Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
29adbb4f
Commit
29adbb4f
authored
May 26, 2019
by
swift_gan
Committed by
swift_gan
May 26, 2019
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
[NativeHook]add decode filter
parent
1ca0a145
Show whitespace changes
Inline
Side-by-side
Showing
7 changed files
with
30 additions
and
23 deletions
+30
-23
decoder_arm32.cpp
...ok/src/main/cpp/archs/arm/arm32/decoder/decoder_arm32.cpp
+15
-11
decoder_arm32.h
...hook/src/main/cpp/archs/arm/arm32/decoder/decoder_arm32.h
+1
-1
code_relocate_arm32.cpp
...main/cpp/archs/arm/arm32/relocate/code_relocate_arm32.cpp
+1
-1
decoder_arm64.cpp
...ok/src/main/cpp/archs/arm/arm64/decoder/decoder_arm64.cpp
+10
-7
decoder_arm64.h
...hook/src/main/cpp/archs/arm/arm64/decoder/decoder_arm64.h
+1
-1
code_relocate_arm64.cpp
...main/cpp/archs/arm/arm64/relocate/code_relocate_arm64.cpp
+1
-1
decoder.h
nativehook/src/main/cpp/includes/decoder.h
+1
-1
No files found.
nativehook/src/main/cpp/archs/arm/arm32/decoder/decoder_arm32.cpp
View file @
29adbb4f
...
...
@@ -23,7 +23,7 @@ goto label_matched; \
Arm32Decoder
*
Arm32Decoder
::
instant
=
new
Arm32Decoder
();
void
Arm32Decoder
::
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
)
{
void
Arm32Decoder
::
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
,
bool
onlyPcRelInst
)
{
bool
thumb
=
isThumbCode
(
reinterpret_cast
<
Addr
>
(
codeStart
));
if
(
thumb
)
{
codeStart
=
getThumbCodeAddress
(
codeStart
);
...
...
@@ -36,9 +36,11 @@ void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
if
(
thumb
&&
thumb32
)
{
CASE_T32
(
B32
)
CASE_T32
(
LDR_LIT
)
if
(
!
onlyPcRelInst
)
{
CASE_T32
(
LDR_IMM
)
CASE_T32
(
LDR_UIMM
)
CASE_T32
(
MOV_MOVT_IMM
)
}
if
(
unit
==
nullptr
)
{
unit
=
reinterpret_cast
<
Unit
<
Base
>
*>
(
new
INST_T32
(
UNKNOW
)(
*
reinterpret_cast
<
STRUCT_T32
(
UNKNOW
)
*>
(
pc
)));
}
...
...
@@ -50,17 +52,19 @@ void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
CASE_T16
(
LDR_LIT
)
CASE_T16
(
ADD_IMM_RDN
)
CASE_T16
(
ADR
)
if
(
!
onlyPcRelInst
)
{
CASE_T16
(
ADD_REG
)
CASE_T16
(
CMP_REG
)
CASE_T16
(
CMP_REG_EXT
)
CASE_T16
(
MOV_REG
)
CASE_T16
(
POP
)
CASE_T16
(
PUSH
)
}
if
(
unit
==
nullptr
)
{
unit
=
reinterpret_cast
<
Unit
<
Base
>
*>
(
new
INST_T16
(
UNKNOW
)(
*
reinterpret_cast
<
STRUCT_T16
(
UNKNOW
)
*>
(
pc
)));
}
}
else
{
//TODO
//TODO
arm32 support
unit
=
reinterpret_cast
<
Unit
<
Base
>
*>
(
new
INST_T32
(
UNKNOW
)(
*
reinterpret_cast
<
STRUCT_T32
(
UNKNOW
)
*>
(
pc
)));
}
...
...
nativehook/src/main/cpp/archs/arm/arm32/decoder/decoder_arm32.h
View file @
29adbb4f
...
...
@@ -12,7 +12,7 @@ namespace SandHook {
class
Arm32Decoder
:
public
InstDecoder
{
public
:
void
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
)
override
;
void
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
,
bool
onlyPcRelInst
)
override
;
public
:
static
Arm32Decoder
*
instant
;
};
...
...
nativehook/src/main/cpp/archs/arm/arm32/relocate/code_relocate_arm32.cpp
View file @
29adbb4f
...
...
@@ -44,7 +44,7 @@ void* CodeRelocateA32::relocate(void *startPc, Addr len, void *toPc = nullptr) t
__
allocBufferFirst
(
static_cast
<
U32
>
(
len
*
8
));
void
*
curPc
=
__
getPC
();
if
(
toPc
==
nullptr
)
{
Disassembler
::
get
()
->
decode
(
startPc
,
len
,
*
this
);
Disassembler
::
get
()
->
decode
(
startPc
,
len
,
*
this
,
true
);
}
else
{
//TODO
}
...
...
nativehook/src/main/cpp/archs/arm/arm64/decoder/decoder_arm64.cpp
View file @
29adbb4f
...
...
@@ -17,26 +17,29 @@ goto label_matched; \
Arm64Decoder
*
Arm64Decoder
::
instant
=
new
Arm64Decoder
();
void
Arm64Decoder
::
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
)
{
void
Arm64Decoder
::
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
,
bool
onlyPcRelInst
)
{
InstA64
*
pc
=
reinterpret_cast
<
InstA64
*>
(
codeStart
);
Addr
endAddr
=
(
Addr
)
codeStart
+
codeLen
;
Unit
<
Base
>*
unit
=
nullptr
;
while
((
Addr
)
pc
<
endAddr
)
{
// pc relate insts
CASE
(
B_BL
)
CASE
(
B_COND
)
CASE
(
CBZ_CBNZ
)
CASE
(
TBZ_TBNZ
)
CASE
(
LDR_LIT
)
CASE
(
ADR_ADRP
)
if
(
onlyPcRelInst
)
goto
label_matched
;
CASE
(
MOV_WIDE
)
CASE
(
MOV_REG
)
CASE
(
ADR_ADRP
)
CASE
(
LDR_LIT
)
CASE
(
LDR_IMM
)
CASE
(
LDR_UIMM
)
CASE
(
LDRSW_IMM
)
CASE
(
LDRSW_UIMM
)
CASE
(
STR_UIMM
)
CASE
(
STR_IMM
)
CASE
(
B_BL
)
CASE
(
B_COND
)
CASE
(
BR_BLR_RET
)
CASE
(
CBZ_CBNZ
)
CASE
(
TBZ_TBNZ
)
CASE
(
SUB_EXT_REG
)
CASE
(
SVC
)
CASE
(
EXCEPTION_GEN
)
...
...
nativehook/src/main/cpp/archs/arm/arm64/decoder/decoder_arm64.h
View file @
29adbb4f
...
...
@@ -12,7 +12,7 @@ namespace SandHook {
class
Arm64Decoder
:
public
InstDecoder
{
public
:
void
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
)
override
;
void
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
,
bool
onlyPcRelInst
)
override
;
public
:
static
Arm64Decoder
*
instant
;
};
...
...
nativehook/src/main/cpp/archs/arm/arm64/relocate/code_relocate_arm64.cpp
View file @
29adbb4f
...
...
@@ -41,7 +41,7 @@ void* CodeRelocateA64::relocate(void *startPc, Addr len, void *toPc = nullptr) t
__
allocBufferFirst
(
static_cast
<
U32
>
(
len
*
8
));
void
*
curPc
=
__
getPC
();
if
(
toPc
==
nullptr
)
{
Disassembler
::
get
()
->
decode
(
startPc
,
len
,
*
this
);
Disassembler
::
get
()
->
decode
(
startPc
,
len
,
*
this
,
true
);
}
else
{
//TODO
}
...
...
nativehook/src/main/cpp/includes/decoder.h
View file @
29adbb4f
...
...
@@ -21,7 +21,7 @@ namespace SandHook {
class
InstDecoder
{
public
:
virtual
void
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
)
=
0
;
virtual
void
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
,
bool
onlyPcRelInst
=
false
)
=
0
;
};
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment