WhoIsIt

나름 깔끔한 날씨 프로그램인 eWeather HD를 Android P OS까지 문제없이 사용하고 있었습니다.

그런데 Galaxy S9을 최신 Q OS 업그레이드 직후 eWeather HD 실행, 화면이 보이는 동시에 crash가 나고 죽어 버립니다.

죽는 위치는 dump 하면 쉽게 확인됩니다.

JNI DETECTED ERROR IN APPLICATION: use of invalid jobject 0xc30e076c

from java.lang.String com.skt.arm.ArmManager.ARMPluginMakeChallenge(java.lang.String)

crash log 중요 내용은 아래와 같습니다.

02-17 02:25:19.945 10426 13450 16754 F nt.WeatherCloc: java_vm_ext.cc:570] JNI DETECTED ERROR IN APPLICATION: use of invalid jobject 0xc30e076c
02-17 02:25:19.945 10426 13450 16754 F nt.WeatherCloc: java_vm_ext.cc:570]     from java.lang.String com.skt.arm.ArmManager.ARMPluginMakeChallenge(java.lang.String)
...
...
02-17 02:25:20.220 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641] Runtime aborting...
02-17 02:25:20.220 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641] Dumping all threads without mutator lock held
02-17 02:25:20.220 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641] All threads:
02-17 02:25:20.220 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641] DALVIK THREADS (17):
02-17 02:25:20.220 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641] "AsyncTask #1" prio=4 tid=7 Runnable
02-17 02:25:20.220 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   | group="" sCount=0 dsCount=0 flags=0 obj=0x12e5fe20 self=0xd6567800
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   | sysTid=16754 nice=10 cgrp=default sched=0/0 handle=0xc3208230
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   | state=R schedstat=( 33144883 457271 28 ) utm=1 stm=1 core=5 HZ=100
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   | stack=0xc3105000-0xc3107000 stackSize=1040KB
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   | held mutexes= "abort lock" "mutator lock"(shared held)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #00 pc 002fe4ef  /apex/com.android.runtime/lib/libart.so (art::DumpNativeStack(std::__1::basic_ostream<char, std::__1::char_traits<char>>&, int, BacktraceMap*, char const*, art::ArtMethod*, void*, bool)+78)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #01 pc 003a768b  /apex/com.android.runtime/lib/libart.so (art::Thread::DumpStack(std::__1::basic_ostream<char, std::__1::char_traits<char>>&, bool, BacktraceMap*, bool) const+358)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #02 pc 003a3e63  /apex/com.android.runtime/lib/libart.so (art::Thread::Dump(std::__1::basic_ostream<char, std::__1::char_traits<char>>&, bool, BacktraceMap*, bool) const+34)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #03 pc 003bc485  /apex/com.android.runtime/lib/libart.so (art::DumpCheckpoint::Run(art::Thread*)+576)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #04 pc 003b70c7  /apex/com.android.runtime/lib/libart.so (art::ThreadList::RunCheckpoint(art::Closure*, art::Closure*)+354)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #05 pc 003b67ad  /apex/com.android.runtime/lib/libart.so (art::ThreadList::Dump(std::__1::basic_ostream<char, std::__1::char_traits<char>>&, bool)+1416)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #06 pc 00376953  /apex/com.android.runtime/lib/libart.so (art::Runtime::Abort(char const*)+1058)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #07 pc 0000855f  /system/lib/libbase.so (android::base::LogMessage::~LogMessage()+406)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #08 pc 0028806f  /apex/com.android.runtime/lib/libart.so (art::JavaVMExt::JniAbort(char const*, char const*)+1194)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #09 pc 00288211  /apex/com.android.runtime/lib/libart.so (art::JavaVMExt::JniAbortF(char const*, char const*, ...)+64)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #10 pc 003ac06f  /apex/com.android.runtime/lib/libart.so (art::Thread::DecodeJObject(_jobject*) const+538)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   native: #11 pc 00417905  /apex/com.android.runtime/lib/libart.so (_ZN3artL37JniMethodEndWithReferenceHandleResultEP8_jobjectjPNS_6ThreadE.llvm.5386863320803738609+36)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   at com.skt.arm.ArmManager.ARMPluginMakeChallenge(Native method)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   at com.skt.arm.ArmManager.a(unavailable:-1)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   at com.skt.arm.f.a(unavailable:-1)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   at com.skt.arm.f.doInBackground(unavailable:-1)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   at android.os.AsyncTask$3.call(AsyncTask.java:378)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   at java.util.concurrent.FutureTask.run(FutureTask.java:266)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
02-17 02:25:20.221 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641]   at java.lang.Thread.run(Thread.java:919)
02-17 02:25:20.230 10426 13450 16754 F nt.WeatherCloc: runtime.cc:641] 
02-17 02:25:20.230 10426 13450 16754 F nt.WeatherCloc: runtime.cc:649] JNI DETECTED ERROR IN APPLICATION: use of invalid jobject 0xc30e076c
02-17 02:25:20.230 10426 13450 16754 F nt.WeatherCloc: runtime.cc:649]     from java.lang.String com.skt.arm.ArmManager.ARMPluginMakeChallenge(java.lang.String)
...
...
--------- beginning of crash
02-17 02:25:20.230 10426 13450 16754 F libc    : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 16754 (AsyncTask #1), pid 13450 (nt.WeatherClock)
02-17 02:25:20.251  1000  4997  5086 E libprocessgroup: Failed to kill process cgroup uid 10158 pid 13776 in 206ms, 1 processes remain
02-17 02:25:20.279 10426 16786 16786 E crash_dump32: unknown process state: t
02-17 02:25:20.290 10426 16786 16786 I crash_dump32: obtaining output fd from tombstoned, type: kDebuggerdTombstone
02-17 02:25:20.295  1058  4758  4758 I /system/bin/tombstoned: received crash request for pid 16754
02-17 02:25:20.296  1000  4777  5396 D bauth_FPBAuthService: pcf : 0x1012, 0 ,2 ,0 ,0 ,0 ,2, 5.0.0.0
02-17 02:25:20.296  1000  4777  5396 D bauth_FPBAuthService: thread id : 2, preenroll_flag : 0, nd cnt : 1, cso : 0, et : 0
02-17 02:25:20.296  1000  4777  5396 D bauth_FPBAuthService: FPBAuthService, 10979
02-17 02:25:20.296 10426 16786 16786 I crash_dump32: performing dump of process 13450 (target tid = 16754)
02-17 02:25:20.307 10426 16786 16786 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
02-17 02:25:20.308 10426 16786 16786 F DEBUG   : Build fingerprint: 'samsung/starlteks/starlteks:10/QP1A.190711.020/G960NKSU2DTAB:user/release-keys'
02-17 02:25:20.308 10426 16786 16786 F DEBUG   : Revision: '26'
02-17 02:25:20.308 10426 16786 16786 F DEBUG   : ABI: 'arm'
02-17 02:25:20.308 10426 16786 16786 F DEBUG   : Timestamp: 2020-02-17 02:25:20+0900
02-17 02:25:20.308 10426 16786 16786 F DEBUG   : pid: 13450, tid: 16754, name: AsyncTask #1  >>> com.Elecont.WeatherClock <<<
02-17 02:25:20.308 10426 16786 16786 F DEBUG   : uid: 10426
02-17 02:25:20.308 10426 16786 16786 F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
02-17 02:25:20.308 10426 16786 16786 F DEBUG   : Abort message: 'JNI DETECTED ERROR IN APPLICATION: use of invalid jobject 0xc30e076c

대충 보면 skt에서 제공하는 so library의 특정 native 함수에서 죽는 문제입니다.

업데이트가 매우 오래전에 멈추어진 App.이라 그럴 수도 있겠죠.

핵심 호출 부분은 아래입니다.

at com.skt.arm.f.a(unavailable:-1)

at com.skt.arm.f.doInBackground(unavailable:-1)

즉 doInBackground 안에서 호출하는 com.skt.arm.f.a 호출 흐름에서 죽습니다.

이걸 해결할 방법은 없고 대신 호출을 막습니다.

그리고 test하니 - SKT 서비스가 없다면서 App. 을 강제 종료 해 버립니다 우쓰!

그래서 doInBackground 종료 후 호출되는 onPostExecute 의 주요 호출을 막으니, 정상 동작이 됩니다.

아마다 예전 SKT 관련 서비스 유무 확인 혹은 여러 내용(라이센?!)을 확인하는 루틴이 Q OS에서 동작이 되지 않은 듯 합니다.

어찌 되었건 문제는 해결되었습니다.

비록 오래된 App.이지만 더 이상 update 되지 않는 버전이지만 문제만 해결해서 계속 사용하게 되었습니다.

** 해당 App. 은 Play store에 최신 버전의 App. 이 제공되지만 예전 T Store 와는 다른 signature 사용으로 인해 업그레이드를 할 수 없습니다.

주요 수정 point는 아래와 같이 요약할 수 있습니다. 단순히 smali 수준에서 문제 함수를 막아서 해결했습니다.

맨 앞에 # 한 부분입니다.

# virtual methods
.method protected final varargs synthetic doInBackground([Ljava/lang/Object;)Ljava/lang/Object;
    .locals 1

#    invoke-direct {p0}, Lcom/skt/arm/f;->a()Ljava/lang/String;

#    move-result-object v0
	const-string v0, " Not ACTIVITY"

    return-object v0
.end method

.method protected final synthetic onPostExecute(Ljava/lang/Object;)V
    .locals 1

    check-cast p1, Ljava/lang/String;

    invoke-super {p0, p1}, Landroid/os/AsyncTask;->onPostExecute(Ljava/lang/Object;)V

#    iget-object v0, p0, Lcom/skt/arm/f;->a:Lcom/skt/arm/e;

#    invoke-static {v0}, Lcom/skt/arm/e;->a(Lcom/skt/arm/e;)Lcom/skt/arm/ArmManager;

#    move-result-object v0

#    invoke-static {v0}, Lcom/skt/arm/ArmManager;->b(Lcom/skt/arm/ArmManager;)V

    return-void
.end method

위 내용 참고요 스크린 샷 (APK Studio)

* 수정 후 정상 동작 스크린 샷~

** 리버스 엔지니어링은 더이상 업그레이드가 제공되지 않는 S/W 에 대한 호환성 확보를 위한 목적에는 적법합니다.