staleroot
### Steps to reproduce/复现步骤 Minimal reproduction repo: https://github.com/staleroot/frida-crash-module 1. Install the module from the repo above on a device with Vector active. The module only installs this hook, nothing else: ```kotlin hook(Class.forName("android.app.Application").getMethod("onCreate")).intercept { chain -> chain.proceed() } ``` 2. Save this script as `script.js`: ```javascript import Java from "frida-java-bridge"; setTimeout(() => { console.log("Hello"); Java.perform(() => { console.log("Inside Java.perform"); // This line is never reached }); }, 2000); ``` then ``` frida-compile script.js -o bundle.js ``` 3. Spawn the target app with Frida attached and this script loaded: ``` frida -U -f com.hello.world -l bundle.js ``` `frida` version: `17.18.0` `frida-java-bridge` version: `7.0.13` `frida-compile` version: `19.0.5` 4. The process crashes before the `Java.perform` callback runs — the "hello" log line is printed, but "Inside Java.perform" is never printed. Only "Hello" appears, then the process aborts. 5. If the `Application.onCreate` hook from step 1 is removed (module uninstalled/disabled), the exact same Frida command and script run fine, and "does not get called" prints normally (i.e. `Java.perform` succeeds). ### Expected behaviour/预期行为 Frida should be able to spawn/attach and call `Java.perform` normally, even while Vector has a hook installed on `Application.onCreate`. ### Actual behaviour/实际行为 ``` 2026-09-18 03:08:08.335 tchapp.helloworld com...app.helloworld Openjdkjvmti plugin was loaded on a non-debuggable Runtime. Plugin was loaded too late to change runtime state to support all capabilities. Only kArtTiVersion (0x70010200) environments are available. Some functionality might not work properly. 2026-09-18 03:08:08.521 tchapp.helloworld com...app.helloworld oat_file.cc:2535] Check failed: method_index < num_methods_ (method_index=275, num_methods_=42) /system/framework/arm64/boot-framework.oat 2026-09-18 03:08:08.662 tchapp.helloworld com...app.helloworld runtime.cc:714] Runtime aborting... runtime.cc:714] Skipping all-threads dump as mutator lock is exclusively held.Aborting thread: runtime.cc:714] "Thread-2" prio=5 tid=9 Native runtime.cc:714] | group="" sCount=0 ucsCount=0 flags=64 obj=0x0 self=0xb4000073cea6d3f0 runtime.cc:714] | sysTid=17564 nice=0 cgrp=default sched=0/0 handle=0x72143fb2c0 runtime.cc:714] | state=R schedstat=( 484357905 10645360 136 ) utm=20 stm=27 core=3 HZ=100 runtime.cc:714] | stack=0x7214304000-0x7214306000 stackSize=988KB runtime.cc:714] | held mutexes= "abort lock" "Class loader classes"(shared held) "ClassLinker classes lock"(shared held) "mutator lock"(exclusive held) runtime.cc:714] native: #00 pc 00447800 /apex/com.android.art/lib64/libart.so (art::DumpNativeStack+112) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #01 pc 00541e5c /apex/com.android.art/lib64/libart.so (art::Thread::DumpStack const+204) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #02 pc 00931838 /apex/com.android.art/lib64/libart.so (art::Thread::DumpStack const+104) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #03 pc 00925de8 /apex/com.android.art/lib64/libart.so (art::AbortState::DumpThread const+56) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #04 pc 0092206c /apex/com.android.art/lib64/libart.so (art::Runtime::Abort+1084) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #05 pc 00014db0 /apex/com.android.art/lib64/libbase.so (android::base::SetAborter::$_0::__invoke+80) (BuildId: 01f56bead4468a24561430f970f06de2) runtime.cc:714] native: #06 pc 00014250 /apex/com.android.art/lib64/libbase.so (android::base::LogMessage::~LogMessage+544) (BuildId: 01f56bead4468a24561430f970f06de2) runtime.cc:714] native: #07 pc 005b1b18 /apex/com.android.art/lib64/libart.so (art::OatFile::OatClass::GetOatMethodOffsets const+1224) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #08 pc 0022ad68 /apex/com.android.art/lib64/libart.so (art::FindOatMethodFor +200) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #09 pc 0054fa44 /apex/com.android.art/lib64/libart.so (art::ArtMethod::GetOatMethodQuickCode+52) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #10 pc 007ff8cc /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::GetOptimizedCodeFor+76) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #11 pc 007ff76c /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::InstallStubsForMethod+300) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #12 pc 005c43bc /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::InstallStubsForClass+140) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #13 pc 0080223c /apex/com.android.art/lib64/libart.so (art::instrumentation::InstallStubsClassVisitor::operator+12) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #14 pc 00612e5c /apex/com.android.art/lib64/libart.so (bool art::ClassTable::Visit<0, art::VisitClassLoaderClassesVisitor::DefiningClassLoaderFilterVisitor>+204) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #15 pc 00612d70 /apex/com.android.art/lib64/libart.so (art::VisitClassLoaderClassesVisitor::Visit+112) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #16 pc 00396758 /apex/com.android.art/lib64/libart.so (art::ClassLinker::VisitClassLoaders const+104) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #17 pc 004b7514 /apex/com.android.art/lib64/libart.so (art::ClassLinker::VisitClassesInternal+1172) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #18 pc 004b6e9c /apex/com.android.art/lib64/libart.so (art::ClassLinker::VisitClasses+124) (BuildId: 40c660f95066cc11f492b0a0091a58ad) 2026-09-18 03:08:08.662 tchapp.helloworld com...app.helloworld runtime.cc:714] native: #19 pc 007ffb8c /apex/com.android.art/lib64/libart.so (art::instrumentation::Instrumentation::UpdateEntrypointsForDebuggable+60) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #20 pc 0002f560 /apex/com.android.art/lib64/libopenjdkjvmti.so (openjdkjvmti::DeoptManager::FinishSetup+336) (BuildId: fdfe1c687dfb83aeced7ca2a67feff78) runtime.cc:714] native: #21 pc 0004a3ec /apex/com.android.art/lib64/libopenjdkjvmti.so (ArtPlugin_Initialize+252) (BuildId: fdfe1c687dfb83aeced7ca2a67feff78) runtime.cc:714] native: #22 pc 003fdd78 /apex/com.android.art/lib64/libart.so (art::Plugin::Load+104) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #23 pc 003fdb38 /apex/com.android.art/lib64/libart.so (art::Runtime::EnsurePluginLoaded+216) (BuildId: 40c660f95066cc11f492b0a0091a58ad) runtime.cc:714] native: #24 pc 00b0105c /memfd:frida-agent-64.so (deleted) (???) runtime.cc:714] native: #25 pc 00b00b04 /memfd:frida-agent-64.so (deleted) (???) runtime.cc:714] native: #26 pc 009d2fd4 /memfd:frida-agent-64.so (deleted) (???) runtime.cc:714] native: #27 pc 009d2b98 /memfd:frida-agent-64.so (deleted) (???) runtime.cc:714] native: #60 pc 00b2814c /memfd:frida-agent-64.so (deleted) (???) 2026-09-18 03:08:08.662 tchapp.helloworld com...app.helloworld runtime.cc:714] native: #61 pc 000877dc /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start +236) (BuildId: 30ed8d12b73f97af114ffd98e0d4f2e7) runtime.cc:714] native: #62 pc 000785c0 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 30ed8d12b73f97af114ffd98e0d4f2e7) runtime.cc:714] (no managed stack frames) runtime.cc:714] ``` ``` Error: abort was called at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1) at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1) at fc (D:\projects\test\app\src\main\assets\scripts\script.js:1) at get (D:\projects\test\app\src\main\assets\scripts\script.js:1) at dd (D:\projects\test\app\src\main\assets\scripts\script.js:1874) at No (D:\projects\test\app\src\main\assets\scripts\script.js:1874) at build (D:\projects\test\app\src\main\assets\scripts\script.js:1874) at _make (D:\projects\test\app\src\main\assets\scripts\script.js:1875) at use (D:\projects\test\app\src\main\assets\scripts\script.js:1875) at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1884) at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1) at _performPendingVmOpsWhenReady (D:\projects\test\app\src\main\assets\scripts\script.js:1884) at perform (D:\projects\test\app\src\main\assets\scripts\script.js:1884) at <anonymous> (D:\projects\test\app\src\main\assets\scripts\script.js:1884) at apply (native) at <anonymous> (/frida/runtime/core.js:55) ``` ### Observation I've reproduced this same abort signature (`method_index < num_methods_`) across multiple different apps and different hooked methods, always with `method_index=275`, while `num_methods_` varies (5, 42, ...) depending on the class involved. The crash only happens when both of these are true: 1. Vector has an active hook on some method in the process (in this specific repro: `Application.onCreate`). 2. Frida performs `Java.perform` in that same process. Neither condition alone causes a crash. ### Xposed Module List/Xposed 模块列表 ```shell https://github.com/staleroot/frida-crash-module ``` ### Root implementation/Root 方案 Magisk 30.7, Vector 2.2 (3111) API 102 ### System Module List/系统模块列表 ```shell https://github.com/staleroot/frida-crash-module ``` ### Vector version/Vector 版本 2.2 (3111) ### Android version/Android 版本 16 (API 36.1) LineageOS 23.2-20260830-NIGHTLY-davinci ### Version requirement/版本要求 - [x] I am using the latest debug build from [GitHub Actions](https://github.com/JingMatrix/Vector/actions?query=branch%3Amaster)./我正在使用 [GitHub Actions](https://github.com/JingMatrix/Vector/actions?query=branch%3Amaster) 中最新的调试版本。 ### Logs/日志 [logs.zip](https://github.com/user-attachments/files/32364677/logs.zip)