Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
746e516a
Commit
746e516a
authored
May 11, 2019
by
swift_gan
Committed by
swift_gan
May 11, 2019
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
tweak code
parent
7617452e
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
36 additions
and
18 deletions
+36
-18
inst_arm64.cpp
nativehook/src/main/cpp/archs/arm64/inst/inst_arm64.cpp
+8
-8
assembler.cpp
nativehook/src/main/cpp/assembler/assembler.cpp
+1
-0
base.h
nativehook/src/main/cpp/includes/base.h
+1
-1
sandhook_native.cpp
nativehook/src/main/cpp/sandhook_native.cpp
+26
-9
No files found.
nativehook/src/main/cpp/archs/arm64/inst/inst_arm64.cpp
View file @
746e516a
...
...
@@ -52,13 +52,13 @@ Off A64_ADR_ADRP::getImmPCOffset() {
U32
lo
=
get
()
->
immlo
;
Off
offset
=
signExtend64
(
IMM_LO_W
+
IMM_HI_W
,
COMBINE
(
hi
,
lo
,
IMM_LO_W
));
if
(
isADRP
())
{
offset
*=
P
AGE
_SIZE
;
offset
*=
P_SIZE
;
}
return
offset
;
}
Addr
A64_ADR_ADRP
::
getImmPCOffsetTarget
()
{
void
*
base
=
AlignDown
(
getPC
(),
P
AGE
_SIZE
);
void
*
base
=
AlignDown
(
getPC
(),
P_SIZE
);
return
getImmPCOffset
()
+
reinterpret_cast
<
Addr
>
(
base
);
}
...
...
@@ -132,7 +132,7 @@ Off A64_B_BL::getImmPCOffset() {
void
A64_B_BL
::
onOffsetApply
(
Off
offset
)
{
this
->
offset
=
offset
;
get
()
->
imm26
=
TruncateToUint26
(
offset
);
get
()
->
imm26
=
TruncateToUint26
(
offset
>>
2
);
}
void
A64_B_BL
::
decode
(
STRUCT_A64
(
B_BL
)
*
inst
)
{
...
...
@@ -143,7 +143,7 @@ void A64_B_BL::decode(STRUCT_A64(B_BL) *inst) {
void
A64_B_BL
::
assembler
()
{
SET_OPCODE
(
B_BL
);
get
()
->
op
=
op
;
get
()
->
imm26
=
TruncateToUint26
(
offset
);
get
()
->
imm26
=
TruncateToUint26
(
offset
>>
4
);
}
...
...
@@ -179,7 +179,7 @@ void A64_CBZ_CBNZ::assembler() {
get
()
->
op
=
op
;
get
()
->
rt
=
rt
->
getCode
();
get
()
->
sf
=
rt
->
is64Bit
()
?
1
:
0
;
get
()
->
imm19
=
TruncateToUint19
(
offset
);
get
()
->
imm19
=
TruncateToUint19
(
offset
>>
2
);
}
...
...
@@ -205,7 +205,7 @@ void A64_B_COND::decode(STRUCT_A64(B_COND) *inst) {
void
A64_B_COND
::
assembler
()
{
SET_OPCODE
(
B_COND
);
get
()
->
cond
=
condition
;
get
()
->
imm19
=
TruncateToUint19
(
offset
);
get
()
->
imm19
=
TruncateToUint19
(
offset
>>
2
);
}
...
...
@@ -243,7 +243,7 @@ void A64_TBZ_TBNZ::assembler() {
get
()
->
b5
=
rt
->
is64Bit
()
?
1
:
0
;
get
()
->
rt
=
rt
->
getCode
();
get
()
->
b40
=
static_cast
<
InstA64
>
(
BITS
(
bit
,
sizeof
(
InstA64
)
-
5
,
sizeof
(
InstA64
)));
get
()
->
imm14
=
TruncateToUint14
(
offset
);
get
()
->
imm14
=
TruncateToUint14
(
offset
>>
2
);
}
...
...
@@ -278,7 +278,7 @@ void A64_LDR_LIT::assembler() {
SET_OPCODE
(
LDR_LIT
);
get
()
->
rt
=
rt
->
getCode
();
get
()
->
op
=
op
;
get
()
->
imm19
=
TruncateToUint19
(
offset
);
get
()
->
imm19
=
TruncateToUint19
(
offset
>>
2
);
}
...
...
nativehook/src/main/cpp/assembler/assembler.cpp
View file @
746e516a
...
...
@@ -8,6 +8,7 @@ using namespace SandHook::Assembler;
using
namespace
SandHook
::
Asm
;
void
CodeContainer
::
append
(
Unit
<
Base
>
*
unit
)
{
Label
*
l
=
dynamic_cast
<
Label
*>
(
unit
);
units
.
push_back
(
unit
);
switch
(
unit
->
unitType
())
{
case
UnitLabel
:
...
...
nativehook/src/main/cpp/includes/base.h
View file @
746e516a
...
...
@@ -28,7 +28,7 @@ const int PTR_BYTE = sizeof(void*);
const
int
BITS_OF_BYTE
=
8
;
const
Addr
P
AGE
_SIZE
=
2
<<
PAGE_OFFSET
;
const
Addr
P_SIZE
=
2
<<
PAGE_OFFSET
;
enum
Arch
{
arm32
,
...
...
nativehook/src/main/cpp/sandhook_native.cpp
View file @
746e516a
...
...
@@ -3,12 +3,23 @@
//
#include <jni.h>
#include <sys/mman.h>
#include "sandhook_native.h"
#include "inst_arm64.h"
bool
memUnprotect
(
Addr
addr
,
Addr
len
)
{
long
pagesize
=
4096
;
unsigned
alignment
=
(
unsigned
)((
unsigned
long
long
)
addr
%
pagesize
);
int
i
=
mprotect
((
void
*
)
(
addr
-
alignment
),
(
size_t
)
(
alignment
+
len
),
PROT_READ
|
PROT_WRITE
|
PROT_EXEC
);
if
(
i
==
-
1
)
{
return
false
;
}
return
true
;
}
void
do2
()
{
int
a
=
1
+
1
;
}
void
do1
()
{
...
...
@@ -19,22 +30,28 @@ extern "C"
JNIEXPORT
void
JNICALL
Java_com_swift_sandhook_nativehook_NativeHook_test
(
JNIEnv
*
env
,
jclass
jclass1
)
{
do1
();
U8
s
=
sizeof
(
STRUCT_A64
(
B_BL
));
union
{
InstA64
raw
=
0x36A01005
;
STRUCT_A64
(
TBZ_TBNZ
)
bl
;
}
test
;
if
(
IS_OPCODE
(
test
.
raw
,
TBZ_TBNZ
))
{
InstA64
*
codebl
=
reinterpret_cast
<
InstA64
*>
((
Addr
)
do1
+
8
);
if
(
IS_OPCODE
(
*
codebl
,
B_BL
))
{
//decode
A64_B_BL
a64bl
(
reinterpret_cast
<
STRUCT_A64
(
B_BL
)
*>
(
codebl
));
Off
off
=
a64bl
.
offset
;
void
(
*
dosth2
)()
=
reinterpret_cast
<
void
(
*
)()
>
(
a64bl
.
getImmPCOffsetTarget
());
dosth2
();
STRUCT_A64
(
TBZ_TBNZ
)
bl
=
test
.
bl
;
//asm
memUnprotect
(
reinterpret_cast
<
Addr
>
(
a64bl
.
get
()),
a64bl
.
size
());
a64bl
.
assembler
();
Off
off1
=
a64bl
.
getImmPCOffset
();
A64_TBZ_TBNZ
a64ldr
(
bl
);
do1
(
);
Off
off
=
a64ldr
.
offset
;
}
}
\ No newline at end of file
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment