Commit a2623a31 authored by swift_gan's avatar swift_gan

fix bugs

parent 032ebf96
...@@ -6,6 +6,33 @@ ...@@ -6,6 +6,33 @@
namespace SandHook { namespace SandHook {
class CastDexCacheResolvedMethods : public IMember<art::mirror::ArtMethod, void*> {
protected:
Size calOffset(art::mirror::ArtMethod p) override {
if (SDK_INT >= ANDROID_P)
return getParentSize() + 1;
auto filter = [](int offset, void *ptr) -> bool {
if (isBadReadPtr(ptr, BYTE_POINT))
return false;
Size addr = ADDR(ptr);
if (isBadReadPtr(reinterpret_cast<void *>(addr + offset), BYTE_POINT))
return false;
Size subAddr = ADDR(addr + offset);
return addr == subAddr;
};
int offset = findOffsetWithCB1(&p, getParentSize(), 4, *filter);
}
};
class CastEntryPointFormInterpreter : public IMember<art::mirror::ArtMethod, void*> {
protected:
Size calOffset(art::mirror::ArtMethod p) override {
if (SDK_INT <= ANDROID_M)
return getParentSize() - 3 * BYTE_POINT;
else
return getParentSize() + 1;
}
};
class CastEntryPointQuickCompiled : public IMember<art::mirror::ArtMethod, void*> { class CastEntryPointQuickCompiled : public IMember<art::mirror::ArtMethod, void*> {
protected: protected:
...@@ -20,7 +47,7 @@ namespace SandHook { ...@@ -20,7 +47,7 @@ namespace SandHook {
Size calOffset(art::mirror::ArtMethod p) override { Size calOffset(art::mirror::ArtMethod p) override {
int offset = findOffset(&p, getParentSize(), sizeof(uint32_t), 524313); int offset = findOffset(&p, getParentSize(), sizeof(uint32_t), 524313);
if (offset < 0) if (offset < 0)
throw 0; throw getParentSize() + 1;
else else
return static_cast<size_t>(offset); return static_cast<size_t>(offset);
} }
...@@ -33,6 +60,8 @@ namespace SandHook { ...@@ -33,6 +60,8 @@ namespace SandHook {
public: public:
static Size size; static Size size;
static IMember<art::mirror::ArtMethod, void*>* entryPointQuickCompiled; static IMember<art::mirror::ArtMethod, void*>* entryPointQuickCompiled;
static IMember<art::mirror::ArtMethod, void*>* entryPointFormInterpreter;
static IMember<art::mirror::ArtMethod, void*>* dexCacheResolvedMethods;
static IMember<art::mirror::ArtMethod, uint32_t>* accessFlag; static IMember<art::mirror::ArtMethod, uint32_t>* accessFlag;
static void init(JNIEnv *env) { static void init(JNIEnv *env) {
...@@ -42,20 +71,34 @@ namespace SandHook { ...@@ -42,20 +71,34 @@ namespace SandHook {
Size artMethod2 = (Size) env->GetStaticMethodID(sizeTestClass, "method2", "()V"); Size artMethod2 = (Size) env->GetStaticMethodID(sizeTestClass, "method2", "()V");
size = artMethod2 - artMethod1; size = artMethod2 - artMethod1;
art::mirror::ArtMethod m = *reinterpret_cast<art::mirror::ArtMethod *>(artMethod1); art::mirror::ArtMethod m1 = *reinterpret_cast<art::mirror::ArtMethod *>(artMethod1);
art::mirror::ArtMethod m2 = *reinterpret_cast<art::mirror::ArtMethod *>(artMethod2);
//init Members //init Members
entryPointQuickCompiled = new CastEntryPointQuickCompiled(); entryPointQuickCompiled = new CastEntryPointQuickCompiled();
entryPointQuickCompiled->init(m, size); entryPointQuickCompiled->init(m1, size);
accessFlag = new CastAccessFlag(); accessFlag = new CastAccessFlag();
accessFlag->init(m, size); accessFlag->init(m1, size);
entryPointFormInterpreter = new CastEntryPointFormInterpreter();
entryPointFormInterpreter->init(m1, size);
dexCacheResolvedMethods = new CastDexCacheResolvedMethods();
dexCacheResolvedMethods->init(m1, size);
}
static void copy(art::mirror::ArtMethod* from, art::mirror::ArtMethod* to) {
memcpy(to, from, size);
} }
}; };
Size CastArtMethod::size = 0; Size CastArtMethod::size = 0;
IMember<art::mirror::ArtMethod, void*>* CastArtMethod::entryPointQuickCompiled = nullptr; IMember<art::mirror::ArtMethod, void*>* CastArtMethod::entryPointQuickCompiled = nullptr;
IMember<art::mirror::ArtMethod, void*>* CastArtMethod::entryPointFormInterpreter = nullptr;
IMember<art::mirror::ArtMethod, void*>* CastArtMethod::dexCacheResolvedMethods = nullptr;
IMember<art::mirror::ArtMethod, uint32_t>* CastArtMethod::accessFlag = nullptr; IMember<art::mirror::ArtMethod, uint32_t>* CastArtMethod::accessFlag = nullptr;
} }
......
...@@ -7,11 +7,22 @@ ...@@ -7,11 +7,22 @@
#include "arch.h" #include "arch.h"
#include "utils.h" #include "utils.h"
#define ANDROID_L 21
#define ANDROID_L2 22
#define ANDROID_M 23
#define ANDROID_N 24
#define ANDROID_N2 25
#define ANDROID_O 26
#define ANDROID_O2 27
#define ANDROID_P 28
#ifndef SANDHOOK_ICAST_H #ifndef SANDHOOK_ICAST_H
#define SANDHOOK_ICAST_H #define SANDHOOK_ICAST_H
namespace SandHook { namespace SandHook {
static int SDK_INT = 0;
template <typename T> template <typename T>
class ICast { class ICast {
public: public:
...@@ -43,10 +54,14 @@ namespace SandHook { ...@@ -43,10 +54,14 @@ namespace SandHook {
} }
virtual MType get(PType p) { virtual MType get(PType p) {
return reinterpret_cast<MType>(&p + getOffset()); if (offset > parentSize)
return NULL;
return *reinterpret_cast<MType*>(&p + getOffset());
}; };
virtual void set(PType p, MType t) { virtual void set(PType p, MType t) {
if (offset > parentSize)
return;
memcpy(&p + getOffset(), &t, sizeof(MType)); memcpy(&p + getOffset(), &t, sizeof(MType));
}; };
......
...@@ -11,16 +11,17 @@ namespace SandHook { ...@@ -11,16 +11,17 @@ namespace SandHook {
#define BYTE_POINT sizeof(void*) #define BYTE_POINT sizeof(void*)
#define Size size_t
//32bit //32bit
#if defined(__i386__) || defined(__arm__) #if defined(__i386__) || defined(__arm__)
#define ADDR(addr) read32(addr) #define ADDR(addr) *((uint32_t *) addr)
#define ALIGN_ADDR(x) ((v+4-1) - ((v+4-1)&3)) #define ALIGN_ADDR(x) ((v+4-1) - ((v+4-1)&3))
#define Size uint32_t
//64bit //64bit
#elif defined(__aarch64__) || defined(__x86_64__) #elif defined(__aarch64__) || defined(__x86_64__)
#define ADDR(addr) read64(addr) #define ADDR(addr) *((uint64_t *) addr)
#define ALIGN_ADDR(x) ((v+8-1) - ((v+8-1)&7)) #define ALIGN_ADDR(x) ((v+8-1) - ((v+8-1)&7))
#define Size uint64_t
#else #else
#endif #endif
......
...@@ -6,6 +6,18 @@ ...@@ -6,6 +6,18 @@
#define SANDHOOK_UTILS_H #define SANDHOOK_UTILS_H
#if defined(__MACH__) && defined(__FreeBSD__) && defined(__NetBSD__) && defined(__OpenBSD__)\
&& defined(__DragonFly__)
#define ERROR_SIGNAL SIGBUS
#else
#define ERROR_SIGNAL SIGSEGV
#endif
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <setjmp.h>
#include <unistd.h>
#include <cwchar> #include <cwchar>
template<typename T> template<typename T>
...@@ -24,4 +36,91 @@ int findOffset(void *start, size_t len,size_t step,T value) { ...@@ -24,4 +36,91 @@ int findOffset(void *start, size_t len,size_t step,T value) {
return -1; return -1;
} }
template<typename T>
int findOffsetWithCB1(void *start, size_t len,size_t step, bool func(int, T)) {
if (NULL == start) {
return -1;
}
for (int i = 0; i <= len; i += step) {
T current_value = *reinterpret_cast<T*>((size_t)start + i);
if (func(i, current_value)) {
return i;
}
}
return -1;
}
template<typename T>
int findOffsetWithCB2(void *start1, void *start2, size_t len,size_t step, bool func(T,T)) {
if (NULL == start1 || NULL == start2) {
return -1;
}
for (int i = 0; i <= len; i += step) {
T v1 = *reinterpret_cast<T*>((size_t)start1 + i);
T v2 = *reinterpret_cast<T*>((size_t)start2 + i);
if (func(v1, v2)) {
return i;
}
}
return -1;
}
static sigjmp_buf badreadjmpbuf;
static void badreadfunc(int signo)
{
/*write(STDOUT_FILENO, "catch\n", 6);*/
siglongjmp(badreadjmpbuf, 1);
}
bool isBadReadPtr(void *ptr, int length)
{
struct sigaction sa, osa;
bool ret = false;
/*init new handler struct*/
sa.sa_handler = badreadfunc;
sigemptyset(&sa.sa_mask);
sa.sa_flags = 0;
/*retrieve old and set new handlers*/
if(sigaction(ERROR_SIGNAL, &sa, &osa)<0)
return true;
if(sigsetjmp(badreadjmpbuf, 1) == 0)
{
int i, hi=length/sizeof(int), remain=length%sizeof(int);
int* pi = static_cast<int *>(ptr);
char* pc = (char*)ptr + hi;
for(i=0;i<hi;i++)
{
int tmp = *(pi+i);
}
for(i=0;i<remain;i++)
{
char tmp = *(pc+i);
}
}
else
{
ret = true;
}
/*restore prevouis signal actions*/
if(sigaction(ERROR_SIGNAL, &osa, NULL)<0)
return true;
return ret;
}
#endif //SANDHOOK_UTILS_H #endif //SANDHOOK_UTILS_H
package com.swift.sandhook;
public class SandHook {
public final static boolean init() {
// make sure resolved!
ArtMethodSizeTest.method1();
ArtMethodSizeTest.method2();
return true;
}
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment