oat, offset: 0x57b200
TIME(s)        UID    COMM             PID     TID     RET              EVENT                ARGS

Kotlin Code (partially)

val res = Base64.decode("Test", Base64.DEFAULT)
Log.i("INFO", res.toString())
val lastKnownLocationByGps = lm.getLastKnownLocation(LocationManager.GPS_PROVIDER)
Log.i("INFO", lastKnownLocationByGps?.getLatitude().toString())

[yanivagman]

Hi,

Can it be that you use a debug version of your application? IIRC, applications in debug mode don't use the compiled oat files, but the java based code