Commit 04f28dc1 authored by swift_gan's avatar swift_gan

done replacement hook

parent 8dc5d1bf
...@@ -8,7 +8,8 @@ ...@@ -8,7 +8,8 @@
android:label="@string/app_name" android:label="@string/app_name"
android:roundIcon="@mipmap/ic_launcher_round" android:roundIcon="@mipmap/ic_launcher_round"
android:supportsRtl="true" android:supportsRtl="true"
android:theme="@style/AppTheme"> android:theme="@style/AppTheme"
android:name=".MyApp">
<activity <activity
android:name=".MainActivity" android:name=".MainActivity"
android:label="@string/app_name" android:label="@string/app_name"
......
...@@ -59,13 +59,13 @@ namespace SandHook { ...@@ -59,13 +59,13 @@ namespace SandHook {
virtual MType get(PType p) { virtual MType get(PType p) {
if (offset > parentSize) if (offset > parentSize)
return NULL; return NULL;
return *reinterpret_cast<MType*>(&p + getOffset()); return *reinterpret_cast<MType*>((Size)&p + getOffset());
}; };
virtual void set(PType p, MType t) { virtual void set(PType* p, MType t) {
if (offset > parentSize) if (offset > parentSize)
return; return;
memcpy(&p + getOffset(), &t, sizeof(MType)); memcpy(reinterpret_cast<void *>((Size)p + getOffset()), &t, sizeof(MType));
}; };
private: private:
......
...@@ -4,17 +4,32 @@ ...@@ -4,17 +4,32 @@
SandHook::TrampolineManager trampolineManager; SandHook::TrampolineManager trampolineManager;
int SDK_INT = 0;
extern "C" extern "C"
JNIEXPORT jboolean JNICALL JNIEXPORT jboolean JNICALL
Java_com_swift_sandhook_SandHook_initNative(JNIEnv *env, jclass type, jint sdk) { Java_com_swift_sandhook_SandHook_initNative(JNIEnv *env, jclass type, jint sdk) {
// TODO // TODO
SDK_INT = sdk;
SandHook::CastArtMethod::init(env, sdk); SandHook::CastArtMethod::init(env, sdk);
trampolineManager.init(SandHook::CastArtMethod::entryPointQuickCompiled->getOffset()); trampolineManager.init(SandHook::CastArtMethod::entryPointQuickCompiled->getOffset());
return JNI_TRUE; return JNI_TRUE;
} }
void disableCompilable(art::mirror::ArtMethod* method) {
uint32_t accessFlag = SandHook::CastArtMethod::accessFlag->get(*method);
accessFlag |= 0x01000000;
SandHook::CastArtMethod::accessFlag->set(method, accessFlag);
}
void disableInterpreterForO(art::mirror::ArtMethod* method) {
uint32_t accessFlag = SandHook::CastArtMethod::accessFlag->get(*method);
accessFlag |= 0x0100;
SandHook::CastArtMethod::accessFlag->set(method, accessFlag);
}
extern "C" extern "C"
JNIEXPORT jboolean JNICALL JNIEXPORT jboolean JNICALL
Java_com_swift_sandhook_SandHook_hookMethod(JNIEnv *env, jclass type, jobject originMethod, Java_com_swift_sandhook_SandHook_hookMethod(JNIEnv *env, jclass type, jobject originMethod,
...@@ -25,11 +40,24 @@ Java_com_swift_sandhook_SandHook_hookMethod(JNIEnv *env, jclass type, jobject or ...@@ -25,11 +40,24 @@ Java_com_swift_sandhook_SandHook_hookMethod(JNIEnv *env, jclass type, jobject or
art::mirror::ArtMethod* hook = reinterpret_cast<art::mirror::ArtMethod *>(env->FromReflectedMethod(hookMethod)); art::mirror::ArtMethod* hook = reinterpret_cast<art::mirror::ArtMethod *>(env->FromReflectedMethod(hookMethod));
art::mirror::ArtMethod* backup = backupMethod == NULL ? nullptr : reinterpret_cast<art::mirror::ArtMethod *>(env->FromReflectedMethod(backupMethod)); art::mirror::ArtMethod* backup = backupMethod == NULL ? nullptr : reinterpret_cast<art::mirror::ArtMethod *>(env->FromReflectedMethod(backupMethod));
if (SandHook::CastArtMethod::entryPointQuickCompiled->get(*origin) == SandHook::CastArtMethod::quickToInterpreterBridge) { // if (SandHook::CastArtMethod::entryPointQuickCompiled->get(*origin) == SandHook::CastArtMethod::quickToInterpreterBridge) {
return JNI_FALSE; // return JNI_FALSE;
// }
if (SDK_INT >= ANDROID_N) {
disableCompilable(origin);
disableCompilable(hook);
}
if (SDK_INT >= ANDROID_O) {
disableInterpreterForO(origin);
} }
trampolineManager.installInlineTrampoline(origin, hook, backup); SandHook::HookTrampoline* hookTrampoline = trampolineManager.installReplacementTrampoline(origin, hook, backup);
if (hookTrampoline != nullptr) {
SandHook::CastArtMethod::entryPointQuickCompiled->set(origin, hookTrampoline->replacement->getCode());
hookTrampoline->replacement->flushCache(reinterpret_cast<uint64_t>(origin), 100);
}
return JNI_TRUE; return JNI_TRUE;
......
...@@ -70,11 +70,11 @@ namespace SandHook { ...@@ -70,11 +70,11 @@ namespace SandHook {
protected: protected:
Size codeLength() override { Size codeLength() override {
return SIZE_REPLACEMENT_HOOK_TRAMPOLINE; return SIZE_INLINE_HOOK_TRAMPOLINE;
} }
Code templateCode() override { Code templateCode() override {
return reinterpret_cast<Code>(REPLACEMENT_HOOK_TRAMPOLINE); return reinterpret_cast<Code>(INLINE_HOOK_TRAMPOLINE);
} }
}; };
......
...@@ -89,7 +89,22 @@ namespace SandHook { ...@@ -89,7 +89,22 @@ namespace SandHook {
} }
void codeCopy(Code src, Size targetOffset, Size len) { void codeCopy(Code src, Size targetOffset, Size len) {
memcpy(reinterpret_cast<void*>((Size)code + targetOffset), src, len); memcpy(reinterpret_cast<void*>((Size)code + targetOffset), src, len);
flushCache((Size)code + targetOffset, len);
} }
bool flushCache(Size addr, Size len) {
#if defined(__arm__)
int i = cacheflush(addr, addr + len, 0);
if (i == -1) {
return false;
}
#elif defined(__aarch64__)
char *begin = reinterpret_cast<char *>(addr);
__builtin___clear_cache(begin, begin + len);
#endif
return true;
}
void clone(Code dest) { void clone(Code dest) {
memcpy(dest, code, codeLen); memcpy(dest, code, codeLen);
} }
......
package com.swift.sandhook; package com.swift.sandhook;
import android.app.Activity;
import android.os.Bundle; import android.os.Bundle;
import android.util.Log; import android.util.Log;
...@@ -8,19 +9,18 @@ import com.swift.sandhook.wrapper.HookMethod; ...@@ -8,19 +9,18 @@ import com.swift.sandhook.wrapper.HookMethod;
import com.swift.sandhook.wrapper.HookMethodBackup; import com.swift.sandhook.wrapper.HookMethodBackup;
import com.swift.sandhook.wrapper.MethodParams; import com.swift.sandhook.wrapper.MethodParams;
@HookClass(MainActivity.class) @HookClass(Activity.class)
public class ActivityHooker { public class ActivityHooker {
@HookMethod("methodBeHooked") @HookMethod("onCreate")
@MethodParams(Bundle.class) @MethodParams(Bundle.class)
public static void onCreate(MainActivity thiz, Bundle bundle) { public static void onCreate(Activity thiz, Bundle bundle) {
Log.e("ActivityHooker", "hooked success " + thiz); Log.e("ActivityHooker", "hooked success " + thiz);
onCreateBackup(thiz, bundle);
} }
@HookMethodBackup("methodBeHooked") @HookMethodBackup("onCreate")
@MethodParams(Bundle.class) @MethodParams(Bundle.class)
public static void onCreateBackup(MainActivity thiz, Bundle bundle) { public static void onCreateBackup(Activity thiz, Bundle bundle) {
} }
......
...@@ -23,7 +23,7 @@ public class MainActivity extends AppCompatActivity { ...@@ -23,7 +23,7 @@ public class MainActivity extends AppCompatActivity {
@Override @Override
protected void onCreate(Bundle savedInstanceState) { protected void onCreate(final Bundle savedInstanceState) {
super.onCreate(savedInstanceState); super.onCreate(savedInstanceState);
setContentView(R.layout.activity_main); setContentView(R.layout.activity_main);
Toolbar toolbar = (Toolbar) findViewById(R.id.toolbar); Toolbar toolbar = (Toolbar) findViewById(R.id.toolbar);
...@@ -40,13 +40,13 @@ public class MainActivity extends AppCompatActivity { ...@@ -40,13 +40,13 @@ public class MainActivity extends AppCompatActivity {
methodBeHooked(savedInstanceState); methodBeHooked(savedInstanceState);
try {
HookWrapper.addHookClass(ActivityHooker.class);
} catch (HookErrorException e) {
e.printStackTrace();
}
methodBeHooked(savedInstanceState); toolbar.postDelayed(new Runnable() {
@Override
public void run() {
methodBeHooked(savedInstanceState);
}
}, 3000);
// Example of a call to a native method // Example of a call to a native method
TextView tv = (TextView) findViewById(R.id.sample_text); TextView tv = (TextView) findViewById(R.id.sample_text);
......
package com.swift.sandhook;
import android.app.Application;
import com.swift.sandhook.wrapper.HookErrorException;
import com.swift.sandhook.wrapper.HookWrapper;
public class MyApp extends Application {
@Override
public void onCreate() {
super.onCreate();
try {
HookWrapper.addHookClass(ActivityHooker.class);
} catch (HookErrorException e) {
e.printStackTrace();
}
}
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment