Commit e85c7f8d authored by swift_gan's avatar swift_gan Committed by swift_gan

[NativeHook]tweak code

parent 89594d29
......@@ -19,18 +19,19 @@ add_library( # Sets the name of the library.
# Provides a relative path to your source file(s).
src/main/cpp/sandhook_native.cpp
src/main/cpp/decoder/decoder.cpp
src/main/cpp/archs/arm/arm64/assembler/assembler_a64.cpp
src/main/cpp/archs/arm/arm64/assembler/assembler_arm64.cpp
src/main/cpp/archs/arm/arm64/inst/inst_arm64.cpp
src/main/cpp/archs/arm/arm64/register/register_a64.cpp
src/main/cpp/archs/arm/arm64/register/register_list_a64.cpp
src/main/cpp/archs/arm/arm64/register/register_arm64.cpp
src/main/cpp/archs/arm/arm64/register/register_list_arm64.cpp
src/main/cpp/archs/arm/arm64/decoder/decoder_arm64.cpp
src/main/cpp/archs/arm/arm64/relocate/code_relocate_a64.cpp
src/main/cpp/archs/arm/arm64/relocate/code_relocate_arm64.cpp
src/main/cpp/archs/arm/arm32/inst/inst_arm32.cpp
src/main/cpp/archs/arm/arm32/inst/inst_t32.cpp
src/main/cpp/archs/arm/arm32/inst/inst_t16.cpp
src/main/cpp/archs/arm/arm32/register/register_a32.cpp
src/main/cpp/archs/arm/arm32/register/register_list_a32.cpp
src/main/cpp/archs/arm/arm32/assembler/assembler_a32.cpp
src/main/cpp/archs/arm/arm32/register/register_arm32.cpp
src/main/cpp/archs/arm/arm32/register/register_list_arm32.cpp
src/main/cpp/archs/arm/arm32/assembler/assembler_arm32.cpp
src/main/cpp/archs/arm/arm32/decoder/decoder_arm32.cpp
src/main/cpp/relocate/code_relocate.cpp
src/main/cpp/elf/elf.cpp
src/main/cpp/assembler/assembler.cpp
......@@ -56,6 +57,7 @@ include_directories(
src/main/cpp/archs/arm/arm32/inst
src/main/cpp/archs/arm/arm32/register
src/main/cpp/archs/arm/arm32/assembler
src/main/cpp/archs/arm/arm32/decoder
)
# Searches for a specified prebuilt library and stores the path as a
......
......@@ -2,7 +2,7 @@
// Created by swift on 2019/5/22.
//
#include "assembler_a32.h"
#include "assembler_arm32.h"
#include "exception.h"
using namespace SandHook::Assembler;
......
......@@ -6,7 +6,7 @@
#define SANDHOOK_ASSEMBLER_A32_H
#include "assembler.h"
#include "register_a32.h"
#include "register_arm32.h"
#include "inst_t16.h"
#include "inst_t32.h"
......
//
// Created by swift on 2019/5/23.
//
#include "inst_t16.h"
#include "inst_t32.h"
#include "decoder_arm32.h"
using namespace SandHook::Decoder;
using namespace SandHook::AsmA32;
#define CASE(T, X) \
if (IS_OPCODE_##T(*reinterpret_cast<Inst##T *>(pc), X)) { \
STRUCT_##T(X) *s = reinterpret_cast<STRUCT_##T(X) *>(pc); \
unit = reinterpret_cast<Unit<Base> *>(new INST_##T(X)(s)); \
goto label_matched; \
}
#define CASE_A32(X) CASE(A32, X)
#define CASE_T16(X) CASE(T16, X)
#define CASE_T32(X) CASE(T32, X)
Arm32Decoder* Arm32Decoder::instant = new Arm32Decoder();
void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
void *pc = codeStart;
Addr endAddr = (Addr) codeStart + codeLen;
Unit<Base>* unit = nullptr;
while((Addr) pc < endAddr) {
bool thumb = isThumbCode(reinterpret_cast<Addr>(pc));
bool thumb32 = isThumb32(*reinterpret_cast<InstT16*>(pc));
if (thumb && thumb32) {
CASE_T32(B32)
CASE_T32(LDR_LIT)
CASE_T32(LDR_IMM)
CASE_T32(LDR_UIMM)
CASE_T32(MOV_MOVT_IMM)
if (unit == nullptr) {
unit = reinterpret_cast<Unit<Base> *>(new INST_T32(UNKNOW)(*reinterpret_cast<STRUCT_T32(UNKNOW) *>(pc)));
}
} else if (thumb) {
CASE_T16(B)
CASE_T16(B_COND)
CASE_T16(BX_BLX)
CASE_T16(CBZ_CBNZ)
CASE_T16(LDR_LIT)
CASE_T16(ADD_IMM_RDN)
CASE_T16(ADR)
CASE_T16(ADD_REG)
CASE_T16(CMP_REG)
CASE_T16(CMP_REG_EXT)
CASE_T16(MOV_REG)
CASE_T16(POP)
CASE_T16(PUSH)
if (unit == nullptr) {
unit = reinterpret_cast<Unit<Base> *>(new INST_T16(UNKNOW)(*reinterpret_cast<STRUCT_T16(UNKNOW) *>(pc)));
}
} else {
//TODO
unit = reinterpret_cast<Unit<Base> *>(new INST_T32(UNKNOW)(*reinterpret_cast<STRUCT_T32(UNKNOW) *>(pc)));
}
label_matched:
if (!visitor.visit(unit, pc)) {
break;
}
pc = reinterpret_cast<InstA64 *>((Addr)pc + unit->size());
unit = nullptr;
}
}
//
// Created by swift on 2019/5/23.
//
#ifndef SANDHOOK_DECODER_A32_H
#define SANDHOOK_DECODER_A32_H
#include "decoder.h"
namespace SandHook {
namespace Decoder {
class Arm32Decoder : public InstDecoder {
public:
void decode(void *codeStart, Addr codeLen, InstVisitor &visitor) override;
public:
static Arm32Decoder* instant;
};
}
}
#endif //SANDHOOK_DECODER_A32_H
......@@ -7,7 +7,7 @@
#include <ostream>
#include "arm_base.h"
#include "register_list_a32.h"
#include "register_list_arm32.h"
#include "instruction.h"
#define DECODE_OFFSET(bits, ext) signExtend32(bits + ext, COMBINE(get()->imm##bits, 0, ext))
......
......@@ -10,6 +10,7 @@ enum class InstCodeA32 {
};
enum class InstCodeT16 {
UNKNOW,
BASE_SASMC,
DATA_PROC,
SPDIABE,
......@@ -19,7 +20,6 @@ enum class InstCodeT16 {
BX_BLX,
CBZ_CBNZ,
LDR_LIT,
//when rd = rn
ADD_IMM_RDN,
//rn = pc
ADR,
......@@ -28,17 +28,16 @@ enum class InstCodeT16 {
CMP_REG_EXT,
MOV_IMM,
MOV_REG,
ADD_IMM_RND,
POP,
PUSH
};
enum class InstCodeT32 {
UNKNOW,
B32,
LDR_LIT,
LDR_IMM,
LDR_UIMM,
LDRB_LIT,
MOV_MOVT_IMM
};
......
......@@ -34,6 +34,11 @@ DEFINE_OPCODE_T16(MISC, 0b1011)
#define T16_REG_WIDE 3
//unknow inst
DEFINE_STRUCT_T16(UNKNOW) {
InstT16 raw;
};
DEFINE_OPCODE_T16(B, 0b11100)
DEFINE_STRUCT_T16(B) {
InstT16 imm11:11;
......
......@@ -16,6 +16,12 @@
#define T32_REG_WIDE 4
//unknow inst
DEFINE_STRUCT_T32(UNKNOW) {
InstT32 raw;
};
DEFINE_OPCODE_T32(B32, 0b11110)
DEFINE_STRUCT_T32(B32) {
InstT32 imm11:11;
......
......@@ -4,7 +4,7 @@
#include "inst_t16.h"
#include "arm32_base.h"
#include "register_list_a32.h"
#include "register_list_arm32.h"
#define SET_BASE_OPCODE(X) get()->opcode_base = OPCODE_T16(X)
......@@ -15,6 +15,20 @@ using namespace SandHook::AsmA32;
using namespace SandHook::RegistersA32;
//Unknow
T16_UNKNOW::T16_UNKNOW(STRUCT_T16(UNKNOW) &inst) : InstructionT16(&inst) {
decode(&inst);
}
void T16_UNKNOW::decode(T16_STRUCT_UNKNOW *inst) {
inst_backup = *inst;
}
void T16_UNKNOW::assembler() {
set(inst_backup);
}
//B
T16_B::T16_B() {}
......
......@@ -6,14 +6,14 @@
#define SANDHOOK_INST_T16_H
#include "arm_base.h"
#include "register_list_a32.h"
#include "register_list_arm32.h"
#include "inst_struct_t16.h"
#include "inst_code_arm32.h"
#include "arm32_base.h"
#define INST_T16(X) T16_##X
#define IS_OPCODE_T16(RAW,OP) INST_T16(OP)::is(RAW)
#define IS_OPCODE_T16(RAW, OP) INST_T16(OP)::is(RAW)
#define DEFINE_IS_EXT(X, COND) \
inline static bool is(InstT16& inst) { \
......@@ -27,7 +27,7 @@ return COND; \
#define DEFINE_IS(X) DEFINE_IS_EXT(X, TEST_INST_FIELD(opcode,OPCODE_T16(X)))
#define TEST_INST_FIELD(F,V) inst_test.inst.F == V
#define TEST_INST_FIELD(F, V) inst_test.inst.F == V
#define INST_FIELD(F) inst_test.inst.F
......@@ -87,7 +87,7 @@ namespace SandHook {
};
template <typename Inst>
template<typename Inst>
class T16_INST_PC_REL : public InstructionT16<Inst> {
public:
......@@ -110,6 +110,26 @@ namespace SandHook {
};
class INST_T16(UNKNOW) : public InstructionT16<STRUCT_T16(UNKNOW)> {
public:
T16_UNKNOW(STRUCT_T16(UNKNOW) &inst);
DEFINE_INST_CODE(UNKNOW)
inline bool unknow() override {
return true;
}
void decode(T16_STRUCT_UNKNOW *inst) override;
void assembler() override;
private:
STRUCT_T16(UNKNOW) inst_backup;
};
class INST_T16(B) : public T16_INST_PC_REL<STRUCT_T16(B)> {
public:
T16_B();
......@@ -118,7 +138,7 @@ namespace SandHook {
T16_B(Off offset);
T16_B(Label& label);
T16_B(Label &label);
DEFINE_IS(B)
......@@ -144,9 +164,10 @@ namespace SandHook {
T16_B_COND(Condition condition, Off offset);
T16_B_COND(Condition condition, Label& label);
T16_B_COND(Condition condition, Label &label);
DEFINE_IS_EXT(B_COND, TEST_INST_FIELD(opcode, OPCODE_T16(B_COND)) && INST_FIELD(cond) != 0b1110 && INST_FIELD(cond) != 0b1111)
DEFINE_IS_EXT(B_COND, TEST_INST_FIELD(opcode, OPCODE_T16(B_COND)) &&
INST_FIELD(cond) != 0b1110 && INST_FIELD(cond) != 0b1111)
DEFINE_INST_CODE(B_COND)
......@@ -186,7 +207,7 @@ namespace SandHook {
public:
OP op;
RegisterA32* rm;
RegisterA32 *rm;
};
......@@ -201,9 +222,11 @@ namespace SandHook {
T16_CBZ_CBNZ(OP op, Off offset, RegisterA32 &rn);
T16_CBZ_CBNZ(OP op, Label& label, RegisterA32 &rn);
T16_CBZ_CBNZ(OP op, Label &label, RegisterA32 &rn);
DEFINE_IS_EXT(CBZ_CBNZ, TEST_INST_OPCODE(CBZ_CBNZ, 1) && TEST_INST_OPCODE(CBZ_CBNZ, 2) && TEST_INST_OPCODE(CBZ_CBNZ, 3))
DEFINE_IS_EXT(CBZ_CBNZ,
TEST_INST_OPCODE(CBZ_CBNZ, 1) && TEST_INST_OPCODE(CBZ_CBNZ, 2) &&
TEST_INST_OPCODE(CBZ_CBNZ, 3))
DEFINE_INST_CODE(CBZ_CBNZ)
......@@ -218,7 +241,7 @@ namespace SandHook {
public:
OP op;
Off offset;
RegisterA32* rn;
RegisterA32 *rn;
};
......@@ -247,7 +270,7 @@ namespace SandHook {
public:
Off offset;
RegisterA32* rt;
RegisterA32 *rt;
};
......@@ -259,14 +282,14 @@ namespace SandHook {
DEFINE_IS(ADD_IMM_RDN)
DEFINE_INST_CODE(ADD_IMM_RND)
DEFINE_INST_CODE(ADD_IMM_RDN)
void decode(T16_STRUCT_ADD_IMM_RDN *inst) override;
void assembler() override;
public:
RegisterA32* rdn;
RegisterA32 *rdn;
U8 imm8;
};
......@@ -277,7 +300,7 @@ namespace SandHook {
T16_ADR(RegisterA32 *rd, Off offset);
T16_ADR(RegisterA32 *rd, Label& label);
T16_ADR(RegisterA32 *rd, Label &label);
DEFINE_IS(ADR)
......@@ -292,7 +315,7 @@ namespace SandHook {
void assembler() override;
public:
RegisterA32* rd;
RegisterA32 *rd;
Off offset;
};
......@@ -307,15 +330,16 @@ namespace SandHook {
DEFINE_INST_CODE(CMP_REG)
DEFINE_IS_EXT(CMP_REG, TEST_INST_FIELD(opcode_base, OPCODE_T16(DATA_PROC)) && TEST_INST_FIELD(opcode, OPCODE_T16(CMP_REG)))
DEFINE_IS_EXT(CMP_REG, TEST_INST_FIELD(opcode_base, OPCODE_T16(DATA_PROC)) &&
TEST_INST_FIELD(opcode, OPCODE_T16(CMP_REG)))
void decode(T16_STRUCT_CMP_REG *inst) override;
void assembler() override;
public:
RegisterA32* rm;
RegisterA32* rn;
RegisterA32 *rm;
RegisterA32 *rn;
};
......@@ -328,7 +352,8 @@ namespace SandHook {
DEFINE_INST_CODE(MOV_REG)
DEFINE_IS_EXT(MOV_REG, TEST_INST_FIELD(opcode_base, OPCODE_T16(DATA_PROC)) && TEST_INST_FIELD(opcode, OPCODE_T16(MOV_REG)))
DEFINE_IS_EXT(MOV_REG, TEST_INST_FIELD(opcode_base, OPCODE_T16(DATA_PROC)) &&
TEST_INST_FIELD(opcode, OPCODE_T16(MOV_REG)))
void decode(T16_STRUCT_MOV_REG *inst) override;
......@@ -337,8 +362,8 @@ namespace SandHook {
bool pcRelate() override;
public:
RegisterA32* rd;
RegisterA32* rm;
RegisterA32 *rd;
RegisterA32 *rm;
};
......@@ -359,9 +384,9 @@ namespace SandHook {
void assembler() override;
public:
RegisterA32* rd;
RegisterA32* rn;
RegisterA32* rm;
RegisterA32 *rd;
RegisterA32 *rn;
RegisterA32 *rm;
};
......@@ -382,8 +407,8 @@ namespace SandHook {
public:
RegisterA32* rn;
RegisterA32* rm;
RegisterA32 *rn;
RegisterA32 *rm;
};
......
......@@ -15,6 +15,22 @@ using namespace SandHook::Asm;
using namespace SandHook::AsmA32;
//Unknow
T32_UNKNOW::T32_UNKNOW(STRUCT_T32(UNKNOW) &inst) : InstructionT32(&inst) {
decode(&inst);
}
void T32_UNKNOW::decode(T32_STRUCT_UNKNOW *inst) {
inst_backup = *inst;
}
void T32_UNKNOW::assembler() {
set(inst_backup);
}
T32_B32::T32_B32(T32_STRUCT_B32 *inst) : T32_INST_PC_REL(inst) {}
T32_B32::T32_B32(T32_B32::OP op, T32_B32::X x, Off offset) : op(op), x(x), offset(offset) {}
......
......@@ -7,7 +7,7 @@
#include "arm_base.h"
#include "arm32_base.h"
#include "register_list_a32.h"
#include "register_list_arm32.h"
#include "inst_struct_t16.h"
#include "inst_code_arm32.h"
#include "inst_struct_t32.h"
......@@ -17,7 +17,7 @@
#define IS_OPCODE_T32(RAW,OP) INST_T32(OP)::is(RAW)
#define DEFINE_IS_EXT(X, COND) \
inline static bool is(InstT16& inst) { \
inline static bool is(InstT32& inst) { \
union { \
InstT32 raw; \
STRUCT_T32(X) inst; \
......@@ -107,6 +107,26 @@ namespace SandHook {
};
class INST_T32(UNKNOW) : public InstructionT32<STRUCT_T32(UNKNOW)> {
public:
T32_UNKNOW(STRUCT_T32(UNKNOW) &inst);
DEFINE_INST_CODE(UNKNOW)
inline bool unknow() override {
return true;
}
void decode(T32_STRUCT_UNKNOW *inst) override;
void assembler() override;
private:
STRUCT_T32(UNKNOW) inst_backup;
};
class INST_T32(B32) : public T32_INST_PC_REL<STRUCT_T32(B32)> {
public:
......
......@@ -2,8 +2,8 @@
// Created by swift on 2019/5/12.
//
#include "register_a32.h"
#include "register_list_a32.h"
#include "register_arm32.h"
#include "register_list_arm32.h"
using namespace SandHook::RegistersA32;
......
......@@ -2,7 +2,7 @@
// Created by swift on 2019/5/16.
//
#include "register_list_a32.h"
#include "register_list_arm32.h"
namespace SandHook {
namespace RegistersA32 {
......
......@@ -5,7 +5,7 @@
#ifndef SANDHOOK_NH_REGISTER_LIST_A32_H
#define SANDHOOK_NH_REGISTER_LIST_A32_H
#include "register_a32.h"
#include "register_arm32.h"
using namespace SandHook::Asm;
......
......@@ -2,7 +2,7 @@
// Created by swift on 2019/5/11.
//
#include "assembler_a64.h"
#include "assembler_arm64.h"
using namespace SandHook::Assembler;
using namespace SandHook::RegistersA64;
......
......@@ -6,7 +6,7 @@
#define SANDHOOK_NH_ASSEMBLER_A64_H
#include "assembler.h"
#include "register_a64.h"
#include "register_arm64.h"
#include "inst_arm64.h"
using namespace SandHook::AsmA64;
......
......@@ -15,6 +15,8 @@ unit = reinterpret_cast<Unit<Base> *>(new INST_A64(X)(*s)); \
goto label_matched; \
}
Arm64Decoder* Arm64Decoder::instant = new Arm64Decoder();
void Arm64Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
InstA64 *pc = reinterpret_cast<InstA64 *>(codeStart);
Addr endAddr = (Addr) codeStart + codeLen;
......@@ -40,7 +42,7 @@ void Arm64Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
CASE(EXCEPTION_GEN)
label_matched:
if (unit == nullptr) {
unit = reinterpret_cast<Unit<Base> *>(new A64_UNKNOW(*reinterpret_cast<STRUCT_A64(UNKNOW) *>(pc)));
unit = reinterpret_cast<Unit<Base> *>(new INST_A64(UNKNOW)(*reinterpret_cast<STRUCT_A64(UNKNOW) *>(pc)));
}
if (!visitor.visit(unit, pc)) {
break;
......
......@@ -13,6 +13,8 @@ namespace SandHook {
class Arm64Decoder : public InstDecoder {
public:
void decode(void *codeStart, Addr codeLen, InstVisitor &visitor) override;
public:
static Arm64Decoder* instant;
};
}
......
......@@ -88,8 +88,8 @@ void A64_ADR_ADRP::assembler() {
}
void A64_ADR_ADRP::decode(STRUCT_A64(ADR_ADRP) *inst) {
offset = getImmPCOffsetTarget();
rd = XReg(static_cast<U8>(get()->rd));
offset = getImmPCOffset();
DECODE_RD(XReg);
op = OP(get()->op);
}
......
......@@ -8,7 +8,7 @@
#include "inst_struct_aarch64.h"
#include "instruction.h"
#include "base.h"
#include "register_list_a64.h"
#include "register_list_arm64.h"
#define INST_A64(X) A64_##X
......
......@@ -2,8 +2,8 @@
// Created by swift on 2019/5/8.
//
#include "register_a64.h"
#include "register_list_a64.h"
#include "register_arm64.h"
#include "register_list_arm64.h"
using namespace SandHook::Asm;
using namespace SandHook::RegistersA64;
......
......@@ -2,7 +2,7 @@
// Created by swift on 2019/5/9.
//
#include "register_list_a64.h"
#include "register_list_arm64.h"
namespace SandHook {
......
......@@ -5,7 +5,7 @@
#ifndef SANDHOOK_NH_REGISTER_LIST_A64_H
#define SANDHOOK_NH_REGISTER_LIST_A64_H
#include "register_a64.h"
#include "register_arm64.h"
#include "base.h"
using namespace SandHook::Asm;
......
......@@ -2,7 +2,7 @@
// Created by swift on 2019/5/12.
//
#include "code_relocate_a64.h"
#include "code_relocate_arm64.h"
#include "decoder_arm64.h"
#include "lock.h"
......
......@@ -8,7 +8,7 @@
#include <mutex>
#include <map>
#include "code_relocate.h"
#include "assembler_a64.h"
#include "assembler_arm64.h"
using namespace SandHook::Assembler;
using namespace SandHook::Decoder;
......
//
// Created by swift on 2019/5/23.
//
#ifndef SANDHOOK_MEMORY_H
#define SANDHOOK_MEMORY_H
namespace SandHook {
namespace VM {
class Memory {
};
}
}
#endif //SANDHOOK_MEMORY_H
......@@ -4,6 +4,7 @@
#include <sys/mman.h>
#include <platform.h>
#include "log.h"
#include "code_buffer.h"
#include "lock.h"
......@@ -42,7 +43,9 @@ AndroidCodeBuffer::AndroidCodeBuffer() {}
StaticCodeBuffer::StaticCodeBuffer(Addr pc) : pc(pc) {}
void *StaticCodeBuffer::getBuffer(U32 bufferSize) {
memUnprotect(pc, bufferSize);
if (!memUnprotect(pc, bufferSize)) {
LOGE("error memUnprotect!");
}
return reinterpret_cast<void *>(pc);
}
......
......@@ -3,17 +3,32 @@
//
#include "decoder.h"
#if defined(__arm__)
#include "decoder_arm32.h"
#elif defined(__aarch64__)
#include "decoder_arm64.h"
#endif
using namespace SandHook::Decoder;
//do not support now
InstDecoder* Decoder::get(Arch arch) {
switch (arch) {
case arm32:
break;
return get();
case arm64:
break;
return get();
default:
return nullptr;
}
}
InstDecoder *Decoder::get() {
#if defined(__arm__)
return Arm32Decoder::instant;
#elif defined(__aarch64__)
return Arm64Decoder::instant;
#else
return nullptr;
}
\ No newline at end of file
#endif
}
......@@ -15,9 +15,9 @@ using namespace SandHook::Utils;
#include "assembler_a64.h"
#include "code_relocate_a64.h"
#include "code_relocate_a64.h"
#include "assembler_arm64.h"
#include "code_relocate_arm64.h"
#include "code_relocate_arm64.h"
using namespace SandHook::RegistersA64;
AndroidCodeBuffer* backupBuffer = new AndroidCodeBuffer();
void *InlineHookArm64Android::inlineHook(void *origin, void *replace) {
......
......@@ -27,6 +27,7 @@ namespace SandHook {
class Decoder {
static InstDecoder* get(Arch arch);
static InstDecoder* get();
};
}
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment