Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
e46299fd
Commit
e46299fd
authored
May 14, 2019
by
swift_gan
Committed by
swift_gan
May 14, 2019
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
almost done
parent
ea147c93
Hide whitespace changes
Inline
Side-by-side
Showing
17 changed files
with
213 additions
and
21 deletions
+213
-21
CMakeLists.txt
nativehook/CMakeLists.txt
+1
-0
assembler_a64.cpp
...hook/src/main/cpp/archs/arm64/assembler/assembler_a64.cpp
+13
-0
assembler_a64.h
...vehook/src/main/cpp/archs/arm64/assembler/assembler_a64.h
+5
-3
decoder_arm64.cpp
...vehook/src/main/cpp/archs/arm64/decoder/decoder_arm64.cpp
+4
-0
inst_arm64.cpp
nativehook/src/main/cpp/archs/arm64/inst/inst_arm64.cpp
+12
-4
inst_arm64.h
nativehook/src/main/cpp/archs/arm64/inst/inst_arm64.h
+8
-4
code_relocate_a64.cpp
...k/src/main/cpp/archs/arm64/relocate/code_relocate_a64.cpp
+20
-4
code_relocate_a64.h
...ook/src/main/cpp/archs/arm64/relocate/code_relocate_a64.h
+4
-2
assembler.cpp
nativehook/src/main/cpp/assembler/assembler.cpp
+11
-0
code_buffer.cpp
nativehook/src/main/cpp/buffer/code_buffer.cpp
+1
-2
code_buffer.h
nativehook/src/main/cpp/buffer/code_buffer.h
+3
-0
hook.cpp
nativehook/src/main/cpp/hook/hook.cpp
+54
-0
assembler.h
nativehook/src/main/cpp/includes/assembler.h
+4
-0
base.h
nativehook/src/main/cpp/includes/base.h
+7
-0
code_relocate.h
nativehook/src/main/cpp/includes/code_relocate.h
+2
-2
hook.h
nativehook/src/main/cpp/includes/hook.h
+36
-0
sandhook_native.cpp
nativehook/src/main/cpp/sandhook_native.cpp
+28
-0
No files found.
nativehook/CMakeLists.txt
View file @
e46299fd
...
...
@@ -32,6 +32,7 @@ add_library( # Sets the name of the library.
src/main/cpp/assembler/assembler.cpp
src/main/cpp/buffer/code_buffer.cpp
src/main/cpp/utils/platform.cpp
src/main/cpp/hook/hook.cpp
)
...
...
nativehook/src/main/cpp/archs/arm64/assembler/assembler_a64.cpp
View file @
e46299fd
...
...
@@ -27,6 +27,15 @@ void *AssemblerA64::finish() {
return
reinterpret_cast
<
void
*>
(
codeContainer
.
startPc
);
}
void
AssemblerA64
::
Emit
(
U64
data64
)
{
Emit
(
reinterpret_cast
<
Unit
<
Base
>*>
(
new
Data64
(
data64
)));
}
void
AssemblerA64
::
Emit
(
U32
data32
)
{
Emit
(
reinterpret_cast
<
Unit
<
Base
>*>
(
new
Data32
(
data32
)));
}
void
AssemblerA64
::
Emit
(
Unit
<
Base
>
*
unit
)
{
codeContainer
.
append
(
unit
);
}
...
...
@@ -151,6 +160,10 @@ void AssemblerA64::Ldr(RegisterA64 &rt, const MemOperand &memOperand) {
}
}
void
AssemblerA64
::
Ldr
(
RegisterA64
&
rt
,
Label
&
label
)
{
Emit
(
reinterpret_cast
<
Unit
<
Base
>
*>
(
new
INST_A64
(
LDR_LIT
)(
rt
.
isX
()
?
INST_A64
(
LDR_LIT
)
::
LDR_X
:
INST_A64
(
LDR_LIT
)
::
LDR_W
,
rt
,
label
)));
}
void
AssemblerA64
::
Ldrsw
(
XRegister
&
rt
,
const
MemOperand
&
memOperand
)
{
if
(
memOperand
.
addr_mode
==
Offset
)
{
Emit
(
reinterpret_cast
<
Unit
<
Base
>
*>
(
new
INST_A64
(
LDRSW_UIMM
)(
rt
,
memOperand
)));
...
...
nativehook/src/main/cpp/archs/arm64/assembler/assembler_a64.h
View file @
e46299fd
...
...
@@ -5,7 +5,7 @@
#ifndef SANDHOOK_NH_ASSEMBLER_A64_H
#define SANDHOOK_NH_ASSEMBLER_A64_H
#include
<assembler.h>
#include
"assembler.h"
#include "register_a64.h"
#include "inst_arm64.h"
...
...
@@ -22,10 +22,10 @@ namespace SandHook {
void
*
getPC
();
void
*
finish
();
void
Emit
(
U32
data32
);
void
Emit
(
U64
data64
);
void
Emit
(
Unit
<
Base
>*
unit
);
void
MoveWide
(
RegisterA64
&
rd
,
INST_A64
(
MOV_WIDE
)
::
OP
op
,
U64
imme
,
INST_A64
(
MOV_WIDE
)
::
Shift
shift
);
void
Movz
(
RegisterA64
&
rd
,
U64
imme
,
INST_A64
(
MOV_WIDE
)
::
Shift
shift
);
...
...
@@ -61,6 +61,8 @@ namespace SandHook {
void
Str
(
RegisterA64
&
rt
,
const
MemOperand
&
memOperand
);
void
Ldr
(
RegisterA64
&
rt
,
const
MemOperand
&
memOperand
);
void
Ldr
(
RegisterA64
&
rt
,
Label
&
label
);
void
Ldrsw
(
XRegister
&
rt
,
const
MemOperand
&
memOperand
);
void
Pop
(
RegisterA64
&
rt
);
...
...
nativehook/src/main/cpp/archs/arm64/decoder/decoder_arm64.cpp
View file @
e46299fd
...
...
@@ -23,6 +23,10 @@ void Arm64Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
CASE
(
MOV_REG
)
CASE
(
ADR_ADRP
)
CASE
(
LDR_LIT
)
CASE
(
LDR_IMM
)
CASE
(
LDR_UIMM
)
CASE
(
LDRSW_IMM
)
CASE
(
LDRSW_UIMM
)
CASE
(
STR_IMM
)
CASE
(
STR_UIMM
)
CASE
(
B_BL
)
...
...
nativehook/src/main/cpp/archs/arm64/inst/inst_arm64.cpp
View file @
e46299fd
...
...
@@ -300,14 +300,22 @@ A64_LDR_LIT::A64_LDR_LIT(STRUCT_A64(LDR_LIT) &inst) : A64_INST_PC_REL(&inst) {
decode
(
&
inst
);
}
A64_LDR_LIT
::
A64_LDR_LIT
(
A64_LDR_LIT
::
OP
op
,
RegisterA64
*
rt
,
Off
offset
)
:
op
(
op
),
rt
(
rt
),
A64_LDR_LIT
::
A64_LDR_LIT
(
A64_LDR_LIT
::
OP
op
,
RegisterA64
&
rt
,
Off
offset
)
:
op
(
op
),
rt
(
&
rt
),
offset
(
offset
)
{}
A64_LDR_LIT
::
A64_LDR_LIT
(
A64_LDR_LIT
::
OP
op
,
RegisterA64
&
rt
,
Label
&
label
)
:
op
(
op
),
rt
(
&
rt
)
{
bindLabel
(
label
);
}
Off
A64_LDR_LIT
::
getImmPCOffset
()
{
return
signExtend64
(
19
+
2
,
COMBINE
(
get
()
->
imm19
,
0
b00
,
2
));
}
void
A64_LDR_LIT
::
onOffsetApply
(
Off
offset
)
{
this
->
offset
=
offset
;
get
()
->
imm19
=
TruncateToUint19
(
offset
>>
2
);
}
void
A64_LDR_LIT
::
decode
(
STRUCT_A64
(
LDR_LIT
)
*
inst
)
{
op
=
OP
(
inst
->
op
);
if
(
op
==
LDR_W
)
{
...
...
@@ -699,9 +707,9 @@ void A64_LDR_UIMM::assembler() {
A64_LDRSW_IMM
::
A64_LDRSW_IMM
()
{}
A64_LDRSW_IMM
::
A64_LDRSW_IMM
(
INS
T_A64
(
LDRSW_IMM
)
&
inst
)
:
A64_LDR_IMM
(
inst
)
{}
A64_LDRSW_IMM
::
A64_LDRSW_IMM
(
STRUC
T_A64
(
LDRSW_IMM
)
&
inst
)
:
A64_LDR_IMM
(
inst
)
{}
A64_LDRSW_IMM
::
A64_LDRSW_IMM
(
XRegister
&
rt
,
const
MemOperand
&
operand
)
:
A64_LDR_IMM
(
rt
,
A64_LDRSW_IMM
::
A64_LDRSW_IMM
(
RegisterA64
&
rt
,
const
MemOperand
&
operand
)
:
A64_LDR_IMM
(
rt
,
operand
)
{}
void
A64_LDRSW_IMM
::
decode
(
STRUCT_A64
(
LDR_IMM
)
*
inst
)
{
...
...
nativehook/src/main/cpp/archs/arm64/inst/inst_arm64.h
View file @
e46299fd
...
...
@@ -468,7 +468,9 @@ namespace SandHook {
A64_LDR_LIT
(
STRUCT_A64
(
LDR_LIT
)
&
inst
);
A64_LDR_LIT
(
OP
op
,
RegisterA64
*
rt
,
Off
offset
);
A64_LDR_LIT
(
OP
op
,
RegisterA64
&
rt
,
Off
offset
);
A64_LDR_LIT
(
OP
op
,
RegisterA64
&
rt
,
Label
&
label
);
DEFINE_IS
(
LDR_LIT
)
...
...
@@ -476,6 +478,8 @@ namespace SandHook {
Off
getImmPCOffset
()
override
;
void
onOffsetApply
(
Off
offset
)
override
;
void
decode
(
STRUCT_A64
(
LDR_LIT
)
*
inst
)
override
;
void
assembler
()
override
;
...
...
@@ -729,9 +733,9 @@ namespace SandHook {
public:
A64_LDRSW_IMM
();
A64_LDRSW_IMM
(
INS
T_A64
(
LDRSW_IMM
)
&
inst
);
A64_LDRSW_IMM
(
STRUC
T_A64
(
LDRSW_IMM
)
&
inst
);
A64_LDRSW_IMM
(
XRegister
&
rt
,
const
MemOperand
&
operand
);
A64_LDRSW_IMM
(
RegisterA64
&
rt
,
const
MemOperand
&
operand
);
DEFINE_IS_EXT
(
LDRSW_IMM
,
TEST_INST_FIELD
(
opcode
,
OPCODE_A64
(
LDRSW_IMM
))
&&
TEST_INST_FIELD
(
size
,
Size32
))
...
...
@@ -740,7 +744,7 @@ namespace SandHook {
void
decode
(
STRUCT_A64
(
LDR_IMM
)
*
inst
)
override
;
void
assembler
()
override
;
};
};
class
INST_A64
(
LDRSW_UIMM
)
:
public
INST_A64
(
LDR_UIMM
)
{
...
...
nativehook/src/main/cpp/archs/arm64/relocate/code_relocate_a64.cpp
View file @
e46299fd
...
...
@@ -3,6 +3,7 @@
//
#include "code_relocate_a64.h"
#include "decoder_arm64.h"
#define __ assemblerA64->
...
...
@@ -17,14 +18,23 @@ CodeRelocateA64::CodeRelocateA64(AssemblerA64 &assembler) : CodeRelocate(assembl
this
->
assemblerA64
=
&
assembler
;
}
void
CodeRelocateA64
::
relocate
(
void
*
startPc
,
void
*
toPc
,
Addr
len
)
throw
(
ErrorCodeException
)
{
void
*
CodeRelocateA64
::
relocate
(
void
*
startPc
,
Addr
len
,
void
*
toPc
=
nullptr
)
throw
(
ErrorCodeException
)
{
assemblerA64
->
allocBufferFirst
(
static_cast
<
U32
>
(
len
*
8
));
void
*
curPc
=
assemblerA64
->
getPC
();
Arm64Decoder
decoder
=
Arm64Decoder
();
if
(
toPc
==
nullptr
)
{
decoder
.
decode
(
startPc
,
len
,
*
this
);
}
else
{
//TODO
}
return
curPc
;
}
void
CodeRelocateA64
::
relocate
(
Instruction
<
Base
>
*
instruction
,
void
*
toPc
)
throw
(
ErrorCodeException
)
{
void
*
CodeRelocateA64
::
relocate
(
Instruction
<
Base
>
*
instruction
,
void
*
toPc
)
throw
(
ErrorCodeException
)
{
void
*
curPc
=
assemblerA64
->
getPC
();
if
(
!
instruction
->
pcRelate
())
{
__
Emit
(
instruction
);
return
;
return
curPc
;
}
switch
(
instruction
->
instCode
())
{
CASE
(
B_BL
)
...
...
@@ -36,6 +46,7 @@ void CodeRelocateA64::relocate(Instruction<Base> *instruction, void *toPc) throw
default
:
__
Emit
(
instruction
);
}
return
curPc
;
}
IMPL_RELOCATE
(
B_BL
)
{
...
...
@@ -133,3 +144,8 @@ IMPL_RELOCATE(LDR_LIT) {
IMPL_RELOCATE
(
ADR_ADRP
)
{
__
Mov
(
*
inst
->
rd
,
inst
->
getImmPCOffsetTarget
());
}
bool
CodeRelocateA64
::
visit
(
Unit
<
Base
>
*
unit
,
void
*
pc
)
{
relocate
(
reinterpret_cast
<
Instruction
<
Base
>
*>
(
unit
),
assemblerA64
->
getPC
());
return
true
;
}
nativehook/src/main/cpp/archs/arm64/relocate/code_relocate_a64.h
View file @
e46299fd
...
...
@@ -20,9 +20,11 @@ namespace SandHook {
public
:
CodeRelocateA64
(
AssemblerA64
&
assembler
);
void
relocate
(
Instruction
<
Base
>
*
instruction
,
void
*
toPc
)
throw
(
ErrorCodeException
)
override
;
void
*
relocate
(
Instruction
<
Base
>
*
instruction
,
void
*
toPc
)
throw
(
ErrorCodeException
)
override
;
void
relocate
(
void
*
startPc
,
void
*
toPc
,
Addr
len
)
throw
(
ErrorCodeException
)
override
;
void
*
relocate
(
void
*
startPc
,
Addr
len
,
void
*
toPc
)
throw
(
ErrorCodeException
)
override
;
bool
visit
(
Unit
<
Base
>
*
unit
,
void
*
pc
)
override
;
DEFINE_RELOCATE
(
B_BL
)
...
...
nativehook/src/main/cpp/assembler/assembler.cpp
View file @
e46299fd
...
...
@@ -70,3 +70,14 @@ void CodeContainer::allocBufferFirst(U32 size) {
startPc
=
reinterpret_cast
<
Addr
>
(
codeBuffer
->
getBuffer
(
size
));
curPc
=
startPc
;
}
CodeContainer
::~
CodeContainer
()
{
std
::
list
<
Unit
<
Base
>*>::
iterator
unit
;
for
(
unit
=
units
.
begin
();
unit
!=
units
.
end
();
++
unit
)
{
delete
(
*
unit
);
}
}
Addr
CodeContainer
::
size
()
{
return
curPc
-
startPc
;
}
nativehook/src/main/cpp/buffer/code_buffer.cpp
View file @
e46299fd
...
...
@@ -37,8 +37,7 @@ label_alloc_new_space:
return
mmapRes
;
}
AndroidCodeBuffer
::
AndroidCodeBuffer
()
{}
StaticCodeBuffer
::
StaticCodeBuffer
(
Addr
pc
)
:
pc
(
pc
)
{}
...
...
nativehook/src/main/cpp/buffer/code_buffer.h
View file @
e46299fd
...
...
@@ -12,6 +12,9 @@ namespace SandHook {
namespace
Assembler
{
class
AndroidCodeBuffer
:
public
CodeBuffer
{
public
:
AndroidCodeBuffer
();
void
*
getBuffer
(
U32
bufferSize
)
override
;
protected
:
...
...
nativehook/src/main/cpp/hook/hook.cpp
0 → 100644
View file @
e46299fd
//
// Created by swift on 2019/5/14.
//
#include "hook.h"
#include "../buffer/code_buffer.h"
#include "../../../../../hooklib/src/main/cpp/utils/lock.h"
using
namespace
SandHook
::
Hook
;
using
namespace
SandHook
::
Decoder
;
using
namespace
SandHook
::
Asm
;
using
namespace
SandHook
::
Assembler
;
#include "assembler_a64.h"
#include "../archs/arm64/relocate/code_relocate_a64.h"
AndroidCodeBuffer
*
backupBuffer
=
new
AndroidCodeBuffer
();
void
*
InlineHookArm64Android
::
inlineHook
(
void
*
origin
,
void
*
replace
)
{
AutoLock
lock
(
hookLock
);
void
*
backup
=
nullptr
;
AssemblerA64
assemblerBackup
(
backupBuffer
);
CodeContainer
*
codeContainerBackup
=
&
assemblerBackup
.
codeContainer
;
StaticCodeBuffer
inlineBuffer
=
StaticCodeBuffer
(
reinterpret_cast
<
Addr
>
(
origin
));
AssemblerA64
assemblerInline
(
&
inlineBuffer
);
CodeContainer
*
codeContainerInline
=
&
assemblerInline
.
codeContainer
;
//build inline trampoline
#define __ assemblerInline.
Label
*
target_addr_label
=
new
Label
();
__
Ldr
(
IP1
,
*
target_addr_label
);
__
Br
(
IP1
);
__
Emit
(
target_addr_label
);
__
Emit
(
reinterpret_cast
<
Addr
>
(
replace
));
#undef __
//build backup method
CodeRelocateA64
relocate
=
CodeRelocateA64
(
assemblerBackup
);
backup
=
relocate
.
relocate
(
origin
,
codeContainerInline
->
size
(),
nullptr
);
#define __ assemblerBackup.
Label
*
origin_addr_label
=
new
Label
();
__
Ldr
(
IP1
,
*
origin_addr_label
);
__
Br
(
IP1
);
__
Emit
(
origin_addr_label
);
__
Emit
(
reinterpret_cast
<
Addr
>
(
origin
)
+
codeContainerInline
->
size
());
__
finish
();
#undef __
//commit inline trampoline
assemblerInline
.
finish
();
return
backup
;
}
nativehook/src/main/cpp/includes/assembler.h
View file @
e46299fd
...
...
@@ -37,6 +37,10 @@ namespace SandHook {
void
append
(
Unit
<
Base
>*
unit
);
void
commit
();
Addr
size
();
virtual
~
CodeContainer
();
public
:
//before commit is virtual address so = 0, after commit is real address
Addr
startPc
=
0
;
...
...
nativehook/src/main/cpp/includes/base.h
View file @
e46299fd
...
...
@@ -20,7 +20,14 @@ typedef int32_t S32;
typedef
int64_t
S64
;
typedef
size_t
Addr
;
//32bit
#if defined(__i386__) || defined(__arm__)
typedef
S32
Off
;
//64bit
#elif defined(__aarch64__) || defined(__x86_64__)
typedef
S64
Off
;
#endif
const
int
PTR_BYTE
=
sizeof
(
void
*
);
...
...
nativehook/src/main/cpp/includes/code_relocate.h
View file @
e46299fd
...
...
@@ -21,8 +21,8 @@ namespace SandHook {
CodeRelocate
(
CodeContainer
&
codeContainer
)
:
codeContainer
(
&
codeContainer
)
{}
virtual
void
relocate
(
Instruction
<
Base
>
*
instruction
,
void
*
toPc
)
throw
(
ErrorCodeException
)
=
0
;
virtual
void
relocate
(
void
*
startPc
,
void
*
toPc
,
Addr
len
)
throw
(
ErrorCodeException
)
=
0
;
virtual
void
*
relocate
(
Instruction
<
Base
>
*
instruction
,
void
*
toPc
)
throw
(
ErrorCodeException
)
=
0
;
virtual
void
*
relocate
(
void
*
startPc
,
Addr
len
,
void
*
toPc
)
throw
(
ErrorCodeException
)
=
0
;
private
:
CodeContainer
*
codeContainer
;
...
...
nativehook/src/main/cpp/includes/hook.h
0 → 100644
View file @
e46299fd
//
// Created by swift on 2019/5/14.
//
#ifndef SANDHOOK_NH_HOOK_H
#define SANDHOOK_NH_HOOK_H
#include <mutex>
#include <hook.h>
#include <decoder.h>
#include "hook.h"
#include "assembler.h"
#include "code_relocate.h"
namespace
SandHook
{
namespace
Hook
{
class
InlineHook
{
public
:
//return == backup method
virtual
void
*
inlineHook
(
void
*
origin
,
void
*
replace
)
=
0
;
};
class
InlineHookArm64Android
:
InlineHook
{
public
:
void
*
inlineHook
(
void
*
origin
,
void
*
replace
)
override
;
protected
:
std
::
mutex
*
hookLock
=
new
std
::
mutex
();
};
}
}
#endif //SANDHOOK_NH_HOOK_H
nativehook/src/main/cpp/sandhook_native.cpp
View file @
e46299fd
...
...
@@ -7,9 +7,13 @@
#include "sandhook_native.h"
#include "inst_arm64.h"
#include "decoder_arm64.h"
#include "hook.h"
using
namespace
SandHook
::
Asm
;
using
namespace
SandHook
::
Decoder
;
using
namespace
SandHook
::
Hook
;
void
(
*
dosth3Backup
)()
=
nullptr
;
bool
memUnprotect
(
Addr
addr
,
Addr
len
)
{
long
pagesize
=
4096
;
...
...
@@ -24,6 +28,24 @@ bool memUnprotect(Addr addr, Addr len) {
void
do2
()
{
int
a
=
1
+
1
;
int
b
=
1
+
1
;
int
c
=
1
+
1
;
int
d
=
1
+
1
;
}
void
do3
()
{
int
a
=
1
+
1
;
int
b
=
1
+
1
;
int
c
=
1
+
1
;
int
d
=
a
+
b
+
c
;
}
void
do3replace
()
{
int
a
=
1
+
1
;
int
b
=
1
+
1
;
int
c
=
1
+
1
;
int
d
=
1
+
1
;
dosth3Backup
();
}
void
do1
()
{
...
...
@@ -76,6 +98,12 @@ Java_com_swift_sandhook_nativehook_NativeHook_test(JNIEnv *env, jclass jclass1)
arm64Decoder
.
decode
(
reinterpret_cast
<
void
*>
(
do1
),
4
*
8
,
visitor
);
InlineHookArm64Android
inlineHookArm64Android
=
InlineHookArm64Android
();
dosth3Backup
=
reinterpret_cast
<
void
(
*
)()
>
(
inlineHookArm64Android
.
inlineHook
(
reinterpret_cast
<
void
*>
(
do3
),
reinterpret_cast
<
void
*>
(
do3replace
)));
do3
();
}
\ No newline at end of file
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment