Running HWAsan

[1bsyl]

Hello,

I try to run HWAsan on my project, to check some native C code. But I can't get it running (using https://developer.android.com/ndk/guides/hwasan).

My build is in command line, "wrap.sh" isn't automatically included. So I have to add it manually in the .apk / re-sign / re-align.
but, currently, it doesn't seems to make any difference.

In short, my app is a Java Activity, that uses System.loadlibray() to load a shared object library.

Here's the issue :

1. If I run the .APK on my recent device, it tries to use the device hwasan library, but the error is:

it cannot load the libclang_rt.hwasan-aarch-64-android.so because "TLS symbol (NULL)" in dlopen ... using IE access model"
(seem similar to https://stackoverflow.com/questions/78983648/failing-to-run-hwasan-build-on-android-dlopen-failed-tls-symbol-null )

readelf says there is a TLS header

TLS            0x0000000000050670 0x0000000000054670 0x0000000000054670
                 0x0000000000000000 0x0000000000000004  R      0x4

2. If I copy the hwasan lib from NDK-r28c directory, in my APK

there is a tombstone, at:
__hwasan_init+180 then __register_atfork+44

(no TLS header in the lib from NDK-r28c)

3. If I try to use an AVD image (Atom). there is not HWAsan lib provided.
   (I cannot use a full Arm64, because of Avd's CPU Architecture 'arm64' is not supported by the QEMU2 emulator on x86_64 host.)

Not sure what I should do now. Any help is welcome

---

the full stack trace of case (2).

tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000280
Cause: null pointer dereference
...
21 total frames
backtrace:
      #00 pc 00000000000d3f70  /apex/com.android.runtime/lib64/bionic/libc.so (__aarch64_cas4_acq+16) (BuildId: 9ecf995a27c885d1447a549f8c253e65)
      #01 pc 000000000004d1dc  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::HybridMutex::tryLock()+24) (BuildId: 9ecf995a27c885d1447a549f8c253e65)
      #02 pc 000000000004c8e4  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::HybridMutex::lock()+20) (BuildId: 9ecf995a27c885d1447a549f8c253e65)
      #03 pc 0000000000052ca4  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::SizeClassAllocator64<scudo::PrimaryConfig<scudo::AndroidNormalConfig>>::popBlocks(scudo::SizeClassAllocatorLocalCache<scudo::SizeClassAllocator64<scudo::PrimaryConfig<scudo::AndroidNormalConfig>>>*, unsigned long, unsigned int*, unsigned short)+64) (BuildId: 9ecf995a27c885d1447a549f8c253e65)
      #04 pc 0000000000052c38  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::SizeClassAllocatorLocalCache<scudo::SizeClassAllocator64<scudo::PrimaryConfig<scudo::AndroidNormalConfig>>>::refill(scudo::SizeClassAllocatorLocalCache<scudo::SizeClassAllocator64<scudo::PrimaryConfig<scudo::AndroidNormalConfig>>>::PerClass*, unsigned long, unsigned short)+40) (BuildId: 9ecf995a27c885d1447a549f8c253e65)
      #05 pc 000000000004f2e4  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::Allocator<scudo::AndroidNormalConfig, &scudo_malloc_postinit>::allocate(unsigned long, scudo::Chunk::Origin, unsigned long, bool)+416) (BuildId: 9ecf995a27c885d1447a549f8c253e65)
      #06 pc 000000000004f7fc  /apex/com.android.runtime/lib64/bionic/libc.so (scudo_malloc+40) (BuildId: 9ecf995a27c885d1447a549f8c253e65)
      #07 pc 00000000000496ec  /apex/com.android.runtime/lib64/bionic/libc.so (malloc+48) (BuildId: 9ecf995a27c885d1447a549f8c253e65)
      #08 pc 0000000000070308  /apex/com.android.runtime/lib64/bionic/libc.so (__register_atfork+44) (BuildId: 9ecf995a27c885d1447a549f8c253e65)
      #09 pc 0000000000020488  /data/app/~~j7XwuFhkbv8ZZ9rEsVJlTw==/my.app.app-kn57GxoBhuQgreBHLBfJAA==/lib/arm64/libclang_rt.hwasan-aarch64-android.so (__hwasan_init+1808) (BuildId: 20c2a0d11924cb9fd782270eb5312e7031a8b27e)
      #10 pc 00000000000eef60  /apex/com.android.runtime/bin/linker64 (__dl__ZN6soinfo17call_constructorsEv+616) (BuildId: 8fff9070c32a10dc0c62a853ef36c1c8)
      #11 pc 00000000000eed8c  /apex/com.android.runtime/bin/linker64 (__dl__ZN6soinfo17call_constructorsEv+148) (BuildId: 8fff9070c32a10dc0c62a853ef36c1c8)
      #12 pc 00000000000d65d8  /apex/com.android.runtime/bin/linker64 (__dl__Z9do_dlopenPKciPK17android_dlextinfoPKv+2796) (BuildId: 8fff9070c32a10dc0c62a853ef36c1c8)
      #13 pc 00000000000d0d20  /apex/com.android.runtime/bin/linker64 (__loader_android_dlopen_ext+76) (BuildId: 8fff9070c32a10dc0c62a853ef36c1c8)
      #14 pc 000000000000410c  /apex/com.android.runtime/lib64/bionic/libdl.so (android_dlopen_ext+20) (BuildId: 57927e0a59af83dab12a35f04503a21b)
      #15 pc 0000000000019fb8  /apex/com.android.art/lib64/libnativeloader.so (android::NativeLoaderNamespace::Load(char const*) const+140) (BuildId: 7db588114f55294ac990cf0e933b7758)
      #16 pc 00000000000087bc  /apex/com.android.art/lib64/libnativeloader.so (OpenNativeLibrary+536) (BuildId: 7db588114f55294ac990cf0e933b7758)
      #17 pc 000000000058389c  /apex/com.android.art/lib64/libart.so (art::JavaVMExt::LoadNativeLibrary(_JNIEnv*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, _jobject*, _jclass*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>*)+604) (BuildId: 4ccb65ae9ac5ad5da3af5a342d5b0b92)
      #18 pc 0000000000005914  /apex/com.android.art/lib64/libopenjdkjvm.so (JVM_NativeLoad+356) (BuildId: ee01ddb5e82126991cafcbd31e55fd49)
      #19 pc 000000000037ef70  /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: 4ccb65ae9ac5ad5da3af5a342d5b0b92)
      #20 pc 00000000000230a8  [anon_shmem:dalvik-jit-code-cache] (offset 0x2000000)

[1bsyl]

I ve solved my issue.
It didn't work using bundles .aab, but that's okay generating .apk

[jnbmoffa]

I had the same error and same stack as case 2. It was because my wrap.sh was actually called wrap.sh.sh. 🤦‍♂️

[1bsyl]

@jnbmoffa
maybe if wrap.sh was renamed wrap.sh.sh while building the .aab. Otherwase, I pretty sure I write it manually wrap.sh
thanks for the info anyway !