Dynamic Method Offset detection for ART fails in Android 16

[as0ler]

Looks like the dynamic detection for the method offsets is not successfully working on Android 16.

Reproducible on a physical Pixel 10 rooted device running Android 16.

The device enters on a loop reboot when the server runs and not able to spawn/launch apps using Frida.

Affected code:

frida-java-bridge/lib/android.js

Line 1153 in f72e61e

throw new Error('Unable to find copied methods in java/lang/Thread; please file a bug');

Error message:

{"type":"error","description":"Error: Unable to find copied methods in java/lang/Thread; please file a bug","stack":"Error: Unable to find copied methods in java/lang/Thread; please file a bug\n at /internal-agent.js:1:47232\n at Ie.perform (/internal-agent.js:1:25891)\n at Gn (/internal-agent.js:1:45951)\n at Md (/internal-agent.js:1827:1640)\n at Uo (/internal-agent.js:1827:1258)\n at Function.build (/internal-agent.js:1827:85)\n at t._make (/internal-agent.js:1828:18234)\n at t.use (/internal-agent.js:1828:17033)\n at /internal-agent.js:1837:6963\n at Ie.perform (/internal-agent.js:1:25891)","fileName":"/internal-agent.js","lineNumber":1,"columnNumber":47232}

[enovella]

Could you specify which OS patch you're on? This was working recently. (viz @AeonLucid )

[as0ler]

This is the OS version that was not working: 16.0.0_BD3A.251105.010.E1

[esauvisky]

This is the same issue as frida/frida#3644 frida/frida#3642 frida/frida#3641 and frida/frida#3639. This problem technically belongs here, rather than on frida/frida.

The latest security patch from November 1st comes with a new version of the ART runtime that breaks the offset detection the same way it happened several times before.

Downgrading the ART runtime might work temporarily if the device doesn't have the new security patch, only the new APEX of the ART:

adb shell su -c 'pm uninstall com.google.android.art'

[dvrkcoder]

When will there be a fix? How long should I wait? There are persistent issues with FRIDA version 17.

[s1341]

If you want a fix, open a PR and make a fix.

[radubogdan2k]

Please note this is not only on Android 16. It is now spreading to OS versions as low as Android 12 via the Google Play update.

[LLeavesG]

After the Google Play update in November 2025, my Android 13 device encountered the same problem, and uninstalling the update did not resolve it.

[SeanPesce]

Not sure if this helps anyone, but here is the apex file from an affected device (Pixel 6A, Android 16):

com.android.art.zip

[ExternalAddress4401]

Is anyone going to actually work on this or do we need to crowd source our own solution? Android Frida has been unusable now for an inappropriate amount of time.

[AeonLucid]

Is anyone going to actually work on this or do we need to crowd source our own solution? Android Frida has been unusable now for an inappropriate amount of time.

Make a PR

[ExternalAddress4401]

Fine... I'll start then.

As we can tell from the comments we should probably be expecting to find 79 methods in java/lang/Thread. On a working device we can verify this by printing the below right after they're made on this line

console.log(JSON.stringify(methodsArray), offsetMethods);

{"length":79,"data":"0x709b8070"} 48

On an affected device we can do the same and find

{"length":125,"data":"0x70dbc938"} 48

The memory region between the 2 has some similarities upon first glance

frida-java-bridge/lib/android.js

Line 1146 in f72e61e

for (let offset = offsetMethods; offset !== MAX_OFFSET; offset += 4) {

      let str = '';
      for (let offset = offsetMethods; offset !== MAX_OFFSET; offset += 2) {
        str += object.add(offset).readU16().toString(16);
        if (object.add(offset).readU16() === methodsArraySize) {
          offsetCopiedMethods = offset;
          break;
        }
      }
      console.log(str);

Unaffected devices above, affected below. Affected has been expanded to showcase patterns.

c068708500100021c0004901c40c04072078002fff00f0004f
c93070db0010600102c10004a01e80f050820880027fff00f0004109

Of note is the 00 10 in both instances which correlates to Thread MAX_PRIORITY which verifies we should be in the right area still. The ending pattern in the working example is FF 00 F0 00 also exists in the affected device but is no longer followed by 79. Expanding the search ranges on affected devices doesn't yield any obvious instances of 79.

Forcing it to continue with 65 (the value that exists there instead of 79) simply crashes which isn't surprising.

I can see some obvious patterns here in how this works. It's 2 bytes defining a value which was called the number of methods, 8 bytes defining something than groups of 4 bytes with a separator. The group's don't seem to match the "number of methods" short in both instances though. I'll have to play with it more tomorrow.

[AeonLucid]

Relevant android commit https://cs.android.com/android/_/android/platform/art/+/1b4f99626e096a7366a028e7423602e505972f82, the copied_methods_offset_ field has been removed.