Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
M
Magisk
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
Magisk
Commits
e219867c
Commit
e219867c
authored
Apr 20, 2020
by
topjohnwu
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Hijack another binary for 2nd stage
Instead of using ptrace hacks, use another hack instead :D
parent
765d5d97
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
52 additions
and
52 deletions
+52
-52
init.hpp
native/jni/init/init.hpp
+3
-2
mount.cpp
native/jni/init/mount.cpp
+4
-5
rootdir.cpp
native/jni/init/rootdir.cpp
+8
-6
twostage.cpp
native/jni/init/twostage.cpp
+37
-39
No files found.
native/jni/init/init.hpp
View file @
e219867c
...
...
@@ -101,7 +101,7 @@ public:
class
SARFirstStageInit
:
public
SARBase
{
private
:
void
traced_exec_init
();
void
prepare
();
protected
:
void
early_mount
()
override
;
public
:
...
...
@@ -110,7 +110,8 @@ public:
};
void
start
()
override
{
early_mount
();
traced_exec_init
();
prepare
();
exec_init
();
}
};
...
...
native/jni/init/mount.cpp
View file @
e219867c
...
...
@@ -195,7 +195,8 @@ void SARBase::backup_files() {
backup_folder
(
"/overlay.d"
,
overlays
);
full_read
(
"/proc/self/exe"
,
self
.
buf
,
self
.
sz
);
full_read
(
"/.backup/.magisk"
,
config
.
buf
,
config
.
sz
);
if
(
access
(
"/.backup/.magisk"
,
R_OK
)
==
0
)
full_read
(
"/.backup/.magisk"
,
config
.
buf
,
config
.
sz
);
}
void
SARBase
::
mount_system_root
()
{
...
...
@@ -242,11 +243,9 @@ void SARFirstStageInit::early_mount() {
void
SecondStageInit
::
early_mount
()
{
backup_files
();
rm_rf
(
"/system"
);
rm_rf
(
"/.backup"
);
rm_rf
(
"/overlay.d"
);
umount2
(
"/system/bin/init"
,
MNT_DETACH
);
umount2
(
"/init"
,
MNT_DETACH
);
umount2
(
"/proc/self/exe"
,
MNT_DETACH
);
if
(
access
(
"/system_root"
,
F_OK
)
==
0
)
switch_root
(
"/system_root"
);
...
...
native/jni/init/rootdir.cpp
View file @
e219867c
...
...
@@ -131,9 +131,11 @@ bool MagiskInit::patch_sepolicy(const char *file) {
return
false
;
}
// Mount selinuxfs to communicate with kernel
xmount
(
"selinuxfs"
,
SELINUX_MNT
,
"selinuxfs"
,
0
,
nullptr
);
mount_list
.
emplace_back
(
SELINUX_MNT
);
if
(
access
(
SELINUX_VERSION
,
F_OK
)
!=
0
)
{
// Mount selinuxfs to communicate with kernel
xmount
(
"selinuxfs"
,
SELINUX_MNT
,
"selinuxfs"
,
0
,
nullptr
);
mount_list
.
emplace_back
(
SELINUX_MNT
);
}
if
(
patch_init
)
load_split_cil
();
...
...
@@ -307,10 +309,10 @@ void SARBase::patch_rootdir() {
struct
sockaddr_un
sun
;
int
sockfd
=
xsocket
(
AF_LOCAL
,
SOCK_STREAM
|
SOCK_CLOEXEC
,
0
);
if
(
connect
(
sockfd
,
(
struct
sockaddr
*
)
&
sun
,
setup_sockaddr
(
&
sun
,
INIT_SOCKET
))
==
0
)
{
LOGD
(
"ACK init
tracer
to write backup files
\n
"
);
// Let
tracer
know where tmp_dir is
LOGD
(
"ACK init
daemon
to write backup files
\n
"
);
// Let
daemon
know where tmp_dir is
write_string
(
sockfd
,
tmp_dir
);
// Wait for
tracer to finish copy
ing files
// Wait for
daemon to finish restor
ing files
int
ack
;
read
(
sockfd
,
&
ack
,
sizeof
(
ack
));
}
else
{
...
...
native/jni/init/twostage.cpp
View file @
e219867c
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <magisk.hpp>
#include <utils.hpp>
#include <logging.hpp>
...
...
@@ -76,20 +73,41 @@ void FirstStageInit::prepare() {
chdir
(
"/"
);
}
static
inline
long
xptrace
(
int
request
,
pid_t
pid
,
void
*
addr
,
void
*
data
)
{
long
ret
=
ptrace
(
request
,
pid
,
addr
,
data
);
if
(
ret
<
0
)
PLOGE
(
"ptrace %d"
,
pid
);
return
ret
;
}
static
inline
long
xptrace
(
int
request
,
pid_t
pid
,
void
*
addr
=
nullptr
,
intptr_t
data
=
0
)
{
return
xptrace
(
request
,
pid
,
addr
,
reinterpret_cast
<
void
*>
(
data
));
}
#define INIT_PATH "/system/bin/init"
#define REDIR_PATH "/system/bin/adbd"
void
SARFirstStageInit
::
traced_exec_init
()
{
void
SARFirstStageInit
::
prepare
()
{
int
pid
=
getpid
();
xmount
(
"tmpfs"
,
"/dev"
,
"tmpfs"
,
0
,
"mode=755"
);
// Patch init binary
raw_data
init
;
int
src
=
xopen
(
"/init"
,
O_RDONLY
);
fd_full_read
(
src
,
init
.
buf
,
init
.
sz
);
for
(
uint8_t
*
p
=
init
.
buf
,
*
eof
=
init
.
buf
+
init
.
sz
;
p
<
eof
;
++
p
)
{
if
(
memcmp
(
p
,
INIT_PATH
,
sizeof
(
INIT_PATH
))
==
0
)
{
LOGD
(
"Patch init ["
INIT_PATH
"] -> ["
REDIR_PATH
"]
\n
"
);
memcpy
(
p
,
REDIR_PATH
,
sizeof
(
REDIR_PATH
));
break
;
}
}
int
dest
=
xopen
(
"/dev/init"
,
O_CREAT
|
O_WRONLY
,
0
);
write
(
dest
,
init
.
buf
,
init
.
sz
);
fclone_attr
(
src
,
dest
);
close
(
dest
);
// Replace redirect init with magiskinit
dest
=
xopen
(
"/dev/magiskinit"
,
O_CREAT
|
O_WRONLY
,
0
);
write
(
dest
,
self
.
buf
,
self
.
sz
);
fclone_attr
(
src
,
dest
);
close
(
src
);
close
(
dest
);
xmount
(
"/dev/init"
,
"/init"
,
nullptr
,
MS_BIND
,
nullptr
);
xmount
(
"/dev/magiskinit"
,
REDIR_PATH
,
nullptr
,
MS_BIND
,
nullptr
);
xumount2
(
"/dev"
,
MNT_DETACH
);
// Block SIGUSR1
sigset_t
block
,
old
;
sigemptyset
(
&
block
);
...
...
@@ -97,42 +115,22 @@ void SARFirstStageInit::traced_exec_init() {
sigprocmask
(
SIG_BLOCK
,
&
block
,
&
old
);
if
(
int
child
=
xfork
();
child
)
{
LOGD
(
"init
tracer
[%d]
\n
"
,
child
);
// Wait for children
to attach
LOGD
(
"init
daemon
[%d]
\n
"
,
child
);
// Wait for children
signal
int
sig
;
sigwait
(
&
block
,
&
sig
);
// Restore sigmask
sigprocmask
(
SIG_BLOCK
,
&
old
,
nullptr
);
// Re-exec init
exec_init
();
sigprocmask
(
SIG_SETMASK
,
&
old
,
nullptr
);
}
else
{
// Attach to parent to trace exec
xptrace
(
PTRACE_ATTACH
,
pid
);
waitpid
(
pid
,
nullptr
,
__WALL
|
__WNOTHREAD
);
xptrace
(
PTRACE_SETOPTIONS
,
pid
,
nullptr
,
PTRACE_O_TRACEEXEC
);
xptrace
(
PTRACE_CONT
,
pid
,
0
,
SIGUSR1
);
// Wait for execve
waitpid
(
pid
,
nullptr
,
__WALL
|
__WNOTHREAD
);
// Swap out init with bind mount
xmount
(
"tmpfs"
,
"/dev"
,
"tmpfs"
,
0
,
"mode=755"
);
int
init
=
xopen
(
"/dev/magiskinit"
,
O_CREAT
|
O_WRONLY
,
0750
);
write
(
init
,
self
.
buf
,
self
.
sz
);
close
(
init
);
xmount
(
"/dev/magiskinit"
,
"/init"
,
nullptr
,
MS_BIND
,
nullptr
);
xumount2
(
"/dev"
,
MNT_DETACH
);
// Establish socket for 2nd stage ack
struct
sockaddr_un
sun
;
int
sockfd
=
xsocket
(
AF_LOCAL
,
SOCK_STREAM
|
SOCK_CLOEXEC
,
0
);
xbind
(
sockfd
,
(
struct
sockaddr
*
)
&
sun
,
setup_sockaddr
(
&
sun
,
INIT_SOCKET
));
xlisten
(
sockfd
,
1
);
// Resume
ini
t
xptrace
(
PTRACE_DETACH
,
pid
);
// Resume
paren
t
kill
(
pid
,
SIGUSR1
);
// Wait for second stage ack
int
client
=
xaccept4
(
sockfd
,
nullptr
,
nullptr
,
SOCK_CLOEXEC
);
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment