Skip to content

Instantly share code, notes, and snippets.

@DHuckaby
Last active December 30, 2015 22:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save DHuckaby/08258c12ab311d5374c2 to your computer and use it in GitHub Desktop.
Save DHuckaby/08258c12ab311d5374c2 to your computer and use it in GitHub Desktop.
Example for hugo issue #9.
public class Example extends View {
public Example(Context context) {
super(context);
synchronized (Boolean.TRUE) {
}
}
@Override
public void onDraw(Canvas canvas) {
super.onDraw(canvas);
draw(canvas, null);
}
private boolean draw(Canvas canvas, Object o) {
return false;
}
@DebugLog
public void test() {
}
}
12-11 10:38:53.153 19311-19311/com.handlerexploit.tweedle.debug W/dalvikvm﹕ VFY: invoke type does not match method type of Lcom/handlerexploit/tweedle/Example;.draw
12-11 10:38:53.153 19311-19311/com.handlerexploit.tweedle.debug W/dalvikvm﹕ VFY: rejecting opcode 0x6f at 0x0004
12-11 10:38:53.153 19311-19311/com.handlerexploit.tweedle.debug W/dalvikvm﹕ VFY: rejected Lcom/handlerexploit/tweedle/Example;.onDraw (Landroid/graphics/Canvas;)V
12-11 10:38:53.153 19311-19311/com.handlerexploit.tweedle.debug W/dalvikvm﹕ Verifier rejected class Lcom/handlerexploit/tweedle/Example;
12-11 10:38:53.153 19311-19311/com.handlerexploit.tweedle.debug D/AndroidRuntime﹕ Shutting down VM
12-11 10:38:53.153 19311-19311/com.handlerexploit.tweedle.debug W/dalvikvm﹕ threadid=1: thread exiting with uncaught exception (group=0x40c68930)
12-11 10:38:53.153 19311-19315/com.handlerexploit.tweedle.debug D/dalvikvm﹕ GC_CONCURRENT freed 1221K, 29% free 3732K/5192K, paused 1ms+1ms, total 18ms
12-11 10:38:53.163 19311-19311/com.handlerexploit.tweedle.debug E/AndroidRuntime﹕ FATAL EXCEPTION: main
java.lang.VerifyError: com/handlerexploit/tweedle/Example
at com.handlerexploit.tweedle.activities.MainActivity.onCreate(MainActivity.java:151)
at android.app.Activity.performCreate(Activity.java:5104)
at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1080)
at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2260)
at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2356)
at android.app.ActivityThread.access$600(ActivityThread.java:150)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1244)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loop(Looper.java:137)
at android.app.ActivityThread.main(ActivityThread.java:5195)
at java.lang.reflect.Method.invokeNative(Native Method)
at java.lang.reflect.Method.invoke(Method.java:511)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:795)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:562)
at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:126)
at dalvik.system.NativeStart.main(Native Method)
new Example(this).test();
@JakeWharton
Copy link

Here's the offending bytecode.

  public void onDraw(android.graphics.Canvas);
    Code:
       0: aload_0
       1: aload_1
       2: invokespecial #3                  // Method android/view/View.onDraw:(Landroid/graphics/Canvas;)V
       5: aload_0
       6: aload_1
       7: aconst_null
       8: invokespecial #4                  // Method com/handlerexploit/tweedle/Example.draw:(Landroid/graphics/Canvas;Ljava/lang/Object;)Z
      11: pop
      12: return

  private boolean draw(android.graphics.Canvas, java.lang.Object);
    Code:
       0: iconst_0
       1: ireturn

Can't find anything wrong with it yet...

@JakeWharton
Copy link

Here's the bytecode diff between Java 6 and Java 7:

1,3c1,3
< Classfile /Users/jw/Downloads/Example Java6/Example.class
<   Last modified Dec 11, 2013; size 3016 bytes
<   MD5 checksum d7618224525ea1753e7da0a7e0de287f

---
> Classfile /Users/jw/Downloads/Example/Example.class
>   Last modified Dec 11, 2013; size 3099 bytes
>   MD5 checksum 1a15da568061270282b363b5b10e7467
14c14
<      75 67 6F 3B 00 00 01 98 00 30 00 00 02 8D 00 21

---
>      75 67 6F 3B 00 00 01 98 00 30 00 00 02 A3 00 21
42c42
<   major version: 50

---
>   major version: 51
160c160
<     flags: ACC_PRIVATE, ACC_STATIC, ACC_FINAL, ACC_SYNTHETIC

---
>     flags: ACC_PRIVATE, ACC_STATIC, ACC_FINAL
206a207,213
>       StackMapTable: number_of_entries = 2
>            frame_type = 255 /* full_frame */
>           offset_delta = 16
>           locals = [ class com/example/app/Example, class android/content/Context, class java/lang/Boolean ]
>           stack = [ class java/lang/Throwable ]
>            frame_type = 4 /* same */
>
227c234
<          8: invokespecial #4                  // Method draw:(Landroid/graphics/Canvas;Ljava/lang/Object;)Z

---
>          8: invokespecial #4                  // Method com/example/app/Example.draw:(Landroid/graphics/Canvas;Ljava/lang/Object;)Z
230,233d236
<       LineNumberTable:
<         line 19: 0
<         line 20: 5
<         line 21: 12
237a241,244
>       LineNumberTable:
>         line 19: 0
>         line 20: 5
>         line 21: 12
253,254d259
<       LineNumberTable:
<         line 24: 0
259a265,266
>       LineNumberTable:
>         line 24: 0
271c278
<          0: getstatic     #52                 // Field ajc$tjp_0:Lorg/aspectj/lang/JoinPoint$StaticPart;

---
>          0: getstatic     #52                 // Field com/example/app/Example.ajc$tjp_0:Lorg/aspectj/lang/JoinPoint$StaticPart;
312c319
<          0: invokestatic  #111                // Method ajc$preClinit:()V

---
>          0: invokestatic  #111                // Method com/example/app/Example.ajc$preClinit:()V
319c326
<     flags: ACC_STATIC, ACC_FINAL, ACC_SYNTHETIC

---
>     flags: ACC_STATIC, ACC_FINAL
325d331
<     Synthetic: true
333a340
>     Synthetic: true
337c344
<     flags: ACC_PRIVATE, ACC_STATIC, ACC_SYNTHETIC

---
>     flags: ACC_PRIVATE, ACC_STATIC
340d346
<     Synthetic: true
362c368
<         38: putstatic     #52                 // Field ajc$tjp_0:Lorg/aspectj/lang/JoinPoint$StaticPart;

---
>         38: putstatic     #52                 // Field com/example/app/Example.ajc$tjp_0:Lorg/aspectj/lang/JoinPoint$StaticPart;
365a372
>     Synthetic: true

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment