0

I'm trying to bypass the security that checks if a file is modified on an android app and will crash without error if modified. It have around 10 fake crashes. I have bypassed some of them in smali and libs but it still keep crashing and Zygote returns different numbers like 2, 4, 15, 25, etc. There is no explanation or details about "Process exited cleanly"

Can anyone explain what that "Process exited cleanly" means and what c++ codes could be used to fake crash than getpid+kill, exit, abort?

Here is what it says in logcat:

08-18 23:02:10.751 I/ActivityManager(412): Process com.xxx.xxx (pid 17716) has died
08-18 23:02:10.768 I/Zygote  (160): Process 17716 exited cleanly (15)
0

Exited cleanly means that the process was not terminated by a signal, but called the exit system call. This happens usually due to a call to exit, _exit or returning from main. The number in parenthesis is the exit code, which is the parameter passed to exit or the value returned from main.

If you are lucky, the number is unique to the check that failed. If you are unlucky, there is code to terminate the process on tampering which directly calls the exit system call without setting the register used for the exit code, so the number is mostly "random junk".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.