Commit 627b057f authored by swift_gan's avatar swift_gan Committed by swift_gan

[NativeHook]almost done break point

parent 1ae52e14
......@@ -86,6 +86,10 @@ void AssemblerA64::Br(XRegister &rn) {
Emit(reinterpret_cast<Unit<Base> *>(new INST_A64(BR_BLR_RET)(INST_A64(BR_BLR_RET)::BR, rn)));
}
void AssemblerA64::Blr(XRegister &rn) {
Emit(reinterpret_cast<Unit<Base> *>(new INST_A64(BR_BLR_RET)(INST_A64(BR_BLR_RET)::BLR, rn)));
}
void AssemblerA64::B(Off offset) {
Emit(reinterpret_cast<Unit<Base> *>(new INST_A64(B_BL)(INST_A64(B_BL)::B, offset)));
}
......@@ -239,6 +243,10 @@ void AssemblerA64::Msr(SystemRegister &sysReg, RegisterA64 &rt) {
Emit(reinterpret_cast<Unit<Base> *>(new INST_A64(MSR_MRS)(INST_A64(MSR_MRS)::MSR, sysReg, rt)));
}
void AssemblerA64::Mov(RegisterA64 &rd, RegisterA64 rt) {
Emit(reinterpret_cast<Unit<Base> *>(new INST_A64(MOV_REG)(rd, rt)));
}
......@@ -38,6 +38,7 @@ namespace SandHook {
void Mov(XRegister& rd, U64 imme);
void Br(XRegister& rn);
void Blr(XRegister& rn);
void B(Off offset);
void B(Label* label);
......@@ -86,6 +87,8 @@ namespace SandHook {
void Msr(SystemRegister &sysReg, RegisterA64& rt);
void Mrs(SystemRegister &sysReg, RegisterA64& rt);
void Mov(RegisterA64& rd, RegisterA64 rt);
public:
CodeContainer codeContainer = CodeContainer(nullptr);
......
......@@ -51,6 +51,86 @@ void *InlineHookArm64Android::inlineHook(void *origin, void *replace) {
return backup;
}
bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[], void* sp)) {
return false;
bool InlineHookArm64Android::breakPoint(void *point, void (*callback)(REG regs[])) {
AutoLock lock(hookLock);
void* backup = nullptr;
AssemblerA64 assemblerBackup(backupBuffer);
AssemblerA64 assemblerTrampoline(backupBuffer);
StaticCodeBuffer inlineBuffer = StaticCodeBuffer(reinterpret_cast<Addr>(point));
AssemblerA64 assemblerInline(&inlineBuffer);
//build backup inst
CodeRelocateA64 relocate = CodeRelocateA64(assemblerBackup);
backup = relocate.relocate(point, 6 * 4, nullptr);
#define __ assemblerBackup.
Label* origin_addr_label = new Label();
__ Ldr(IP1, origin_addr_label);
__ Br(IP1);
__ Emit(origin_addr_label);
__ Emit((Addr) point + 5 * 4);
__ finish();
#undef __
//build shell code
#define __ assemblerTrampoline.
//backup NZCV
__ Sub(SP, Operand(&SP, 0x20));
__ Mrs(NZCV, X0);
__ Str(X0, MemOperand(&SP, 0x10));
__ Str(X30, MemOperand(&SP));
__ Add(X30, Operand(&SP, 0x20));
__ Str(X30, MemOperand(&SP, 0x8));
__ Ldr(X0, MemOperand(&SP, 0x18));
//backup X0 - X29
U8 douRegCount = 30 / 2;
__ Sub(SP, Operand(&SP, 0xf0));
for (int i = 0; i < douRegCount; ++i) {
__ Stp(*XReg(i), *XReg(i + 1), MemOperand(&SP, i * 16));
}
__ Mov(X0, SP);
__ Mov(X3, (Addr) callback);
__ Blr(X3);
__ Ldr(X0, MemOperand(&SP, 0x100));
__ Msr(NZCV, X0);
//restore X0 - X29
for (int i = 0; i < douRegCount; ++i) {
__ Ldp(*XReg(i), *XReg(i + 1), MemOperand(&SP, i * 16));
}
__ Add(SP, Operand(&SP, 0xf0));
__ Ldr(X30, MemOperand(&SP, (Off) 0));
__ Add(SP, Operand(&SP, 0x20));
__ Stp(X1, X0, MemOperand(&SP, -0x10));
//jump to origin
__ Mov(X0, (Addr) backup);
__ Br(X0);
__ finish();
#undef __
void* secondTrampoline = assemblerTrampoline.getStartPC();
//build inline trampoline
#define __ assemblerInline.
Label* target_addr_label = new Label();
__ Stp(X1, X0, MemOperand(&SP, -0x10));
__ Ldr(X0, target_addr_label);
__ Br(X0);
__ Emit(target_addr_label);
__ Emit((Addr) secondTrampoline);
__ Ldr(X0, MemOperand(&SP, -0x8));
__ finish();
#undef __
return true;
}
......@@ -19,7 +19,7 @@ namespace SandHook {
}
void *inlineHook(void *origin, void *replace) override;
bool breakPoint(void *point, void (*callback)(REG[], void*)) override;
bool breakPoint(void *point, void (*callback)(REG[])) override;
protected:
std::mutex* hookLock;
......
......@@ -101,9 +101,9 @@ namespace SandHook {
inline explicit Operand(){};
inline explicit Operand(S64 imm)
: immediate(imm), reg(&UnknowRegiser), shift(NO_SHIFT), extend(NO_EXTEND), shift_extend_imm(0) {}
inline Operand(RegisterA64* reg, Shift shift = LSL, int32_t imm = 0)
inline explicit Operand(RegisterA64* reg, int32_t imm = 0, Shift shift = LSL)
: immediate(0), reg(reg), shift(shift), extend(NO_EXTEND), shift_extend_imm(imm) {}
inline Operand(RegisterA64* reg, Extend extend, int32_t imm = 0)
inline explicit Operand(RegisterA64* reg, Extend extend, int32_t imm = 0)
: immediate(0), reg(reg), shift(NO_SHIFT), extend(extend), shift_extend_imm(imm) {}
// =====
......@@ -547,7 +547,7 @@ namespace SandHook {
DEFINE_IS(STR_IMM)
DEFINE_INST_CODE(MOV_REG)
DEFINE_INST_CODE(STR_IMM)
void decode(STRUCT_A64(STR_IMM) *inst) override;
......
......@@ -21,7 +21,7 @@ namespace SandHook {
public:
//return == backup method
virtual void* inlineHook(void* origin, void* replace) = 0;
virtual bool breakPoint(void* point, void (*callback)(REG[], void *)) {
virtual bool breakPoint(void* point, void (*callback)(REG[])) {
return false;
};
protected:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment