1 背景
首先我们来了解一下上面是隐藏API： 以下内容摘录自官方文档
针对非 SDK 接口的限制
从 Android 9（API 级别 28）开始，Android 平台对应用能使用的非 SDK 接口实施了限制。只要应用引用非 SDK 接口或尝试使用反射或 JNI 来获取其句柄，这些限制就适用。这些限制旨在帮助提升用户体验和开发者体验，为用户降低应用发生崩溃的风险，同时为开发者降低紧急发布的风险。如需详细了解有关此限制的决定，请参阅通过减少非 SDK 接口的使用来提高稳定性。
官方文档
developer.android.com/guide/app-c…
2 资源准备
git clone android.googlesource.com/platform/ar… --depth 1
3 方法反射（Method Reflection）
Java 类java.lang.reflect.Method实例是对类方法（Method）的反射。Method类继承自通用抽象父类Executable，其自身是不可变（Immutable）类。
| 方法 | 描述 |
|---|---|
| Method[] getMethods() | 返回目标类中所有可访问的公开方法，包括从父类继承的公开方法。 |
| Method[] getDeclaredMethods() | 返回目标类中所有方法，不包括从父类继承的方法。 |
| Method getMethod(String name, Class... parameterTypes) | 根据方法名与参数类型取得目标方法对象。 |
| Method getDeclaredMethod(String name, Class... parameterTypes) | 根据方法名与参数类型取得目标方法对象，不包括从父类继承的方法。 |
大白话解读：
-
getDeclaredMethod：获取当前类的所有声明的方法，包括public、protected和private修饰的方法。需要注意的是，这些方法一定是在当前类中声明的，从父类中继承的不算，实现接口的方法由于有声明所以包括在内。
-
getMethod：获取当前类和父类的所有public的方法。这里的父类，指的是继承层次中的所有父类。比如说，A继承B，B继承C，那么B和C都属于A的父类。
案例：
public class Fruit {
private String name;
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
}
public class Apple extends Fruit {
private int price;
public int getPrice() {
return price;
}
public void setPrice(int price) {
this.price = price;
}
}
import java.lang.reflect.Constructor;
import java.lang.reflect.Method;
public class ReflectTest {
public static void main(String[] args) throws Exception {
//正常调用
Apple apple = new Apple();
apple.setPrice(5);
System.out.println("Apple Price:" + apple.getPrice());
//使用反射调用-getMethod
Class clz = Class.forName("Apple");
Method setPriceMethod = clz.getMethod("setPrice", int.class);
Constructor appleConstructor = clz.getConstructor();
Object appleObj = appleConstructor.newInstance();
setPriceMethod.invoke(appleObj, 14);
Method getPriceMethod = clz.getMethod("getPrice");
System.out.println("Apple Price:" + getPriceMethod.invoke(appleObj));
System.out.println("================================");
//静态方法反射调用
Method showMethod = clz.getMethod("show",int.class);
showMethod.invoke(null,9);
System.out.println("================================");
//获取本类+父类所有方法
Method[] methods = clz.getMethods();
for (Method method : methods) {
System.out.println("method:" + method);
}
System.out.println("================================");
//获取本类所有方法
Method[] declaredMethods = clz.getDeclaredMethods();
for (Method method : declaredMethods) {
System.out.println("declaredMethod:" + method);
}
System.out.println("================================");
//使用反射调用-getDeclaredMethod
setPriceMethod = clz.getDeclaredMethod("setPrice", int.class);
appleConstructor = clz.getConstructor();
appleObj = appleConstructor.newInstance();
setPriceMethod.invoke(appleObj, 22);
getPriceMethod = clz.getDeclaredMethod("getPrice");
System.out.println("Apple Price:" + getPriceMethod.invoke(appleObj));
}
}
运行结果：
Apple Price:5
Apple Price:14
================================
show static method called,price:9
================================
method:public static void Apple.show(int)
method:public void Apple.setPrice(int)
method:public int Apple.getPrice()
method:public java.lang.String Fruit.getName()
method:public void Fruit.setName(java.lang.String)
method:public final native void java.lang.Object.wait(long) throws java.lang.InterruptedException
method:public final void java.lang.Object.wait(long,int) throws java.lang.InterruptedException
method:public final void java.lang.Object.wait() throws java.lang.InterruptedException
method:public boolean java.lang.Object.equals(java.lang.Object)
method:public java.lang.String java.lang.Object.toString()
method:public native int java.lang.Object.hashCode()
method:public final native java.lang.Class java.lang.Object.getClass()
method:public final native void java.lang.Object.notify()
method:public final native void java.lang.Object.notifyAll()
================================
declaredMethod:public static void Apple.show(int)
declaredMethod:public void Apple.setPrice(int)
declaredMethod:public int Apple.getPrice()
================================
Apple Price:22
4 源码分析
以访问Ldalvik/system/VMRuntime;->setTargetSdkVersion(I)V为例
try {
val runtimeClass = Class.forName("dalvik.system.VMRuntime")
val nativeLoadMethod = runtimeClass.getDeclaredMethod(
"setTargetSdkVersionNative",
*arrayOf<Class<*>?>(Int::class.javaPrimitiveType)
)
Log.i(TAG, "setTargetSdkVersionNative success,nativeLoadMethod:$nativeLoadMethod")
} catch (e: Throwable) {
e.printStackTrace()
}
然后运行时抛出了异常NoSuchMethodException
2024-06-20 07:57:04.716 29837-29837 .ndk.hidden.api com.ygq.ndk.hidden.api W Accessing hidden method Ldalvik/system/VMRuntime;->setTargetSdkVersionNative(I)V (blocked, reflection, denied)
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W java.lang.NoSuchMethodException: dalvik.system.VMRuntime.setTargetSdkVersionNative [int]
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W at java.lang.Class.getMethod(Class.java:2937)
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W at java.lang.Class.getDeclaredMethod(Class.java:2914)
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W at com.ygq.ndk.hiddenapi.MainActivity.onCreate$lambda$0(MainActivity.kt:32)
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W at com.ygq.ndk.hiddenapi.MainActivity.$r8$lambda$bSb4PNoYIVmHUKhD73qlXfirQvk(Unknown Source:0)
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W at com.ygq.ndk.hiddenapi.MainActivity$$ExternalSyntheticLambda0.onClick(Unknown Source:0)
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W at android.view.View.performClick(View.java:7799)
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W at com.google.android.material.button.MaterialButton.performClick(MaterialButton.java:1218)
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W at android.view.View.performClickInternal(View.java:7776)
2024-06-20 07:57:04.717 29837-29837 System.err com.ygq.ndk.hidden.api W at android.view.View.-$$Nest$mperformClickInternal(Unknown Source:0)
2024-06-20 07:57:04.718 29837-29837 System.err com.ygq.ndk.hidden.api W at android.view.View$PerformClick.run(View.java:31213)
2024-06-20 07:57:04.718 29837-29837 System.err com.ygq.ndk.hidden.api W at android.os.Handler.handleCallback(Handler.java:958)
2024-06-20 07:57:04.718 29837-29837 System.err com.ygq.ndk.hidden.api W at android.os.Handler.dispatchMessage(Handler.java:99)
2024-06-20 07:57:04.718 29837-29837 System.err com.ygq.ndk.hidden.api W at android.os.Looper.loopOnce(Looper.java:224)
2024-06-20 07:57:04.718 29837-29837 System.err com.ygq.ndk.hidden.api W at android.os.Looper.loop(Looper.java:318)
2024-06-20 07:57:04.718 29837-29837 System.err com.ygq.ndk.hidden.api W at android.app.ActivityThread.main(ActivityThread.java:8754)
2024-06-20 07:57:04.718 29837-29837 System.err com.ygq.ndk.hidden.api W at java.lang.reflect.Method.invoke(Native Method)
2024-06-20 07:57:04.718 29837-29837 System.err com.ygq.ndk.hidden.api W at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:561)
2024-06-20 07:57:04.718 29837-29837 System.err com.ygq.ndk.hidden.api W at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1013)
结论：非 sdk 接口，greylist以及whitelist不受限制，但是blacklist以及greylist-max-x会进行限制
4.1 查找漏洞
从android framework的角度分析非sdk接口限制的原理，找到系统漏洞
java.lang.Class;->getDeclaredMethod函数，源码如下：
@CallerSensitive
public Method getDeclaredMethod(String name, Class<?>... parameterTypes)
throws NoSuchMethodException, SecurityException {
// Android-changed: ART has a different JNI layer.
return getMethod(name, parameterTypes, false);
}
其内部调用了getMethod函数
// BEGIN Android-added: Internal methods to implement getMethod(...).
private Method getMethod(String name, Class<?>[] parameterTypes, boolean recursivePublicMethods)
throws NoSuchMethodException {
if (name == null) {
throw new NullPointerException("name == null");
}
if (parameterTypes == null) {
parameterTypes = EmptyArray.CLASS;
}
for (Class<?> c : parameterTypes) {
if (c == null) {
throw new NoSuchMethodException("parameter type is null");
}
}
Method result = recursivePublicMethods ? getPublicMethodRecursive(name, parameterTypes)
: getDeclaredMethodInternal(name, parameterTypes);
// Fail if we didn't find the method or it was expected to be public.
if (result == null ||
(recursivePublicMethods && !Modifier.isPublic(result.getAccessFlags()))) {
throw new NoSuchMethodException(getName() + "." + name + " "
+ Arrays.toString(parameterTypes));
}
return result;
}
第三个参数recursivePublicMethods为false，所以内部实际调用的是getDeclaredMethodInternal
@FastNative
private native Method getDeclaredMethodInternal(String name, Class<?>[] args);
getDeclaredMethodInternal为native函数，会调用到c++
4.2 源码分析
查看java_lang_Class.cc中getDeclaredMethodInternal源码
//art/runtime/native/java_lang_Class.cc
static jobject Class_getDeclaredMethodInternal(JNIEnv* env, jobject javaThis,
jstring name, jobjectArray args) {
ScopedFastNativeObjectAccess soa(env);
StackHandleScope<1> hs(soa.Self());
DCHECK_EQ(Runtime::Current()->GetClassLinker()->GetImagePointerSize(), kRuntimePointerSize);
DCHECK(!Runtime::Current()->IsActiveTransaction());
ObjPtr<mirror::Class> klass = DecodeClass(soa, javaThis);
if (UNLIKELY(klass->IsObsoleteObject())) {
ThrowRuntimeException("Obsolete Object!");
return nullptr;
}
Handle<mirror::Method> result = hs.NewHandle(
mirror::Class::GetDeclaredMethodInternal<kRuntimePointerSize>(
soa.Self(),
klass,
soa.Decode<mirror::String>(name),
soa.Decode<mirror::ObjectArray<mirror::Class>>(args),
GetHiddenapiAccessContextFunction(soa.Self()))); /* 3.hiddenapi访问上下文 */
if (result == nullptr || ShouldDenyAccessToMember(result->GetArtMethod(), soa.Self())) {
return nullptr;
}
return soa.AddLocalReference<jobject>(result.Get());
}
其内部调用了mirror::Class::GetDeclaredMethodInternal
//art/runtime/mirror/class.cc
template <PointerSize kPointerSize>
ObjPtr<Method> Class::GetDeclaredMethodInternal(
Thread* self,
ObjPtr<Class> klass,
ObjPtr<String> name,
ObjPtr<ObjectArray<Class>> args,
const std::function<hiddenapi::AccessContext()>& fn_get_access_context) {
// Covariant return types (or smali) permit the class to define
// multiple methods with the same name and parameter types.
// Prefer (in decreasing order of importance):
// 1) non-hidden method over hidden
// 2) virtual methods over direct
// 3) non-synthetic methods over synthetic
// We never return miranda methods that were synthesized by the runtime.
StackHandleScope<3> hs(self);
auto h_method_name = hs.NewHandle(name);
if (UNLIKELY(h_method_name == nullptr)) {
ThrowNullPointerException("name == null");
return nullptr;
}
auto h_args = hs.NewHandle(args);
Handle<Class> h_klass = hs.NewHandle(klass);
constexpr hiddenapi::AccessMethod access_method = hiddenapi::AccessMethod::kNone;
ArtMethod* result = nullptr;
bool result_hidden = false;
for (auto& m : h_klass->GetDeclaredVirtualMethods(kPointerSize)) { /* 4.遍历virtual method */
if (m.IsMiranda()) {
continue;
}
ArtMethod* np_method = m.GetInterfaceMethodIfProxy(kPointerSize);
if (!np_method->NameEquals(h_method_name.Get())) { /* 5.判断方法名与参数类型 */
continue;
}
// `ArtMethod::EqualParameters()` may throw when resolving types.
if (!np_method->EqualParameters(h_args)) {
if (UNLIKELY(self->IsExceptionPending())) {
return nullptr;
}
continue;
}
bool m_hidden = hiddenapi::ShouldDenyAccessToMember(&m, fn_get_access_context, access_method); /* 6.调用ShouldDenyAccessToMember */
if (!m_hidden && !m.IsSynthetic()) {
// Non-hidden, virtual, non-synthetic. Best possible result, exit early.
return Method::CreateFromArtMethod<kPointerSize>(self, &m);
} else if (IsMethodPreferredOver(result, result_hidden, &m, m_hidden)) {
// Remember as potential result.
result = &m;
result_hidden = m_hidden;
}
}
if ((result != nullptr) && !result_hidden) {
// We have not found a non-hidden, virtual, non-synthetic method, but
// if we have found a non-hidden, virtual, synthetic method, we cannot
// do better than that later.
DCHECK(!result->IsDirect());
DCHECK(result->IsSynthetic());
} else {
for (auto& m : h_klass->GetDirectMethods(kPointerSize)) { /* 7.遍历direct method */
auto modifiers = m.GetAccessFlags();
if ((modifiers & kAccConstructor) != 0) {
continue;
}
ArtMethod* np_method = m.GetInterfaceMethodIfProxy(kPointerSize);
if (!np_method->NameEquals(h_method_name.Get())) { /* 8.判断方法名与参数类型 */
continue;
}
// `ArtMethod::EqualParameters()` may throw when resolving types.
if (!np_method->EqualParameters(h_args)) {
if (UNLIKELY(self->IsExceptionPending())) {
return nullptr;
}
continue;
}
DCHECK(!m.IsMiranda()); // Direct methods cannot be miranda methods.
bool m_hidden = hiddenapi::ShouldDenyAccessToMember(&m, fn_get_access_context, access_method); /* 9.调用ShouldDenyAccessToMember */
if (!m_hidden && !m.IsSynthetic()) {
// Non-hidden, direct, non-synthetic. Any virtual result could only have been
// hidden, therefore this is the best possible match. Exit now.
DCHECK((result == nullptr) || result_hidden);
return Method::CreateFromArtMethod<kPointerSize>(self, &m);
} else if (IsMethodPreferredOver(result, result_hidden, &m, m_hidden)) {
// Remember as potential result.
result = &m;
result_hidden = m_hidden;
}
}
}
return result != nullptr
? Method::CreateFromArtMethod<kPointerSize>(self, result)
: nullptr;
}
4.3 权限判断
接下来看看ShouldDenyAccessToMember函数源码
//art/runtime/hidden_api.cc
template <typename T>
bool ShouldDenyAccessToMember(T* member,
const std::function<AccessContext()>& fn_get_access_context,
AccessMethod access_method) {
DCHECK(member != nullptr);
// First check if we have an explicit sdk checker installed that should be used to
// verify access. If so, make the decision based on it.
//
// This is used during off-device AOT compilation which may want to generate verification
// metadata only for a specific list of public SDKs. Note that the check here is made
// based on descriptor equality and it's aim to further restrict a symbol that would
// otherwise be resolved.
//
// The check only applies to boot classpaths dex files.
Runtime* runtime = Runtime::Current();
if (UNLIKELY(runtime->IsAotCompiler())) {
if (member->GetDeclaringClass()->IsBootStrapClassLoaded() &&
runtime->GetClassLinker()->DenyAccessBasedOnPublicSdk(member)) {
return true;
}
}
// Get the runtime flags encoded in member's access flags.
// Note: this works for proxy methods because they inherit access flags from their
// respective interface methods.
const uint32_t runtime_flags = GetRuntimeFlags(member);
// Exit early if member is public API. This flag is also set for non-boot class
// path fields/methods.
if ((runtime_flags & kAccPublicApi) != 0) { /* 1.如果方法是public api，则允许访问 */
return false;
}
// Determine which domain the caller and callee belong to.
// This can be *very* expensive. This is why ShouldDenyAccessToMember
// should not be called on every individual access.
const AccessContext caller_context = fn_get_access_context(); /* 2.获取caller的上下文 */
const AccessContext callee_context(member->GetDeclaringClass()); /* 3.获取所调用方法的上下文 */
// Non-boot classpath callers should have exited early.
DCHECK(!callee_context.IsApplicationDomain());
// Check if the caller is always allowed to access members in the callee context.
if (caller_context.CanAlwaysAccess(callee_context)) { /* 4.caller是否可以不受约束访问callee */
return false;
}
// Check if this is platform accessing core platform. We may warn if `member` is
// not part of core platform API.
switch (caller_context.GetDomain()) { /* 5.根据domain级别区分对待hiddenapi策略 */
case Domain::kApplication: {
DCHECK(!callee_context.IsApplicationDomain());
// Exit early if access checks are completely disabled.
EnforcementPolicy policy = runtime->GetHiddenApiEnforcementPolicy();
if (policy == EnforcementPolicy::kDisabled) { /* 5.1.如果policy disable，则返回false，即允许访问 */
return false;
}
// If this is a proxy method, look at the interface method instead.
member = detail::GetInterfaceMemberIfProxy(member);
// Decode hidden API access flags from the dex file.
// This is an O(N) operation scaling with the number of fields/methods
// in the class. Only do this on slow path and only do it once.
ApiList api_list(detail::GetDexFlags(member));
DCHECK(api_list.IsValid());
// Member is hidden and caller is not exempted. Enter slow path.
return detail::ShouldDenyAccessToMemberImpl(member, api_list, access_method);
}
case Domain::kPlatform: {
DCHECK(callee_context.GetDomain() == Domain::kCorePlatform);
// Member is part of core platform API. Accessing it is allowed.
if ((runtime_flags & kAccCorePlatformApi) != 0) {
return false;
}
// Allow access if access checks are disabled.
EnforcementPolicy policy = Runtime::Current()->GetCorePlatformApiEnforcementPolicy();
if (policy == EnforcementPolicy::kDisabled) {
return false;
}
// If this is a proxy method, look at the interface method instead.
member = detail::GetInterfaceMemberIfProxy(member);
// Access checks are not disabled, report the violation.
// This may also add kAccCorePlatformApi to the access flags of `member`
// so as to not warn again on next access.
return detail::HandleCorePlatformApiViolation(member, caller_context, access_method, policy);
}
case Domain::kCorePlatform: {
LOG(FATAL) << "CorePlatform domain should be allowed to access all domains";
UNREACHABLE();
}
}
}
fn_get_access_context的源头是在java_lang_Class->getMethodIdInternal传过来的函数指针，即GetHiddenapiAccessContextFunction：
//art/runtime/native/java_lang_Class.cc
static std::function<hiddenapi::AccessContext()> GetHiddenapiAccessContextFunction(Thread* self) {
return [=]() REQUIRES_SHARED(Locks::mutator_lock_) {
return hiddenapi::GetReflectionCallerAccessContext(self);
};
}
//art/runtime/hidden_api.h
class AccessContext {
...
// Returns true if this domain is always allowed to access the domain of `callee`.
bool CanAlwaysAccess(const AccessContext& callee) const {
return IsDomainMoreTrustedThan(domain_, callee.domain_);
}
...
}
//art/libartbase/base/hiddenapi_domain.h
enum class Domain : char {
kCorePlatform = 0,
kPlatform,
kApplication,
};
inline bool IsDomainMoreTrustedThan(Domain domainA, Domain domainB) {
return static_cast<char>(domainA) <= static_cast<char>(domainB);
}
也就是说，如果caller的domain值越小，能访问的hiddenapi范围越广。比如corePlatform能访问所有级别的api，但是application级别不能访问corePlatform以及platform级别的api。
4.4 Android 系统API的隐藏策略
- 第三方app肯定会走到这里，根据domain级别区分对待hiddenapi策略
- 如果policy disable，则返回false，即允许访问(重点)
- 最终会调用
detail::ShouldDenyAccessToMemberImpl(member, api_list, access_method)
//art/runtime/hidden_api.cc
template <typename T>
bool ShouldDenyAccessToMemberImpl(T* member, ApiList api_list, AccessMethod access_method) {
DCHECK(member != nullptr);
Runtime* runtime = Runtime::Current();
CompatFramework& compatFramework = runtime->GetCompatFramework();
EnforcementPolicy hiddenApiPolicy = runtime->GetHiddenApiEnforcementPolicy();
DCHECK(hiddenApiPolicy != EnforcementPolicy::kDisabled)
<< "Should never enter this function when access checks are completely disabled";
MemberSignature member_signature(member);
// Check for an exemption first. Exempted APIs are treated as SDK.
if (member_signature.DoesPrefixMatchAny(runtime->GetHiddenApiExemptions())) {
// Avoid re-examining the exemption list next time.
// Note this results in no warning for the member, which seems like what one would expect.
// Exemptions effectively adds new members to the public API list.
MaybeUpdateAccessFlags(runtime, member, kAccPublicApi);
return false;
}
...
}
这里返回了false(重点), 后边的代码省略，因为当前已经找到了两处返回false的地方(返回false表示可以访问)。
4.4.1 第一处返回false关键点
//art/runtime/hidden_api.cc
// Exit early if access checks are completely disabled.
EnforcementPolicy policy = runtime->GetHiddenApiEnforcementPolicy();
if (policy == EnforcementPolicy::kDisabled) { /* 5.1.如果policydisable，则返回false，即允许访问 */
return false;
}
也就是说policy策略关闭时，可以自由访问hiddenapi，该方案可使用FreeReflection
但是需要适配不同的系统版本。
开源的方案是通过修改runtime内存实现的, 内存hidden_api_policy_的偏移值可因为系统版本，也可因为厂家定制导致不统一，所以该方案兼容性问题较大。
//art/runtime/runtime.h
hiddenapi::EnforcementPolicy GetHiddenApiEnforcementPolicy() const {
return hidden_api_policy_;
}
void SetHiddenApiEnforcementPolicy(hiddenapi::EnforcementPolicy policy) {
hidden_api_policy_ = policy;
}
4.4.2 第二处返回false关键点
runtime->GetHiddenApiExemptions, 顾名思义：获取豁免的hiddenapi签名
//art/runtime/hidden_api.cc
// Check for an exemption first. Exempted APIs are treated as SDK.
if (member_signature.DoesPrefixMatchAny(runtime->GetHiddenApiExemptions())) {
// Avoid re-examining the exemption list next time.
// Note this results in no warning for the member, which seems like what one would expect.
// Exemptions effectively adds new members to the public API list.
MaybeUpdateAccessFlags(runtime, member, kAccPublicApi);
return false;
}
MemberSignature::DoesPrefixMatchAny函数
//art/runtime/hidden_api.cc
bool MemberSignature::DoesPrefixMatchAny(const std::vector<std::string>& exemptions) {
for (const std::string& exemption : exemptions) {
if (DoesPrefixMatch(exemption)) {
return true;
}
}
return false;
}
该函数会遍历exemptions，只要有一个exemption，匹配当前访问的method->signature前缀，就可返回false。
//art/runtime/hidden_api.cc
bool MemberSignature::DoesPrefixMatch(const std::string& prefix) const {
size_t pos = 0;
for (const char* part : GetSignatureParts()) {
size_t count = std::min(prefix.length() - pos, strlen(part));
if (prefix.compare(pos, count, part, 0, count) == 0) {
pos += count;
} else {
return false;
}
}
// We have a complete match if all parts match (we exit the loop without
// returning) AND we've matched the whole prefix.
return pos == prefix.length();
}
4.4.3 接下来看看MemberSignature->GetSignatureParts
//art/runtime/hidden_api.cc
inline std::vector<const char*> MemberSignature::GetSignatureParts() const {
if (type_ == kField) {
return {class_name_.c_str(), "->", member_name_.c_str(), ":", type_signature_.c_str()};
} else {
DCHECK_EQ(type_, kMethod);
return {class_name_.c_str(), "->", member_name_.c_str(), type_signature_.c_str()};
}
}
无论MemberSignature的type_为field还是method，其返回值都是以class_name.c_str为前缀
MemberSignature的构造函数：
//art/runtime/hidden_api.cc
MemberSignature::MemberSignature(const ClassAccessor::Field& field) {
const DexFile& dex_file = field.GetDexFile();
const dex::FieldId& field_id = dex_file.GetFieldId(field.GetIndex());
class_name_ = dex_file.GetFieldDeclaringClassDescriptor(field_id);
member_name_ = dex_file.GetFieldName(field_id);
type_signature_ = dex_file.GetFieldTypeDescriptor(field_id);
type_ = kField;
}
MemberSignature::MemberSignature(const ClassAccessor::Method& method) {
const DexFile& dex_file = method.GetDexFile();
const dex::MethodId& method_id = dex_file.GetMethodId(method.GetIndex());
class_name_ = dex_file.GetMethodDeclaringClassDescriptor(method_id);
member_name_ = dex_file.GetMethodName(method_id);
type_signature_ = dex_file.GetMethodSignature(method_id).ToString();
type_ = kMethod;
}
另外，我们知道一个class的签名，形式都是如Ljava/lang/String;这种，肯定是以L开头的。
接下来分析HiddenApiExemptions，从runtime->GetHiddenApiExemptions着手
综上：所以exemption只要是L，就可以达到返回false的目的。
//art/runtime/runtime.h
void SetHiddenApiExemptions(const std::vector<std::string>& exemptions) {
hidden_api_exemptions_ = exemptions;
}
const std::vector<std::string>& GetHiddenApiExemptions() {
return hidden_api_exemptions_;
}
搜一下SetHiddenApiExemptions调用的位置
//art/runtime/native/dalvik_system_VMRuntime.cc
static void VMRuntime_setHiddenApiExemptions(JNIEnv* env,
jclass,
jobjectArray exemptions) {
std::vector<std::string> exemptions_vec;
int exemptions_length = env->GetArrayLength(exemptions);
for (int i = 0; i < exemptions_length; i++) {
jstring exemption = reinterpret_cast<jstring>(env->GetObjectArrayElement(exemptions, i));
const char* raw_exemption = env->GetStringUTFChars(exemption, nullptr);
exemptions_vec.push_back(raw_exemption);
env->ReleaseStringUTFChars(exemption, raw_exemption);
}
Runtime::Current()->SetHiddenApiExemptions(exemptions_vec);
}
static JNINativeMethod gMethods[] = {
...
NATIVE_METHOD(VMRuntime, setHiddenApiExemptions, "([Ljava/lang/String;)V"),
...
}
VMRuntime_setHiddenApiExemptions是jni方法，其native函数的声明在VMRuntime.java中。
//libcore/libart/src/main/java/dalvik/system/VMRuntime.java
/**
* Sets the list of exemptions from hidden API access enforcement.
*
* @param signaturePrefixes
* A list of signature prefixes. Each item in the list is a prefix match on the type
* signature of a blacklisted API. All matching APIs are treated as if they were on
* the whitelist: access permitted, and no logging..
*
* @hide
*/
@SystemApi(client = MODULE_LIBRARIES)
public native void setHiddenApiExemptions(String[] signaturePrefixes);
也就是说，想要调用setHiddenApiExemptions， 必须fake掉hiddenapi的限制。
之前的关键点中，caller是否可以不受约束访问callee，给了我们一些启示
caller的上下文是这样的获得的，如果该上下文domain的值越小，拥有的hiddenapi访问权限越大。
const AccessContext caller_context = fn_get_access_context(); /* 2.获取caller的上下文 */
//art/runtime/native/java_lang_Class.cc
static std::function<hiddenapi::AccessContext()> GetHiddenapiAccessContextFunction(Thread* self) {
return [=]() REQUIRES_SHARED(Locks::mutator_lock_) {
return hiddenapi::GetReflectionCallerAccessContext(self);
};
}
//art/runtime/hidden_api.cc
hiddenapi::AccessContext GetReflectionCallerAccessContext(Thread* self)
REQUIRES_SHARED(Locks::mutator_lock_) {
// Walk the stack and find the first frame not from java.lang.Class,
// java.lang.invoke or java.lang.reflect. This is very expensive.
// Save this till the last.
struct FirstExternalCallerVisitor : public StackVisitor {
explicit FirstExternalCallerVisitor(Thread* thread)
: StackVisitor(thread, nullptr, StackVisitor::StackWalkKind::kIncludeInlinedFrames),
caller(nullptr) {}
bool VisitFrame() override REQUIRES_SHARED(Locks::mutator_lock_) {
ArtMethod* m = GetMethod();
if (m == nullptr) {
// Attached native thread. Assume this is *not* boot class path.
caller = nullptr;
return false;
} else if (m->IsRuntimeMethod()) {
// Internal runtime method, continue walking the stack.
return true;
}
ObjPtr<mirror::Class> declaring_class = m->GetDeclaringClass();
if (declaring_class->IsBootStrapClassLoaded()) {
if (declaring_class->IsClassClass()) {
return true;
}
// MethodHandles.makeIdentity is doing findStatic to find hidden methods,
// where reflection is used.
if (m == WellKnownClasses::java_lang_invoke_MethodHandles_makeIdentity) {
return false;
}
// Check classes in the java.lang.invoke package. At the time of writing, the
// classes of interest are MethodHandles and MethodHandles.Lookup, but this
// is subject to change so conservatively cover the entire package.
// NB Static initializers within java.lang.invoke are permitted and do not
// need further stack inspection.
ObjPtr<mirror::Class> lookup_class = GetClassRoot<mirror::MethodHandlesLookup>();
if ((declaring_class == lookup_class || declaring_class->IsInSamePackage(lookup_class)) &&
!m->IsClassInitializer()) {
return true;
}
// Check for classes in the java.lang.reflect package, except for java.lang.reflect.Proxy.
// java.lang.reflect.Proxy does its own hidden api checks (https://r.android.com/915496),
// and walking over this frame would cause a null pointer dereference
// (e.g. in 691-hiddenapi-proxy).
ObjPtr<mirror::Class> proxy_class = GetClassRoot<mirror::Proxy>();
CompatFramework& compat_framework = Runtime::Current()->GetCompatFramework();
if (declaring_class->IsInSamePackage(proxy_class) && declaring_class != proxy_class) {
if (compat_framework.IsChangeEnabled(kPreventMetaReflectionBlocklistAccess)) {
return true;
}
}
}
caller = m;
return false;
}
ArtMethod* caller;
};
FirstExternalCallerVisitor visitor(self);
visitor.WalkStack();
// Construct AccessContext from the calling class found on the stack.
// If the calling class cannot be determined, e.g. unattached threads,
// we conservatively assume the caller is trusted.
ObjPtr<mirror::Class> caller =
(visitor.caller == nullptr) ? nullptr : visitor.caller->GetDeclaringClass();
return caller.IsNull() ? AccessContext(/* is_trusted= */ true) : AccessContext(caller);
}
最后一行caller.IsNull()的时候上下文传入了true
// Represents the API domain of a caller/callee.
class AccessContext {
public:
// Initialize to either the fully-trusted or fully-untrusted domain.
explicit AccessContext(bool is_trusted)
: klass_(nullptr),
dex_file_(nullptr),
domain_(ComputeDomain(is_trusted)) {}
private:
static Domain ComputeDomain(bool is_trusted) {
return is_trusted ? Domain::kCorePlatform : Domain::kApplication;
}
}
在此，domain_通过ComputeDomain初始化,当is_trusted为true的时候，确实会获取级别最高的hiddenapi访问权限
再来看看caller不为null时
// Represents the API domain of a caller/callee.
class AccessContext {
public:
// Initialize from Class.
explicit AccessContext(ObjPtr<mirror::Class> klass)
REQUIRES_SHARED(Locks::mutator_lock_)
: klass_(klass),
dex_file_(GetDexFileFromDexCache(klass->GetDexCache())),
domain_(ComputeDomain(klass, dex_file_)) {}
private:
static Domain ComputeDomain(ObjPtr<mirror::ClassLoader> class_loader, const DexFile* dex_file) {
if (dex_file == nullptr) {
return ComputeDomain(/* is_trusted= */ class_loader.IsNull());
}
return dex_file->GetHiddenapiDomain();
}
static Domain ComputeDomain(ObjPtr<mirror::Class> klass, const DexFile* dex_file)
REQUIRES_SHARED(Locks::mutator_lock_) {
// Check other aspects of the context.
Domain domain = ComputeDomain(klass->GetClassLoader(), dex_file);
if (domain == Domain::kApplication &&
klass->ShouldSkipHiddenApiChecks() &&
Runtime::Current()->IsJavaDebuggableAtInit()) { /* 只有debugable的包才会走if中的逻辑 */
// Class is known, it is marked trusted and we are in debuggable mode.
domain = ComputeDomain(/* is_trusted= */ true);
}
return domain;
}
}
通过kclass拿到dex_file，然后调用computeDomain计算该dex_file的domain,最终dex_file的domain值是通过GetHiddenapiDomain()获取的
//art/libdexfile/dex/dex_file.h
hiddenapi::Domain GetHiddenapiDomain() const { return hiddenapi_domain_; }
void SetHiddenapiDomain(hiddenapi::Domain value) const { hiddenapi_domain_ = value; }
查看调用位置
//art/runtime/hidden_api.cc
void InitializeDexFileDomain(const DexFile& dex_file, ObjPtr<mirror::ClassLoader> class_loader) {
Domain dex_domain = DetermineDomainFromLocation(dex_file.GetLocation(), class_loader);
// Assign the domain unless a more permissive domain has already been assigned.
// This may happen when DexFile is initialized as trusted.
if (IsDomainMoreTrustedThan(dex_domain, dex_file.GetHiddenapiDomain())) {
dex_file.SetHiddenapiDomain(dex_domain);
}
}
DetermineDomainFromLocation顾名思义：根据dex_file的文件位置，计算出其domain值
static Domain DetermineDomainFromLocation(const std::string& dex_location,
ObjPtr<mirror::ClassLoader> class_loader) {
// If running with APEX, check `path` against known APEX locations.
// These checks will be skipped on target buildbots where ANDROID_ART_ROOT
// is set to "/system".
if (ArtModuleRootDistinctFromAndroidRoot()) { /* 1.只是为了判断相关的dir路径是否存在 */
if (LocationIsOnArtModule(dex_location) /* 2.dex的路径是否是在artModule */
|| LocationIsOnConscryptModule(dex_location) /* 3.dex的路径是否是在ConscryptModule */
||LocationIsOnI18nModule(dex_location)) { /*4.dex的路径是否是在i18nModule */
return Domain::kCorePlatform;
}
if (LocationIsOnApex(dex_location)) { /*5.dex的路径是否是在apex目录 */
return Domain::kPlatform;
}
}
if (LocationIsOnSystemFramework(dex_location)) { / *6.dex的路径是否是在system / framework目录 */
return Domain::kPlatform;
}
if (LocationIsOnSystemExtFramework(dex_location)) { / *7.dex的路径是否是在system_ext/framework目录 */
return Domain::kPlatform;
}
if (class_loader.IsNull()) {
if (kIsTargetBuild && !kIsTargetLinux) {
// This is unexpected only when running on Android.
LOG(WARNING) << "DexFile " << dex_location
<< " is in boot class path but is not in a known location";
}
return Domain::kPlatform;
}
return Domain::kApplication;
}
代码中一共判断了7个文件位置，分别对应不同的domain
这些位置可以在init.environ.rc中查看到:
//core/rootdir/init.environ.rc.in
# set up the global environment
on early-init
export ANDROID_BOOTLOGO 1
export ANDROID_ROOT /system
export ANDROID_ASSETS /system/app
export ANDROID_DATA /data
export ANDROID_STORAGE /storage
export ANDROID_ART_ROOT /apex/com.android.art
export ANDROID_I18N_ROOT /apex/com.android.i18n
export ANDROID_TZDATA_ROOT /apex/com.android.tzdata
export EXTERNAL_STORAGE /sdcard
export ASEC_MOUNTPOINT /mnt/asec
%EXPORT_GLOBAL_ASAN_OPTIONS%
%EXPORT_GLOBAL_GCOV_OPTIONS%
%EXPORT_GLOBAL_CLANG_COVERAGE_OPTIONS%
%EXPORT_GLOBAL_HWASAN_OPTIONS%
%EXPORT_GLOBAL_SCUDO_ALLOCATION_RING_BUFFER_SIZE%
1.只是为了判断相关module的dir是否存在，一般都是存在的
2.artModule路径为/apex/com.android.art(android 14)
3.conscryptModule路径为/apex/com.android.conscrypt
4.apex的路径为/apex/
5.SystemFramework的路径为/system/framework
如果caller的路径为artModule或者conscryptModule即可将domain值置为kCorePlatform，达到目的。
先随便找个debug的app看一下运行时apex路径都有哪些
cat /proc/7156/maps |grep "/apex/.*.jar"
core-oj.jar正是可以利用的点:
这里有一个java.lang.System类，该类我们经常使用其加载so库，比如System.loadLibrary。
所以，我们可以通过System.loadLibrary，然后在native层的JNI_OnLoad中通过反射调用setHiddenApiExemptions(此时caller为java.lang.System.其domain级别为corePlatform)，然后就可以随意访问hiddenapi了
5 总结
- 系统framework代码中可以通过设置setHiddenApiExemptions，达到随意访问hiddenapi的目的
- 由于class VMRuntime被hide，可以在JNI_OnLoad中操作VMRuntime，达到调用setHiddenApiExemptions的目的
初步形成解决方案
系统类伪装
如果调用者是系统类，那么就允许被调用。即如果我们能以系统类的身份去反射，那么就能畅通无阻：
- 首先通过反射 API 拿到 getDeclaredMethod 方法。getDeclaredMethod 是 public 的，不存在问题；这个通过反射拿到的方法网上称之为元反射方法。
- 然后通过刚刚的元反射方法去反射调用 getDeclardMethod。这里我们就实现了以系统身份去反射的目的——反射相关的 API 都是系统类，因此我们的元反射方法也是被系统类加载的方法；所以我们的元反射方法调用的 getDeclardMethod 会被认为是系统调用的，可以反射任意的方法。
- 另外系统在检查豁免时是通过方法签名前缀进行匹配的，而 Java 方法签名都是 L 开头的，因此我们可以把直接传个 L 进去，那么所有的隐藏API全部被赦免了！
//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
/**
* Sets the list of classes/methods for the hidden API
*/
public static void setApiDenylistExemptions(String[] exemptions) {
VMRuntime.getRuntime().setHiddenApiExemptions(exemptions);
}
try {
Method mm = Class.class.getDeclaredMethod("forName", String.class);
Class<?> cls = (Class)mm.invoke((Object)null, "dalvik.system.VMRuntime");
mm = Class.class.getDeclaredMethod("getDeclaredMethod", String.class, Class[].class);
Method m = (Method)mm.invoke(cls, "getRuntime", null);
Object vr = m.invoke((Object)null);
m = (Method)mm.invoke(cls, "setHiddenApiExemptions", new Class[]{String[].class});
//Java class的签名都是以L开头的，所以这里全部进行豁免
String[] args = new String[]{"L"};
m.invoke(vr, args);
} catch (Throwable e) {
e.printStackTrace();
}
Android 11.0 → 限制升级
从此版本开始，系统升级了上层接口的访问限制，直接将VMRuntime的类接口限制升级，因此只能通过native层进行访问。原理不变，利用系统加载lib库时JNI_OnLoad通过反射调用setHiddenApiExemptions，此时caller为java.lang.System其domain级别为libcore.api.CorePlatformApi，就可以访问hiddenapi了。
最终解决方案
#include <jni.h>
#include <string.h>
#include <android/log.h>
#define LOG_TAG "ygq_hidden_api"
#define LOGV(...) __android_log_print(ANDROID_LOG_VERBOSE,LOG_TAG,__VA_ARGS__)
#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG,LOG_TAG,__VA_ARGS__)
#define LOGI(...) __android_log_print(ANDROID_LOG_INFO,LOG_TAG,__VA_ARGS__)
#define LOGW(...) __android_log_print(ANDROID_LOG_WARN,LOG_TAG,__VA_ARGS__)
#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR,LOG_TAG,__VA_ARGS__)
/**
* frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
*
* Android 12+ & static method
* Lcom/android/internal/os/ZygoteInit;->setApiDenylistExemptions([Ljava/lang/String;)V
* <p>
* setApiDenylistExemptions(new String[]{"L"})
*
* Android 9+ & static method
* Lcom/android/internal/os/ZygoteInit;->setApiBlacklistExemptions([Ljava/lang/String;)V
* <p>
* setApiBlacklistExemptions(new String[]{"L"}
*
* @param env JNIEnv
*/
bool setApiDenylistExemptions(JNIEnv *env) {
// Android 9.0 +
int sdkInt = android_get_device_api_level();
if (sdkInt < __ANDROID_API_P__) {
LOGV("setApiDenylistExemptions below Android 9.0, just ignored");
return true;
}
const char* zygoteInitClass = "com/android/internal/os/ZygoteInit";
jclass clazz = env->FindClass(zygoteInitClass);
if (clazz == nullptr) {
env->ExceptionClear();
LOGI("setApiDenylistExemptions can't find %s class", *zygoteInitClass);
return false;
}
jmethodID setApiDenylistExemptions;
if (sdkInt >= __ANDROID_API_S__) {
setApiDenylistExemptions = env->GetStaticMethodID(clazz, "setApiDenylistExemptions",
"([Ljava/lang/String;)V");
} else {
setApiDenylistExemptions = env->GetStaticMethodID(clazz, "setApiBlacklistExemptions",
"([Ljava/lang/String;)V");
}
if (setApiDenylistExemptions == nullptr) {
env->ExceptionClear();
LOGI("setApiDenylistExemptions can't find %s method", "setApiDenylistExemptions");
return false;
}
jclass stringClass = env->FindClass("java/lang/String");
jstring fakeStr = env->NewStringUTF("L");
jobjectArray fakeArray = env->NewObjectArray(1, stringClass, NULL);
env->SetObjectArrayElement(fakeArray, 0, fakeStr);
env->CallStaticVoidMethod(clazz, setApiDenylistExemptions, fakeArray);
env->DeleteLocalRef(fakeStr);
env->DeleteLocalRef(fakeArray);
LOGD("setApiDenylistExemptions success");
return true;
}
/**
* libcore/libart/src/main/java/dalvik/system/VMRuntime.java
*
* Android 9+ & object method
* Ldalvik/system/VMRuntime;->setHiddenApiExemptions([Ljava/lang/String;)V
* <p>
* setHiddenApiExemptions(new String[]{"L"})
*
* @param env JNIEnv
*/
bool setHiddenApiExemptions(JNIEnv *env) {
// Android 9.0 +
int sdkInt = android_get_device_api_level();
if (sdkInt < __ANDROID_API_P__) {
LOGV("setHiddenApiExemptions below Android 9.0, just ignored");
return true;
}
const char* vmRuntimeClass = "dalvik/system/VMRuntime";
jclass clazz = env->FindClass(vmRuntimeClass);
if (clazz == nullptr) {
env->ExceptionClear();
LOGI("setHiddenApiExemptions can't find %s class", *vmRuntimeClass);
return false;
}
jmethodID getRuntime = env->GetStaticMethodID(clazz, "getRuntime",
"()Ldalvik/system/VMRuntime;");
if (getRuntime == nullptr) {
env->ExceptionClear();
LOGI("setHiddenApiExemptions can't find %s method", "getRuntime");
return false;
}
jobject vmRuntime = env->CallStaticObjectMethod(clazz, getRuntime);
if (vmRuntime == nullptr) {
env->ExceptionClear();
LOGI("setHiddenApiExemptions can't get vmRuntime instance");
return false;
}
jmethodID setHiddenApiExemptions = env->GetMethodID(clazz, "setHiddenApiExemptions",
"([Ljava/lang/String;)V");
if (setHiddenApiExemptions == nullptr) {
env->ExceptionClear();
LOGI("setHiddenApiExemptions can't find %s method", "setHiddenApiExemptions");
return false;
}
jclass stringClass = env->FindClass("java/lang/String");
jstring fakeStr = env->NewStringUTF("L");
jobjectArray fakeArray = env->NewObjectArray(1, stringClass, NULL);
env->SetObjectArrayElement(fakeArray, 0, fakeStr);
env->CallVoidMethod(vmRuntime, setHiddenApiExemptions, fakeArray);
env->DeleteLocalRef(fakeStr);
env->DeleteLocalRef(fakeArray);
LOGD("setHiddenApiExemptions success");
return true;
}
bool checkHiddenApiExemptions(JNIEnv *env) {
if (!setHiddenApiExemptions(env)){
return setApiDenylistExemptions(env);
}
return true;
}
extern "C" JNIEXPORT jint JNI_OnLoad(JavaVM *vm, void *reserved) {
JNIEnv *env = nullptr;
if (vm->GetEnv(reinterpret_cast<void **>(&env), JNI_VERSION_1_6) != JNI_OK) {
return JNI_ERR;
}
// 设置 hidden-api 访问豁免
if(!checkHiddenApiExemptions(env)){
LOGE("checkHiddenApiExemptions error");
return JNI_ERR;
}
return JNI_VERSION_1_6;
}
Demo源码
暂时无法在路特斯桌面文档外展示此内容
