Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
04f28dc1
Commit
04f28dc1
authored
Jan 21, 2019
by
swift_gan
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
done replacement hook
parent
8dc5d1bf
Hide whitespace changes
Inline
Side-by-side
Showing
8 changed files
with
84 additions
and
22 deletions
+84
-22
AndroidManifest.xml
app/src/main/AndroidManifest.xml
+2
-1
cast.h
app/src/main/cpp/includes/cast.h
+3
-3
native-lib.cpp
app/src/main/cpp/native-lib.cpp
+31
-3
trampoline.cpp
app/src/main/cpp/trampoline/trampoline.cpp
+2
-2
trampoline.h
app/src/main/cpp/trampoline/trampoline.h
+15
-0
ActivityHooker.java
app/src/main/java/com/swift/sandhook/ActivityHooker.java
+6
-6
MainActivity.java
app/src/main/java/com/swift/sandhook/MainActivity.java
+7
-7
MyApp.java
app/src/main/java/com/swift/sandhook/MyApp.java
+18
-0
No files found.
app/src/main/AndroidManifest.xml
View file @
04f28dc1
...
...
@@ -8,7 +8,8 @@
android:label=
"@string/app_name"
android:roundIcon=
"@mipmap/ic_launcher_round"
android:supportsRtl=
"true"
android:theme=
"@style/AppTheme"
>
android:theme=
"@style/AppTheme"
android:name=
".MyApp"
>
<activity
android:name=
".MainActivity"
android:label=
"@string/app_name"
...
...
app/src/main/cpp/includes/cast.h
View file @
04f28dc1
...
...
@@ -59,13 +59,13 @@ namespace SandHook {
virtual
MType
get
(
PType
p
)
{
if
(
offset
>
parentSize
)
return
NULL
;
return
*
reinterpret_cast
<
MType
*>
(
&
p
+
getOffset
());
return
*
reinterpret_cast
<
MType
*>
(
(
Size
)
&
p
+
getOffset
());
};
virtual
void
set
(
PType
p
,
MType
t
)
{
virtual
void
set
(
PType
*
p
,
MType
t
)
{
if
(
offset
>
parentSize
)
return
;
memcpy
(
&
p
+
getOffset
(
),
&
t
,
sizeof
(
MType
));
memcpy
(
reinterpret_cast
<
void
*>
((
Size
)
p
+
getOffset
()
),
&
t
,
sizeof
(
MType
));
};
private
:
...
...
app/src/main/cpp/native-lib.cpp
View file @
04f28dc1
...
...
@@ -4,17 +4,32 @@
SandHook
::
TrampolineManager
trampolineManager
;
int
SDK_INT
=
0
;
extern
"C"
JNIEXPORT
jboolean
JNICALL
Java_com_swift_sandhook_SandHook_initNative
(
JNIEnv
*
env
,
jclass
type
,
jint
sdk
)
{
// TODO
SDK_INT
=
sdk
;
SandHook
::
CastArtMethod
::
init
(
env
,
sdk
);
trampolineManager
.
init
(
SandHook
::
CastArtMethod
::
entryPointQuickCompiled
->
getOffset
());
return
JNI_TRUE
;
}
void
disableCompilable
(
art
::
mirror
::
ArtMethod
*
method
)
{
uint32_t
accessFlag
=
SandHook
::
CastArtMethod
::
accessFlag
->
get
(
*
method
);
accessFlag
|=
0x01000000
;
SandHook
::
CastArtMethod
::
accessFlag
->
set
(
method
,
accessFlag
);
}
void
disableInterpreterForO
(
art
::
mirror
::
ArtMethod
*
method
)
{
uint32_t
accessFlag
=
SandHook
::
CastArtMethod
::
accessFlag
->
get
(
*
method
);
accessFlag
|=
0x0100
;
SandHook
::
CastArtMethod
::
accessFlag
->
set
(
method
,
accessFlag
);
}
extern
"C"
JNIEXPORT
jboolean
JNICALL
Java_com_swift_sandhook_SandHook_hookMethod
(
JNIEnv
*
env
,
jclass
type
,
jobject
originMethod
,
...
...
@@ -25,11 +40,24 @@ Java_com_swift_sandhook_SandHook_hookMethod(JNIEnv *env, jclass type, jobject or
art
::
mirror
::
ArtMethod
*
hook
=
reinterpret_cast
<
art
::
mirror
::
ArtMethod
*>
(
env
->
FromReflectedMethod
(
hookMethod
));
art
::
mirror
::
ArtMethod
*
backup
=
backupMethod
==
NULL
?
nullptr
:
reinterpret_cast
<
art
::
mirror
::
ArtMethod
*>
(
env
->
FromReflectedMethod
(
backupMethod
));
if
(
SandHook
::
CastArtMethod
::
entryPointQuickCompiled
->
get
(
*
origin
)
==
SandHook
::
CastArtMethod
::
quickToInterpreterBridge
)
{
return
JNI_FALSE
;
// if (SandHook::CastArtMethod::entryPointQuickCompiled->get(*origin) == SandHook::CastArtMethod::quickToInterpreterBridge) {
// return JNI_FALSE;
// }
if
(
SDK_INT
>=
ANDROID_N
)
{
disableCompilable
(
origin
);
disableCompilable
(
hook
);
}
if
(
SDK_INT
>=
ANDROID_O
)
{
disableInterpreterForO
(
origin
);
}
trampolineManager
.
installInlineTrampoline
(
origin
,
hook
,
backup
);
SandHook
::
HookTrampoline
*
hookTrampoline
=
trampolineManager
.
installReplacementTrampoline
(
origin
,
hook
,
backup
);
if
(
hookTrampoline
!=
nullptr
)
{
SandHook
::
CastArtMethod
::
entryPointQuickCompiled
->
set
(
origin
,
hookTrampoline
->
replacement
->
getCode
());
hookTrampoline
->
replacement
->
flushCache
(
reinterpret_cast
<
uint64_t
>
(
origin
),
100
);
}
return
JNI_TRUE
;
...
...
app/src/main/cpp/trampoline/trampoline.cpp
View file @
04f28dc1
...
...
@@ -70,11 +70,11 @@ namespace SandHook {
protected
:
Size
codeLength
()
override
{
return
SIZE_
REPLACEMENT
_HOOK_TRAMPOLINE
;
return
SIZE_
INLINE
_HOOK_TRAMPOLINE
;
}
Code
templateCode
()
override
{
return
reinterpret_cast
<
Code
>
(
REPLACEMENT
_HOOK_TRAMPOLINE
);
return
reinterpret_cast
<
Code
>
(
INLINE
_HOOK_TRAMPOLINE
);
}
};
...
...
app/src/main/cpp/trampoline/trampoline.h
View file @
04f28dc1
...
...
@@ -89,7 +89,22 @@ namespace SandHook {
}
void
codeCopy
(
Code
src
,
Size
targetOffset
,
Size
len
)
{
memcpy
(
reinterpret_cast
<
void
*>
((
Size
)
code
+
targetOffset
),
src
,
len
);
flushCache
((
Size
)
code
+
targetOffset
,
len
);
}
bool
flushCache
(
Size
addr
,
Size
len
)
{
#if defined(__arm__)
int
i
=
cacheflush
(
addr
,
addr
+
len
,
0
);
if
(
i
==
-
1
)
{
return
false
;
}
#elif defined(__aarch64__)
char
*
begin
=
reinterpret_cast
<
char
*>
(
addr
);
__builtin___clear_cache
(
begin
,
begin
+
len
);
#endif
return
true
;
}
void
clone
(
Code
dest
)
{
memcpy
(
dest
,
code
,
codeLen
);
}
...
...
app/src/main/java/com/swift/sandhook/ActivityHooker.java
View file @
04f28dc1
package
com
.
swift
.
sandhook
;
import
android.app.Activity
;
import
android.os.Bundle
;
import
android.util.Log
;
...
...
@@ -8,19 +9,18 @@ import com.swift.sandhook.wrapper.HookMethod;
import
com.swift.sandhook.wrapper.HookMethodBackup
;
import
com.swift.sandhook.wrapper.MethodParams
;
@HookClass
(
Main
Activity
.
class
)
@HookClass
(
Activity
.
class
)
public
class
ActivityHooker
{
@HookMethod
(
"
methodBeHooked
"
)
@HookMethod
(
"
onCreate
"
)
@MethodParams
(
Bundle
.
class
)
public
static
void
onCreate
(
Main
Activity
thiz
,
Bundle
bundle
)
{
public
static
void
onCreate
(
Activity
thiz
,
Bundle
bundle
)
{
Log
.
e
(
"ActivityHooker"
,
"hooked success "
+
thiz
);
onCreateBackup
(
thiz
,
bundle
);
}
@HookMethodBackup
(
"
methodBeHooked
"
)
@HookMethodBackup
(
"
onCreate
"
)
@MethodParams
(
Bundle
.
class
)
public
static
void
onCreateBackup
(
Main
Activity
thiz
,
Bundle
bundle
)
{
public
static
void
onCreateBackup
(
Activity
thiz
,
Bundle
bundle
)
{
}
...
...
app/src/main/java/com/swift/sandhook/MainActivity.java
View file @
04f28dc1
...
...
@@ -23,7 +23,7 @@ public class MainActivity extends AppCompatActivity {
@Override
protected
void
onCreate
(
Bundle
savedInstanceState
)
{
protected
void
onCreate
(
final
Bundle
savedInstanceState
)
{
super
.
onCreate
(
savedInstanceState
);
setContentView
(
R
.
layout
.
activity_main
);
Toolbar
toolbar
=
(
Toolbar
)
findViewById
(
R
.
id
.
toolbar
);
...
...
@@ -40,13 +40,13 @@ public class MainActivity extends AppCompatActivity {
methodBeHooked
(
savedInstanceState
);
try
{
HookWrapper
.
addHookClass
(
ActivityHooker
.
class
);
}
catch
(
HookErrorException
e
)
{
e
.
printStackTrace
();
}
methodBeHooked
(
savedInstanceState
);
toolbar
.
postDelayed
(
new
Runnable
()
{
@Override
public
void
run
()
{
methodBeHooked
(
savedInstanceState
);
}
},
3000
);
// Example of a call to a native method
TextView
tv
=
(
TextView
)
findViewById
(
R
.
id
.
sample_text
);
...
...
app/src/main/java/com/swift/sandhook/MyApp.java
0 → 100644
View file @
04f28dc1
package
com
.
swift
.
sandhook
;
import
android.app.Application
;
import
com.swift.sandhook.wrapper.HookErrorException
;
import
com.swift.sandhook.wrapper.HookWrapper
;
public
class
MyApp
extends
Application
{
@Override
public
void
onCreate
()
{
super
.
onCreate
();
try
{
HookWrapper
.
addHookClass
(
ActivityHooker
.
class
);
}
catch
(
HookErrorException
e
)
{
e
.
printStackTrace
();
}
}
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment