Problems instrumenting Android applications #6
Description
Currently I'm trying to trace Android applications on a real device (Nexus 6, rooted, Stock ROM Android 6).
I'm running the valgrind build from the wiki page which works fine on preinstalled binaries and busybox, but when it comes to real android applications there are some problems.
Instrumenting an android application works roughly like described here: http://stackoverflow.com/questions/13531496/cant-run-a-java-android-program-with-valgrind/19235439#19235439
I've got this /data/local/start_valgrind.sh:
#!/system/bin/sh
PACKAGE="foo.bar.baz"
# TracerGrind
VGPARAMS='--kernel-variant=android-gpu-adreno3xx --trace-children=yes --tool=tracergrind --filter=foo.so --vex-iropt-register-updates=allregs-at-mem-access --output=/sdcard/foo.trace'
export TMPDIR=/data/data/$PACKAGE
exec /data/local/Inst/bin/valgrind $VGPARAMS $*
To actually run the application with valgrind attached to foo.so, it's required to disable SELinux via setenforce 0 because valgrind and SELinux do not seem to be best friends on Android 6.
After that, setting PACKAGE="foo.bar.baz" and setprop wrap.$PACKAGE "logwrapper /data/local/start_valgrind.sh", starting the app on the phone brings up valgrind, too.
In logcat, I can see logs like those:
03-30 13:26:10.019 10502 10502 I start_valgrind.sh: disInstr(thumb): unhandled instruction: 0xDEFF 0x4620
03-30 13:26:10.027 10502 10502 I start_valgrind.sh: disInstr(thumb): unhandled instruction: 0xDEFF 0x461C
03-30 13:26:10.029 10502 10502 I start_valgrind.sh: disInstr(thumb): unhandled instruction: 0xDEFF 0x461D
03-30 13:26:10.054 10502 10502 I start_valgrind.sh: disInstr(thumb): unhandled instruction: 0xDEFF 0x48F8
03-30 13:26:10.058 10502 10502 I start_valgrind.sh: disInstr(thumb): unhandled instruction: 0xDEFF 0x686F
03-30 13:26:10.249 10502 10502 I start_valgrind.sh: disInstr(thumb): unhandled instruction: 0xDEFF 0x4B4C
03-30 13:26:10.342 10502 10502 I start_valgrind.sh: disInstr(thumb): unhandled instruction: 0xDEFF 0xF8DF
The recovered trace can not be decoded by text-/sqlitetrace, I'm getting errors like:
root@9bbb2997e81e ~ # Tracer/TracerGrind/sqlitetrace/sqlitetrace foo.trace foo.db
Invalid message of type 100 encountered.
The app I'm testing is proprietary from Google Play Store. I noticed this behaviour on different apps but if you require the name of this specific app I'm going to send you an E-Mail.
As I said, regular binaries work fine.
BTW, feel free to add the steps above to the wiki article's TODO-section :)