安卓16 IncompatibleClassChangeError

[Krosxx]

Describe the bug
使用 Rhino，开启proguard混淆后，dpt加固后 均报错

• 已确认， 排除保护 Lorg/mozilla/javascript/.*
• 混淆规则已添加：-keep class org.mozilla.javascript.**{*;}

dpt-shell version
2.11.0

Device's brand and model
oneplus 13

Android version
16

Logcat

Found interface org.mozilla.javascript.lc.type.impl.factory.FactoryBase, but class was expected (declaration of 'org.mozilla.javascript.lc.type.impl.factory.FactoryBase' appears in /data/app/~~0S_DfyyWYy5MZTZzAb9OiA==/com.xxxxxxx-RPpNrU7_Fx4S06Pj31pTVQ==/base.apk!classes2.dex)
java.lang.IncompatibleClassChangeError: Found interface org.mozilla.javascript.lc.type.impl.factory.FactoryBase, but class was expected (declaration of 'org.mozilla.javascript.lc.type.impl.factory.FactoryBase' appears in /data/app/~~0S_DfyyWYy5MZTZzAb9OiA==/com.xxxxxxx-RPpNrU7_Fx4S06Pj31pTVQ==/base.apk!classes2.dex)
at org.mozilla.javascript.lc.type.impl.factory.FactoryBase.computeConsolidationMapping(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:10)
at org.mozilla.javascript.lc.type.impl.factory.WithCacheFactory.getConsolidationMapping(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:24)
at org.mozilla.javascript.MemberBox.init(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:37)
at org.mozilla.javascript.MemberBox.(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:15)
at org.mozilla.javascript.JavaMembers.reflect(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:135)
at org.mozilla.javascript.JavaMembers.(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:75)
at org.mozilla.javascript.JavaMembers.createJavaMembers(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:13)
at org.mozilla.javascript.JavaMembers.lookupClass(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:42)
at org.mozilla.javascript.NativeJavaObject.initMembers(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:26)
at org.mozilla.javascript.NativeJavaObject.(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:12)
at org.mozilla.javascript.NativeJavaObject.(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:16)
at org.mozilla.javascript.WrapFactory.wrapAsJavaObject(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:73)
at org.mozilla.javascript.WrapFactory.wrap(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:98)
at org.mozilla.javascript.Context.javaToJS(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:45)
at org.mozilla.javascript.Context.javaToJS(r8-map-id-e5d79ea19c9f8ce70716071b7b06fe1ea77c2a5c76ad0c3a188de72bb70fcc4f:50)

[luoyesiqiu]

看着是类冲突了，且apk里面还有还有classes2.dex，你是用了-K参数吗？

[Krosxx]

@luoyesiqiu 是加了-K，不加-K报：
java.lang.IncompatibleClassChangeError: Found interface org.mozilla.javascript.lc.type.impl.factory.FactoryBase, but class was expected (declaration of 'org.mozilla.javascript.lc.type.impl.factory.FactoryBase' appears in /data/user/0/com.xxxx/code_cache/i11111i111.zip)

另外安卓16以下就正常运行

[Krosxx]

另外发现，单独使用nmmp保护函数也会报这个错误。只要经过了 smali-dexlib2 操作就会这样🥲

也对比过 FactoryBase 和 WithCacheFactory 前后字节码，没什么区别

[Krosxx]

使用 dexdump 加固后的dex，输出 一条 warn
W dexdump.exe: dex_file_verifier.cc:3843 This dex file is invalid and will be rejected in the future. Error is: Interface virtual method 12519(Lorg/mozilla/javascript/lc/type/impl/factory/FactoryBase;.extractSuperMapping) is not public
自己把 extractSuperMapping 改成static，重编译可以正常运行了🤦‍♂️

[luoyesiqiu]

简单写了个demo没有复现。你是怎么用这个库的

[Krosxx]

很普通的命令，给release包，-K 加不加都是

    execOps.exec {
            commandLine(
                System.getProperty("java.home") + "/bin/java",
                "-jar", "../dpt/dpt.jar", "-f",
                apkFile.absolutePath, "-o", apkFile.parent,
                "-c", "../dpt/dpt-protect-config-template.json",
                "-r", "../dpt/dpt-exclude-classes-template.rules",
                "-S", "-K"
            )
        }

[luoyesiqiu]

很普通的命令，给release包，-K 加不加都是

    execOps.exec {
            commandLine(
                System.getProperty("java.home") + "/bin/java",
                "-jar", "../dpt/dpt.jar", "-f",
                apkFile.absolutePath, "-o", apkFile.parent,
                "-c", "../dpt/dpt-protect-config-template.json",
                "-r", "../dpt/dpt-exclude-classes-template.rules",
                "-S", "-K"
            )
        }

我的意思是你怎么用Rhino这个库的

[Krosxx]

           try {
               val rhino = Context.enter()
               rhino.applicationClassLoader = App.classLoader
               rhino.setInterpretedMode(true)
               val scope = rhino.initStandardObjects()
               val myConsole = object : IScriptApi {
                   fun log(msg: Any?) {
                       Log.d("Rhino", msg.toString())
                   }
               }
               val wrappedConsole = Context.javaToJS(myConsole, scope)
               ScriptableObject.putProperty(scope, "console", wrappedConsole);
               callback?.onStart()
               rhino.evaluateString(scope, "console.log('hello')", "test", 1, null)
               callback?.onFinish(null)
           } catch (e: Throwable) {
               callback?.onFinish(e)
               Log.e(e, "execute $title error $e")
           } finally {
               Context.exit()
               Log.d("script end $title")
           }

[luoyesiqiu]

           try {
               val rhino = Context.enter()
               rhino.applicationClassLoader = App.classLoader
               rhino.setInterpretedMode(true)
               val scope = rhino.initStandardObjects()
               val myConsole = object : IScriptApi {
                   fun log(msg: Any?) {
                       Log.d("Rhino", msg.toString())
                   }
               }
               val wrappedConsole = Context.javaToJS(myConsole, scope)
               ScriptableObject.putProperty(scope, "console", wrappedConsole);
               callback?.onStart()
               rhino.evaluateString(scope, "console.log('hello')", "test", 1, null)
               callback?.onFinish(null)
           } catch (e: Throwable) {
               callback?.onFinish(e)
               Log.e(e, "execute $title error $e")
           } finally {
               Context.exit()
               Log.d("script end $title")
           }

还是没有复现，可能有些路径没走到