{"id":10020669,"date":"2025-03-13T21:09:57","date_gmt":"2025-03-13T13:09:57","guid":{"rendered":"https:\/\/itmax.cn\/?p=10020669"},"modified":"2025-03-13T21:09:57","modified_gmt":"2025-03-13T13:09:57","slug":"%e5%be%97%e7%89%a9-android-crash-%e6%b2%bb%e7%90%86%e5%ae%9e%e8%b7%b5","status":"publish","type":"post","link":"https:\/\/itmax.cn\/?p=10020669","title":{"rendered":"\u5f97\u7269 Android Crash \u6cbb\u7406\u5b9e\u8df5"},"content":{"rendered":"<h2>\u4e00\u3001\u524d\u8a00<\/h2>\n<p>\u901a\u8fc7\u4fee\u590d\u5386\u53f2\u9057\u7559\u7684Crash\u6f0f\u62a5\u95ee\u9898\uff08\u5305\u62ec\u7aef\u4fa7SDK\u91c7\u96c6\u7684\u517c\u5bb9\u6027\u4f18\u5316\u53caCrash\u5e73\u53f0\u7684\u6570\u636e\u6d88\u8d39\u673a\u5236\u5b8c\u5584\uff09\uff0c\u5f97\u7269Android\u7aef\u7684Crash\u76d1\u63a7\u4f53\u7cfb\u5f97\u5230\u663e\u8457\u589e\u5f3a\uff0c\u4f7f\u5f97\u5386\u53f2Crash\u6570\u636e\u7684\u5b8c\u6574\u6355\u83b7\u80fd\u529b\u5f97\u5230\u7cfb\u7edf\u6027\u6539\u5584\uff0c\u76f8\u5e94Crash\u6307\u6807\u4e5f\u6709\u6240\u4e0a\u5347\uff0c\u7ecf\u8fc7\u67b6\u6784\u4ee5\u53ca\u5404\u56e2\u961f\u7684\u5171\u540c\u52aa\u529b\u4e0b\uff0c\u5d29\u6e83\u7387\u5df2\u4ece\u6700\u9ad8\u7684\u4e072\u964d\u81f3\u76ee\u524d\u7684\u4e071.1\u5230\u4e071.5\uff0c\u5176\u4e2d\u7591\u96be\u95ee\u9898\u5360\u6bd4\u7ea690%\u3001\u56e0\u7cfb\u7edfbug\u5bfc\u81f4\u7684Crash\u5360\u6bd4\u7ea640%\uff0c\u5728\u672c\u6587\u4e2d\u5c06\u7b80\u8981\u4ecb\u7ecd\u4e00\u4e9b\u8f83\u5178\u578b\u7684\u7cfb\u7edfCrash\u7684\u6cbb\u7406\u8fc7\u7a0b\u3002<\/p>\n<h2>\u4e8c\u3001DNS\u89e3\u6790\u5d29\u6e83<\/h2>\n<h3>\u80cc\u666f<\/h3>\n<p>Android11\u53ca\u4ee5\u4e0b\u7248\u672c\u5728DNS\u89e3\u6790\u8fc7\u7a0b\u4e2d\u7684\u6709\u51e0\u7387\u4ea7\u751f\u91ce\u6307\u9488\u95ee\u9898\u5bfc\u81f4\u7684Native Crash\uff0c\u5176\u4e2dAndroid9\u5360\u6bd4\u6700\u9ad8\u3002 <\/p>\n<p><em>\u5806\u6808\u4e0e\u4e0a\u62a5\u8d8b\u52bf<\/em><\/p>\n<pre><code class=\"java\">at libcore.io.Linux.android_getaddrinfo(Linux.java)\nat libcore.io.BlockGuardOs.android_getaddrinfo(BlockGuardOs.java:172)\nat java.net.InetAddress.parseNumericAddressNoThrow(InetAddress.java:1631)\nat java.net.Inet6AddressImpl.lookupAllHostAddr(Inet6AddressImpl.java:96)\nat java.net.InetAddress.getAllByName(InetAddress.java:1154)\n\n#00 pc 000000000003b938  \/system\/lib64\/libc.so (android_detectaddrtype+1164)\n#01 pc 000000000003b454  \/system\/lib64\/libc.so (android_getaddrinfofornet+72)\n#02 pc 000000000002b5f4  \/system\/lib64\/libjavacore.so (_ZL25Linux_android_getaddrinfoP7_JNIEnvP8_jobjectP8_jstringS2_i+336)<\/code><\/pre>\n<p><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216356\" alt=\"\u4e0a\u62a5\u8d8b\u52bf.jpeg\" title=\"\u4e0a\u62a5\u8d8b\u52bf.jpeg\"><\/p>\n<h3>\u95ee\u9898\u5206\u6790<\/h3>\n<p>\u5d29\u6e83\u5165\u53e3\u65b9\u6cd5InetAddress.getAllByName\u7528\u4e8e\u6839\u636e\u6307\u5b9a\u7684\u4e3b\u673a\u540d\u8fd4\u56de\u4e0e\u4e4b\u5173\u8054\u7684\u6240\u6709 IP \u5730\u5740\uff0c\u5b83\u4f1a\u6839\u636e\u7cfb\u7edf\u914d\u7f6e\u7684\u540d\u79f0\u670d\u52a1\u8fdb\u884c\u89e3\u6790\uff0c\u6cbf\u7740\u8c03\u7528\u94fe\u67e5\u770b\u6e90\u7801\u53d1\u73b0\u5728parseNumericAddressNoThrow\u65b9\u6cd5\u5185\u90e8\u8c03\u7528Libcore.os.android_getaddrinfo\u65f6\u4e2d\u6709try catch\u7684\u5bb9\u9519\u903b\u8f91\uff0c\u7ee7\u7eed\u67e5\u770b\u540e\u7eed\u8c03\u7528\u7684c++\u7684\u6e90\u7801\uff0c\u5728\u8c03\u7528android_getaddrinfofornet\u51fd\u6570\u8fd4\u56de\u503c\u4e0d\u4e3a0\u65f6\u629b\u51faGaiException\u5f02\u5e38\u3002<\/p>\n<pre><code class=\"java\">https:\/\/cs.android.com\/android\/platform\/superproject\/+\/android-9.0.0_r49:libcore\/ojluni\/src\/main\/java\/java\/net\/InetAddress.java\n\nstatic InetAddress parseNumericAddressNoThrow(String address) {\n       \/\/ Accept IPv6 addresses (only) in square brackets for compatibility.\n       if (address.startsWith(&quot;[&quot;) &amp;&amp; address.endsWith(&quot;]&quot;) &amp;&amp; address.indexOf(':') != -1) {\n           address = address.substring(1, address.length() - 1);\n       }\n       StructAddrinfo hints = new StructAddrinfo();\n       hints.ai_flags = AI_NUMERICHOST;\n       InetAddress[] addresses = null;\n       try {\n           addresses = Libcore.os.android_getaddrinfo(address, hints, NETID_UNSET);\n       } catch (GaiException ignored) {\n       }\n       return (addresses != null) ? addresses[0] : null;\n   }<\/code><\/pre>\n<pre><code class=\"java\">https:\/\/cs.android.com\/android\/platform\/superproject\/+\/master:libcore\/luni\/src\/main\/native\/libcore_io_Linux.cpp?q=Linux_android_getaddrinfo&amp;ss=android%2Fplatform%2Fsuperproject\n\nstatic jobjectArray Linux_android_getaddrinfo(JNIEnv* env, jobject, jstring javaNode,\n        jobject javaHints, jint netId) {\n    ......\n    int rc = android_getaddrinfofornet(node.c_str(), NULL, &amp;hints, netId, 0, &amp;addressList);\n    std::unique_ptr&lt;addrinfo, addrinfo_deleter&gt; addressListDeleter(addressList);\n    if (rc != 0) {\n        throwGaiException(env, &quot;android_getaddrinfo&quot;, rc);\n        return NULL;\n    }\n    ......\n    return result;\n}<\/code><\/pre>\n<h3>\u89e3\u51b3\u8fc7\u7a0b<\/h3>\n<p>\u89e3\u51b3\u601d\u8def\u662f\u4ee3\u7406android_getaddrinfofornet\u51fd\u6570\uff0c\u6355\u6349\u8c03\u7528\u539f\u51fd\u6570\u8fc7\u7a0b\u4e2d\u51fa\u73b0\u7684\u6bb5\u9519\u8bef\u4fe1\u53f7\uff0c\u63a5\u7740\u5403\u6389\u8fd9\u4e2a\u4fe1\u53f7\u5e76\u8fd4\u56de-1\uff0c\u4f7f\u4e4b\u8f6c\u6362\u4e3aJAVA\u5f02\u5e38\u8fdb\u800c\u8d70\u8fdbparseNumericAddressNoThrow\u65b9\u6cd5\u7684\u5bb9\u9519\u903b\u8f91\uff0c\u548c\u8d1f\u8d23\u7f51\u7edc\u7684\u540c\u5b66\u63d0\u524d\u505a\u4e86\u6c9f\u901a\uff0c\u786e\u5b9a\u6b64\u6d41\u7a0b\u5bf9\u4e1a\u52a1\u6ca1\u6709\u5f71\u54cd\u540e\u5f00\u59cb\u89e3\u51b3\u3002<\/p>\n<p>\u9996\u5148\u4f7f\u7528inline-hook\u4ee3\u7406\u4e86android_getaddrinfofornet\u51fd\u6570\uff0c\u63a5\u7740\u4f7f\u7528\u5b57\u8282\u5c01\u88c5\u597d\u7684native try catch\u5de5\u5177\u505a\u5403\u6389\u6bb5\u9519\u8bef\u4fe1\u53f7\u5e76\u8fd4\u56de-1\u7684\uff0c\u5b57\u8282\u5de5\u5177\u5185\u90e8\u539f\u7406\u662f\u5728try\u5757\u7684\u5f00\u59cb\u4f7f\u7528sigsetjmp\u6253\u4e2a\u951a\u70b9\u5e76\u5feb\u7167\u5f53\u524d\u5bc4\u5b58\u5668\u7684\u503c\uff0c\u7136\u540e\u8bbe\u7f6e\u4fe1\u53f7\u91cf\u5904\u7406\u5668\u5e76\u5173\u8054\u5f53\u524d\u7ebf\u7a0b\uff0c\u5728catch\u5757\u4e2d\u89e3\u7ed1\u7ebf\u7a0b\u4e0e\u4fe1\u53f7\u7684\u5173\u8054\u5e76\u6267\u884c\u4e1a\u52a1\u515c\u5e95\u4ee3\u7801\uff0c\u5728\u6355\u6349\u5230\u4fe1\u53f7\u65f6\u901a\u8fc7siglongjmp\u51fd\u6570\u957f\u8df3\u8f6c\u5230catch\u5757\u4e2d\uff0c\u611f\u5174\u8da3\u7684\u540c\u5b66\u53ef\u4ee5\u7528\u4e0b\u9762\u7cbe\u7b80\u540e\u7684demo\u8bd5\u8bd5\uff0c\u4ee5\u4e0b\u4ee3\u7801\u4fdd\u5b58\u4e3amem_err.c\uff0c\u6267\u884cgcc .\/mem_err.c;.\/a.out<\/p>\n<pre><code class=\"java\">#include &lt;stdio.h&gt;\n#include &lt;signal.h&gt;\n#include &lt;setjmp.h&gt;\n\nstruct sigaction old;\nstatic sigjmp_buf buf;\n\nvoid SIGSEGV_handler(int sig, siginfo_t *info, void *ucontext) {\n    printf(&quot;\u4fe1\u53f7\u5904\u7406 sig: %d, code: %d\/n&quot;, sig, info-&gt;si_code);\n    siglongjmp(buf, -1);\n}\n\nint main() {\n    if (!sigsetjmp(buf, 0)) {\n        struct sigaction sa;\n\n        sa.sa_sigaction = SIGSEGV_handler;\n        sigaction(SIGSEGV, &amp;sa, &amp;old);\n\n        printf(&quot;try exec\/n&quot;);\n        \/\/\u4ea7\u751f\u6bb5\u9519\u8bef\n        int *ptr = NULL;\n        *ptr = 1;\n        printf(&quot;try-block end\/n&quot;);\/\/\u8d70\u4e0d\u5230\n    } else {\n        printf(&quot;catch exec\/n&quot;);\n        sigaction(SIGSEGV, &amp;old, NULL);\n    }\n    printf(&quot;main func end\/n&quot;);\n    return 0;\n}\n\n\/\/\u8f93\u51fa\u4ee5\u4e0b\u65e5\u5fd7\n\/\/try exec\n\/\/\u4fe1\u53f7\u5904\u7406 sig: 11, code: 2\n\/\/catch exec\n\/\/main func end<\/code><\/pre>\n<p><em>inline-hook\u5e93: <a href=\"https:\/\/link.segmentfault.com\/?enc=1BwoystVUZE342ysswORiQ%3D%3D.Bd4VxGObRlq8mx6bOXTiMaHBnmSzmu1%2FA%2FS1JUragO3APHlqagxI7oAFcRpO3Fbvfsneng4SSEjcf5%2B%2B4VxCiA%3D%3D\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/github.com\/bytedance\/android-inline-hook<\/a><\/em><\/p>\n<p><em>\u5b57\u8282native try catch\u5de5\u5177: <a href=\"https:\/\/link.segmentfault.com\/?enc=UVn85tMlNV40M5tCovwJmQ%3D%3D.bvHGSp2%2F8MFLUR9%2FGcz2QB%2BXgFIEP27x2axKT9nXpiOrfW2VoWicY2TwwSglsqKnLcSHBx49MB0v6I8o5ucEdJDJ3%2Fsz5YHbtpM9V2QgnZMvoLM3wPMJ0Vo1KvQwOYZ%2FXcJz%2BnAeXfNKB2dGPwgs%2FQ%3D%3D\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/github.com\/bytedance\/android-inline-hook\/blob\/main\/shadowhook\/src\/main\/cpp\/common\/bytesig.c<\/a><\/em><\/p>\n<h2>\u4e09\u3001MediaCodec \u72b6\u6001\u5f02\u5e38\u5d29\u6e83<\/h2>\n<h3>\u80cc\u666f<\/h3>\n<p>\u5728Android 11\u7cfb\u7edf\u5e93\u7684\u97f3\u89c6\u9891\u64ad\u653e\u8fc7\u7a0b\u4e2d\uff0c\u5076\u5c14\u4f1a\u51fa\u73b0\u56e0\u72b6\u6001\u5f02\u5e38\u5bfc\u81f4\u7684SIGABRT\u5d29\u6e83\u3002\u97f3\u89c6\u9891\u56e2\u961f\u53cd\u9988\u6307\u51fa\uff0c\u8fd9\u662fAndroid 11\u7684\u4e00\u4e2a\u7cfb\u7edfbug\u3002\u968f\u540e\uff0c\u6211\u4eec\u534f\u52a9\u97f3\u89c6\u9891\u56e2\u961f\u901a\u8fc7hook\u89e3\u51b3\u4e86\u8fd9\u4e00\u95ee\u9898\u3002<\/p>\n<p><em>\u5806\u6808\u4e0e\u4e0a\u62a5\u8d8b\u52bf<\/em><\/p>\n<pre><code class=\"java\">#00 pc 0000000000089b1c  \/apex\/com.android.runtime\/lib64\/bionic\/libc.so (abort+164)\n#01 pc 000000000055ed78  \/apex\/com.android.art\/lib64\/libart.so (_ZN3art7Runtime5AbortEPKc+2308)\n#02 pc 0000000000013978  \/system\/lib64\/libbase.so (_ZZN7android4base10SetAborterEONSt3__18functionIFvPKcEEEEN3$_38__invokeES4_+76)\n#03 pc 0000000000006e30  \/system\/lib64\/liblog.so (__android_log_assert+336)\n#04 pc 0000000000122074  \/system\/lib64\/libstagefright.so (_ZN7android10MediaCodec37postPendingRepliesAndDeferredMessagesENSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEERKNS_2spINS_8AMessageEEE+720)\n#05 pc 00000000001215cc  \/system\/lib64\/libstagefright.so (_ZN7android10MediaCodec37postPendingRepliesAndDeferredMessagesENSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEi+244)\n#06 pc 000000000011c308  \/system\/lib64\/libstagefright.so (_ZN7android10MediaCodec17onMessageReceivedERKNS_2spINS_8AMessageEEE+8752)\n#07 pc 0000000000017814  \/system\/lib64\/libstagefright_foundation.so (_ZN7android8AHandler14deliverMessageERKNS_2spINS_8AMessageEEE+84)\n#08 pc 000000000001d9cc  \/system\/lib64\/libstagefright_foundation.so (_ZN7android8AMessage7deliverEv+188)\n#09 pc 0000000000018b48  \/system\/lib64\/libstagefright_foundation.so (_ZN7android7ALooper4loopEv+572)\n#10 pc 0000000000015598  \/system\/lib64\/libutils.so (_ZN7android6Thread11_threadLoopEPv+460)\n#11 pc 00000000000a1d6c  \/system\/lib64\/libandroid_runtime.so (_ZN7android14AndroidRuntime15javaThreadShellEPv+144)\n#12 pc 0000000000014d94  \/system\/lib64\/libutils.so (_ZN13thread_data_t10trampolineEPKS_+412)\n#13 pc 00000000000eba94  \/apex\/com.android.runtime\/lib64\/bionic\/libc.so (_ZL15__pthread_startPv+64)\n#14 pc 000000000008bd80  \/apex\/com.android.runtime\/lib64\/bionic\/libc.so (__start_thread+64)<\/code><\/pre>\n<p><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216357\" alt=\"\u72b6\u6001\u5f02\u5e38\u5d29\u6e83\u4e0a\u62a5\u8d8b\u52bf.jpeg\" title=\"\u72b6\u6001\u5f02\u5e38\u5d29\u6e83\u4e0a\u62a5\u8d8b\u52bf.jpeg\" loading=\"lazy\"><\/p>\n<h3>\u95ee\u9898\u5206\u6790<\/h3>\n<p>\u6839\u636e\u5806\u6808\u5185\u5bb9\u5206\u6790Android11\u7684\u6e90\u7801\u4ee5\u53ca\u7ed3\u5408SIGABRT\u4fe1\u53f7\u91c7\u96c6\u5230\u7684\u4fe1\u606f(postPendingRepliesAndDeferredMessages: mReplyID == null, from kWhatRelease:STOPPING following kWhatError:STOPPING)\uff0c\u627e\u5230\u5d29\u6e83\u53d1\u751f\u5728onMessageReceived\u51fd\u6570\u5904\u7406kWhatRelease\u7c7b\u578b\u6d88\u606f\u7684\u8fc7\u7a0b\u4e2d\uff0conMessageReceived\u51fd\u6570\u8fde\u7eed\u6536\u5230\u4e24\u6761\u6d88\u606f\uff0c\u7b2c\u4e00\u6761\u662fkWhatError:STOPPING\uff0c\u7b2c\u4e8c\u6761\u662fkWhatRelease:STOPPING\u6b64\u65f6\u56e0mReplyID\u5df2\u7ecf\u88ab\u7f6e\u4e3a\u7a7a\uff0c\u56e0\u6b64\u8d70\u5230\u5224\u7a7a\u629b\u5f02\u5e38\u7684\u903b\u8f91\u3002<\/p>\n<p><em><a href=\"https:\/\/link.segmentfault.com\/?enc=hcymPrNmupdbMMQPVvuf9g%3D%3D.ut0UDVwmRTyHxzcpdFNPnSU7gJp4PZDsn7OZUh1YwKXvHRWexvfhflO6UF1TXPhCNUbuGNYxsxu6dDm16udEoi9RpeoRHJD61BYbSyLz4Z71bwJC%2Bjzk0JIc2oeRjxuMNiJn0SUlz5S8JMg4fcdttiFphdjfQCYTKIY0BZRUG4vFyOyV26H1Wl01h6ov5zFL\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/cs.android.com\/android\/_\/android\/platform\/frameworks\/&#8230;<\/a>;l=2280;drc=789055bbcb4560b42faf19103b1cda5534e8f9cb;bpv=0;bpt=0<\/em><\/p>\n<p><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216358\" alt=\"\u95ee\u9898\u5206\u67901.jpeg\" title=\"\u95ee\u9898\u5206\u67901.jpeg\" loading=\"lazy\"><br \/><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216359\" alt=\"\u95ee\u9898\u5206\u67902.jpeg\" title=\"\u95ee\u9898\u5206\u67902.jpeg\" loading=\"lazy\"><br \/><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216360\" alt=\"\u95ee\u9898\u5206\u67903.jpeg\" title=\"\u95ee\u9898\u5206\u67903.jpeg\" loading=\"lazy\"><br \/><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216361\" alt=\"\u95ee\u9898\u5206\u67904.jpeg\" title=\"\u95ee\u9898\u5206\u67904.jpeg\" loading=\"lazy\"><br \/>\u5bf9\u6bd4Android12\u7684\u6e90\u7801\uff0c\u5728\u5904\u7406kWhatRelease\u4e8b\u4ef6\u4e14\u72b6\u6001\u4e3aSTOPPING\u629b\u5f02\u5e38\u524d\uff0c\u589e\u52a0\u4e86\u5bf9mReplyID\u4e0d\u4e3a\u7a7a\u7684\u5224\u65ad\u6765\u89c4\u907f\u8fd9\u4e2a\u95ee\u9898\u3002<\/p>\n<p><em><a href=\"https:\/\/link.segmentfault.com\/?enc=hguabs8DbsH4ViKekuqb7Q%3D%3D.xPsATBIzZPv4W2Uo0mCzjgGqgJaa9py417JLi%2FnC6uJASKHOfVfTvgKkXRD4TPqgzLDJ%2Fq37vEScB8ueRQ7dwzXVCwUF0VzGTzXJiFURWS%2BbXqWSc%2F6RyXPYN%2B%2FsGViL%2Bpksy2k4nfdefjdbpyO2KOrzKytZzkQG9XaBqEX%2FKwZGq6At8KyQENh6SVpqhsWP\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/cs.android.com\/android\/_\/android\/platform\/frameworks\/&#8230;<\/a>;dlc=7327aab894f6c456ea16c95b64134841da8d5737<\/em><\/p>\n<p><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216362\" alt=\"\u89c4\u907f\u8fd9\u4e2a\u95ee\u9898.jpeg\" title=\"\u89c4\u907f\u8fd9\u4e2a\u95ee\u9898.jpeg\" loading=\"lazy\"><\/p>\n<h3>\u89e3\u51b3\u8fc7\u7a0b<\/h3>\n<p>Android12\u7684\u4fee\u590d\u65b9\u5f0f\u610f\u5473\u7740\u4e0a\u8ff0\u4e09\u4e2a\u6761\u4ef6\u7ed3\u5408\u4e0b\u5403\u6389\u5f02\u5e38\u662f\u7b26\u5408\u9884\u671f\u7684\uff0c\u63a5\u4e0b\u6765\u5c31\u662f\u60f3\u529e\u6cd5\u901a\u8fc7hook Android11\u4f7f\u903b\u8f91\u5bf9\u9f50Android12\u3002<\/p>\n<p>\u3010\u521d\u63a2\u3011\u6700\u5148\u60f3\u5230\u7684\u529e\u6cd5\u662f\u4ee3\u7406\u76f8\u5173\u51fd\u6570\u901a\u8fc7\u5224\u65ad\u8d70\u5230\u8fd9\u4e2a\u573a\u666f\u65f6\u63d0\u524dreturn\u51fa\u53bb\u6765\u89c4\u907f\uff0c\u97f3\u89c6\u9891\u7684\u540c\u5b66\u5c1d\u8bd5\u540e\u53d1\u73b0\u4e0d\u53ef\u884c\uff0c\u539f\u56e0\u5982\u4e0b\uff1a<\/p>\n<ul>\n<li>void MediaCodec::postPendingRepliesAndDeferredMessages(std::string origin, status_t err): \u5339\u914dorigin\u662f\u5426\u4e3a\u7279\u5f81\u5b57\u7b26\u4e32(postPendingRepliesAndDeferredMessages: mReplyID == null, from kWhatRelease:STOPPING following kWhatError:STOPPING)\uff1b\u5f88\u591a\u8bbe\u5907\u627e\u4e0d\u5230\u8fd9\u4e2a\u7b26\u53f7\u4e0d\u53ef\u884c\uff1b<\/li>\n<li>void MediaCodec::onMessageReceived(const sp&#038;msg): \u5df2\u77e5MediaCodec\u5b9e\u4f8b\u7684\u5185\u5b58\u9996\u5730\u5740\uff0c\u9700\u8981\u901a\u8fc7hardcode\u504f\u79fb\u91cf\u6765\u83b7\u53d6mReplay\u3001mState\u4e24\u4e2a\u5b57\u6bb5\uff0c\u8fd9\u91cc\u53c8\u7f3a\u5c11\u53ef\u4f9b\u6821\u9a8c\u6b63\u786e\u6027\u7684\u7279\u5f81\uff0c\u98ce\u9669\u7565\u5927\u62c5\u5fc3\u6709\u4e0d\u540c\u673a\u578b\u7684\u517c\u5bb9\u6027\u95ee\u9898(\u4e0d\u540c\u673a\u578b\u65b0\u589e\u3001\u5220\u9664\u5b57\u6bb5\u5bfc\u81f4\u504f\u79fb\u91cf\u4e0d\u51c6)\u3002<\/li>\n<\/ul>\n<p>\u3010\u8e29\u5751\u3011\u63a5\u7740\u5c1d\u8bd5\u4f7f\u7528\u4e0e\u4fee\u590dDNS\u5d29\u6e83\u7c7b\u4f3c\u601d\u8def\u7684\u4fdd\u62a4\u65b9\u6848\uff0c\u4f7f\u7528inline-hook\u4ee3\u7406onMessageReceived\u51fd\u6570\u8c03\u7528\u539f\u51fd\u6570\u65f6\u4f7f\u7528setjmp\u6253\u951a\u70b9\uff0c\u7136\u540e\u4f7f\u7528plt hook\u4ee3\u7406_android_log_assert\u51fd\u6570\u5e76\u5728\u5185\u90e8\u68c0\u6d4b\u9519\u8bef\u4fe1\u606f\u4e3a\u7279\u5f81\u5b57\u7b26\u4e32\u65f6\u901a\u8fc7longjmp\u8df3\u8f6c\u5230onMessageReceived\u51fd\u6570\u7684\u951a\u70b9\u5e76\u4f5creturn\u64cd\u4f5c\uff0c\u7cbe\u7b80\u540e\u7684demo\u5982\u4e0b\uff1a<\/p>\n<p><em>Plt-hook \u5e93: <a href=\"https:\/\/link.segmentfault.com\/?enc=txtERFxndSz3GvaobOLczw%3D%3D.Kw%2Bnsg6sTD6QXwFMXAUGUoAaA9EEdrP%2Ff3OCWfhEXfg%3D\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/github.com\/iqiyi\/xHook<\/a><\/em><\/p>\n<pre><code class=\"java\">#include &lt;iostream&gt;\n#include &lt;setjmp.h&gt;\n#include &lt;csignal&gt;\n\nstatic thread_local jmp_buf _buf;\nvoid *origin_onMessageReceived = nullptr;\nvoid *origin__android_log_assert = nullptr;\n\nvoid _android_log_assert_proxy(const char* cond, const char *tag, const char* fmt, ...) {\n    \/\/\u6a21\u62dfliblog.so\u7684__android_log_assert\u51fd\u6570\n    std::cout &lt;&lt; &quot;__android_log_assert start&quot; &lt;&lt; std::endl;\n    if (!strncmp(fmt, &quot;postPendingRepliesAndDeferredMessages: mReplyID == null&quot;, 55)) {\n        longjmp(_buf, -1);\n    }\n    \/\/\u6a21\u62df\u8c03\u7528origin__android_log_assert\uff0c\u4ea7\u751f\u5d29\u6e83 \n    raise(SIGABRT);\n}\n\nvoid onMessageReceived_proxy(void *thiz, void *msg) {\n    std::cout &lt;&lt; &quot;onMessageReceived_proxy start&quot; &lt;&lt; std::endl;\n    if (!setjmp(_buf)) {\n        \/\/\u6a21\u62df\u8c03\u7528onMessageReceived\u539f\u51fd\u6570(origin_onMessageReceived)\u8fdb\u5165\u5d29\u6e83\u6d41\u7a0b\n        std::cout &lt;&lt; &quot;onMessageReceived_proxy 1&quot; &lt;&lt; std::endl;\n        _android_log_assert_proxy(nullptr, nullptr, &quot;postPendingRepliesAndDeferredMessages: mReplyID == null, from kWhatRelease:STOPPING following kWhatError:STOPPING&quot;);\n        std::cout &lt;&lt; &quot;onMessageReceived_proxy 2&quot; &lt;&lt; std::endl;\/\/\u8d70\u4e0d\u5230\n    } else {\n        \/\/\u4fdd\u62a4\u540e\u4ece\u6b64\u5904\u8fd4\u56de\n        std::cout &lt;&lt; &quot;onMessageReceived_proxy 3&quot; &lt;&lt; std::endl;\n    }\n    std::cout &lt;&lt; &quot;onMessageReceived_proxy end&quot; &lt;&lt; std::endl;\n}\n\nint main() {\n    std::cout &lt;&lt; &quot;main func start&quot; &lt;&lt; std::endl;\n    \/**\n     inline-hook: shadowhook_hook_sym_name(&quot;libstagefright.so&quot;,&quot;_ZN7android10MediaCodec17onMessageReceivedERKNS_2spINS_8AMessageEEE&quot;,(void *) onMessageReceived_proxy, (void **) &amp;origin_onMessageReceived);\n     plhook: xh_core_register(&quot;libstagefright.so&quot;, &quot;__android_log_assert&quot;, (void *) (_android_log_assert_proxy), (void **) (&amp;origin__android_log_assert));\n     *\/\n    \/\/\u6a21\u62df\u8c03\u7528libstagefright.so\u7684_ZN7android10MediaCodec17onMessageReceivedERKNS_2spINS_8AMessageEEE\u51fd\u6570\n    onMessageReceived_proxy(nullptr, nullptr);\n    std::cout &lt;&lt; &quot;main func end&quot; &lt;&lt; std::endl;\n    return 0;\n}\n\n\/**\n\u65e5\u5fd7\u8f93\u51fa\n main func start\nonMessageReceived_proxy start\nonMessageReceived_proxy 1\n__android_log_assert start\nonMessageReceived_proxy 3\nonMessageReceived_proxy end\nmain func end\n*\/<\/code><\/pre>\n<p>\u7ebf\u4e0b\u4e00\u9635\u64cd\u4f5c\u731b\u5982\u864e\u7ecf\u6d4b\u8bd5\u4fdd\u62a4\u903b\u8f91\u7b26\u5408\u9884\u671f\uff0c\u4f46\u662f\u5728\u7070\u5ea6\u671f\u95f4\u8e29\u5230\u6808\u6ea2\u51fa\u4fdd\u62a4\u5bfc\u81f4\u9519\u8bef\u8f6c\u79fb\u7684\u5751\uff0c\u5806\u6808\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"java\">#00 pc 000000000004e40c  \/apex\/com.android.runtime\/lib64\/bionic\/libc.so (abort+164)\n#01 pc 0000000000062730  \/apex\/com.android.runtime\/lib64\/bionic\/libc.so (__stack_chk_fail+20)\n#02 pc 000000000000a768 \/data\/app\/~~JaQm4SU8wxP7T2GaSWxYkQ==\/com.shizhuang.duapp-N5RFIB8WurdccMgAVsBang==\/lib\/arm64\/libduhook.so (_ZN25CrashMediaCodecProtection5proxyEPvS0_)\n#03 pc 0000000001091c0c  [anon:scudo:primary]<\/code><\/pre>\n<p>*\u5173\u4e8e\u6808\u6ea2\u51fa\u4fdd\u62a4\u673a\u5236\u611f\u5174\u8da3\u7684\u540c\u5b66\u53ef\u4ee5\u53c2\u8003\u8fd9\u7bc7\u6587\u7ae0<a href=\"https:\/\/link.segmentfault.com\/?enc=wqdRNOfpJA%2FhupE9VfQIaA%3D%3D.SZDXml%2BqPvoLZwJAqi798rFr2K5O1BXJ6EJF5re2HTeDBdZYFeSKsQyWE7xDTMER\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/bbs.kanxue.com\/thread-221762-1.htm<\/a><\/p>\n<p>\uff08CSPP \u7b2c3\u7248 \u201c3.10.3 \u5185\u5b58\u8d8a\u754c\u5f15\u7528\u548c\u7f13\u51b2\u533a\u6ea2\u51fa\u201d\u7ae0\u8282\u8bb2\u7684\u66f4\u8be6\u7ec6\uff09*<\/p>\n<p>longjmp\u51fd\u6570\u53ea\u662f\u6062\u590d\u5bc4\u5b58\u5668\u7684\u503c\u540e\u4ece\u951a\u70b9\u5904\u518d\u6b21\u8fd4\u56de\uff0c\u8fc7\u7a0b\u4e2d\u4e5f\u552f\u4e00\u53ef\u80fd\u4f1a\u64cd\u4f5c\u6808\u796f\u53ea\u6709inline-hook\uff0c\u5f53\u65f6\u6000\u7591\u662f\u4e0esetjmp\/longjmp\u673a\u5236\u4e0d\u517c\u5bb9\uff0c\u7531\u4e8einline-hook\u5185\u90e8\u903b\u8f91\u5927\u91cf\u4f7f\u7528\u6c47\u7f16\u6765\u5b9e\u73b0\u6392\u67e5\u8d77\u6765\u6bd4\u8f83\u56f0\u96be\uff0c\u56e0\u6b64\u8fd9\u4e2a\u95ee\u9898\u56f0\u6270\u6bd4\u8f83\u4e45\uff0c\u7f51\u4e0a\u7684\u8d44\u6599\u63d0\u5230\u53ef\u4ee5\u4f7f\u7528\u4ee3\u7406\u51fa\u9519\u51fd\u6570(__stack_chk_fail)\u6216\u8005\u7f16\u8bd1so\u65f6\u589e\u52a0\u53c2\u6570\u4e0d\u8ba9\u7f16\u8bd1\u5668\u751f\u6210\u4fdd\u62a4\u4ee3\u7801\u6765\u7ed5\u8fc7\uff0c\u8fd9\u4e24\u79cd\u65b9\u5f0f\u5f71\u54cd\u9762\u90fd\u6bd4\u8f83\u5927\u6240\u4ee5\u672a\u91c7\u7528\u3002\u6709\u4e86\u524d\u9762\u7684\u6000\u7591\u70b9\u60f3\u5230\u4f7f\u7528c++\u7684try catch\u673a\u5236\u6765\u505a\u8de8\u51fd\u6570\u57df\u7684\u8df3\u8f6c\uff0c\u5927\u81f4\u7684\u601d\u8def\u540c\u4e0a\u53ea\u662f\u628asetjmp\u66ff\u6362\u4e3ac++\u7684try catch\uff0c\u628alongjmp\u66ff\u6362\u4e3athrow exception\uff0c\u7cbe\u7b80\u540e\u7684demo\u5982\u4e0b\uff1a<\/p>\n<p><em>c++\u5f02\u5e38\u673a\u5236\u4ecb\u7ecd: <a href=\"https:\/\/link.segmentfault.com\/?enc=GbrtPFylJ0E4DtfqQ%2FlFdw%3D%3D.YafIr1gmSGy3%2BltnryGrUyeVAjPIPi1UbwESpXZdISKhmg5cNZpbLrqu2Yzwj7S0\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/baiy.cn\/doc\/cpp\/inside_exception.htm<\/a><\/em><\/p>\n<pre><code class=\"java\">#include &lt;iostream&gt;\n#include &lt;csignal&gt;\n\nvoid *origin_onMessageReceived = nullptr;\nvoid *origin__android_log_assert = nullptr;\n\nclass MyCustomException : public std::exception {\npublic:\n    explicit MyCustomException(const std::string&amp; message)\n            : msg_(message) {}\n\n    virtual const char* what() const noexcept override {\n        return msg_.c_str();\n    }\n\nprivate:\n    std::string msg_;\n};\n\nvoid _android_log_assert_proxy(const char* cond, const char *tag, const char* fmt, ...) {\n    \/\/\u6a21\u62dfliblog.so\u7684__android_log_assert\u51fd\u6570\n    std::cout &lt;&lt; &quot;__android_log_assert start&quot; &lt;&lt; std::endl;\n    if (!strncmp(fmt, &quot;postPendingRepliesAndDeferredMessages: mReplyID == null&quot;, 55)) {\n        throw MyCustomException(&quot;postPendingRepliesAndDeferredMessages: mReplyID == null&quot;);\n    }\n    \/\/\u6a21\u62df\u8c03\u7528origin__android_log_assert\uff0c\u4ea7\u751f\u5d29\u6e83\n    raise(SIGABRT);\n}\n\nvoid onMessageReceived_proxy(void *thiz, void *msg) {\n    std::cout &lt;&lt; &quot;onMessageReceived_proxy start&quot; &lt;&lt; std::endl;\n    try {\n        \/\/\u6a21\u62df\u8c03\u7528onMessageReceived\u539f\u51fd\u6570(origin_onMessageReceived)\u8fdb\u5165\u5d29\u6e83\u6d41\u7a0b\n        std::cout &lt;&lt; &quot;onMessageReceived_proxy 1&quot; &lt;&lt; std::endl;\n        _android_log_assert_proxy(nullptr, nullptr, &quot;postPendingRepliesAndDeferredMessages: mReplyID == null, from kWhatRelease:STOPPING following kWhatError:STOPPING&quot;);\n        std::cout &lt;&lt; &quot;onMessageReceived_proxy 2&quot; &lt;&lt; std::endl;\/\/\u8d70\u4e0d\u5230\n    } catch (const MyCustomException&amp; e) {\n        \/\/\u4fdd\u62a4\u540e\u4ece\u6b64\u5904\u8fd4\u56de\n        std::cout &lt;&lt; &quot;onMessageReceived_proxy 3&quot; &lt;&lt; std::endl;\n    }\n    std::cout &lt;&lt; &quot;onMessageReceived_proxy end&quot; &lt;&lt; std::endl;\n}\n\nint main() {\n    std::cout &lt;&lt; &quot;main func start&quot; &lt;&lt; std::endl;\n    \/**\n     inline-hook: shadowhook_hook_sym_name(&quot;libstagefright.so&quot;,&quot;_ZN7android10MediaCodec17onMessageReceivedERKNS_2spINS_8AMessageEEE&quot;,(void *) onMessageReceived_proxy, (void **) &amp;origin_onMessageReceived);\n     plhook: xh_core_register(&quot;libstagefright.so&quot;, &quot;__android_log_assert&quot;, (void *) (_android_log_assert_proxy), (void **) (&amp;origin__android_log_assert));\n     *\/\n    \/\/\u6a21\u62df\u8c03\u7528libstagefright.so\u7684_ZN7android10MediaCodec17onMessageReceivedERKNS_2spINS_8AMessageEEE\u51fd\u6570\n    onMessageReceived_proxy(nullptr, nullptr);\n    std::cout &lt;&lt; &quot;main func end&quot; &lt;&lt; std::endl;\n    return 0;\n}\n\n\/**\n\u65e5\u5fd7\u8f93\u51fa\n main func start\nonMessageReceived_proxy start\nonMessageReceived_proxy 1\n__android_log_assert start\nonMessageReceived_proxy 3\nonMessageReceived_proxy end\nmain func end\n*\/<\/code><\/pre>\n<p>\u7070\u5ea6\u4e0a\u7ebf\u540e\u53d1\u73b0\u6709\u8bbe\u5907\u8d70\u5230\u4e86_android_log_assert\u4ee3\u7406\u51fd\u6570\u4e2d\u7684throw\u903b\u8f91\uff0c\u4f46\u662f\u672a\u6309\u9884\u671f\u8d70\u5230catch\u5757\u800c\u662f\u628a\u9519\u8bef\u53c8\u8f6c\u79fb\u4e3a&#8221; terminating with uncaught exception of type&#8221; \uff0c\u6709\u70b9\u641e\u5fc3\u6001\u554a\u3002<\/p>\n<p>\u3010\u67f3\u6697\u82b1\u660e\u3011C++\u7684\u5f02\u5e38\u5904\u7406\u673a\u5236\u5728throw\u6267\u884c\u65f6\uff0c\u4f1a\u5f00\u59cb\u5728\u8c03\u7528\u6808\u4e2d\u5411\u4e0a\u67e5\u627e\u5339\u914d\u7684catch\u5757\uff0c\u68c0\u67e5\u6bcf\u4e00\u4e2a\u51fd\u6570\u76f4\u5230\u627e\u5230\u4e00\u4e2a\u5177\u6709\u5408\u9002\u7c7b\u578b\u7684catch\u5757\uff0c\u4e0a\u8ff0\u7684\u9519\u8bef\u4fe1\u606f\u4ee3\u8868\u672a\u627e\u5230\u5339\u914d\u7684catch\u5757\u3002\u4ece\u8f6c\u79fb\u7684\u5806\u6808\u4e2d\u6ce8\u610f\u5230\u6ca1\u6709onMessageReceived\u4ee3\u7406\u51fd\u6570\u7684\u5806\u6808\uff0c\u6b64\u65f6\u57fa\u4e8einline-hook\u7684\u539f\u7406(\u4fee\u6539\u539f\u51fd\u6570\u524d\u9762\u7684\u6c47\u7f16\u4ee3\u7801\u8df3\u8f6c\u5230\u4ee3\u7406\u51fd\u6570)\u53c8\u6000\u7591\u5230\u5b83\u8eab\u4e0a\uff0c\u518d\u6b21\u6392\u67e5\u4ee3\u7801\u65f6\u53d1\u73b0\u4ee3\u7406\u51fd\u6570\u5f00\u5934\u6f0f\u5199\u4e86\u4e00\u4e2a\u5b8f\uff0c\u5728inline-hook\u4e2dSHADOWHOOK_STACK_SCOPE\u5c31\u662f\u6765\u7ba1\u7406\u6808\u796f\u7684\uff0c\u56e0\u6b64\u51fa\u73b0\u627e\u4e0d\u5230catch\u5757\u4ee5\u53ca\u524d\u9762longjmp\u7684\u95ee\u9898\u5c31\u4e0d\u5947\u602a\u4e86\u3002\u52a0\u4e0a\u8fd9\u4e2a\u5b8f\u4ee5\u540e\u67f3\u6697\u82b1\u660e\uff0c\u91cd\u65b0\u653e\u91cf\u540e\u4fdd\u62a4\u903b\u8f91\u6309\u9884\u671f\u6267\u884c\u5e76\u4e14\u4fdd\u62a4\u751f\u6548\u540e\u89c6\u9891\u64ad\u653e\u6b63\u5e38\u3002\u548c\u97f3\u89c6\u9891\u7684\u5c0f\u4f19\u4f34\u4e00\u52aa\u529b\u4e0b\uff0c\u7ecf\u5386\u4e86\u51e0\u4e2a\u7248\u672c\u7ec8\u4e8e\u89e3\u51b3\u4e86\u8fd9\u4e2a\u7cfb\u7edfbug\uff0c\u76ee\u524d\u4ec5\u5269\u8001\u7248\u672cApp\u6709\u96f6\u661f\u7684\u4e0a\u62a5\u3002<\/p>\n<h2>\u56db\u3001bio\u591a\u7ebf\u7a0b\u73af\u5883\u5d29\u6e83<\/h2>\n<h3>\u80cc\u666f<\/h3>\n<p>Android 11  Socket close\u8fc7\u7a0b\u4e2d\u5728\u591a\u7ebf\u7a0b\u573a\u666f\u4e0b\u6709\u51e0\u7387\u4ea7\u751f\u91ce\u6307\u9488\u95ee\u9898\u5bfc\u81f4Native Crash\uff0c\u73b0\u8c61\u662f\u591a\u4e2a\u7ebf\u7a0b\u540c\u65f6close\u8fde\u63a5\u65f6\uff0c\u4e00\u4e2a\u7ebf\u7a0b\u5df2\u9500\u6bc1\u4e86bio\u7684\u4e0a\u4e0b\u6587\uff0c\u53e6\u5916\u4e00\u4e2a\u7ebf\u7a0b\u4ecd\u6267\u884cclose\u5e76\u5728\u6b64\u8fc7\u7a0b\u4e2d\u5c1d\u8bd5\u83b7\u53d6\u8fd9\u4e2abio\u6709\u591a\u5c11\u672a\u5199\u51fa\u53bb\u7684\u5b57\u8282\u6570\u65f6\u51fa\u73b0\u91ce\u6307\u9488\u5bfc\u81f4\u7684\u6bb5\u9519\u8bef\u3002\u6b64\u95ee\u9898\u4ece21\u5e74\u9996\u6b21\u4e0a\u62a5\u4ee5\u6765\u5728\u5f97\u7269\u7684Crash\u5217\u8868\u4e2d\u4e00\u76f4\u5904\u4e8e\u8f83\u524d\u7684\u4f4d\u7f6e\u3002<\/p>\n<p><em>\u5806\u6808\u4e0e\u4e0a\u62a5\u8d8b\u52bf<\/em><\/p>\n<pre><code class=\"Java\">at com.android.org.conscrypt.NativeCrypto.SSL_pending_written_bytes_in_BIO(Native method)\nat com.android.org.conscrypt.NativeSsl$BioWrapper.getPendingWrittenBytes(NativeSsl.java:660)\nat com.android.org.conscrypt.ConscryptEngine.pendingOutboundEncryptedBytes(ConscryptEngine.java:566)\nat com.android.org.conscrypt.ConscryptEngineSocket.drainOutgoingQueue(ConscryptEngineSocket.java:584)\nat com.android.org.conscrypt.ConscryptEngineSocket.close(ConscryptEngineSocket.java:480)\nat okhttp3.internal.Util.closeQuietly_aroundBody0(Util.java:1)\nat okhttp3.internal.Util$AjcClosure1.run(Util.java:1)\nat org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:3)\nat com.shizhuang.duapp.common.aspect.ThirdSdkAspect.t(ThirdSdkAspect.java:1)\nat okhttp3.internal.Util.closeQuietly(Util.java:3)\nat okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.java:42)\nat okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.java:1)\nat okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.java:6)\nat okhttp3.internal.connection.Transmitter.newExchange(Transmitter.java:5)\nat okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:5)\n\n#00 pc 0000000000064060  \/system\/lib64\/libcrypto.so (bio_ctrl+144)\n#01 pc 00000000000615d8  \/system\/lib64\/libcrypto.so (BIO_ctrl_pending+40)\n#02 pc 00000000000387dc  \/apex\/com.android.conscrypt\/lib64\/libjavacrypto.so (_ZL45NativeCrypto_SSL_pending_written_bytes_in_BIOP7_JNIEnvP7_jclassl+20)<\/code><\/pre>\n<p><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216363\" alt=\"bio\u591a\u7ebf\u7a0b.jpeg\" title=\"bio\u591a\u7ebf\u7a0b.jpeg\" loading=\"lazy\"><\/p>\n<h3>\u95ee\u9898\u5206\u6790<\/h3>\n<p>\u4ece\u8bbe\u5907\u5206\u5e03\u4e0a\u770b\uff0c\u51fa\u95ee\u9898\u90fd\u5168\u662fAndroid 11\u4e14\u5404\u4e2a\u56fd\u5185\u5382\u5546\u7684\u8bbe\u5907\u90fd\u6709\uff0c\u6000\u7591\u662fAndroid 11\u5f15\u5165\u7684bug\uff0c\u5bf9\u6bd4\u4e86Android 11 \u548c Android 12\u7684\u6e90\u7801\uff0c\u53d1\u73b0\u5728Android12 \u5d29\u6e83\u5806\u6808\u4e2d\u7684\u76f8\u5173\u7c7b com.android.org.conscrypt.NativeSsl$BioWrapper\u6709\u56db\u4e2a\u65b9\u6cd5\u589e\u52a0\u4e86\u8bfb\u5199\u9501\uff0c\u6b64\u65f6\u6000\u7591\u662f\u591a\u7ebf\u7a0b\u95ee\u9898\uff0c\u901a\u8fc7\u641c\u7d22Android\u6e90\u7801\u7684\u76f8\u5173issue\u4ee5\u53ca\u5dee\u5f02\u4ee3\u7801\u7684MR\u63cf\u8ff0\u4fe1\u606f\uff0c\u8fdb\u4e00\u6b65\u786e\u8ba4\u6b64\u7ed3\u8bba\u3002\u901a\u8fc7\u6e90\u7801\u8fdb\u4e00\u6b65\u5206\u6790\u53d1\u73b0NativeSsl\u7684\u6240\u6709\u52a0\u9501\u7684\u65b9\u6cd5\uff0c\u4f1a\u5206\u53d1\u5230NativeCrypto.java\u4e2d\u7684native\u65b9\u6cd5\uff0c\u6700\u7ec8\u8c03\u7528\u5230native_crypto.cc\u4e2d\u7684JNI\u51fd\u6570\uff0c\u5982\u679c\u80fdhook\u5230\u76f8\u5173\u7684native\u51fd\u6570\u5e76\u5728Native\u5c42\u5b9e\u73b0\u4e0eAndroid12\u76f8\u540c\u7684\u8bfb\u5199\u9501\u903b\u8f91\uff0c\u8fd9\u4e2a\u95ee\u9898\u5c31\u53ef\u4ee5\u89e3\u51b3\u4e86\u3002<\/p>\n<p>*<a href=\"https:\/\/link.segmentfault.com\/?enc=0YeOvPT6MHfw%2Bz0nl7dqHA%3D%3D.inSKeXg6cP11B1%2Ff9BB6b9wFZabZ7fMrrm9fxTMQVyqOeYYxQVklAwz9LcCbk%2FTX5nMn3e9dHc65iQls1%2FPtVEKJb7%2BGYUA%2Bjo7Vd4FlStdjww67mMLvgp%2BQAB2F9wYnaNHazhx2zSekOrYNpRwuBzlay0r93nGDSGN%2F4%2F3QJ4DBdppjy%2BFO7MiA%2BFnhtB5KochXjkPlOwFv6vtbSed7yz2oMJWt3pFejZMaKpn%2Ft7g%3D\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/cs.android.com\/android\/platform\/superproject\/+\/androi&#8230;<\/a><br \/><a href=\"https:\/\/link.segmentfault.com\/?enc=eSQUeX89bjYDoLK%2BV9Lzww%3D%3D.iS4CZhLmIKPAzaC0vwJJBVxtrkEJxGqTPbQ2k%2BaOVBgf%2FLHyo6yld02vxUcMl0fu2N0NnOZCfEP5na8t6oUBtY9QoQTiDzlKBeRpao4YuPqCiUSyJaIJBQRrlBVWbYeD6NXHXzzjGzNZOTL3BSUWznGTqKswWG2Ii65XFHV3ZhKhw4Fjc27HCb6D04Z8Q9Zi7b4cCImHqsw4eoJCdF2uS09li0eLtK4wZIznQnNglnc%3D\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/cs.android.com\/android\/platform\/superproject\/+\/androi&#8230;<\/a><br \/><a href=\"https:\/\/link.segmentfault.com\/?enc=5wwC18dG4zilr2ttX3q7qQ%3D%3D.izU4iSGWGjoeV41UfjUUkLNd%2FXwxro%2BfjEY6zWl4hFItl18%2FnezcZZVOfL2%2FdCLqGKxdXd4rpSYsxyVbccrCfyLc3q7NaEKIOqDmnY%2FoRVx6Qjoicw785aJJLUWKe659mEB%2BTXvIftIbGQUR8nITx5KP5y8fjFOABPrtJ0q3N4gsOg7Bc38yoI2Lwp2lLrbB\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/cs.android.com\/android\/platform\/superproject\/+\/androi&#8230;<\/a>*<\/p>\n<h3>\u89e3\u51b3\u8fc7\u7a0b<\/h3>\n<p>\u901a\u8fc7JNI hook\u4ee3\u7406Android12\u4e2d\u589e\u52a0\u9501\u7684\u76f8\u5173\u51fd\u6570\uff0c\u5f53\u8d70\u5230\u4ee3\u7406\u51fd\u6570\u4e2d\u65f6\uff0c\u5148\u5206\u53d1\u5230JAVA\u5c42\u901a\u8fc7\u53cd\u5c04\u83b7\u53d6ReadWriteLock\u5b9e\u4f8b\u5e76\u4e0a\u9501\u518d\u901a\u8fc7\u8df3\u677f\u51fd\u6570\u8c03\u7528\u539f\u6765\u7684JNI\u51fd\u6570\uff0c\u6b64\u65f6\u5c31\u5b8c\u6210\u4e86\u5bf9Android12 \u589e\u91cf\u9501\u903b\u8f91\u7684\u590d\u523b\u3002\u7ecf\u5386\u4e86\u4e24\u4e2a\u7248\u672c\u7684\u7070\u5ea6hook\u65b9\u6848\u5df2\u7a33\u5b9a\u5728\u7ebf\u4e0a\u8fd0\u884c\uff0c\u671f\u95f4\u65e0\u56e0hook\u5bfc\u81f4\u7684\u7f51\u7edc\u4e0d\u53ef\u7528\u548c\u5176\u5b83\u5d29\u6e83\u95ee\u9898\uff0c\u76ee\u524d\u5f00\u5173\u653e\u5168\u91cf\u7684\u7248\u672c\u5d29\u6e83\u8bbe\u5907\u6570\u5df2\u964d\u4e3a0\u3002<\/p>\n<p><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216364\" alt=\"\u89e3\u51b3\u8fc7\u7a0b.jpeg\" title=\"\u89e3\u51b3\u8fc7\u7a0b.jpeg\" loading=\"lazy\"><br \/><em>JNI hook\u539f\u7406\uff0c\u4ee5\u53ca\u8be6\u7ec6\u4fee\u590d\u8fc7\u7a0b:  <a href=\"https:\/\/link.segmentfault.com\/?enc=ga81QzFAE%2FF%2FIEZDVk%2BeoQ%3D%3D.6OCmCk4AQtpVmNNjVrWVi8uV0m3104mz5DjqqrPKQMA7Ftcol9TQat0QzB7XiCGYqqc3TXD7Oa3MnJoROLSKRMG7jHgKC4rPnaC0ktBrB7U%3D\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/blog.dewu-inc.com\/article\/MTMwNDU?fromType=personal_blog<\/a><\/em><\/p>\n<h2>\u4e94\u3001\u5c0f\u7c73Android15 \u7126\u70b9\u5904\u7406\u7a7a\u6307\u9488\u5d29\u6e83<\/h2>\n<h3>\u80cc\u666f<\/h3>\n<p>\u968f\u7740Android15\u5f00\u653e\u516c\u6d4b\uff0c\u7126\u70b9\u5904\u7406\u8fc7\u7a0b\u4e2d\u53d1\u751f\u7684\u7a7a\u6307\u9488\u95ee\u9898\u9010\u6b65\u589e\u591a\uff0c\u5e76\u57281\u6708\u4efd\u4e0a\u5347\u5230Top\u3002<\/p>\n<p><em>\u5806\u6808\u4e0e\u4e0a\u62a5\u8d8b\u52bf<\/em><\/p>\n<pre><code class=\"java\">java.lang.NullPointerException: Attempt to invoke virtual method 'android.view.ViewGroup$LayoutParams android.view.View.getLayoutParams()' on a null object reference\nat android.view.ViewRootImpl.handleWindowFocusChanged(ViewRootImpl.java:5307)\nat android.view.ViewRootImpl.-$$Nest$mhandleWindowFocusChanged(Unknown Source:0)\nat android.view.ViewRootImpl$ViewRootHandler.handleMessageImpl(ViewRootImpl.java:7715)\nat android.view.ViewRootImpl$ViewRootHandler.handleMessage(ViewRootImpl.java:7611)\nat android.os.Handler.dispatchMessage(Handler.java:107)\nat android.os.Looper.loopOnce(Looper.java:249)\nat android.os.Looper.loop(Looper.java:337)\nat android.app.ActivityThread.main(ActivityThread.java:9568)\nat java.lang.reflect.Method.invoke(Native Method)\nat com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:593)\nat com.android.internal.os.ZygoteInit.main(ZygoteInit.java:935)<\/code><\/pre>\n<h3>\u95ee\u9898\u5206\u6790<\/h3>\n<p>\u901a\u8fc7\u5206\u6790ASOP\u7684\u6e90\u7801\uff0c\u5d29\u6e83\u7684\u89e6\u53d1\u70b9\u662fmView\u5b57\u6bb5\u4e3a\u7a7a\u3002<\/p>\n<p><em><a href=\"https:\/\/link.segmentfault.com\/?enc=VDESTRZ9WavpTWkjpfobGA%3D%3D.v66poZqgsJRhXN%2Fch09TdTNr4PxyIRyPP6OhV14E0zjLVRepFUy2%2Bo%2B7mi5vvJLlXrAVBXOoRJsHWhz6S7fUSEecsYARxM%2FuK0BfnkbXotzRxXCs45AKWe8GYo9jDMz35ghiRokGlqCh0o5pHG39TK8JDnW1HYLa8eIcSvGjJdc%3D\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">https:\/\/cs.android.com\/android\/platform\/superproject\/main\/+\/m&#8230;<\/a>;drc=98e96368cc73432efbacd6fbcf61fe789dcec0ee;l=7243?q=ViewRootImpl<\/em><\/p>\n<p><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216365\" alt=\"\u95ee\u9898\u5206\u67905.jpeg\" title=\"\u95ee\u9898\u5206\u67905.jpeg\" loading=\"lazy\"><br \/>\u6e90\u7801\u4e2dmView\u4e3a\u7a7a\u7684\u60c5\u51b5\u6709\u4e24\u79cd\uff1a<\/p>\n<ul>\n<li>\u672a\u8c03\u7528setView\u65b9\u6cd5\u524d\u89e6\u53d1\u7a97\u53e3\u7126\u70b9\u53d8\u5316\u4e8b\u4ef6\uff08\u53ea\u6709setView\u65b9\u6cd5\u624d\u4f1a\u7ed9mView\u8d4b\u4e0d\u4e3a\u7a7a\u7684\u503c\uff09\u3002<\/li>\n<li>\u5148\u6b63\u5e38\u8c03\u7528setView\u4f7fmView\u4e0d\u4e3a\u7a7a\uff0c\u5176\u5b83\u5730\u65b9\u7f6e\u4e3a\u7a7a\u3002<\/li>\n<\/ul>\n<p>\u7ed3\u5408\u524d\u7f6e\u5224\u65ad\u4e86mAdded\u4e3atrue\u624d\u4f1a\u8d70\u5230\u5d29\u6e83\u70b9\uff0c\u5728\u6e90\u7801\u4e2d\u5bfb\u627e\u5230\u53ea\u6709\u5148\u6b63\u5e38\u8c03\u7528setView\u4ee5\u540e\u5728\u8c03\u7528dispatchDetachedFromWindow\u65f6\u624d\u6ee1\u8db3mAdded=true\u3001mView=null\u7684\u6761\u4ef6\uff0c\u4ece\u91c7\u96c6\u7684logcat\u65e5\u5fd7\u4e2d\u53ef\u4ee5\u8bc1\u660e\u8fd9\u4e00\u70b9\uff0c\u6b64\u65f6\u57fa\u672c\u53ef\u4ee5\u5b9a\u4f4d\u6839\u56e0\u662f\u7a97\u53e3\u9500\u6bc1\u4e0e\u7126\u70b9\u4e8b\u4ef6\u5904\u7406\u7684\u65f6\u5e8f\u95ee\u9898\u3002<\/p>\n<p><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216366\" alt=\"\u65f6\u5e8f\u95ee\u9898.jpeg\" title=\"\u65f6\u5e8f\u95ee\u9898.jpeg\" loading=\"lazy\"><br \/><img decoding=\"async\"   referrerpolicy=\"no-referrer\" src=\"https:\/\/segmentfault.com\/img\/remote\/1460000046216367\" alt=\"\u65f6\u5e8f\u95ee\u98982.jpeg\" title=\"\u65f6\u5e8f\u95ee\u98982.jpeg\" loading=\"lazy\"><\/p>\n<h3>\u89e3\u51b3\u8fc7\u7a0b<\/h3>\n<p>\u5728\u95ee\u9898\u521d\u671f\uff0c\u5c1d\u8bd5\u901a\u8fc7 Hook \u62e6\u622a handleWindowFocusChanged \u65b9\u6cd5\u589e\u52a0\u9632\u5fa1\uff1a\u5f53\u68c0\u6d4b\u5230 mView \u4e3a\u7a7a\u65f6\u76f4\u63a5\u4e2d\u65ad\u540e\u7eed\u903b\u8f91\u6267\u884c\u3002\u672c\u5730\u9a8c\u8bc1\u9636\u6bb5\uff0c\u901a\u8fc7\u5728 Android 15 \u8bbe\u5907\u4e0a\u9ad8\u9891\u89e6\u53d1\u5546\u8be6\u9875 Dialog \u5f39\u7a97\u7684\u7126\u70b9\u83b7\u53d6\u4e0e\u5173\u95ed\u64cd\u4f5c\uff0c\u672a\u590d\u73b0\u7ebf\u4e0a\u5d29\u6e83\u95ee\u9898\u3002\u8003\u8651\u5230 Hook \u65b9\u6848\u7684\u4fb5\u5165\u6027\u98ce\u9669 \uff0c\u4e14\u65e0\u6cd5\u672c\u5730\u6d4b\u8bd5\uff0c\u6700\u7ec8\u653e\u5f03\u6b64\u65b9\u6848\u4e0a\u7ebf\u3002<\/p>\n<p>\u901a\u8fc7\u5d29\u6e83\u65e5\u5fd7\u5206\u6790\u53d1\u73b0\uff0c\u95ee\u9898\u8bbe\u5907100% \u96c6\u4e2d\u5728\u5c0f\u7c73\/\u7ea2\u7c73\u673a\u578b\uff0c\u800c\u8be5\u54c1\u724c\u5728 Android 15 DAU\u4e2d\u4ec5\u5360 36% \uff0c\u56e0\u6b64\u6000\u7591\u662fMIUI\u5bf9Android15\u67d0\u4e9b\u5b9a\u5236\u529f\u80fd\u6709bug\u3002\u7ecf\u4e0e\u5c0f\u7c73\u6280\u672f\u56e2\u961f\u6570\u5468\u7684\u6c9f\u901a\u4e0e\u8054\u5408\u6392\u67e5\uff0c\u6700\u7ec8\u5c0f\u7c73\u5728v2.0.28\u7248\u672c\u4fee\u590d\u4e86\u6b64\u95ee\u9898\uff0c\u9700\u8981\u7528\u6237\u5347\u7ea7ROM\u89e3\u51b3\uff0c\u76ee\u524d&gt;=2.0.28\u7684MIUI\u8bbe\u5907\u65e0\u6b64\u95ee\u9898\u7684\u4e0a\u62a5\u3002<\/p>\n<h2>\u516d\u3001\u603b\u7ed3<\/h2>\n<p>\u901a\u8fc7\u4e0a\u8ff0\u95ee\u9898\u7684\u6cbb\u7406\uff0c\u7cfb\u7edfbug\u7c7b\u7684\u5d29\u6e83\u663e\u8457\u51cf\u5c11\uff0c\u5e0c\u671b\u8fd9\u4e9b\u7ecf\u9a8c\u5bf9\u5927\u5bb6\u6709\u6240\u5e2e\u52a9\u3002<\/p>\n<p>\u6587 \/ \u4e9a\u9e4f<\/p>\n<p>\u5173\u6ce8\u5f97\u7269\u6280\u672f\uff0c\u6bcf\u5468\u66f4\u65b0\u6280\u672f\u5e72\u8d27<\/p>\n<p>\u8981\u662f\u89c9\u5f97\u6587\u7ae0\u5bf9\u4f60\u6709\u5e2e\u52a9\u7684\u8bdd\uff0c\u6b22\u8fce\u8bc4\u8bba\u8f6c\u53d1\u70b9\u8d5e\uff5e<\/p>\n<p>\u672a\u7ecf\u5f97\u7269\u6280\u672f\u8bb8\u53ef\u4e25\u7981\u8f6c\u8f7d\uff0c\u5426\u5219\u4f9d\u6cd5\u8ffd\u7a76\u6cd5\u5f8b\u8d23\u4efb\u3002<\/p>\n<p><a href=\"https:\/\/segmentfault.com\/a\/1190000046216354\">https:\/\/segmentfault.com\/a\/1190000046216354<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u4e00\u3001\u524d\u8a00 \u901a\u8fc7\u4fee\u590d\u5386\u53f2\u9057\u7559\u7684Crash\u6f0f\u62a5\u95ee\u9898\uff08\u5305\u62ec\u7aef\u4fa7SDK\u91c7\u96c6\u7684\u517c\u5bb9\u6027\u4f18\u5316\u53caCrash\u5e73\u53f0\u7684\u6570\u636e\u6d88\u8d39\u673a\u5236\u5b8c [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-10020669","post","type-post","status-publish","format-standard","hentry","category-share"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/itmax.cn\/index.php?rest_route=\/wp\/v2\/posts\/10020669","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itmax.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itmax.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itmax.cn\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/itmax.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10020669"}],"version-history":[{"count":0,"href":"https:\/\/itmax.cn\/index.php?rest_route=\/wp\/v2\/posts\/10020669\/revisions"}],"wp:attachment":[{"href":"https:\/\/itmax.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10020669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itmax.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10020669"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itmax.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10020669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}