Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
3b441fc3
Commit
3b441fc3
authored
May 31, 2019
by
swift_gan
Committed by
swift_gan
May 31, 2019
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
[NativeHook]fix break point
parent
e8aa714a
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
39 additions
and
17 deletions
+39
-17
hook_arm64.cpp
nativehook/src/main/cpp/archs/arm/arm64/hook/hook_arm64.cpp
+10
-13
sandhook_native.cpp
nativehook/src/main/cpp/sandhook_native.cpp
+29
-4
No files found.
nativehook/src/main/cpp/archs/arm/arm64/hook/hook_arm64.cpp
View file @
3b441fc3
...
@@ -64,13 +64,13 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
...
@@ -64,13 +64,13 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
//build backup inst
//build backup inst
CodeRelocateA64
relocate
=
CodeRelocateA64
(
assemblerBackup
);
CodeRelocateA64
relocate
=
CodeRelocateA64
(
assemblerBackup
);
backup
=
relocate
.
relocate
(
point
,
6
*
4
,
nullptr
);
backup
=
relocate
.
relocate
(
point
,
4
*
4
,
nullptr
);
#define __ assemblerBackup.
#define __ assemblerBackup.
Label
*
origin_addr_label
=
new
Label
();
Label
*
origin_addr_label
=
new
Label
();
__
Ldr
(
IP1
,
origin_addr_label
);
__
Ldr
(
IP1
,
origin_addr_label
);
__
Br
(
IP1
);
__
Br
(
IP1
);
__
Emit
(
origin_addr_label
);
__
Emit
(
origin_addr_label
);
__
Emit
((
Addr
)
point
+
5
*
4
);
__
Emit
((
Addr
)
point
+
4
*
4
);
__
finish
();
__
finish
();
#undef __
#undef __
...
@@ -80,12 +80,12 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
...
@@ -80,12 +80,12 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
//backup NZCV
//backup NZCV
__
Sub
(
SP
,
Operand
(
&
SP
,
0x20
));
__
Sub
(
SP
,
Operand
(
&
SP
,
0x20
));
__
Mrs
(
NZCV
,
X0
);
__
Str
(
X0
,
MemOperand
(
&
SP
,
0x10
));
__
Str
(
X0
,
MemOperand
(
&
SP
,
0x10
));
__
Mrs
(
NZCV
,
X0
);
__
Str
(
X30
,
MemOperand
(
&
SP
));
__
Str
(
X30
,
MemOperand
(
&
SP
));
__
Add
(
X30
,
Operand
(
&
SP
,
0x20
));
__
Add
(
X30
,
Operand
(
&
SP
,
0x20
));
__
Str
(
X30
,
MemOperand
(
&
SP
,
0x8
));
__
Str
(
X30
,
MemOperand
(
&
SP
,
0x8
));
__
Ldr
(
X0
,
MemOperand
(
&
SP
,
0x1
8
));
__
Ldr
(
X0
,
MemOperand
(
&
SP
,
0x1
0
));
//backup X0 - X29
//backup X0 - X29
U8
douRegCount
=
30
/
2
;
U8
douRegCount
=
30
/
2
;
...
@@ -95,8 +95,8 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
...
@@ -95,8 +95,8 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
}
}
__
Mov
(
X0
,
SP
);
__
Mov
(
X0
,
SP
);
__
Mov
(
X3
,
(
Addr
)
callback
);
__
Mov
(
IP1
,
(
Addr
)
callback
);
__
Blr
(
X3
);
__
Blr
(
IP1
);
__
Ldr
(
X0
,
MemOperand
(
&
SP
,
0x100
));
__
Ldr
(
X0
,
MemOperand
(
&
SP
,
0x100
));
__
Msr
(
NZCV
,
X0
);
__
Msr
(
NZCV
,
X0
);
...
@@ -109,11 +109,10 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
...
@@ -109,11 +109,10 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
__
Ldr
(
X30
,
MemOperand
(
&
SP
,
(
Off
)
0
));
__
Ldr
(
X30
,
MemOperand
(
&
SP
,
(
Off
)
0
));
__
Add
(
SP
,
Operand
(
&
SP
,
0x20
));
__
Add
(
SP
,
Operand
(
&
SP
,
0x20
));
__
Stp
(
X1
,
X0
,
MemOperand
(
&
SP
,
-
0x10
));
//jump to origin
//jump to origin
__
Mov
(
X0
,
(
Addr
)
backup
);
__
Mov
(
IP1
,
(
Addr
)
backup
);
__
Br
(
X0
);
__
Br
(
IP1
);
__
finish
();
__
finish
();
#undef __
#undef __
...
@@ -123,12 +122,10 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
...
@@ -123,12 +122,10 @@ bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[]
//build inline trampoline
//build inline trampoline
#define __ assemblerInline.
#define __ assemblerInline.
Label
*
target_addr_label
=
new
Label
();
Label
*
target_addr_label
=
new
Label
();
__
Stp
(
X1
,
X0
,
MemOperand
(
&
SP
,
-
0x10
));
__
Ldr
(
IP1
,
target_addr_label
);
__
Ldr
(
X0
,
target_addr_label
);
__
Br
(
IP1
);
__
Br
(
X0
);
__
Emit
(
target_addr_label
);
__
Emit
(
target_addr_label
);
__
Emit
((
Addr
)
secondTrampoline
);
__
Emit
((
Addr
)
secondTrampoline
);
__
Ldr
(
X0
,
MemOperand
(
&
SP
,
-
0x8
));
__
finish
();
__
finish
();
#undef __
#undef __
...
...
nativehook/src/main/cpp/sandhook_native.cpp
View file @
3b441fc3
...
@@ -24,6 +24,14 @@ void (*dosth4Backup2)() = nullptr;
...
@@ -24,6 +24,14 @@ void (*dosth4Backup2)() = nullptr;
void
(
*
innerSuspendVM
)()
=
nullptr
;
void
(
*
innerSuspendVM
)()
=
nullptr
;
static
void
(
*
heapPreForkBackup
)(
void
*
)
=
nullptr
;
static
void
myHeapPreFork
(
void
*
heap
)
{
heapPreForkBackup
(
heap
);
}
void
SuspendVMReplace
()
{
void
SuspendVMReplace
()
{
LOGE
(
"VM Suspend!"
);
LOGE
(
"VM Suspend!"
);
innerSuspendVM
();
innerSuspendVM
();
...
@@ -42,7 +50,7 @@ void do3(int x, int y) {
...
@@ -42,7 +50,7 @@ void do3(int x, int y) {
int
b
=
1
+
1
;
int
b
=
1
+
1
;
int
c
=
1
+
1
;
int
c
=
1
+
1
;
int
d
=
a
+
b
+
c
;
int
d
=
a
+
b
+
c
;
LOGE
(
"
x = %d"
,
x
);
LOGE
(
"
do3 = %d"
,
y
);
}
}
void
do5
()
{
void
do5
()
{
...
@@ -50,9 +58,6 @@ void do5() {
...
@@ -50,9 +58,6 @@ void do5() {
}
}
void
do4
()
{
void
do4
()
{
if
(
m3
>
m2
)
{
return
;
}
do5
();
do5
();
int
a
=
1
+
1
;
int
a
=
1
+
1
;
int
b
=
a
+
1
;
int
b
=
a
+
1
;
...
@@ -88,6 +93,10 @@ void do1() {
...
@@ -88,6 +93,10 @@ void do1() {
do2
();
do2
();
}
}
void
breakCallback
(
REG
regs
[])
{
LOGE
(
"breakCallback"
);
}
class
Visitor
:
public
InstVisitor
{
class
Visitor
:
public
InstVisitor
{
bool
visit
(
Unit
<
Base
>
*
unit
,
void
*
pc
)
override
{
bool
visit
(
Unit
<
Base
>
*
unit
,
void
*
pc
)
override
{
...
@@ -106,17 +115,32 @@ Java_com_swift_sandhook_nativehook_NativeHook_test(JNIEnv *env, jclass jclass1)
...
@@ -106,17 +115,32 @@ Java_com_swift_sandhook_nativehook_NativeHook_test(JNIEnv *env, jclass jclass1)
reinterpret_cast
<
void
*>
(
do4
),
reinterpret_cast
<
void
*>
(
do4
),
reinterpret_cast
<
void
*>
(
do4replace
)));
reinterpret_cast
<
void
*>
(
do4replace
)));
// dosth4Backup2 = reinterpret_cast<void (*)()>(InlineHook::instance->inlineHook(
// reinterpret_cast<void *>(do4),
// reinterpret_cast<void *>(do4replace2)));
do4
();
do4
();
if
(
sizeof
(
void
*
)
==
8
)
{
if
(
sizeof
(
void
*
)
==
8
)
{
heapPreForkBackup
=
reinterpret_cast
<
void
(
*
)(
void
*
)
>
(
SandInlineHookSym
(
"/system/lib64/libart.so"
,
"_ZN3art2gc4Heap13PreZygoteForkEv"
,
reinterpret_cast
<
void
*>
(
myHeapPreFork
)));
innerSuspendVM
=
reinterpret_cast
<
void
(
*
)()
>
(
SandInlineHookSym
(
"/system/lib64/libart.so"
,
"_ZN3art3Dbg9SuspendVMEv"
,
innerSuspendVM
=
reinterpret_cast
<
void
(
*
)()
>
(
SandInlineHookSym
(
"/system/lib64/libart.so"
,
"_ZN3art3Dbg9SuspendVMEv"
,
reinterpret_cast
<
void
*>
(
SuspendVMReplace
)));
reinterpret_cast
<
void
*>
(
SuspendVMReplace
)));
}
else
{
}
else
{
heapPreForkBackup
=
reinterpret_cast
<
void
(
*
)(
void
*
)
>
(
SandInlineHookSym
(
"/system/lib/libart.so"
,
"_ZN3art2gc4Heap13PreZygoteForkEv"
,
reinterpret_cast
<
void
*>
(
myHeapPreFork
)));
innerSuspendVM
=
reinterpret_cast
<
void
(
*
)()
>
(
SandInlineHookSym
(
"/system/lib/libart.so"
,
"_ZN3art3Dbg9SuspendVMEv"
,
innerSuspendVM
=
reinterpret_cast
<
void
(
*
)()
>
(
SandInlineHookSym
(
"/system/lib/libart.so"
,
"_ZN3art3Dbg9SuspendVMEv"
,
reinterpret_cast
<
void
*>
(
SuspendVMReplace
)));
reinterpret_cast
<
void
*>
(
SuspendVMReplace
)));
}
}
void
*
do3P
=
reinterpret_cast
<
void
*>
(
do3
);
InlineHook
::
instance
->
breakPoint
(
reinterpret_cast
<
void
*>
(
do3
),
breakCallback
);
LOGE
(
"ok"
);
do3
(
100
,
2
);
}
}
...
@@ -131,6 +155,7 @@ extern "C"
...
@@ -131,6 +155,7 @@ extern "C"
EXPORT
void
*
SandInlineHookSym
(
const
char
*
so
,
const
char
*
symb
,
void
*
replace
)
{
EXPORT
void
*
SandInlineHookSym
(
const
char
*
so
,
const
char
*
symb
,
void
*
replace
)
{
ElfImg
elfImg
(
so
);
ElfImg
elfImg
(
so
);
void
*
origin
=
reinterpret_cast
<
void
*>
(
elfImg
.
getSymbAddress
(
symb
));
void
*
origin
=
reinterpret_cast
<
void
*>
(
elfImg
.
getSymbAddress
(
symb
));
if
(
origin
==
nullptr
)
if
(
origin
==
nullptr
)
return
nullptr
;
return
nullptr
;
return
InlineHook
::
instance
->
inlineHook
(
origin
,
replace
);
return
InlineHook
::
instance
->
inlineHook
(
origin
,
replace
);
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment