From ea571a968d5d0ceaa8fd892cb1e32f231b5d53d6 Mon Sep 17 00:00:00 2001 From: alexytomi <60690056+alexytomi@users.noreply.github.com> Date: Sat, 6 Dec 2025 15:04:35 +0800 Subject: [PATCH] mitigation: Mitigate AE1 bug AE1 mistakenly passes in `1` as an ASM api version when it uses `SignatureVisitor`. This is valid in ASM4 because it never checks if the Opcode is valid, this is fixed in ASM5, which we override ASM4 with due to compatibility issues with the Java 8 JRE we use --- .../lwjgl2_methods_injector.jar | Bin 3917 -> 8730 bytes .../lwjgl2_methods_injector/version | 2 +- .../ASM5OverrideInjector.java | 89 ++++++++++++++++++ .../startInjectors.java | 7 ++ 4 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 lwjgl2_methods_injector/src/main/java/org/angelauramc/lwjgl2_methods_injector/ASM5OverrideInjector.java diff --git a/app_pojavlauncher/src/main/assets/components/lwjgl2_methods_injector/lwjgl2_methods_injector.jar b/app_pojavlauncher/src/main/assets/components/lwjgl2_methods_injector/lwjgl2_methods_injector.jar index 443d1588096fef15299157832b8394b1264ae8c6..ddc922bfda424f9d5ae1593680c9f8c35eda930f 100644 GIT binary patch literal 8730 zcmcI}1z40_w>Di4T?0r+2}lf$q%d@M*T|64gM@;TLx)HsF*GP3J*2?UU5bPf5)u+h zBXID%@A-URf6w{P_kGvdb3M;Ib6sn#d+lfTUVE)|YpY>mQJ|sW;h}A3!_CmH2gZ-v z^}xTrG!*n@c~mqN`7qJ6{~@^a8fLcRPP^=KE#QBBU90~T)R5IwQB=^==haZ;8R92E zfdJTJ9~LE6FhpE>U!{v)JgxPy4@3;a3@wKV=}U_O{NDhn^4@o4?8b`ffOWBk%0vWbZ6s{!0T$d5zn>(0jXtlU#Xj1=#9a(iSKSM5)?u)dgrThF(bmy`%=9;xm!GuIMBBf82CITim2gbp9rTxpnGD4B zL%qZF5HQ`Q* zRX-#Yp>r5E&wfznv?!0*8lo}iz2%AW`D9%FZWe|6?iIosK~Bfl+2=sOsQ~SQNVo%J zyZ{mhX68*A)38;`M)Q%EQ_@p9?bz`7l!Q7dPL5cws#=}FPc|`5$Pya>4yy4gGWJ#t zU8C-p>3m5t?Z8TPoQJ{w(2YuZw+G0tJwhtJOZH~91#~#H6#_A3!Qm?D-U^c|Rc<4X zCF61kb|N_9Rg(0t0E9U$j4egXOnVd+obKt676qVwCg^A`;T-@EamFP5O-Uj&*yN<{~_buqmkV7t5`>ayQm1MBwOY}YOQ)&yXSBjDm zjz#{Ywjl0~H^049jxR-AbAx?Rpm&$+_%CYvl!3jz3zKX`QS z`xlm!F8eSQy>irgwI}esURS5<n`{YdWNl^1a+oDiOQ+o?8gcONt4T~ufp4!F=4s zOeP0kuIkkz>Ok5xM_XikSOxzeQ|yxo9%9Ey`h%-rz~e)S5dfi&ds|4n^7i6HW#5pk zm5pa>!iL~V*DIc z)*EU`F^LRI{A@4%r4be>lGJ+?cgFfA9bYZet&A~2iAsYg3CRy~Av~P(4aUX7vG!eU zDib6d>a$YC##|~CC%AtPasy^~S@GA=+7=rPP5oaEB(hMb#(#z^St!Ka%hvOcxKge^ zr#q=lVNuM(%0sFuPm!#K&gPO_>nqF2T*qR}a}qd7&6p;1SFf`G|9L?>uu8){FXQomdrWNW>yLyNWlXBv^pV z3?X3`@nEJY#u2{%&6I}<3I*z}j1$|h0ol(_1cJ;6Ty26NVqA3)SZ`TV(BNxNod?wq zJ2DLtz?ZdQytZ;Ly`TF~a?8nRxYG2ZqXG@T*hUkigvxj(1?-qEUq%67rdM|hnJt5BG*4jp7X>LX6VI{zvB%cO% zh2!m$-0z6+MJJ0gE^654C5qn@TYlE<#6-pJTG@L<6hi8B_ZYv_OIPD1mkoW)+pqNI zgYnDx;)Nq6HS|N1O98m1(xkhKM7B2?$>+~a{8K)6bE(@<+W4w|6-6wu#g5y`V^J;R~P=D=ck^A z+vGixfUVFpWXA=XsRP14ED^1Y6T<_qj6xv_+VAd28L3wn*|4K{ByK8k;Nww-7RlHi zFE_+XN`MIGlJ;F69%%_U-#$Ivnj=PY8#`LeUCx_r7oGxo!?LhW-MJN48-X}2eZiIk z(f65dn5<9>+}*c+!}DponrJjuaN%ko^{)U8~) zLn6yC!70hT#ZJNX3Xs0(mkt8gcAu)*cG`C|88(;cxSXW8x|D_4c5=zGC!#BbLzE$- zpH7Tn1~1mc$qU@yP+H77?vAIHroG%ryE6~IA_fKm6*fmfxxy!Y;1?bK=C8i7?rM*_@e-D#~5BR*{mri0re>GZ1BSAgV?3@ zohJUAq&2lyJVkqWbV3Bz#~trY{b4bZSynIQ_lUY9|8JO-P+StFsw;XL?FPo$)1W3o_|u}5ei9h^8^LS$8wHSIK)7NP80L-=Vqc~9G? zH!)w?PJhKc$v58-R53GiC6qtCFT>kLo|{*&*Fdv8 z?}K`X@CM=ttR63{-_GvwNJl&kdzsb#MLw2A#V-Z>_@k4wHBxu);@*rZ)+OCxcv3BM zeSn!T+pfd;9;q%4T-`tB!EUfqSk!c+`WUM#ri&Q!YX(v(g$Sg@XfJ=KHun@hiHR1K zzY$L7aG?=~QHulVnirxv(c6pEH|+_jazM6M1@33!<*(WA3l^R z@enqIRo)=-=a`KS;GtMW{P`V2**Ha$u(A}p z?~Rdsdu*}gUq0*d$7F37Ph^{{Xbdggf#2ZbsHfmlc5DDX5+Ki1z_bz^%86dB4Z=Wm z%^4EN=vSMpw>jmTP%&6NuVWi7BF$Oy{fg0CrsKW zNyi5{tW76c8(%_+|7B zGlNsX=1QY!LN4`Bqf8$AveZby4@~Iotr<{@`12)cZ5Hta0ikSu;4m0)RXxJ%&xN|s~60aCq7eNw|(A&e)a_AE8@pV zrdZv7=NTwL!!j02F!LtUlF|GXc}V{fX3S;WNAqpU9#P%a@U*e}-Yk?`(p~x^zF`}& zNgffSp8NXTl)KXHtrUfQtx!JBV^%xI^LaU+&_f1`$a_)lM36w&JW}&~Y+-f7d}yj7 z(KP-!p=8nd5>3xy;ySOZ(tI}QC7XEaUZ9vv5yt`o5OP3W6&xP%z?*)})U-RlgqC4O zI#P855iBg1SGcQF80FwdFQeTpqPznhUBSd`NK;VM%Exfi^-Wlce=iqXz`9Yiv68Uw zpM-aX{`aV(I3Loo!{^9Svr#pdQc3zC7 zmR%|4^qJ+HkC{3Ze*Gv@w%q)(neUK_K;}skZHrjf>G)TPx4j#c*dm zeVSRE`R03#4cz+mioOI|f-t|JrM*UaiV6YcPic8m0?N0tq(Wk3C;H z;e6RFBO0&8%&h3EwZ6^@IouJ(ZZ|!f44v3L_d~aLr^9B%Ru;tqm%>DByf;9sz$xo@vQ!A zVIk(FBIU^?GWW(eVI2MosyEm=@$yd?Yr=~<4I@Pu(pL}?IccbDSLv|f2Zo#h?)cjw zhhw!*jD;mGD9Ar%-$+(i zHAq!Hr7O7Ir&nJLGa5O}TnqJGl(6Jv_=u~-QK{o&l49Enz@TCEFtT2{Dqwa$d-J>l zpyU>%XAG@zI?;{#CK`-!%%?qjPkk4-I`{^hG^+nd`LgE|4Bo=v_25xj*Otd0 z)6J_CEooN2!8VMLi#Otk?+MJQ@jb^AzJn~wMUU5x-uTY>y)M3LzQ0k%eUmyS$wtcm z?9RmMcXMLDZqmt{cj?bXs*xco^M(18!$RbZG$4(9RWd~3%e32*!dd%c(BS5q5&?lm ztVVSuB)JXoHE!rVo|DPP%9;rU0+fte2Ot>9I$d0k8-FyedK1EfilrFy#Q<7y@ThQH zVufCm;|5M4GR1Y7YH%hzYj_N9(?EP4<2@jt^?tfCVZ=UXn;1=RRdNA${2eGt>BV{c z1{9pHAWTlW2p;gWNz$(cq8#haN)}9~c-}m_myHU~9 zby3!igNA1Df49&7$X@FVEVRgFDWoPVUDP;@v3T$(N@r8z38L`I ztfX%5h8@>vtxMvC@Azpz6`_6Hlgya?ky^4)Ck;SmZ7b|}&*?})LX_{|6H@Ky*X z-KT+xrJe5j-Ny&Qpg5zm|e)5#xUxM3g18>eaH;&g-?=W0uNxj%l+yVdWotDX8u zfozi%QdZm#xKK#ls;u_|&*VeWA=SOSWZJbE^}Gyp6Jx%jA!~)~aODo6u<}`|IJhME z@~N{u@S3P?FfJ!UReM6>yRS`^fFws^s1RgB;SsVqOUMX^vILWc8O5I{dRtM{BjUWA-KA0 zr975R4ygnf1olSVe>~B17oujJBCW0fOEWSh>(gB^7*nWk z$D>y0E%Jj3__nyow64~0h}2|N>fssl5TE?$C-y@ka#wYx*df7TP|fY+p<^0ajW^$X z+?y%Iko~XSAm-i7OW@(jF*V*ZkFU$Dl&2Exx{;G))$olK+Mk+63HWS73x`}1L# z(+qAYh?b3ccf!xQOAp z+s#@#7>)O3d~C-TJ1{+g88bXtCC`V4y#FwntVx?SCZrdzTig`+OsHM}7n26h zeLwF)n|X*ijz>c_nDQWu7vikvxzyuY@HcvH0Wu%#ncL;=}Nx3JHS zp4Ha^cF(EVw|khF1_64v zf?C(>EMP#<{kY&5IJX^cwb=zfUKm*Aa5m{vWCh!xV11vuau1dd0f8&OdiFupMEy3$ zFf4)%0)j>nN!^+mq_mhk=7w>$vdcZ9hZIG>^*nPFT`sKEZ!BLT+R-)GH&jEigLh<{ ztglOz4C5(xtu`ZpgC=##+`_Zesk-ZsMo~A8An+bx64wjr#)>ir4~3+4BbZE4m6+9ExAX}Q;fKOn}}V-K`f*= z3X7c0aiFkg>>dEX(Wj^1gQFh$7cANk(w#s-Vb3%ksqP14&UN5he>mcS=9F-#Slhx^ zVK!wc)S{d&ZMIP?4g?}J6Sp7LEQf7Xk1$-0k?_zo2alE*#TRl}vNo_EHF>u2@fgtT zWQnFQtvvCizzT|~)GZ!2<}|4&sm*HIYw-I}MAy0^jI{XF#x~kI=!?^~no>qT^mHgyGYal=y~b!VasWRYwCWTgNb2APp^3{C=oE)Pve8QC&T_ zbGjB>dk*&kZlG~?UG=mCJ7RA=g}5r*;;o_`A56c(&{jjopuqg^Nzv;-aXm=TzR3Rg z{s%?+SGC_!q(6jzjDjG}>-#^{{z91k)xxg~00&Y#*huaDqgwf{T5^RHHa$9Mke)b)FS{u5Sz%YOa}^(!Ot6RP~0 zBl+J>;O|hs=SO};{>)tO(*tDnxuk^i4L^ZS3|*VOcUDs?|1M0Jk;+!!(nL(WP$(yEG&S9 z>Y#Lv4q!-bQ2MYa@F@Ewe-wz)3$Jq=G4DPX9;bzn2&-DLLD>NwGtuJZ4r(l=BuHBl->pkepr`F*> zd;cJ!uPJ+He{CBy&4lDs?i%mPOp7zHgi)E7V$n?W>x3RqLhIY<=nB(lza~nEr4A+5 zx{cR_spKWt*`?>AM!JeXJ>m201(wtZ9_ym8oQ-<8z{}vO-4TjgL>AB3)_sEvcE&1t zzf)+&oY?AZ5oZY#b1}(`iG9wpnU|{qE`qX5-iaw`QZmD%EUdbfd|WWykMq%=%${fw z@wLLf#Y^vj0-Bgde)IgiUBr`H&A-6w8Mp0fUq2JEeJ$TRBjY>H-}}^i&eY|) z{)?~s?91vC##T;2Y-MeowQLxB3!`e4ng@tU6ZMJw--_eJ$kCJj00;o+FarQ6000nx z^Hy{tcC)|<5=sgler`cQdFZ_>)<%#6dDaF|XTG9)R#A|b5oupc;*}e{%nsV;0&^N6qivp7-b%ChTn@ zBava5Bmghyz9cB!9r|%*rTznA;FLsWbBKgfnfW zK(M1toJ}_ln!K6h<=Q0Dq7=?glPw91|NIpjBa5fGX52_x}03R?H83 z#8ZOotbZArJgtlaRp!(uV8Hw-Sh8#FaQEL_Sh@jP0Rc9HCso{G(nz{asSTTRP|Y@? zn39~tdR$M3XHKO;LF|GyUcr0qhM2;nObWzbswfp!$-nHuKo0p*(^_3Tbnh`X{M_7Q zs_ft{#^PN-jO~WwHd&8*bIE2U|C#Iy!br_XX>FL3N58AB+mt3}qo}y?NCuE^`kbUm zb?G}=pnh(G%B?4EE)M2yeeX22yr3yDzG|m3;d3sro`v;Rs@1L7tzg|=Sp5gf-73$) z)S2p8R&6@P{(hxBM}x3cVwjjjm*W60c;0U@(OalWy3J-Xcu^9=%!wD&%vhokTFg2F z&W5a`b}}}|V7)c%Rj~GMOQVW5a^N+J7R=1I!=H}T7}9WAni7%ZhW$)sOf_vWldrS# za#d&_W44q!lOLfmq8H}52!Eu_WV$6EyKB5qJmLwp1cOeS{Fr0yeLnOi)#_Ul*NaVa zQvQG!*xS~fzFXfju}Ai@jW#DNu-Fh1@K+s7WKQ`;y>Ffc@tl~7;0M{lPMO>IoaA`E zs3e9)K*>f)JUd+qFAijJndUcqz<++)GAIQ?hHi;7=PRtM3^BK^!jiWbwyEe6>b!(Q z?fH=NjqIC=`!`cZGMfLoXW-cTn2}s>founAE(;#SOT_wAc_lj`q1yyl%<^80cu zq_H!dqd_r^InHL^-F#8mCd=+OC}ZtCH~Pj50+sSizYN9;(a11l{oZ4mgvthFur?)q z_5-w&@8PzcQWPfVX?Ts!AkfU$acZkzr#55bMDq|DQ(90y`<$}E^UG$?LypJgEQ(|Y z>0|OQNGX9V$>DwqAdo)Q({fpBNl?wvn`3Z!#bDcJlIb|no>ccUrC9D$@4&S@9~y;e zRqgltY!@RAPA0aVxK6ONv`V;ChDKU%Fq9~2!LQ+--7!8XX&j}!iXRFjCvn}56#i0g z;rJKHKJKN($Lv>|kdBocxtGrlR>TBV{#z5;AxAN3M!E~P$Cin zf=lUM5fSf(hiEk}Lv=0dfXI!Tv80fR*X0JY3+q zZlR*@g7Vh*6t0JT>whH1?L6jN{#e<%ezOTJ%b!(_!Zdq2Agv6$l{xjy<=nsWw41eT zD;vT(!S8R9+Hn(G4T4!HwYhVJNfltKBjVz{OAC{tcn%{pqEX#Iv{&`SY<(X*SOVTC z2X!3Ui3;>wAaJS{t;9BeMJ#;{apEgZ_TDtq8sg9p(!Rdesp^qH7smILH6<+1?(#} zTvz_{mP29P0LpG~Xgw^~x)k z{qj$~*n?yWwyS7FlZsu64PbAaH@mZg;3GKfXtTQ%C;L+jy|?L%y}qNE9m%ROo`xwb z|J_os$#6)6a7Y)BH5bgKXh0O*J7?v&z=Z;=B}NrLlhs@Bye?*bMyIcAZC9FC_(_rx zH?tw(C%=epyUeX*{EtX*NxjWLc98pLUNLdarFXJ*b`eP+iWEiQx>dvc+{gX9L%yl# zhYOX3mpt9=Q>z~jA}MS_jG9GT-77~e$@L!qa4LdCL*|GLESCr${Hce(`s|&YdeUW6 z>C}tickf4{t(n|;(9#Kz?)z?38QuzCUM{-+rkP6U0{&$=Af9Wwh#OC1xjSIMr>MCV z{*~r2b+x7CfN2#Z#KkG2P|o43m+WSjD=|Z zS^B2EZ=fS27EgE+SD{~g^Up8@=in>j`^{S2`hn%MyZSQhC6@;hx0$Qj8b&o%r`uj_ zRVty!^F9msx8h$;>YNk=zhFIRi^+%tmaVt-C>JJ(>|)k0`gTnJxS)k_{*wQ?n@Ncl zV3Zx26$JK_IaS^mdM6hgU?)K8kdN)lR21*s);IXN4>ZPw@DHoYB%zJBa7|eml4bXJ)r|cY_v3Wc zCq7i;RaHPMm->6`?bBJ-gy}n{q6>Ls&YDR-?Q+rdhCbh{_Xs9~Vl;Lqq~{|I%9*(!eN&_K}*ieobs_l6{CWYS_5v-xFnM9jJoZP;5SY zDJ=4n`UoJihD`Vcq?ZH@wG@7Kg#{%dJ})vpON|RdyKley!Rn@-QHPS(ETSso1J{<* zM-BJ5EKM00A;ABZ|BxyGhje#1i1I?1BNim)3Mn2_V6PDJII^Fy{y#Jra7O)*22aWS zZuh^$a_oG#6h}dU#7G8hV$&J0$Pro|KZS<}dz}CP%>J!97J``%g%^mT!eYn5".equals(name)) { + return getMethodVisitor(mv); + } + return mv; + } + private MethodVisitor getMethodVisitor(MethodVisitor mv) { + return new MethodVisitor(this.api, mv) { + @Override + public void visitTypeInsn(int opcode, String type) { + if (opcode == Opcodes.NEW && "java/lang/IllegalArgumentException".equals(type)) { + super.visitInsn(Opcodes.NOP); + } else { + super.visitTypeInsn(opcode, type); + } + } + @Override + public void visitMethodInsn(int opcode, String owner, String name, String desc, boolean itf) { + if (opcode == Opcodes.INVOKESPECIAL && "java/lang/IllegalArgumentException".equals(owner) && "".equals(name)) { + super.visitInsn(Opcodes.NOP); + } else { + super.visitMethodInsn(opcode, owner, name, desc, itf); + } + } + @Override + public void visitInsn(int opcode) { + if (opcode == Opcodes.ATHROW || opcode == Opcodes.DUP) { + super.visitInsn(Opcodes.NOP); + } else { + super.visitInsn(opcode); + } + } + }; + } + } +} + diff --git a/lwjgl2_methods_injector/src/main/java/org/angelauramc/lwjgl2_methods_injector/startInjectors.java b/lwjgl2_methods_injector/src/main/java/org/angelauramc/lwjgl2_methods_injector/startInjectors.java index f60b29ecf..da952df6b 100644 --- a/lwjgl2_methods_injector/src/main/java/org/angelauramc/lwjgl2_methods_injector/startInjectors.java +++ b/lwjgl2_methods_injector/src/main/java/org/angelauramc/lwjgl2_methods_injector/startInjectors.java @@ -11,7 +11,14 @@ public class startInjectors { Class.forName("org.objectweb.asm.ClassWriter"); Class.forName("org.objectweb.asm.MethodVisitor"); Class.forName("org.objectweb.asm.Opcodes"); + Package asmPackage = org.objectweb.asm.Opcodes.class.getPackage(); + String implVersion = asmPackage.getImplementationVersion(); + if (implVersion == null) implVersion = "not found"; + System.out.println("Amethyst-Android: Detected ASM version: " + implVersion); ALC10Injector.premain(args, inst); + // This is the version we override old asm vers with. So we add the patches + // so the older version bugs are ported. + if (implVersion.equals("5.0.4")) ASM5OverrideInjector.premain(args, inst); } catch (ClassNotFoundException | NoClassDefFoundError ignored) { } }