ART 执行链与 Nterp：解析 FART Android12‑16 失效问题

ArtMethod::GetEntryPointFromQuickCompiledCode()

constvoid* ArtMethod::GetEntryPointFromQuickCompiledCode() const{
return GetEntryPointFromQuickCompiledCodePtrSize(kRuntimePointerSize);
}

// 读的是 ptr_sized_fields_ 里那一项
// EntryPointFromQuickCompiledCodeOffset(pointer_size)

boolArtMethod::HasNterpEntryPointFastPathFlag() const{
constexpr uint32_t mask = kAccNative | kAccNterpEntryPointFastPathFlag;
return (GetAccessFlags() & mask) == kAccNterpEntryPointFastPathFlag;
}

voidArtMethod::SetNterpInvokeFastPathFlag() {
AddAccessFlags(kAccNterpInvokeFastPathFlag);
}

void DumpMethodState(ArtMethod* m) {
LOG(INFO) << "method = " << m->PrettyMethod();
LOG(INFO) << "ArtMethod* = " << m;
LOG(INFO) << "access_flags = 0x" << std::hex << m->GetAccessFlags();
LOG(INFO) << "entry = " << m->GetEntryPointFromQuickCompiledCode();
LOG(INFO) << "is_native = " << m->IsNative();
LOG(INFO) << "is_static = " << m->IsStatic();
}

voidArtMethod::Invoke(Thread* self,
uint32_t* args,
uint32_t args_size,
                       JValue* result,
constchar* shorty) {
if (UNLIKELY(__builtin_frame_address(0) < self->GetStackEnd())) {
ThrowStackOverflowError(self);
return;
  }

  ManagedStack fragment;
  self->PushManagedStackFragment(&fragment);
  Runtime* runtime = Runtime::Current();

// FART 老插入点大致就在这附近
// if (self == nullptr) {
//   dumpArtMethod(this);
//   return;
// }

if (UNLIKELY(!runtime->IsStarted() ||
               (self->IsForceInterpreter() &&
                !IsNative() &&
                !IsProxyMethod() &&
IsInvokable()) ||
/* debugger / fake-invoke */)) {
if (IsStatic()) {
      art::interpreter::EnterInterpreterFromInvoke(
          self, this, nullptr, args, result, /*stay_in_interpreter=*/true);
    } else {
      mirror::Object* receiver =
reinterpret_cast<StackReference<mirror::Object>*>(&args[0])->AsMirrorPtr();
      art::interpreter::EnterInterpreterFromInvoke(
          self, this, receiver, args + 1, result, /*stay_in_interpreter=*/true);
    }
  } else {
bool have_quick_code = GetEntryPointFromQuickCompiledCode() != nullptr;
if (LIKELY(have_quick_code)) {
if (!IsStatic()) {
        (*art_quick_invoke_stub)(this, args, args_size, self, result, shorty);
      } else {
        (*art_quick_invoke_static_stub)(this, args, args_size, self, result, shorty);
      }
    }
  }
}

extern "C" voidmyfartInvoke(ArtMethod* artmethod)
REQUIRES_SHARED(Locks::mutator_lock_) {
  JValue* result = nullptr;
  Thread* self = nullptr;   // 特殊标记
uint32_t temp = 6;
uint32_t* args = &temp;
uint32_t args_size = 6;
  artmethod->Invoke(self, args, args_size, result, "fart");
}

voidEnterInterpreterFromInvoke(Thread* self,
                                ArtMethod* method,
                                ObjPtr<mirror::Object> receiver,
uint32_t* args,
                                JValue* result,
bool stay_in_interpreter) {
// 1. 静态方法可能先 EnsureInitialized
// 2. 构造 ShadowFrame
// 3. 把参数填进 shadow frame
// 4. native -> InterpreterJni
// 5. 非 native -> Execute(...) 或 Nterp 相关入口
}

void EnterInterpreterFromInvoke(...) {
// 主动调用或强制解释时，先看一眼当前方法状态
  if (/* is_fake_invoke || need_dump */) {
dumpArtMethod(method);
  }

// 原逻辑：建 ShadowFrame、填参、Execute / Nterp / JNI
}

staticinline JValue Execute(Thread* self,
const DexFile::CodeItem* code_item,
                             ShadowFrame& shadow_frame,
                             JValue result_register,
bool stay_in_interpreter = false) {
  ArtMethod* method = shadow_frame.GetMethod();

if (strstr(method->PrettyMethod().c_str(), "<clinit>") != nullptr) {
dumpDexFileByExecute(method);
  }

// 原解释逻辑
// switch interpreter / mterp ...
}

voiddumpDexFileByExecute(ArtMethod* artmethod) {
const DexFile* dex_file = artmethod->GetDexFile();
constuint8_t* begin = dex_file->Begin();
size_t size = dex_file->Size();

// 写 begin ~ begin+size
// 再顺手把 class list 打出来
}

force interpreter
  → entry 变成 Nterp
  → 老 Execute hook 不触发
  → CodeItem 看起来像没恢复

art_quick_invoke_stub / art_quick_invoke_static_stub
  → entry_point_from_quick_compiled_code_

// stub 收到 ArtMethod* 后，最终会跳到:
constvoid* code = method->GetEntryPointFromQuickCompiledCode();
// brx / blr code

voiddumpArtMethod(ArtMethod* artmethod) {
const DexFile* dex_file = artmethod->GetDexFile();

// 1. 整体 Dex
constuint8_t* begin = dex_file->Begin();
size_t dex_size = dex_file->Size();
// write(begin, dex_size)

// 2. 方法体
const dex::CodeItem* code_item = artmethod->GetCodeItem();
if (code_item == nullptr) {
LOG(INFO) << "CodeItem is null: " << artmethod->PrettyMethod();
return;
  }

// 3. 算真实长度
// 不能只按 sizeof(CodeItem) 盲切
uint32_t code_item_len = ComputeCodeItemSize(code_item);

uint32_t method_idx = artmethod->GetDexMethodIndex();
// 写出 method_idx / offset / code_item_len / ins bytes
}

CodeItem
  ├─ registers_size / ins_size / outs_size / tries_size
  ├─ insns[]
  ├─ try_item[]// 如果 tries_size > 0
  └─ encoded_catch_handler_list

uint32_tComputeCodeItemSize(const dex::CodeItem* code_item) {
constuint8_t* base = reinterpret_cast<constuint8_t*>(code_item);
constuint8_t* p = base;

// 跳过 header + insns
// insns 是 u2 数组，长度是 insns_size
// 若 tries_size > 0，后面还有 try_item 和 handler

if (code_item->tries_size_ > 0) {
// 对齐到 4 字节
// 跳过 try_item[tries_size_]
// 再按 LEB128 解析 encoded_catch_handler_list
  }

return static_cast<uint32_t>(p - base);
}

// 伪代码
Object pathList = getField(classLoader, "pathList");
Object[] dexElements = (Object[]) getField(pathList, "dexElements");

for (Object element : dexElements) {
Object dexFile = getField(element, "dexFile");
Object cookie = getField(dexFile, "mCookie");
String[] classNames = getClassNameList(cookie);

for (String name : classNames) {
Class<?> clazz = classLoader.loadClass(name);
for (Method m : clazz.getDeclaredMethods()) {
dumpMethodCode(m); // -> native -> myfartInvoke(ArtMethod*)
    }
  }
}

staticvoidDexFile_dumpMethodCode(JNIEnv* env, jclass, jobject method) {
if (method == nullptr) return;
  ArtMethod* artmethod = ArtMethod::FromReflectedMethod(...);
myfartInvoke(artmethod);
}

主动调用 → Invoke → 解释器 → Execute → 恢复/dump

主动调用 → Invoke → quick entry → Nterp / AOT / JIT / bridge

entry = 0x70b1c8a000
-> art_quick_to_interpreter_bridge
-> 老 FART 调，CodeItem 不变

--force-interpreter
-> entry 切到 Nterp
-> Execute 不进

dump 点上移到 EnterInterpreterFromInvoke
-> CodeItem 完整

// Frida 思路伪代码
const artMethod = ptr(methodAddr);
const accessFlags = artMethod.add(accessFlagsOff).readU32();
const quickCode = artMethod.add(quickCodeOff).readPointer();
console.log('flags=', accessFlags.toString(16), 'entry=', quickCode);

/sdcard/Android/data/<pkg>/files/fart/

int fd = open(path.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0644);
if (fd < 0) {
  LOG(ERROR) << "open failed: " << path << " errno=" << errno;
return;
}

dump=true
sleep=60000
force=com.target.*
ignore=androidx.*,com.google.*,kotlin.,kotlinx.

1. 打印 entry / flags
2. 必要时 force interpreter
3. 再看 entry 变成了什么
4. 决定 dump 点放哪
5. 小范围 force 调用
6. 对比调用前后 CodeItem
7. 修复并反编译验收