Search code examples
androiddalviksmali

VFY: register1 v4 type 2, wanted 17


I have the following Smali code:

.method private a(Landroid/content/Context;Landroid/os/Bundle;Ljava/lang/String;Ljava/lang/String;I)V
.registers 33
move/16 v22, p5
move-object/16 v21, p4
move-object/16 v20, p3
move-object/16 v19, p2
move-object/16 v18, p1
move-object/16 v17, p0
check-cast v21, Ljava/lang/String;
check-cast v20, Ljava/lang/String;
check-cast v19, Landroid/os/Bundle;
check-cast v18, Landroid/content/Context;
check-cast v17, Lcom/clevertap/android/sdk/aa;
move-object/from16 v1, v18
move-object/from16 v2, v19
move-object/from16 v3, v20
move/from16 v4, v22
.line 476

...

invoke-static {v4}, Ljava/lang/Integer;->valueOf(I)Ljava/lang/Integer;

This is rejected by the Dalvik verifier with the following reason:

VFY: register1 v4 type 2, wanted 17
VFY:  rejecting opcode 0x71 at 0x05f0
VFY:  rejected Lcom/clevertap/android/sdk/aa;.a (Landroid/content/Context;Landroid/os/Bundle;Ljava/lang/String;Ljava/lang/String;I)V
Verifier rejected class Lcom/clevertap/android/sdk/aa;

Type 17 is Integer while type 2 means unknown type. Why does the verifier lose the type?


Solution

  • Given that the offset is 0x05f0, that invoke-static instruction occurs very far down in the method. There is almost certainly code between the top of the method and there that also uses the v4 register.

    I recommend using baksmali's --register-info functionality, which adds a comment before/after each instruction with details on the types of registers. You should be able to trace the code backwards and figure out where the type of v4 is coming from.