Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Method reflection with seemingly concrete variables should be optimized #134

Open
CalebFenton opened this issue Jan 6, 2020 · 0 comments

Comments

@CalebFenton
Copy link
Owner

CalebFenton commented Jan 6, 2020

Provide specific APK, DEX, or file hash
SHA256: 74f0cf3cbaaedcc5a185c635ff3ff4ad26afe6a44e0aef7b668555ad5016489b

Describe the bug
A seemingly obvious method invoke is not being detected or optimized correctly.

Method method;
d d = d.a((Context)this);
DexClassLoader dexClassLoader = d.b();
byte b1 = 2;
if (dexClassLoader != null) {
    String str2 = "com.crashlytics.android.TingerHelper";
    String str1 = "com.crashlytics.android.TingerHelper";
    // Note: This should probably be constantized. Maybe the root problem. Part of a multi-dex, so must've assumed it didn't exist.
    Class<?> clazz = str1.loadClass(str1);
    str1 = "onNotificationReceived";
    Class[] arrayOfClass = new Class[b1];
    Class<NotificationListenerService> clazz2 = NotificationListenerService.class;
    arrayOfClass[0] = clazz2;
    Class<StatusBarNotification> clazz1 = StatusBarNotification.class;
    arrayOfClass[bool1] = clazz1;
    method = clazz.getDeclaredMethod(str1, arrayOfClass);
    b = 0;
    str1 = null;
    Object[] arrayOfObject = new Object[b1];
    arrayOfObject[0] = this;
    arrayOfObject[bool1] = paramStatusBarNotification;
    // Note: Should be com.crashlytics.android.TingerHelper;->onNotificationReceived(Context, StatusBarNotification)
    method.invoke(null, arrayOfObject);

Also, a bit later on:

Class<Intent> clazz = Intent.class;
Class[] arrayOfClass = new Class[bool1];
object = (Object<String>)String.class;
arrayOfClass[0] = (Class)object;
Constructor<Intent> constructor = clazz.getConstructor(arrayOfClass);
Object[] arrayOfObject1 = new Object[bool1];
object = (Object<String>)"action_text";
arrayOfObject1[0] = object;
// Note: constructor should be known because clazz was known
Intent intent = (Intent)constructor.newInstance(arrayOfObject1);
intent = intent;

To Reproduce

java -jar build/libs/simplify.jar -it 'com/ivy/module/a/a/ServiceMain;->onNotificationPosted' sandbox/delme-joker/classes3.dex -v

Additional context
https://twitter.com/caleb_fenton/status/1214278854883233792

@CalebFenton CalebFenton changed the title Method reflection with seemingly concrete variables should be known Method reflection with seemingly concrete variables should be optimized Jan 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant