Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
6ab163a8
Commit
6ab163a8
authored
Jan 21, 2019
by
swift_gan
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
add trampoline manager
parent
d70a536b
Show whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
123 additions
and
19 deletions
+123
-19
build_file_checksums.ser
.idea/caches/build_file_checksums.ser
+0
-0
trampoline.cpp
app/src/main/cpp/trampoline/trampoline.cpp
+9
-11
trampoline.h
app/src/main/cpp/trampoline/trampoline.h
+6
-5
trampoline_manager.cpp
app/src/main/cpp/trampoline/trampoline_manager.cpp
+53
-0
trampoline_manager.h
app/src/main/cpp/trampoline/trampoline_manager.h
+32
-3
lock.h
app/src/main/cpp/utils/lock.h
+23
-0
No files found.
.idea/caches/build_file_checksums.ser
deleted
100644 → 0
View file @
d70a536b
File deleted
app/src/main/cpp/trampoline/trampoline.cpp
View file @
6ab163a8
...
...
@@ -2,8 +2,6 @@
// Created by SwiftGan on 2019/1/17.
//
#include "trampoline.h"
#include "stdlib.h"
#include "map"
namespace
SandHook
{
...
...
@@ -13,7 +11,7 @@ namespace SandHook {
DirectJumpTrampoline
()
:
Trampoline
::
Trampoline
()
{}
void
setJumpTarget
(
Code
target
)
{
codeCopy
(
reinterpret_cast
<
char
*
>
(
&
target
),
OFFSET_JUMP_ADDR_TARGET
,
BYTE_POINT
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
target
),
OFFSET_JUMP_ADDR_TARGET
,
BYTE_POINT
);
}
protected
:
...
...
@@ -22,7 +20,7 @@ namespace SandHook {
}
Code
templateCode
()
override
{
return
reinterpret_cast
<
char
*
>
(
DIRECT_JUMP_TRAMPOLINE
);
return
reinterpret_cast
<
Code
>
(
DIRECT_JUMP_TRAMPOLINE
);
}
};
...
...
@@ -30,11 +28,11 @@ namespace SandHook {
public
:
void
setHookMethod
(
Code
hookMethod
)
{
codeCopy
(
reinterpret_cast
<
char
*
>
(
&
hookMethod
),
OFFSET_REPLACEMENT_ADDR_ART_METHOD
,
BYTE_POINT
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
hookMethod
),
OFFSET_REPLACEMENT_ADDR_ART_METHOD
,
BYTE_POINT
);
}
void
setEntryCodeOffset
(
Size
offSet
)
{
codeCopy
(
reinterpret_cast
<
char
*
>
(
&
offSet
),
OFFSET_REPLACEMENT_OFFSET_ENTRY_CODE
,
BYTE_POINT
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
offSet
),
OFFSET_REPLACEMENT_OFFSET_ENTRY_CODE
,
BYTE_POINT
);
}
protected
:
...
...
@@ -43,7 +41,7 @@ namespace SandHook {
}
Code
templateCode
()
override
{
return
reinterpret_cast
<
char
*
>
(
REPLACEMENT_HOOK_TRAMPOLINE
);
return
reinterpret_cast
<
Code
>
(
REPLACEMENT_HOOK_TRAMPOLINE
);
}
};
...
...
@@ -51,15 +49,15 @@ namespace SandHook {
public
:
void
setOriginMethod
(
Code
originMethod
)
{
codeCopy
(
reinterpret_cast
<
char
*
>
(
&
originMethod
),
OFFSET_INLINE_ADDR_ORIGIN_METHOD
,
BYTE_POINT
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
originMethod
),
OFFSET_INLINE_ADDR_ORIGIN_METHOD
,
BYTE_POINT
);
}
void
setHookMethod
(
Code
hookMethod
)
{
codeCopy
(
reinterpret_cast
<
char
*
>
(
&
hookMethod
),
OFFSET_INLINE_ADDR_HOOK_METHOD
,
BYTE_POINT
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
hookMethod
),
OFFSET_INLINE_ADDR_HOOK_METHOD
,
BYTE_POINT
);
}
void
setEntryCodeOffset
(
Size
offSet
)
{
codeCopy
(
reinterpret_cast
<
char
*
>
(
&
offSet
),
OFFSET_INLINE_OFFSET_ENTRY_CODE
,
BYTE_POINT
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
offSet
),
OFFSET_INLINE_OFFSET_ENTRY_CODE
,
BYTE_POINT
);
}
void
setOriginCode
(
Code
originCode
)
{
...
...
@@ -72,7 +70,7 @@ namespace SandHook {
}
Code
templateCode
()
override
{
return
reinterpret_cast
<
char
*
>
(
REPLACEMENT_HOOK_TRAMPOLINE
);
return
reinterpret_cast
<
Code
>
(
REPLACEMENT_HOOK_TRAMPOLINE
);
}
};
...
...
app/src/main/cpp/trampoline/trampoline.h
View file @
6ab163a8
...
...
@@ -9,8 +9,9 @@
#include <string.h>
#include "../includes/arch.h"
#include "./arch/base.h"
#include "stdlib.h"
#define Code
char
*
#define Code
unsigned char
*
#if defined(__i386__)
#define SIZE_REPLACEMENT_HOOK_TRAMPOLINE 4 * 9
...
...
@@ -67,9 +68,9 @@
#else
#endif
extern
void
DIRECT_JUMP_TRAMPOLINE
();
extern
void
INLINE_HOOK_TRAMPOLINE
();
extern
void
REPLACEMENT_HOOK_TRAMPOLINE
();
extern
"C"
void
DIRECT_JUMP_TRAMPOLINE
();
extern
"C"
void
INLINE_HOOK_TRAMPOLINE
();
extern
"C"
void
REPLACEMENT_HOOK_TRAMPOLINE
();
namespace
SandHook
{
...
...
@@ -82,7 +83,7 @@ namespace SandHook {
codeLen
=
codeLength
();
tempCode
=
templateCode
();
}
const
void
setExcuteSpace
(
Code
start
)
{
const
void
setEx
e
cuteSpace
(
Code
start
)
{
code
=
start
;
memcpy
(
code
,
tempCode
,
codeLen
);
}
...
...
app/src/main/cpp/trampoline/trampoline_manager.cpp
View file @
6ab163a8
...
...
@@ -3,4 +3,57 @@
//
#include "trampoline_manager.h"
namespace
SandHook
{
void
TrampolineManager
::
init
()
{
}
Code
TrampolineManager
::
allocExecuteSpace
(
Size
size
)
{
if
(
size
>
MMAP_PAGE_SIZE
)
return
0
;
AutoLock
autoLock
(
allocSpaceLock
);
void
*
mmapRes
;
Code
exeSpace
=
0
;
if
(
executeSpaceList
.
size
()
==
0
)
{
goto
label_alloc_new_space
;
}
else
if
(
executePageOffset
+
size
>
MMAP_PAGE_SIZE
)
{
goto
label_alloc_new_space
;
}
else
{
exeSpace
=
executeSpaceList
.
back
();
Code
retSpace
=
exeSpace
+
executePageOffset
;
executePageOffset
+=
size
;
return
retSpace
;
}
label_alloc_new_space
:
mmapRes
=
mmap
(
NULL
,
MMAP_PAGE_SIZE
,
PROT_READ
|
PROT_WRITE
|
PROT_EXEC
,
MAP_ANON
|
MAP_PRIVATE
,
-
1
,
0
);
if
(
mmapRes
==
MAP_FAILED
)
{
return
0
;
}
exeSpace
=
static_cast
<
Code
>
(
mmapRes
);
executeSpaceList
.
push_back
(
exeSpace
);
executePageOffset
=
size
;
return
exeSpace
;
}
HookTrampoline
*
TrampolineManager
::
installReplacementTrampoline
(
void
*
originMethod
,
void
*
hookMethod
,
void
*
backupMethod
)
{
if
(
trampolines
.
count
(
originMethod
)
!=
0
)
return
getHookTrampoline
(
originMethod
);
HookTrampoline
*
hookTrampoline
=
new
HookTrampoline
();
}
HookTrampoline
*
TrampolineManager
::
installInlineTrampoline
(
void
*
originMethod
,
void
*
hookMethod
,
void
*
backupMethod
)
{
if
(
trampolines
.
count
(
originMethod
)
!=
0
)
return
getHookTrampoline
(
originMethod
);
HookTrampoline
*
hookTrampoline
=
new
HookTrampoline
();
DirectJumpTrampoline
*
directJumpTrampoline
=
new
DirectJumpTrampoline
();
}
}
app/src/main/cpp/trampoline/trampoline_manager.h
View file @
6ab163a8
...
...
@@ -8,16 +8,45 @@
#include "map"
#include "list"
#include "trampoline.cpp"
#include "../utils/lock.h"
#include <sys/mman.h>
namespace
SandHook
{
#define MMAP_PAGE_SIZE 4 * 1024
class
HookTrampoline
{
public
:
HookTrampoline
()
=
default
;
Trampoline
*
replacement
;
Trampoline
*
inlineJump
;
Trampoline
*
inlineSecondory
;
Trampoline
*
callOrigin
;
};
class
TrampolineManager
{
public
:
TrampolineManager
()
{
trampolines
=
{};
TrampolineManager
()
=
default
;
void
init
();
Code
allocExecuteSpace
(
Size
size
);
HookTrampoline
*
installReplacementTrampoline
(
void
*
originMethod
,
void
*
hookMethod
,
void
*
backupMethod
);
HookTrampoline
*
installInlineTrampoline
(
void
*
originMethod
,
void
*
hookMethod
,
void
*
backupMethod
);
HookTrampoline
*
getHookTrampoline
(
void
*
method
)
{
return
trampolines
[
method
];
}
private
:
std
::
map
<
void
*
,
Trampoline
*>
trampolines
;
std
::
map
<
void
*
,
HookTrampoline
*>
trampolines
=
{};
std
::
list
<
Code
>
executeSpaceList
=
std
::
list
<
Code
>
();
std
::
mutex
allocSpaceLock
;
std
::
mutex
installLock
;
Size
executePageOffset
=
0
;
};
}
...
...
app/src/main/cpp/utils/lock.h
0 → 100644
View file @
6ab163a8
//
// Created by SwiftGan on 2019/1/21.
//
#ifndef SANDHOOK_LOCK_H
#define SANDHOOK_LOCK_H
#include "mutex"
namespace
SandHook
{
class
AutoLock
{
public
:
inline
AutoLock
(
std
::
mutex
&
mutex
)
:
mLock
(
mutex
)
{
mLock
.
lock
();
}
inline
AutoLock
(
std
::
mutex
*
mutex
)
:
mLock
(
*
mutex
)
{
mLock
.
lock
();
}
inline
~
AutoLock
()
{
mLock
.
unlock
();
}
private
:
std
::
mutex
&
mLock
;
};
}
#endif //SANDHOOK_LOCK_H
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment