Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
415861dd
Commit
415861dd
authored
Jun 05, 2019
by
swift_gan
Committed by
swift_gan
Jun 05, 2019
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
[NativeHook]try support arm32 replace
parent
5a5f9c34
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
57 additions
and
19 deletions
+57
-19
hook_arm32.cpp
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.cpp
+30
-18
inst_arm64.h
nativehook/src/main/cpp/archs/arm/arm64/inst/inst_arm64.h
+2
-0
decoder.cpp
nativehook/src/main/cpp/decoder/decoder.cpp
+8
-0
decoder.h
nativehook/src/main/cpp/includes/decoder.h
+17
-1
No files found.
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.cpp
View file @
415861dd
...
...
@@ -2,6 +2,7 @@
// Created by swift on 2019/5/23.
//
#include <log.h>
#include "code_relocate_arm32.h"
#include "hook_arm32.h"
#include "code_buffer.h"
...
...
@@ -19,13 +20,12 @@ using namespace SandHook::RegistersA32;
void
*
InlineHookArm32Android
::
inlineHook
(
void
*
origin
,
void
*
replace
)
{
AutoLock
lock
(
hookLock
);
void
*
originCode
=
origin
;
void
*
originCode
;
if
(
isThumbCode
((
Addr
)
origin
))
{
originCode
=
getThumbCodeAddress
(
origin
);
}
if
(
isThumbCode
((
Addr
)
origin
))
{
replace
=
getThumbPC
(
replace
);
}
else
{
LOGE
(
"hook %d error!, only support thumb2 now!"
,
origin
);
return
nullptr
;
}
void
*
backup
=
nullptr
;
...
...
@@ -37,10 +37,16 @@ void *InlineHookArm32Android::inlineHook(void *origin, void *replace) {
//build inline trampoline
#define __ assemblerInline.
Label
*
target_addr_label
=
new
Label
();
__
Ldr
(
PC
,
target_addr_label
);
__
Emit
(
target_addr_label
);
__
Emit
((
Addr
)
replace
);
if
(
isThumbCode
((
Addr
)
replace
))
{
Label
*
target_addr_label
=
new
Label
();
__
Ldr
(
PC
,
target_addr_label
);
__
Emit
(
target_addr_label
);
__
Emit
((
Addr
)
replace
);
}
else
{
//to arm mode
__
Mov
(
IP
,
(
Addr
)
replace
);
__
Bx
(
IP
);
}
#undef __
//build backup method
...
...
@@ -64,14 +70,15 @@ IMPORT_LABEL(origin_addr_s, Addr)
bool
InlineHookArm32Android
::
breakPoint
(
void
*
origin
,
void
(
*
callback
)(
REG
*
))
{
AutoLock
lock
(
hookLock
);
void
*
originCode
=
origin
;
void
*
originCode
;
if
(
isThumbCode
((
Addr
)
origin
))
{
originCode
=
getThumbCodeAddress
(
origin
);
}
else
{
LOGE
(
"hook %d error!, only support thumb2 now!"
,
origin
);
return
false
;
}
if
(
isThumbCode
((
Addr
)
origin
))
{
callback
=
reinterpret_cast
<
void
(
*
)(
REG
*
)
>
(
getThumbPC
((
void
*
)
callback
));
}
bool
callbackThumb
=
isThumbCode
((
Addr
)
callback
);
void
*
backup
=
nullptr
;
AssemblerA32
assemblerBackup
(
backupBuffer
);
...
...
@@ -81,7 +88,7 @@ bool InlineHookArm32Android::breakPoint(void *origin, void (*callback)(REG *)) {
//build backup method
CodeRelocateA32
relocate
=
CodeRelocateA32
(
assemblerBackup
);
backup
=
relocate
.
relocate
(
origin
,
4
*
2
,
nullptr
);
backup
=
relocate
.
relocate
(
origin
,
callbackThumb
?
(
4
*
2
)
:
(
4
*
2
+
2
)
,
nullptr
);
#define __ assemblerBackup.
__
Mov
(
IP
,(
Addr
)
getThumbPC
(
reinterpret_cast
<
void
*>
((
Addr
)
originCode
+
relocate
.
curOffset
)));
__
Bx
(
IP
);
...
...
@@ -95,10 +102,15 @@ bool InlineHookArm32Android::breakPoint(void *origin, void (*callback)(REG *)) {
//build inline trampoline
#define __ assemblerInline.
Label
*
target_addr_label
=
new
Label
();
__
Ldr
(
PC
,
target_addr_label
);
__
Emit
(
target_addr_label
);
__
Emit
((
Addr
)
trampoline
);
if
(
callbackThumb
)
{
Label
*
target_addr_label
=
new
Label
();
__
Ldr
(
PC
,
target_addr_label
);
__
Emit
(
target_addr_label
);
__
Emit
((
Addr
)
trampoline
);
}
else
{
__
Mov
(
IP
,
(
Addr
)
trampoline
);
__
Bx
(
IP
);
}
__
finish
();
#undef __
...
...
nativehook/src/main/cpp/archs/arm/arm64/inst/inst_arm64.h
View file @
415861dd
...
...
@@ -38,6 +38,8 @@ return ENUM_VALUE(InstCodeA64, InstCodeA64::X); \
#define DEFINE_INST(X) class INST_A64(X) : public InstructionA64<STRUCT_A64(X)>
#define CAST_A64(X,V) reinterpret_cast<SandHook::AsmA64::INST_A64(X) *>(V)
using
namespace
SandHook
::
RegistersA64
;
using
namespace
SandHook
::
Asm
;
...
...
nativehook/src/main/cpp/decoder/decoder.cpp
View file @
415861dd
...
...
@@ -11,6 +11,14 @@
using
namespace
SandHook
::
Decoder
;
bool
DefaultVisitor
::
visit
(
Unit
<
Base
>
*
unit
,
void
*
pc
)
{
bool
res
=
visitor
(
unit
,
pc
);
delete
unit
;
return
res
;
}
DefaultVisitor
::
DefaultVisitor
(
bool
(
*
visitor
)(
Unit
<
Base
>
*
,
void
*
))
:
visitor
(
visitor
)
{}
//do not support now
InstDecoder
*
Disassembler
::
get
(
Arch
arch
)
{
switch
(
arch
)
{
...
...
nativehook/src/main/cpp/includes/decoder.h
View file @
415861dd
...
...
@@ -16,12 +16,28 @@ namespace SandHook {
class
InstVisitor
{
public
:
//need free unit
virtual
bool
visit
(
Unit
<
Base
>*
unit
,
void
*
pc
)
=
0
;
virtual
bool
visit
(
Unit
<
Base
>*
unit
,
void
*
pc
)
{
delete
unit
;
return
false
;
};
};
class
DefaultVisitor
:
public
InstVisitor
{
public
:
DefaultVisitor
(
bool
(
*
visitor
)(
Unit
<
Base
>
*
,
void
*
));
bool
visit
(
Unit
<
Base
>
*
unit
,
void
*
pc
)
override
;
private
:
bool
(
*
visitor
)(
Unit
<
Base
>*
,
void
*
);
};
class
InstDecoder
{
public
:
virtual
void
decode
(
void
*
codeStart
,
Addr
codeLen
,
InstVisitor
&
visitor
,
bool
onlyPcRelInst
=
false
)
=
0
;
inline
void
decode
(
void
*
codeStart
,
Addr
codeLen
,
bool
(
*
visitor
)(
Unit
<
Base
>*
,
void
*
),
bool
onlyPcRelInst
=
false
)
{
InstVisitor
vis
=
DefaultVisitor
(
visitor
);
decode
(
codeStart
,
codeLen
,
vis
,
onlyPcRelInst
);
};
};
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment