Commit 770e1992 authored by swift_gan's avatar swift_gan Committed by swift_gan

[NativeHook]done arm32 break point

parent 2217a3b3
......@@ -29,6 +29,7 @@ elseif (${CMAKE_ANDROID_ARCH_ABI} STREQUAL "armeabi-v7a")
src/main/cpp/archs/arm/arm32/assembler/assembler_arm32.cpp
src/main/cpp/archs/arm/arm32/decoder/decoder_arm32.cpp
src/main/cpp/archs/arm/arm32/hook/hook_arm32.cpp
src/main/cpp/archs/arm/arm32/hook/breakpoint_shellcode.S
src/main/cpp/archs/arm/arm32/relocate/code_relocate_arm32.cpp)
endif()
......
#include "shellcode_arm.h"
.global callback_addr_s
.global origin_addr_s
.data
FUNCTION_START(BP_SHELLCODE)
push {r0, r1, r2, r3}
mrs r0, cpsr
str r0, [sp, #0xC]
str r14, [sp, #8]
add r14, sp, #0x10
str r14, [sp, #4]
pop {r0}
push {r0-r12}
mov r0, sp
ldr r3, callback_addr_s
blx r3
ldr r0, [sp, #0x3C]
msr cpsr, r0
ldmfd sp!, {r0-r12}
ldr r14, [sp, #4]
ldr sp, [r13]
ldr pc, origin_addr_s
callback_addr_s:
.long 0
origin_addr_s:
.long 0
FUNCTION_END(BP_SHELLCODE)
.end
\ No newline at end of file
......@@ -6,6 +6,7 @@
#include "hook_arm32.h"
#include "code_buffer.h"
#include "lock.h"
#include "shellcode_arm.h"
using namespace SandHook::Hook;
using namespace SandHook::Decoder;
......@@ -54,4 +55,56 @@ void *InlineHookArm32Android::inlineHook(void *origin, void *replace) {
//commit inline trampoline
assemblerInline.finish();
return getThumbPC(backup);
}
\ No newline at end of file
}
IMPORT_SHELLCODE(BP_SHELLCODE)
IMPORT_LABEL(callback_addr_s, Addr)
IMPORT_LABEL(origin_addr_s, Addr)
bool InlineHookArm32Android::breakPoint(void *origin, void (*callback)(REG *)) {
AutoLock lock(hookLock);
void* originCode = origin;
if (isThumbCode((Addr)origin)) {
originCode = getThumbCodeAddress(origin);
}
if (isThumbCode((Addr)origin)) {
callback = reinterpret_cast<void (*)(REG *)>(getThumbPC((void*)callback));
}
void* backup = nullptr;
AssemblerA32 assemblerBackup(backupBuffer);
StaticCodeBuffer inlineBuffer = StaticCodeBuffer(reinterpret_cast<Addr>(originCode));
AssemblerA32 assemblerInline(&inlineBuffer);
CodeContainer* codeContainerInline = &assemblerInline.codeContainer;
//build backup method
CodeRelocateA32 relocate = CodeRelocateA32(assemblerBackup);
backup = relocate.relocate(origin, 4 * 2, nullptr);
#define __ assemblerBackup.
Label* origin_addr_label = new Label();
__ Ldr(PC, origin_addr_label);
__ Emit(origin_addr_label);
__ Emit((Addr) getThumbPC(reinterpret_cast<void *>((Addr)originCode + relocate.curOffset)));
__ finish();
#undef __
//build trampoline
origin_addr_s = (Addr) getThumbPC(backup);
callback_addr_s = (Addr) callback;
void* trampoline = backupBuffer->copy((void*)BP_SHELLCODE, SHELLCODE_LEN(BP_SHELLCODE));
//build inline trampoline
#define __ assemblerInline.
Label* target_addr_label = new Label();
__ Ldr(PC, target_addr_label);
__ Emit(target_addr_label);
__ Emit((Addr) trampoline);
__ finish();
#undef __
return true;
}
......@@ -19,6 +19,9 @@ namespace SandHook {
delete hookLock;
}
void *inlineHook(void *origin, void *replace) override;
bool breakPoint(void *point, void (*callback)(REG *)) override;
protected:
std::mutex* hookLock;
};
......
......@@ -69,5 +69,4 @@ enum AddrMode { Offset, PreIndex, PostIndex, NonAddrMode};
#define DECODE_SHIFT operand.shift = Shift(inst->shift)
#define ENCODE_SHIFT get()->shift = operand.shift
#endif //SANDHOOK_ARM_BASE_H
//
// Created by swift on 2019/6/1.
//
#ifndef SANDHOOK_SHELL_CODE_ARM_H
#define SANDHOOK_SHELL_CODE_ARM_H
//for shell code
#define FUNCTION_START(x) \
.align 4; \
.global x; \
.global x##_END; \
x:
#define FUNCTION_START_T(x) \
.syntax unified; \
.align 4; \
.thumb; \
.thumb_func; \
.global x; \
.global x##_END; \
x:
#define FUNCTION_END(x) x##_END: \
.size x, .-x \
#define IMPORT_SHELLCODE(x) extern "C" void x(); \
extern "C" void x##_END();
#define IMPORT_LABEL(X,T) extern T X;
#define SHELLCODE_LEN(x) (Addr)x##_END - (Addr)x
#endif //SANDHOOK_SHELL_CODE_ARM_H
......@@ -12,7 +12,7 @@
using namespace SandHook::Hook;
AndroidCodeBuffer* InlineHook::backupBuffer = new AndroidCodeBuffer();
CodeBuffer* InlineHook::backupBuffer = new AndroidCodeBuffer();
#if defined(__arm__)
InlineHook* InlineHook::instance = new InlineHookArm32Android();
......
......@@ -8,6 +8,7 @@
#include "label.h"
#include "instruction.h"
#include "data.h"
#include "platform.h"
namespace SandHook {
......@@ -23,6 +24,14 @@ namespace SandHook {
public:
virtual void* getBuffer(U32 size) = 0;
virtual void resetLastBufferSize(U32 size){};
virtual void* copy(void* start, U32 size) {
void* bufferStart = getBuffer(size);
if (bufferStart == nullptr)
return nullptr;
memcpy(bufferStart, start, size);
flushCache((Addr)bufferStart, size);
return bufferStart;
};
};
class CodeContainer {
......
......@@ -25,7 +25,7 @@ namespace SandHook {
return false;
};
protected:
static AndroidCodeBuffer* backupBuffer;
static CodeBuffer* backupBuffer;
public:
static InlineHook* instance;
};
......
......@@ -93,8 +93,8 @@ void do1() {
do2();
}
void breakCallback(REG* regs) {
LOGE("breakCallback = %d", regs[1]);
void breakCallback(REG regs[]) {
LOGE("breakCallback = %d SP = %d", regs[0], regs);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment