使用frida-discover追踪计算器应用时持续崩溃的问题求助

算力阿峰

2026-8-17

问题

尝试使用frida-discover追踪com.google.android.calculator应用时，应用频繁崩溃，崩溃日志如下：

Process crashed: Bad access due to invalid address

***
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'google/sunfish/sunfish:11/RQ1A.201205.008/6943376:user/release-keys'
Revision: 'MP1.0'
ABI: 'arm64'
Timestamp: 2022-10-05 14:55:30+0200
pid: 2921, tid: 2921, name: roid.calculator  >>> com.google.android.calculator <<<
uid: 10211
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xb8
Cause: null pointer dereference
Abort message: 'RenderThread Looper POLL_ERROR!'
    x0  0000000000000000  x1  00000071b09fb4d0  x2  0000007140772060  x3  0000007fc750e130
    x4  0000007140775d30  x5  0000000000000008  x6  53736d647543ff6f  x7  7f7f7f7f7f7f7f7f
    x8  5e7044044a430434  x9  0000000000080100  x10 0000000000000106  x11 0000000000000001
    x12 0000000000000000  x13 00000049ec7e2943  x14 0000510fd40fe42a  x15 00000071b09fb514
    x16 0000000000000001  x17 0000007445488ce0  x18 0000007446356000  x19 0000000000000000
    x20 0000007fc750e4d0  x21 0000000000000000  x22 000000000000003f  x23 0000000000000001
    x24 000000007fffffff  x25 00000074460d3000  x26 b4000071f0aa5e50  x27 00000000708779e8
    x28 b400007320a82be0  x29 0000007fc750e160
    lr  00000071b09fb4d4  sp  0000007fc750e130  pc  000000719dfbf264  pst 0000000080000000
backtrace:
      #00 pc 0000000000018264  <anonymous:719dfa7000>
      #01 pc 00000000006684d0  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x668000) (art::JniMethodEnd(unsigned int, art::Thread*)+28) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #02 pc 00000000006684d0  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x668000) (art::JniMethodEnd(unsigned int, art::Thread*)+28) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #03 pc 000000000020faec  /system/framework/arm64/boot-framework.oat!boot-framework.oat (offset 0x20f000) (art_jni_trampoline+156) (BuildId: c069840a4da062c0cadf31a17c8446ba32b380d8)
      #04 pc 000000000063dbc0  /system/framework/arm64/boot-framework.oat!boot-framework.oat (offset 0x63d000) (android.os.MessageQueue.next+192) (BuildId: c069840a4da062c0cadf31a17c8446ba32b380d8)
      #05 pc 000000000063a678  /system/framework/arm64/boot-framework.oat!boot-framework.oat (offset 0x211000) (android.os.Looper.loop+744) (BuildId: c069840a4da062c0cadf31a17c8446ba32b380d8)
      #06 pc 00000000003fbf90  /system/framework/arm64/boot-framework.oat!boot-framework.oat (offset 0x211000) (android.app.ActivityThread.main+752) (BuildId: c069840a4da062c0cadf31a17c8446ba32b380d8)
      #07 pc 00000000001337e8  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x133000) (art_quick_invoke_static_stub+568) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #08 pc 00000000001a8a94  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x1a6000) (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+228) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #09 pc 000000000055431c  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x49f000) (art::InvokeMethod(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+1364) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #10 pc 00000000004d3b28  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x49f000) (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*)+52) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #11 pc 00000000000896f4  /apex/com.android.art/javalib/arm64/boot.oat (art_jni_trampoline+180) (BuildId: ceb5e62f6d91c45ea99526daec5879eba39c6a54)
      #12 pc 000000000088e588  /system/framework/arm64/boot-framework.oat!boot-framework.oat (offset 0x63f000) (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run+136) (BuildId: c069840a4da062c0cadf31a17c8446ba32b380d8)
      #13 pc 0000000000896cb8  /system/framework/arm64/boot-framework.oat!boot-framework.oat (offset 0x63f000) (com.android.internal.os.ZygoteInit.main+2280) (BuildId: c069840a4da062c0cadf31a17c8446ba32b380d8)
      #14 pc 00000000001337e8  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x133000) (art_quick_invoke_static_stub+568) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #15 pc 00000000001a8a94  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x1a6000) (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+228) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #16 pc 0000000000552d58  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x49f000) (art::JValue art::InvokeWithVarArgs<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, std::__va_list)+448) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #17 pc 000000000055320c  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x49f000) (art::JValue art::InvokeWithVarArgs<_jmethodID*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+92) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #18 pc 000000000043811c  /apex/com.android.art/lib64/libart.so!libart.so (offset 0x1f4000) (art::JNI<true>::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list)+656) (BuildId: c820164b0c64ea40f1abc53aaf588b44)
      #19 pc 0000000000099424  /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+124) (BuildId: 8511fb98bccbbe26c39afaafc8b62b8f)
      #20 pc 00000000000a08b0  /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start(char const*, android::Vector<android::String8> const&, bool)+836) (BuildId: 8511fb98bccbbe26c39afaafc8b62b8f)
      #21 pc 0000000000003580  /system/bin/app_process64 (main+1336) (BuildId: bdcc463a75a1be87eb0f7478ec16547d)
      #22 pc 000000000004988c  /apex/com.android.runtime/lib64/bionic/libc.so!libc.so (offset 0x42000) (__libc_init+108) (BuildId: 95f68a34fdf7b31f42d3f811d5d88f58)
***
Stopping...

测试环境对比：

崩溃环境：Google Pixel 4a（Android 11），Magisk v25.2，MagiskFrida v15.2.2-1
正常环境：ONEPLUS A5000（Android 9），Magisk v22.0，MagiskFrida v15.1.14-1

可能的原因与解决建议

Frida版本与Android 11的兼容性问题：Frida 15.2.2版本可能存在与Android 11 ART运行时的适配缺陷，尤其是在处理RenderThread的Looper回调时，导致空指针引用崩溃。建议降级到和正常环境一致的Frida 15.1.14版本，或者升级到更高版本的Frida（如15.2.3及以上），看是否修复了该兼容性问题。
Magisk版本过高导致的适配冲突：Magisk v25.2的SELinux策略或注入机制可能与旧版Frida存在冲突，而Magisk v22.0的机制更适配Frida 15.x系列。可以尝试将Pixel 4a的Magisk降级到v22.0，配合Frida 15.1.14测试是否正常。
Android 11的ART运行时变化：Android 11对ART做了不少优化和改动，包括JNI调用的校验、线程管理逻辑，Frida的动态插桩逻辑可能在这些变化下出现异常，触发RenderThread的空指针错误。可以尝试使用frida-discover的--no-debug参数，减少对应用线程的调试干预，看是否能避免崩溃。
目标应用的版本差异：不同设备上的com.google.android.calculator版本可能不同，Android 11上的计算器应用可能引入了新的RenderThread逻辑，Frida的插桩操作干扰了这部分逻辑导致崩溃。可以尝试安装和一加设备上相同版本的计算器应用再测试。

内容的提问来源于stack exchange，提问作者PyKKe