Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
ea2f1173
Commit
ea2f1173
authored
Mar 04, 2019
by
swift_gan
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
try support k
parent
3881352b
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
61 additions
and
4 deletions
+61
-4
cast_art_method.cpp
hooklib/src/main/cpp/casts/cast_art_method.cpp
+22
-1
SandHook.java
hooklib/src/main/java/com/swift/sandhook/SandHook.java
+5
-1
SandHookMethodResolver.java
.../main/java/com/swift/sandhook/SandHookMethodResolver.java
+30
-1
HookWrapper.java
...src/main/java/com/swift/sandhook/wrapper/HookWrapper.java
+4
-1
No files found.
hooklib/src/main/cpp/casts/cast_art_method.cpp
View file @
ea2f1173
...
@@ -48,8 +48,18 @@ namespace SandHook {
...
@@ -48,8 +48,18 @@ namespace SandHook {
Size
calOffset
(
JNIEnv
*
jniEnv
,
art
::
mirror
::
ArtMethod
*
p
)
override
{
Size
calOffset
(
JNIEnv
*
jniEnv
,
art
::
mirror
::
ArtMethod
*
p
)
override
{
if
(
SDK_INT
>=
ANDROID_L2
&&
SDK_INT
<=
ANDROID_M
)
if
(
SDK_INT
>=
ANDROID_L2
&&
SDK_INT
<=
ANDROID_M
)
return
getParentSize
()
-
3
*
BYTE_POINT
;
return
getParentSize
()
-
3
*
BYTE_POINT
;
else
if
(
SDK_INT
<=
ANDROID_L
)
else
if
(
SDK_INT
<=
ANDROID_L
)
{
Size
addr
=
getAddressFromJava
(
jniEnv
,
"com/swift/sandhook/SandHookMethodResolver"
,
"entryPointFromInterpreter"
);
int
offset
=
0
;
if
(
addr
!=
0
)
{
offset
=
findOffset
(
p
,
getParentSize
(),
2
,
addr
);
if
(
offset
>=
0
)
{
return
static_cast
<
Size
>
(
offset
);
}
}
return
getParentSize
()
-
4
*
8
-
4
*
4
;
return
getParentSize
()
-
4
*
8
-
4
*
4
;
}
else
else
return
getParentSize
()
+
1
;
return
getParentSize
()
+
1
;
}
}
...
@@ -60,6 +70,17 @@ namespace SandHook {
...
@@ -60,6 +70,17 @@ namespace SandHook {
Size
calOffset
(
JNIEnv
*
jniEnv
,
art
::
mirror
::
ArtMethod
*
p
)
override
{
Size
calOffset
(
JNIEnv
*
jniEnv
,
art
::
mirror
::
ArtMethod
*
p
)
override
{
if
(
SDK_INT
>=
ANDROID_M
)
{
if
(
SDK_INT
>=
ANDROID_M
)
{
return
getParentSize
()
-
BYTE_POINT
;
return
getParentSize
()
-
BYTE_POINT
;
}
else
if
(
SDK_INT
<=
ANDROID_L
)
{
Size
addr
=
getAddressFromJava
(
jniEnv
,
"com/swift/sandhook/SandHookMethodResolver"
,
"entryPointFromCompiledCode"
);
int
offset
=
0
;
if
(
addr
!=
0
)
{
offset
=
findOffset
(
p
,
getParentSize
(),
2
,
addr
);
if
(
offset
>=
0
)
{
return
static_cast
<
Size
>
(
offset
);
}
}
return
getParentSize
()
-
4
-
2
*
BYTE_POINT
;
}
else
{
}
else
{
return
getParentSize
()
-
4
-
2
*
BYTE_POINT
;
return
getParentSize
()
-
4
-
2
*
BYTE_POINT
;
}
}
...
...
hooklib/src/main/java/com/swift/sandhook/SandHook.java
View file @
ea2f1173
...
@@ -312,7 +312,11 @@ public class SandHook {
...
@@ -312,7 +312,11 @@ public class SandHook {
if
(
nativePeerField
==
null
)
if
(
nativePeerField
==
null
)
return
0
;
return
0
;
try
{
try
{
return
(
long
)
nativePeerField
.
get
(
Thread
.
currentThread
());
if
(
nativePeerField
.
getType
()
==
int
.
class
)
{
return
nativePeerField
.
getInt
(
Thread
.
currentThread
());
}
else
{
return
nativePeerField
.
getLong
(
Thread
.
currentThread
());
}
}
catch
(
IllegalAccessException
e
)
{
}
catch
(
IllegalAccessException
e
)
{
return
0
;
return
0
;
}
}
...
...
hooklib/src/main/java/com/swift/sandhook/SandHookMethodResolver.java
View file @
ea2f1173
...
@@ -13,6 +13,8 @@ public class SandHookMethodResolver {
...
@@ -13,6 +13,8 @@ public class SandHookMethodResolver {
public
static
Field
dexCacheField
;
public
static
Field
dexCacheField
;
public
static
Field
dexMethodIndexField
;
public
static
Field
dexMethodIndexField
;
public
static
Field
artMethodField
;
public
static
Field
artMethodField
;
public
static
Field
fieldEntryPointFromCompiledCode
;
public
static
Field
fieldEntryPointFromInterpreter
;
public
static
boolean
canResolvedInJava
=
false
;
public
static
boolean
canResolvedInJava
=
false
;
public
static
boolean
isArtMethod
=
false
;
public
static
boolean
isArtMethod
=
false
;
...
@@ -20,6 +22,9 @@ public class SandHookMethodResolver {
...
@@ -20,6 +22,9 @@ public class SandHookMethodResolver {
public
static
long
resolvedMethodsAddress
=
0
;
public
static
long
resolvedMethodsAddress
=
0
;
public
static
int
dexMethodIndex
=
0
;
public
static
int
dexMethodIndex
=
0
;
public
static
long
entryPointFromCompiledCode
=
0
;
public
static
long
entryPointFromInterpreter
=
0
;
public
static
Method
testMethod
;
public
static
Method
testMethod
;
public
static
Object
testArtMethod
;
public
static
Object
testArtMethod
;
...
@@ -50,13 +55,37 @@ public class SandHookMethodResolver {
...
@@ -50,13 +55,37 @@ public class SandHookMethodResolver {
// may 5.0
// may 5.0
private
static
void
checkSupportForArtMethod
()
throws
Exception
{
private
static
void
checkSupportForArtMethod
()
throws
Exception
{
dexMethodIndexField
=
getField
(
artMethodClass
,
"dexMethodIndex"
);
try
{
dexMethodIndexField
=
getField
(
artMethodClass
,
"dexMethodIndex"
);
}
catch
(
NoSuchFieldException
e
)
{
//may 4.4
dexMethodIndexField
=
getField
(
artMethodClass
,
"methodDexIndex"
);
}
dexCacheField
=
getField
(
Class
.
class
,
"dexCache"
);
dexCacheField
=
getField
(
Class
.
class
,
"dexCache"
);
Object
dexCache
=
dexCacheField
.
get
(
testMethod
.
getDeclaringClass
());
Object
dexCache
=
dexCacheField
.
get
(
testMethod
.
getDeclaringClass
());
resolvedMethodsField
=
getField
(
dexCache
.
getClass
(),
"resolvedMethods"
);
resolvedMethodsField
=
getField
(
dexCache
.
getClass
(),
"resolvedMethods"
);
if
(
resolvedMethodsField
.
get
(
dexCache
)
instanceof
Object
[])
{
if
(
resolvedMethodsField
.
get
(
dexCache
)
instanceof
Object
[])
{
canResolvedInJava
=
true
;
canResolvedInJava
=
true
;
}
}
try
{
try
{
fieldEntryPointFromCompiledCode
=
getField
(
artMethodClass
,
"entryPointFromQuickCompiledCode"
);
}
catch
(
Exception
e
)
{
fieldEntryPointFromCompiledCode
=
getField
(
artMethodClass
,
"entryPointFromCompiledCode"
);
}
if
(
fieldEntryPointFromCompiledCode
.
getType
()
==
int
.
class
)
{
entryPointFromCompiledCode
=
fieldEntryPointFromCompiledCode
.
getInt
(
testArtMethod
);
}
else
if
(
fieldEntryPointFromCompiledCode
.
getType
()
==
long
.
class
)
{
entryPointFromCompiledCode
=
fieldEntryPointFromCompiledCode
.
getLong
(
testArtMethod
);
}
fieldEntryPointFromInterpreter
=
getField
(
artMethodClass
,
"entryPointFromInterpreter"
);
if
(
fieldEntryPointFromInterpreter
.
getType
()
==
int
.
class
)
{
entryPointFromInterpreter
=
fieldEntryPointFromInterpreter
.
getInt
(
testArtMethod
);
}
else
if
(
fieldEntryPointFromCompiledCode
.
getType
()
==
long
.
class
)
{
entryPointFromInterpreter
=
fieldEntryPointFromInterpreter
.
getLong
(
testArtMethod
);
}
}
catch
(
Throwable
e
)
{
}
}
}
// may 6.0
// may 6.0
...
...
hooklib/src/main/java/com/swift/sandhook/wrapper/HookWrapper.java
View file @
ea2f1173
...
@@ -46,7 +46,10 @@ public class HookWrapper {
...
@@ -46,7 +46,10 @@ public class HookWrapper {
}
}
private
static
void
fillBackupMethod
(
ClassLoader
classLoader
,
Class
<?>
clazz
,
Map
<
Member
,
HookEntity
>
hookEntityMap
)
{
private
static
void
fillBackupMethod
(
ClassLoader
classLoader
,
Class
<?>
clazz
,
Map
<
Member
,
HookEntity
>
hookEntityMap
)
{
Field
[]
fields
=
clazz
.
getDeclaredFields
();
Field
[]
fields
=
null
;
try
{
fields
=
clazz
.
getDeclaredFields
();
}
catch
(
Throwable
throwable
)
{}
if
(
fields
==
null
||
fields
.
length
==
0
)
if
(
fields
==
null
||
fields
.
length
==
0
)
return
;
return
;
if
(
hookEntityMap
.
isEmpty
())
if
(
hookEntityMap
.
isEmpty
())
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment