I’m attempting to trace user-space Java function calls using bpftrace
on an Android device, specifically within oat/odex
files (a special type of ELF
file) that contain pre-compiled code. I’ve been using the following bpftrace
script to probe the parameters of the java.lang.String.indexOf
function:
#!/usr/bin/bpftrace
uprobe:"/data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat":"int java.lang.String.indexOf(java.lang.String, int)"
/ pid==9422 /
{
printf("arg1 is %dn", arg1);
}
However, in order for bpftrace
to resolve symbol information, I have had to recompile the entire system library and include debug information. The downside of this method is that after each device reboot, these modifications are lost, which means that every time I want to use bpftrace
, I have to go through the recompilation process again.
My questions are:
- Is there a way to use
bpftrace
for probing user-space Java functions without having to recompile the system libraries? - Are there any existing tools or solutions in the Android ecosystem that could solve this issue, allowing others to run my
bpftrace
scripts without requiring additional compilation steps?
Relevant Environment Information:
- Android Version: [Android 14]
bpftrace
Version: [bpftrace v0.21.0]
Thank you for your guidance and suggestions!