Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
770e1992
Commit
770e1992
authored
Jun 01, 2019
by
swift_gan
Committed by
swift_gan
Jun 01, 2019
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
[NativeHook]done arm32 break point
parent
2217a3b3
Hide whitespace changes
Inline
Side-by-side
Showing
10 changed files
with
138 additions
and
6 deletions
+138
-6
CMakeLists.txt
nativehook/CMakeLists.txt
+1
-0
breakpoint_shellcode.S
.../src/main/cpp/archs/arm/arm32/hook/breakpoint_shellcode.S
+33
-0
hook_arm32.cpp
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.cpp
+54
-1
hook_arm32.h
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.h
+3
-0
arm_base.h
nativehook/src/main/cpp/archs/arm/arm_base.h
+0
-1
shellcode_arm.h
nativehook/src/main/cpp/archs/arm/shellcode_arm.h
+34
-0
hook.cpp
nativehook/src/main/cpp/hook/hook.cpp
+1
-1
assembler.h
nativehook/src/main/cpp/includes/assembler.h
+9
-0
hook.h
nativehook/src/main/cpp/includes/hook.h
+1
-1
sandhook_native.cpp
nativehook/src/main/cpp/sandhook_native.cpp
+2
-2
No files found.
nativehook/CMakeLists.txt
View file @
770e1992
...
...
@@ -29,6 +29,7 @@ elseif (${CMAKE_ANDROID_ARCH_ABI} STREQUAL "armeabi-v7a")
src/main/cpp/archs/arm/arm32/assembler/assembler_arm32.cpp
src/main/cpp/archs/arm/arm32/decoder/decoder_arm32.cpp
src/main/cpp/archs/arm/arm32/hook/hook_arm32.cpp
src/main/cpp/archs/arm/arm32/hook/breakpoint_shellcode.S
src/main/cpp/archs/arm/arm32/relocate/code_relocate_arm32.cpp
)
endif
()
...
...
nativehook/src/main/cpp/archs/arm/arm32/hook/breakpoint_shellcode.S
0 → 100644
View file @
770e1992
#include "shellcode_arm.h"
.global callback_addr_s
.global origin_addr_s
.data
FUNCTION_START(BP_SHELLCODE)
push {r0, r1, r2, r3}
mrs r0, cpsr
str r0, [sp, #0xC]
str r14, [sp, #8]
add r14, sp, #0x10
str r14, [sp, #4]
pop {r0}
push {r0-r12}
mov r0, sp
ldr r3, callback_addr_s
blx r3
ldr r0, [sp, #0x3C]
msr cpsr, r0
ldmfd sp!, {r0-r12}
ldr r14, [sp, #4]
ldr sp, [r13]
ldr pc, origin_addr_s
callback_addr_s:
.long 0
origin_addr_s:
.long 0
FUNCTION_END(BP_SHELLCODE)
.end
\ No newline at end of file
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.cpp
View file @
770e1992
...
...
@@ -6,6 +6,7 @@
#include "hook_arm32.h"
#include "code_buffer.h"
#include "lock.h"
#include "shellcode_arm.h"
using
namespace
SandHook
::
Hook
;
using
namespace
SandHook
::
Decoder
;
...
...
@@ -54,4 +55,56 @@ void *InlineHookArm32Android::inlineHook(void *origin, void *replace) {
//commit inline trampoline
assemblerInline
.
finish
();
return
getThumbPC
(
backup
);
}
\ No newline at end of file
}
IMPORT_SHELLCODE
(
BP_SHELLCODE
)
IMPORT_LABEL
(
callback_addr_s
,
Addr
)
IMPORT_LABEL
(
origin_addr_s
,
Addr
)
bool
InlineHookArm32Android
::
breakPoint
(
void
*
origin
,
void
(
*
callback
)(
REG
*
))
{
AutoLock
lock
(
hookLock
);
void
*
originCode
=
origin
;
if
(
isThumbCode
((
Addr
)
origin
))
{
originCode
=
getThumbCodeAddress
(
origin
);
}
if
(
isThumbCode
((
Addr
)
origin
))
{
callback
=
reinterpret_cast
<
void
(
*
)(
REG
*
)
>
(
getThumbPC
((
void
*
)
callback
));
}
void
*
backup
=
nullptr
;
AssemblerA32
assemblerBackup
(
backupBuffer
);
StaticCodeBuffer
inlineBuffer
=
StaticCodeBuffer
(
reinterpret_cast
<
Addr
>
(
originCode
));
AssemblerA32
assemblerInline
(
&
inlineBuffer
);
CodeContainer
*
codeContainerInline
=
&
assemblerInline
.
codeContainer
;
//build backup method
CodeRelocateA32
relocate
=
CodeRelocateA32
(
assemblerBackup
);
backup
=
relocate
.
relocate
(
origin
,
4
*
2
,
nullptr
);
#define __ assemblerBackup.
Label
*
origin_addr_label
=
new
Label
();
__
Ldr
(
PC
,
origin_addr_label
);
__
Emit
(
origin_addr_label
);
__
Emit
((
Addr
)
getThumbPC
(
reinterpret_cast
<
void
*>
((
Addr
)
originCode
+
relocate
.
curOffset
)));
__
finish
();
#undef __
//build trampoline
origin_addr_s
=
(
Addr
)
getThumbPC
(
backup
);
callback_addr_s
=
(
Addr
)
callback
;
void
*
trampoline
=
backupBuffer
->
copy
((
void
*
)
BP_SHELLCODE
,
SHELLCODE_LEN
(
BP_SHELLCODE
));
//build inline trampoline
#define __ assemblerInline.
Label
*
target_addr_label
=
new
Label
();
__
Ldr
(
PC
,
target_addr_label
);
__
Emit
(
target_addr_label
);
__
Emit
((
Addr
)
trampoline
);
__
finish
();
#undef __
return
true
;
}
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.h
View file @
770e1992
...
...
@@ -19,6 +19,9 @@ namespace SandHook {
delete
hookLock
;
}
void
*
inlineHook
(
void
*
origin
,
void
*
replace
)
override
;
bool
breakPoint
(
void
*
point
,
void
(
*
callback
)(
REG
*
))
override
;
protected
:
std
::
mutex
*
hookLock
;
};
...
...
nativehook/src/main/cpp/archs/arm/arm_base.h
View file @
770e1992
...
...
@@ -69,5 +69,4 @@ enum AddrMode { Offset, PreIndex, PostIndex, NonAddrMode};
#define DECODE_SHIFT operand.shift = Shift(inst->shift)
#define ENCODE_SHIFT get()->shift = operand.shift
#endif //SANDHOOK_ARM_BASE_H
nativehook/src/main/cpp/archs/arm/shellcode_arm.h
0 → 100644
View file @
770e1992
//
// Created by swift on 2019/6/1.
//
#ifndef SANDHOOK_SHELL_CODE_ARM_H
#define SANDHOOK_SHELL_CODE_ARM_H
//for shell code
#define FUNCTION_START(x) \
.align 4; \
.global x; \
.global x##_END; \
x:
#define FUNCTION_START_T(x) \
.syntax unified; \
.align 4; \
.thumb; \
.thumb_func; \
.global x; \
.global x##_END; \
x:
#define FUNCTION_END(x) x##_END: \
.size x, .-x \
#define IMPORT_SHELLCODE(x) extern "C" void x(); \
extern "C" void x##_END();
#define IMPORT_LABEL(X,T) extern T X;
#define SHELLCODE_LEN(x) (Addr)x##_END - (Addr)x
#endif //SANDHOOK_SHELL_CODE_ARM_H
nativehook/src/main/cpp/hook/hook.cpp
View file @
770e1992
...
...
@@ -12,7 +12,7 @@
using
namespace
SandHook
::
Hook
;
Android
CodeBuffer
*
InlineHook
::
backupBuffer
=
new
AndroidCodeBuffer
();
CodeBuffer
*
InlineHook
::
backupBuffer
=
new
AndroidCodeBuffer
();
#if defined(__arm__)
InlineHook
*
InlineHook
::
instance
=
new
InlineHookArm32Android
();
...
...
nativehook/src/main/cpp/includes/assembler.h
View file @
770e1992
...
...
@@ -8,6 +8,7 @@
#include "label.h"
#include "instruction.h"
#include "data.h"
#include "platform.h"
namespace
SandHook
{
...
...
@@ -23,6 +24,14 @@ namespace SandHook {
public
:
virtual
void
*
getBuffer
(
U32
size
)
=
0
;
virtual
void
resetLastBufferSize
(
U32
size
){};
virtual
void
*
copy
(
void
*
start
,
U32
size
)
{
void
*
bufferStart
=
getBuffer
(
size
);
if
(
bufferStart
==
nullptr
)
return
nullptr
;
memcpy
(
bufferStart
,
start
,
size
);
flushCache
((
Addr
)
bufferStart
,
size
);
return
bufferStart
;
};
};
class
CodeContainer
{
...
...
nativehook/src/main/cpp/includes/hook.h
View file @
770e1992
...
...
@@ -25,7 +25,7 @@ namespace SandHook {
return
false
;
};
protected
:
static
Android
CodeBuffer
*
backupBuffer
;
static
CodeBuffer
*
backupBuffer
;
public
:
static
InlineHook
*
instance
;
};
...
...
nativehook/src/main/cpp/sandhook_native.cpp
View file @
770e1992
...
...
@@ -93,8 +93,8 @@ void do1() {
do2
();
}
void
breakCallback
(
REG
*
regs
)
{
LOGE
(
"breakCallback = %d
"
,
regs
[
1
]
);
void
breakCallback
(
REG
regs
[]
)
{
LOGE
(
"breakCallback = %d
SP = %d"
,
regs
[
0
],
regs
);
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment