Repository navigation
android: Fix crashes when unloading active Java hooks - #415
Open
LanceaKing wants to merge 8 commits into
Open
LanceaKing wants to merge 8 commits into
LanceaKing wants to merge 8 commits into
Conversation
Use VM.perform return values directly for retired replacements and active frames. Preserve the callback-count check after the stack walk and keep resource-release ordering unchanged.
LanceaKing
marked this pull request as ready for review
November 11, 2026 08:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unloading a script while Java hooks are running can free callbacks, cloned ArtMethods, and JNI handles before those calls finish. This can crash the app during or after unload.
Restore the original methods first, then keep those resources alive until active callbacks and ART frames finish. Release JNI handles before detaching from the VM. Suspend ART threads while restoring inline patches.
On Android 13 arm64, 50 concurrent unloads passed with four Java threads and object-return hooks. Another 30 attach/detach sessions, 22 spawns, and two canceled spawns also passed. No new crashes. These tests used official Python bindings and a patched Frida 17.26.2 server. Other Android versions and architectures remain untested.
npm run lintandnode --check index.jsalso pass.Related: frida/frida#545 and #370.