Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
ca6e273c
Commit
ca6e273c
authored
Sep 02, 2019
by
swift_gan
Committed by
swift_gan
Sep 02, 2019
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
protect sigaction
parent
a62d2036
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
53 additions
and
22 deletions
+53
-22
hook_arm32.cpp
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.cpp
+6
-4
hook_arm32.h
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.h
+1
-1
hook_arm64.cpp
nativehook/src/main/cpp/archs/arm/arm64/hook/hook_arm64.cpp
+5
-4
hook_arm64.h
nativehook/src/main/cpp/archs/arm/arm64/hook/hook_arm64.h
+1
-1
hook.cpp
nativehook/src/main/cpp/hook/hook.cpp
+32
-11
hook.h
nativehook/src/main/cpp/includes/hook.h
+8
-1
No files found.
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.cpp
View file @
ca6e273c
...
...
@@ -5,6 +5,7 @@
#include <log.h>
#include <cstdlib>
#include <cassert>
#include <signal.h>
#include "code_relocate_arm32.h"
#include "hook_arm32.h"
#include "code_buffer.h"
...
...
@@ -224,14 +225,14 @@ bool InlineHookArm32Android::SingleBreakPoint(void *point, BreakCallback callbac
return
true
;
}
void
InlineHookArm32Android
::
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
{
assert
(
num
==
SIGILL
);
bool
InlineHookArm32Android
::
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
{
InstT32
*
code
=
reinterpret_cast
<
InstT32
*>
(
context
->
arm_pc
);
assert
(
IS_OPCODE_T32
(
*
code
,
HVC
));
if
(
!
IS_OPCODE_T32
(
*
code
,
HVC
))
return
false
;
INST_T32
(
HVC
)
hvc
(
code
);
hvc
.
Disassemble
();
if
(
hvc
.
imme
>=
hook_infos
.
size
())
return
;
return
false
;
HookInfo
&
hook_info
=
hook_infos
[
hvc
.
imme
];
if
(
!
hook_info
.
is_break_point
)
{
context
->
arm_pc
=
reinterpret_cast
<
U32
>
(
hook_info
.
replace
);
...
...
@@ -243,4 +244,5 @@ void InlineHookArm32Android::ExceptionHandler(int num, sigcontext *context) {
context
->
arm_pc
+=
4
;
}
}
return
true
;
}
nativehook/src/main/cpp/archs/arm/arm32/hook/hook_arm32.h
View file @
ca6e273c
...
...
@@ -20,7 +20,7 @@ namespace SandHook {
void
*
SingleInstHook
(
void
*
origin
,
void
*
replace
)
override
;
void
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
override
;
bool
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
override
;
private
:
std
::
vector
<
HookInfo
>
hook_infos
;
...
...
nativehook/src/main/cpp/archs/arm/arm64/hook/hook_arm64.cpp
View file @
ca6e273c
...
...
@@ -211,14 +211,14 @@ bool InlineHookArm64Android::SingleBreakPoint(void *point, BreakCallback callbac
return
true
;
}
void
InlineHookArm64Android
::
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
{
assert
(
num
==
SIGILL
);
bool
InlineHookArm64Android
::
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
{
InstA64
*
code
=
reinterpret_cast
<
InstA64
*>
(
context
->
pc
);
assert
(
IS_OPCODE_A64
(
*
code
,
EXCEPTION_GEN
));
if
(
!
IS_OPCODE_A64
(
*
code
,
EXCEPTION_GEN
))
return
false
;
INST_A64
(
EXCEPTION_GEN
)
hvc
(
code
);
hvc
.
Disassemble
();
if
(
hvc
.
imme
>=
hook_infos
.
size
())
return
;
return
false
;
HookInfo
&
hook_info
=
hook_infos
[
hvc
.
imme
];
if
(
!
hook_info
.
is_break_point
)
{
context
->
pc
=
reinterpret_cast
<
U64
>
(
hook_info
.
replace
);
...
...
@@ -230,4 +230,5 @@ void InlineHookArm64Android::ExceptionHandler(int num, sigcontext *context) {
context
->
pc
+=
4
;
}
}
return
true
;
}
nativehook/src/main/cpp/archs/arm/arm64/hook/hook_arm64.h
View file @
ca6e273c
...
...
@@ -19,7 +19,7 @@ namespace SandHook {
void
*
SingleInstHook
(
void
*
origin
,
void
*
replace
)
override
;
void
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
override
;
bool
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
override
;
private
:
std
::
vector
<
HookInfo
>
hook_infos
;
...
...
nativehook/src/main/cpp/hook/hook.cpp
View file @
ca6e273c
...
...
@@ -25,20 +25,41 @@ void InterruptHandler(int signum, siginfo_t* siginfo, void* uc) {
if
(
signum
!=
SIGILL
)
return
;
sigcontext
&
context
=
reinterpret_cast
<
ucontext_t
*>
(
uc
)
->
uc_mcontext
;
InlineHook
::
instance
->
ExceptionHandler
(
signum
,
&
context
);
if
(
!
InlineHook
::
instance
->
ExceptionHandler
(
signum
,
&
context
))
{
if
(
InlineHook
::
instance
->
old_sig_act
.
sa_sigaction
)
{
InlineHook
::
instance
->
old_sig_act
.
sa_sigaction
(
signum
,
siginfo
,
uc
);
}
}
}
bool
InlineHook
::
InitForSingleInstHook
()
{
AutoLock
lock
(
hook_lock
);
if
(
inited
)
return
true
;
struct
sigaction
sig
{};
sigemptyset
(
&
sig
.
sa_mask
);
// Notice: remove this flag if needed.
sig
.
sa_flags
=
SA_SIGINFO
;
sig
.
sa_sigaction
=
InterruptHandler
;
if
(
sigaction
(
SIGILL
,
&
sig
,
nullptr
)
!=
-
1
)
{
inited
=
true
;
bool
do_init
=
false
;
{
AutoLock
lock
(
hook_lock
);
if
(
inited
)
return
true
;
struct
sigaction
sig
{};
sigemptyset
(
&
sig
.
sa_mask
);
// Notice: remove this flag if needed.
sig
.
sa_flags
=
SA_SIGINFO
;
sig
.
sa_sigaction
=
InterruptHandler
;
if
(
sigaction
(
SIGILL
,
&
sig
,
&
old_sig_act
)
!=
-
1
)
{
inited
=
true
;
do_init
=
true
;
}
}
//protect sigaction
if
(
do_init
)
{
int
(
*
replace
)(
int
,
struct
sigaction
*
,
struct
sigaction
*
)
=
[](
int
sig
,
struct
sigaction
*
new_sa
,
struct
sigaction
*
old_sa
)
->
int
{
if
(
sig
!=
SIGILL
)
{
return
InlineHook
::
instance
->
sigaction_backup
(
sig
,
new_sa
,
old_sa
);
}
else
{
*
old_sa
=
InlineHook
::
instance
->
old_sig_act
;
InlineHook
::
instance
->
old_sig_act
=
*
new_sa
;
return
0
;
}
};
sigaction_backup
=
reinterpret_cast
<
SigAct
>
(
SingleInstHook
((
void
*
)
sigaction
,
(
void
*
)
replace
));
}
return
inited
;
}
\ No newline at end of file
nativehook/src/main/cpp/includes/hook.h
View file @
ca6e273c
...
...
@@ -40,7 +40,9 @@ namespace SandHook {
virtual
void
*
SingleInstHook
(
void
*
origin
,
void
*
replace
)
{
return
nullptr
;
};
virtual
void
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
{};
virtual
bool
ExceptionHandler
(
int
num
,
sigcontext
*
context
)
{
return
false
;
};
protected
:
virtual
bool
InitForSingleInstHook
();
...
...
@@ -48,8 +50,13 @@ namespace SandHook {
bool
inited
=
false
;
static
CodeBuffer
*
backup_buffer
;
std
::
mutex
hook_lock
;
private
:
using
SigAct
=
int
(
*
)(
int
,
struct
sigaction
*
,
struct
sigaction
*
);
SigAct
sigaction_backup
=
nullptr
;
public
:
static
InlineHook
*
instance
;
struct
sigaction
old_sig_act
{};
};
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment