Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
5f2a6f2a
Commit
5f2a6f2a
authored
May 24, 2019
by
swift_gan
Committed by
swift_gan
May 24, 2019
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
[NativeHook]almost done native hook
parent
2e3b55f1
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
25 additions
and
23 deletions
+25
-23
elf_util.h
hooklib/src/main/cpp/includes/elf_util.h
+1
-1
elf_util.cpp
hooklib/src/main/cpp/utils/elf_util.cpp
+7
-7
inst_arm64.cpp
nativehook/src/main/cpp/archs/arm/arm64/inst/inst_arm64.cpp
+1
-1
elf.cpp
nativehook/src/main/cpp/elf/elf.cpp
+8
-8
elf.h
nativehook/src/main/cpp/includes/elf.h
+1
-1
sandhook_native.cpp
nativehook/src/main/cpp/sandhook_native.cpp
+7
-5
No files found.
hooklib/src/main/cpp/includes/elf_util.h
View file @
5f2a6f2a
...
...
@@ -45,7 +45,7 @@ namespace SandHook {
private
:
const
char
*
elf
=
nullptr
;
uint8_t
*
base
=
nullptr
;
void
*
base
=
nullptr
;
char
*
buffer
=
nullptr
;
off_t
size
=
0
;
off_t
bias
=
-
4396
;
...
...
hooklib/src/main/cpp/utils/elf_util.cpp
View file @
5f2a6f2a
...
...
@@ -31,10 +31,10 @@ ElfImg::ElfImg(const char *elf) {
Elf_Off
symtab_entsize
=
0
;
section_header
=
reinterpret_cast
<
Elf_Shdr
*>
(((
uint8_t
*
)
header
)
+
header
->
e_shoff
);
section_header
=
reinterpret_cast
<
Elf_Shdr
*>
(((
size_t
)
header
)
+
header
->
e_shoff
);
uint8_t
*
shoff
=
reinterpret_cast
<
uint8_t
*
>
(
section_header
);
char
*
section_str
=
reinterpret_cast
<
char
*>
(
section_header
[
header
->
e_shstrndx
].
sh_offset
+
((
uint8_t
*
)
header
));
size_t
shoff
=
reinterpret_cast
<
size_t
>
(
section_header
);
char
*
section_str
=
reinterpret_cast
<
char
*>
(
section_header
[
header
->
e_shstrndx
].
sh_offset
+
((
size_t
)
header
));
bool
has_strtab
=
false
;
bool
has_dynsym
=
false
;
...
...
@@ -75,10 +75,10 @@ ElfImg::ElfImg(const char *elf) {
LOGW
(
"can't find symtab from sections
\n
"
);
}
sym_start
=
reinterpret_cast
<
Elf_Sym
*>
(((
uint8_t
*
)
header
)
+
symtab_offset
);
sym_start
=
reinterpret_cast
<
Elf_Sym
*>
(((
size_t
)
header
)
+
symtab_offset
);
//load module base
base
=
reinterpret_cast
<
uint8_t
*>
(
getModuleBase
(
elf
)
);
base
=
getModuleBase
(
elf
);
}
ElfImg
::~
ElfImg
()
{
...
...
@@ -97,7 +97,7 @@ Elf_Addr ElfImg::getSymbOffset(const char *name) {
Elf_Addr
_offset
=
0
;
for
(
int
i
=
0
;
i
<
symtab_count
;
i
++
)
{
unsigned
int
st_type
=
ELF_ST_TYPE
(
sym_start
[
i
].
st_info
);
char
*
st_name
=
reinterpret_cast
<
char
*>
(((
uint8_t
*
)
header
)
+
symstr_offset
+
sym_start
[
i
].
st_name
);
char
*
st_name
=
reinterpret_cast
<
char
*>
(((
size_t
)
header
)
+
symstr_offset
+
sym_start
[
i
].
st_name
);
if
(
st_type
==
STT_FUNC
&&
sym_start
[
i
].
st_size
)
{
if
(
strcmp
(
st_name
,
name
)
==
0
)
{
_offset
=
sym_start
[
i
].
st_value
;
...
...
@@ -112,7 +112,7 @@ Elf_Addr ElfImg::getSymbOffset(const char *name) {
Elf_Addr
ElfImg
::
getSymbAddress
(
const
char
*
name
)
{
Elf_Addr
offset
=
getSymbOffset
(
name
);
if
(
offset
>
0
&&
base
!=
nullptr
)
{
return
reinterpret_cast
<
Elf_Addr
>
(
base
+
offset
-
bias
);
return
static_cast
<
Elf_Addr
>
((
size_t
)
base
+
offset
-
bias
);
}
else
{
return
0
;
}
...
...
nativehook/src/main/cpp/archs/arm/arm64/inst/inst_arm64.cpp
View file @
5f2a6f2a
...
...
@@ -467,7 +467,7 @@ void A64_STR_UIMM::decode(STRUCT_A64(STR_UIMM) *inst) {
}
void
A64_STR_UIMM
::
assembler
()
{
SET_OPCODE
(
STR_IMM
);
SET_OPCODE
(
STR_
U
IMM
);
ENCODE_RT
;
get
()
->
rn
=
operand
.
base
->
getCode
();
if
(
rt
->
isX
())
{
...
...
nativehook/src/main/cpp/elf/elf.cpp
View file @
5f2a6f2a
...
...
@@ -34,10 +34,10 @@ ElfImg::ElfImg(const char *elf) {
Elf_Off
symtab_entsize
=
0
;
section_header
=
reinterpret_cast
<
Elf_Shdr
*>
(((
uint8_t
*
)
header
)
+
header
->
e_shoff
);
section_header
=
reinterpret_cast
<
Elf_Shdr
*>
(((
size_t
)
header
)
+
header
->
e_shoff
);
uint8_t
*
shoff
=
reinterpret_cast
<
uint8_t
*
>
(
section_header
);
char
*
section_str
=
reinterpret_cast
<
char
*>
(
section_header
[
header
->
e_shstrndx
].
sh_offset
+
((
uint8_t
*
)
header
));
size_t
shoff
=
reinterpret_cast
<
size_t
>
(
section_header
);
char
*
section_str
=
reinterpret_cast
<
char
*>
(
section_header
[
header
->
e_shstrndx
].
sh_offset
+
((
size_t
)
header
));
bool
has_strtab
=
false
;
bool
has_dynsym
=
false
;
...
...
@@ -78,10 +78,10 @@ ElfImg::ElfImg(const char *elf) {
LOGW
(
"can't find symtab from sections
\n
"
);
}
sym_start
=
reinterpret_cast
<
Elf_Sym
*>
(((
uint8_t
*
)
header
)
+
symtab_offset
);
sym_start
=
reinterpret_cast
<
Elf_Sym
*>
(((
size_t
)
header
)
+
symtab_offset
);
//load module base
base
=
reinterpret_cast
<
uint8_t
*>
(
getModuleBase
(
elf
)
);
base
=
getModuleBase
(
elf
);
}
ElfImg
::~
ElfImg
()
{
...
...
@@ -100,7 +100,7 @@ Elf_Addr ElfImg::getSymbOffset(const char *name) {
Elf_Addr
_offset
=
0
;
for
(
int
i
=
0
;
i
<
symtab_count
;
i
++
)
{
unsigned
int
st_type
=
ELF_ST_TYPE
(
sym_start
[
i
].
st_info
);
char
*
st_name
=
reinterpret_cast
<
char
*>
(((
uint8_t
*
)
header
)
+
symstr_offset
+
sym_start
[
i
].
st_name
);
char
*
st_name
=
reinterpret_cast
<
char
*>
(((
size_t
)
header
)
+
symstr_offset
+
sym_start
[
i
].
st_name
);
if
(
st_type
==
STT_FUNC
&&
sym_start
[
i
].
st_size
)
{
if
(
strcmp
(
st_name
,
name
)
==
0
)
{
_offset
=
sym_start
[
i
].
st_value
;
...
...
@@ -115,7 +115,7 @@ Elf_Addr ElfImg::getSymbOffset(const char *name) {
Elf_Addr
ElfImg
::
getSymbAddress
(
const
char
*
name
)
{
Elf_Addr
offset
=
getSymbOffset
(
name
);
if
(
offset
>
0
&&
base
!=
nullptr
)
{
return
reinterpret_cast
<
Elf_Addr
>
(
base
+
offset
-
bias
);
return
static_cast
<
Elf_Addr
>
((
size_t
)
base
+
offset
-
bias
);
}
else
{
return
0
;
}
...
...
@@ -130,7 +130,7 @@ void *ElfImg::getModuleBase(const char *name) {
while
(
fgets
(
buff
,
sizeof
(
buff
),
maps
))
{
if
((
strstr
(
buff
,
"r-xp"
)
||
strstr
(
buff
,
"r--p"
))
&&
strstr
(
buff
,
name
))
{
found
=
1
;
LOGD
(
"dlopen"
,
"%s
\n
"
,
buff
);
__android_log_print
(
ANDROID_LOG_DEBUG
,
"dlopen"
,
"%s
\n
"
,
buff
);
break
;
}
}
...
...
nativehook/src/main/cpp/includes/elf.h
View file @
5f2a6f2a
...
...
@@ -47,7 +47,7 @@ namespace SandHook {
private
:
const
char
*
elf
=
nullptr
;
U8
*
base
=
nullptr
;
void
*
base
=
nullptr
;
char
*
buffer
=
nullptr
;
off_t
size
=
0
;
off_t
bias
=
-
4396
;
...
...
nativehook/src/main/cpp/sandhook_native.cpp
View file @
5f2a6f2a
...
...
@@ -50,6 +50,10 @@ void do5() {
}
void
do4
()
{
if
(
m3
>
m2
)
{
return
;
}
do5
();
int
a
=
1
+
1
;
int
b
=
a
+
1
;
int
d
=
a
+
1
;
...
...
@@ -98,18 +102,16 @@ JNIEXPORT void JNICALL
Java_com_swift_sandhook_nativehook_NativeHook_test
(
JNIEnv
*
env
,
jclass
jclass1
)
{
void
*
do5addr
=
reinterpret_cast
<
void
*>
(
do5
);
void
*
do4addr
=
reinterpret_cast
<
void
*>
(
do4
);
dosth4Backup
=
reinterpret_cast
<
void
(
*
)()
>
(
InlineHook
::
instance
->
inlineHook
(
reinterpret_cast
<
void
*>
(
do4
),
reinterpret_cast
<
void
*>
(
do4replace
)));
do4
();
//innerSuspendVM = reinterpret_cast<void (*)()>(SandInlineHookSym("/system/lib
/libart.so", "_ZN3art3Dbg9SuspendVMEv",
//
reinterpret_cast<void *>(SuspendVMReplace)));
innerSuspendVM
=
reinterpret_cast
<
void
(
*
)()
>
(
SandInlineHookSym
(
"/system/lib64
/libart.so"
,
"_ZN3art3Dbg9SuspendVMEv"
,
reinterpret_cast
<
void
*>
(
SuspendVMReplace
)));
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment