test: exercise strict W^X runtime paths

Author: TheQmaks

scripts/android_smoke.py

@@ -113,7 +113,7 @@ def analyze_proc_maps(text: str) -> dict[str, int]:
         report["executable"] += 1
         if permissions.startswith("rwx"):
             report["rwx"] += 1
-            if not path or path.startswith("[anon:"):
+            if not path or path.startswith("["):
                 report["anonymous_rwx"] += 1
         if "(deleted)" in path:
             report["deleted_executable"] += 1

test_comprehensive.js

@@ -89,6 +89,38 @@ setTimeout(function () {
         fail('agent export lookup failed', error);
     }
 
+    // 5. Native hook execution (exercises Gum's executable-code allocator).
+    var getpidListener = null;
+    try {
+        var getpidAddress = Module.findGlobalExportByName('getpid');
+        if (getpidAddress === null) {
+            fail('getpid export unavailable');
+        } else {
+            var getpidObserved = false;
+            getpidListener = Interceptor.attach(getpidAddress, {
+                onEnter() {
+                    getpidObserved = true;
+                }
+            });
+            Interceptor.flush();
+
+            var getpid = new NativeFunction(getpidAddress, 'int', []);
+            var observedPid = getpid();
+            if (!getpidObserved) {
+                fail('native getpid hook did not execute');
+            }
+            if (observedPid !== Process.id) {
+                fail('native getpid returned unexpected pid', observedPid);
+            }
+        }
+    } catch (error) {
+        fail('native hook acceptance failed', error);
+    } finally {
+        if (getpidListener !== null) {
+            getpidListener.detach();
+        }
+    }
+
     if (!javaAvailable) {
         fail('Java bridge unavailable');
         finish();

tests/test_android_smoke.py

@@ -64,8 +64,9 @@ def test_proc_maps_report_distinguishes_anonymous_rwx_from_art_jit() -> None:
     }
 
 
-def test_proc_maps_report_treats_named_anon_rwx_as_anonymous() -> None:
-    report = android_smoke.analyze_proc_maps("7000-8000 rwxp 00000000 00:00 0 [anon:gum-code]\n")
+@pytest.mark.parametrize("path", ["[anon:gum-code]", "[stack]"])
+def test_proc_maps_report_treats_bracketed_rwx_as_anonymous(path: str) -> None:
+    report = android_smoke.analyze_proc_maps(f"7000-8000 rwxp 00000000 00:00 0 {path}\n")
 
     assert report["anonymous_rwx"] == 1
 
@@ -636,6 +637,8 @@ def test_acceptance_agent_uses_frida_17_file_and_java_wrapper_apis() -> None:
     assert "Java.cast(iterator.next(), Thread).getName()" in source
     assert "rpc.exports" in source
     assert "add(left, right)" in source
+    assert "Interceptor.attach" in source
+    assert "new NativeFunction" in source
 
 
 def test_report_writer_omits_device_serial(tmp_path: Path) -> None: