Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
S
SandHook
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Administrator
SandHook
Commits
eb548da8
Unverified
Commit
eb548da8
authored
Jan 26, 2019
by
ganyao114
Committed by
GitHub
Jan 26, 2019
Browse files
Options
Browse Files
Download
Plain Diff
Merge pull request #1 from ganyao114/trampoline_rewrite
Trampoline rewrite
parents
14200bef
e5e9b351
Hide whitespace changes
Inline
Side-by-side
Showing
7 changed files
with
131 additions
and
92 deletions
+131
-92
MyApp.java
app/src/main/java/com/swift/sandhook/MyApp.java
+5
-2
AbsHooker.java
...c/main/java/com/swift/sandhook/testHookers/AbsHooker.java
+23
-0
arm32.S
hooklib/src/main/cpp/trampoline/arch/arm32.S
+24
-28
arm64.S
hooklib/src/main/cpp/trampoline/arch/arm64.S
+24
-25
trampoline.cpp
hooklib/src/main/cpp/trampoline/trampoline.cpp
+20
-18
trampoline.h
hooklib/src/main/cpp/trampoline/trampoline.h
+34
-18
trampoline_manager.cpp
hooklib/src/main/cpp/trampoline/trampoline_manager.cpp
+1
-1
No files found.
app/src/main/java/com/swift/sandhook/MyApp.java
View file @
eb548da8
...
...
@@ -2,6 +2,7 @@ package com.swift.sandhook;
import
android.app.Application
;
import
com.swift.sandhook.testHookers.AbsHooker
;
import
com.swift.sandhook.testHookers.ActivityHooker
;
import
com.swift.sandhook.testHookers.CtrHook
;
import
com.swift.sandhook.testHookers.CustmizeHooker
;
...
...
@@ -15,11 +16,13 @@ public class MyApp extends Application {
public
void
onCreate
()
{
super
.
onCreate
();
try
{
SandHook
.
addHookClass
(
JniHooker
.
class
,
CtrHook
.
class
,
SandHook
.
addHookClass
(
JniHooker
.
class
,
CtrHook
.
class
,
LogHooker
.
class
,
CustmizeHooker
.
class
,
ActivityHooker
.
class
,
ObjectHooker
.
class
);
ObjectHooker
.
class
,
AbsHooker
.
class
);
}
catch
(
HookErrorException
e
)
{
e
.
printStackTrace
();
}
...
...
app/src/main/java/com/swift/sandhook/testHookers/AbsHooker.java
0 → 100644
View file @
eb548da8
package
com
.
swift
.
sandhook
.
testHookers
;
import
android.util.Log
;
import
com.swift.sandhook.wrapper.HookClass
;
import
com.swift.sandhook.wrapper.HookMethod
;
import
com.swift.sandhook.wrapper.HookMethodBackup
;
@HookClass
(
Runnable
.
class
)
public
class
AbsHooker
{
@HookMethod
(
"run"
)
public
static
void
onRun
(
Object
thiz
)
{
Log
.
e
(
"AbsHooker"
,
"Runnable hook success "
);
onRunBackup
(
thiz
);
}
@HookMethodBackup
(
"run"
)
public
static
void
onRunBackup
(
Object
thiz
)
{
onRunBackup
(
thiz
);
}
}
hooklib/src/main/cpp/trampoline/arch/arm32.S
View file @
eb548da8
...
...
@@ -9,12 +9,11 @@
FUNCTION_START(REPLACEMENT_HOOK_TRAMPOLINE)
ldr RegMethod, addr_art_method
ldr Reg0, offset_entry_code
add Reg0, RegMethod, Reg0
ldr Reg0, addr_code_entry
ldr pc, [Reg0]
addr_art_method:
.long 0
offset_entry_code
:
addr_code_entry
:
.long 0
FUNCTION_END(REPLACEMENT_HOOK_TRAMPOLINE)
...
...
@@ -29,34 +28,34 @@ FUNCTION_END(DIRECT_JUMP_TRAMPOLINE)
FUNCTION_START(INLINE_HOOK_TRAMPOLINE)
ldr Reg0,
addr_
origin_art_method
ldr Reg0, origin_art_method
cmp RegMethod, Reg0
bne origin_code
ldr RegMethod, addr_hook_art_method
ldr Reg0, offset_entry_code2
add Reg0, RegMethod, Reg0
ldr RegMethod, hook_art_method
ldr Reg0, addr_hook_code_entry
ldr pc, [Reg0]
origin_code:
.long 0
.long 0
ldr Reg0, addr_origin_art_method
add Reg0, Reg0, #8
ldr Reg0, addr_origin_code_entry
ldr Reg0, [Reg0]
add Reg0, Reg0, SIZE_JUMP
mov pc, Reg0
addr_origin_art_method:
origin_art_method:
.long 0
addr_origin_code_entry:
.long 0
offset_entry_code2
:
hook_art_method
:
.long 0
addr_hook_
art_method
:
addr_hook_
code_entry
:
.long 0
FUNCTION_END(INLINE_HOOK_TRAMPOLINE)
FUNCTION_START(CALL_ORIGIN_TRAMPOLINE)
ldr RegMethod, origin_
art_
method
ldr RegMethod, origin_method
ldr pc, addr_origin
origin_
art_
method:
origin_method:
.long 0
addr_origin:
.long 0
...
...
@@ -72,7 +71,7 @@ FUNCTION_END(DIRECT_JUMP_TRAMPOLINE_T)
FUNCTION_START_T(INLINE_HOOK_TRAMPOLINE_T)
//4 byte
ldr RegT,
addr_
origin_art_method_t
ldr RegT, origin_art_method_t
//2 byte
cmp RegMethod, RegT
nop
...
...
@@ -80,12 +79,9 @@ FUNCTION_START_T(INLINE_HOOK_TRAMPOLINE_T)
bne origin_code_t
nop
//4 byte
ldr RegMethod,
addr_
hook_art_method_t
ldr RegMethod, hook_art_method_t
//4 byte
ldr RegT, offset_entry_code2_t
//2 byte
add RegT, RegMethod, RegT
nop
ldr RegT, addr_hook_code_entry_t
//4 byte
ldr pc, [RegT]
origin_code_t:
...
...
@@ -94,9 +90,7 @@ origin_code_t:
//4 byte
.long 0
//4 byte
ldr RegT, addr_origin_art_method_t
//4 byte
add RegT, RegT, #36
ldr RegT, addr_origin_code_entry_t
//4 byte
ldr RegT, [RegT]
//4 byte
...
...
@@ -104,18 +98,20 @@ origin_code_t:
//2 byte
mov pc, RegT
nop
addr_
origin_art_method_t:
origin_art_method_t:
.long 0
offset_entry_code2
_t:
addr_origin_code_entry
_t:
.long 0
addr_hook_art_method_t:
hook_art_method_t:
.long 0
addr_hook_code_entry_t:
.long 0
FUNCTION_END(INLINE_HOOK_TRAMPOLINE_T)
FUNCTION_START_T(CALL_ORIGIN_TRAMPOLINE_T)
ldr RegMethod, origin_
art_
method_t
ldr RegMethod, origin_method_t
ldr pc, addr_origin_t
origin_
art_
method_t:
origin_method_t:
.long 0
addr_origin_t:
.long 0
...
...
hooklib/src/main/cpp/trampoline/arch/arm64.S
View file @
eb548da8
...
...
@@ -67,20 +67,19 @@ Stub 中有使用
#if defined(__aarch64__)
#define Reg0 x1
6
#define Reg1 x1
7
#define Reg0 x1
7
#define Reg1 x1
6
#define RegMethod x0
FUNCTION_START(REPLACEMENT_HOOK_TRAMPOLINE)
ldr RegMethod, addr_art_method
ldr Reg0, offset_entry_code
add Reg0, RegMethod, Reg0
ldr Reg0, addr_code_entry
ldr Reg0, [Reg0]
br Reg0
addr_art_method:
.long 0
.long 0
offset_entry_code
:
addr_code_entry
:
.long 0
.long 0
FUNCTION_END(REPLACEMENT_HOOK_TRAMPOLINE)
...
...
@@ -95,44 +94,44 @@ addr_target:
FUNCTION_END(DIRECT_JUMP_TRAMPOLINE)
FUNCTION_START(INLINE_HOOK_TRAMPOLINE)
ldr Reg
1, addr_
origin_art_method
cmp RegMethod, Reg
1
ldr Reg
0,
origin_art_method
cmp RegMethod, Reg
0
bne origin_code
ldr RegMethod, addr_hook_art_method
ldr Reg1, offset_entry_code2
add Reg1, RegMethod, Reg1
ldr Reg1, [Reg1]
br Reg1
ldr RegMethod, hook_art_method
ldr Reg0, addr_hook_code_entry
ldr Reg0, [Reg0]
br Reg0
origin_code:
.long 0
.long 0
.long 0
.long 0
ldr Reg0, addr_origin_art_method
ldr Reg1, offset_entry_code2
add Reg1, Reg0, Reg1
ldr Reg1, [Reg1]
add Reg1, Reg1, SIZE_JUMP
br Reg1
addr_origin_art_method:
ldr Reg0, addr_origin_code_entry
ldr Reg0, [Reg0]
add Reg0, Reg0, SIZE_JUMP
br Reg0
origin_art_method:
.long 0
.long 0
addr_origin_code_entry:
.long 0
.long 0
offset_entry_code2
:
hook_art_method
:
.long 0
.long 0
addr_hook_
art_method
:
addr_hook_
code_entry
:
.long 0
.long 0
FUNCTION_END(INLINE_HOOK_TRAMPOLINE)
FUNCTION_START(CALL_ORIGIN_TRAMPOLINE)
ldr RegMethod, origin_art_method
ldr Reg0, addr_
origin
ldr RegMethod,
call_
origin_art_method
ldr Reg0, addr_
call_origin_code
br Reg0
origin_art_method:
call_
origin_art_method:
.long 0
.long 0
addr_
origin
:
addr_
call_origin_code
:
.long 0
.long 0
FUNCTION_END(CALL_ORIGIN_TRAMPOLINE)
...
...
hooklib/src/main/cpp/trampoline/trampoline.cpp
View file @
eb548da8
...
...
@@ -40,11 +40,9 @@ namespace SandHook {
public
:
void
setHookMethod
(
Code
hookMethod
)
{
codeCopy
(
reinterpret_cast
<
Code
>
(
&
hookMethod
),
OFFSET_REPLACEMENT_ADDR_ART_METHOD
,
BYTE_POINT
);
}
void
setEntryCodeOffset
(
Size
offSet
)
{
codeCopy
(
reinterpret_cast
<
Code
>
(
&
offSet
),
OFFSET_REPLACEMENT_OFFSET_ENTRY_CODE
,
BYTE_POINT
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
hookMethod
),
OFFSET_REPLACEMENT_ART_METHOD
,
BYTE_POINT
);
void
*
codeEntry
=
getEntryCodeAddr
(
hookMethod
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
codeEntry
),
OFFSET_REPLACEMENT_OFFSET_CODE_ENTRY
,
BYTE_POINT
);
}
protected
:
...
...
@@ -61,22 +59,26 @@ namespace SandHook {
public
:
void
setOriginMethod
(
Code
originMethod
)
{
codeCopy
(
reinterpret_cast
<
Code
>
(
&
originMethod
),
OFFSET_INLINE_ADDR_ORIGIN_METHOD
,
BYTE_POINT
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
originMethod
),
OFFSET_INLINE_ORIGIN_ART_METHOD
,
BYTE_POINT
);
void
*
codeEntry
=
getEntryCodeAddr
(
originMethod
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
codeEntry
),
OFFSET_INLINE_ADDR_ORIGIN_CODE_ENTRY
,
BYTE_POINT
);
}
void
setHookMethod
(
Code
hookMethod
)
{
codeCopy
(
reinterpret_cast
<
Code
>
(
&
hookMethod
),
OFFSET_INLINE_ADDR_HOOK_METHOD
,
BYTE_POINT
);
}
void
setEntryCodeOffset
(
Size
offSet
)
{
codeCopy
(
reinterpret_cast
<
Code
>
(
&
offSet
),
OFFSET_INLINE_OFFSET_ENTRY_CODE
,
BYTE_POINT
);
#if defined(__arm__)
Code32Bit
offset32
;
offset32
.
code
=
offSet
;
unsigned
char
offsetOP
=
isBigEnd
()
?
offset32
.
op
.
op2
:
offset32
.
op
.
op1
;
tweakOpImm
(
OFFSET_INLINE_OP_OFFSET_CODE
,
offsetOP
);
#endif
}
codeCopy
(
reinterpret_cast
<
Code
>
(
&
hookMethod
),
OFFSET_INLINE_HOOK_ART_METHOD
,
BYTE_POINT
);
void
*
codeEntry
=
getEntryCodeAddr
(
hookMethod
);
codeCopy
(
reinterpret_cast
<
Code
>
(
&
codeEntry
),
OFFSET_INLINE_ADDR_HOOK_CODE_ENTRY
,
BYTE_POINT
);
}
// void setEntryCodeOffset(Size offSet) {
// codeCopy(reinterpret_cast<Code>(&offSet), OFFSET_INLINE_OFFSET_ENTRY_CODE, BYTE_POINT);
// #if defined(__arm__)
// Code32Bit offset32;
// offset32.code = offSet;
// unsigned char offsetOP = isBigEnd() ? offset32.op.op2 : offset32.op.op1;
// tweakOpImm(OFFSET_INLINE_OP_OFFSET_CODE, offsetOP);
// #endif
// }
void
setOriginCode
(
Code
originCode
)
{
codeCopy
(
originCode
,
OFFSET_INLINE_ORIGIN_CODE
,
SIZE_DIRECT_JUMP_TRAMPOLINE
);
...
...
hooklib/src/main/cpp/trampoline/trampoline.h
View file @
eb548da8
...
...
@@ -41,37 +41,38 @@
#define OFFSET_INLINE_OFFSET_ENTRY_CODE 4 * 20
#define OFFSET_INLINE_ADDR_HOOK_METHOD 4 * 22
#elif defined(__arm__)
#define SIZE_REPLACEMENT_HOOK_TRAMPOLINE 4 *
6
#define OFFSET_REPLACEMENT_A
DDR_ART_METHOD 4 * 4
#define OFFSET_REPLACEMENT_OFFSET_
ENTRY_CODE 4 * 5
#define SIZE_REPLACEMENT_HOOK_TRAMPOLINE 4 *
5
#define OFFSET_REPLACEMENT_A
RT_METHOD 4 * 3
#define OFFSET_REPLACEMENT_OFFSET_
CODE_ENTRY 4 * 4
#define SIZE_DIRECT_JUMP_TRAMPOLINE 4 * 2
#define OFFSET_JUMP_ADDR_TARGET 4 * 1
#define SIZE_INLINE_HOOK_TRAMPOLINE 4 * 1
7
#define OFFSET_INLINE_ORIGIN_CODE 4 *
7
#define OFFSET_INLINE_O
P_OFFSET_CODE 4 * 10
#define OFFSET_INLINE_
OP_ORIGIN_OFFSET_CODE 4 * 12
#define OFFSET_INLINE_
ADDR_ORIGIN
_METHOD 4 * 14
#define OFFSET_INLINE_
OFFSET_ENTRY_CODE
4 * 15
#define OFFSET_INLINE_
ADDR_HOOK_METHOD 4 * 16
#define SIZE_INLINE_HOOK_TRAMPOLINE 4 * 1
6
#define OFFSET_INLINE_ORIGIN_CODE 4 *
6
#define OFFSET_INLINE_O
RIGIN_ART_METHOD 4 * 12
#define OFFSET_INLINE_
ADDR_ORIGIN_CODE_ENTRY 4 * 13
#define OFFSET_INLINE_
HOOK_ART
_METHOD 4 * 14
#define OFFSET_INLINE_
ADDR_HOOK_CODE_ENTRY
4 * 15
#define OFFSET_INLINE_
OP_ORIGIN_OFFSET_CODE 4 * 10
#define SIZE_CALL_ORIGIN_TRAMPOLINE 4 * 4
#define OFFSET_CALL_ORIGIN_ART_METHOD 4 * 2
#define OFFSET_CALL_ORIGIN_JUMP_ADDR 4 * 3
#elif defined(__aarch64__)
#define SIZE_REPLACEMENT_HOOK_TRAMPOLINE 4 *
9
#define OFFSET_REPLACEMENT_A
DDR_ART_METHOD 4 * 5
#define OFFSET_REPLACEMENT_OFFSET_
ENTRY_CODE 4 * 7
#define SIZE_REPLACEMENT_HOOK_TRAMPOLINE 4 *
8
#define OFFSET_REPLACEMENT_A
RT_METHOD 4 * 4
#define OFFSET_REPLACEMENT_OFFSET_
CODE_ENTRY 4 * 6
#define SIZE_DIRECT_JUMP_TRAMPOLINE 4 * 4
#define OFFSET_JUMP_ADDR_TARGET 4 * 2
#define SIZE_INLINE_HOOK_TRAMPOLINE 4 * 24
#define OFFSET_INLINE_ORIGIN_CODE 4 * 8
#define OFFSET_INLINE_ADDR_ORIGIN_METHOD 4 * 18
#define OFFSET_INLINE_OFFSET_ENTRY_CODE 4 * 20
#define OFFSET_INLINE_ADDR_HOOK_METHOD 4 * 22
#define SIZE_INLINE_HOOK_TRAMPOLINE 4 * 23
#define OFFSET_INLINE_ORIGIN_CODE 4 * 7
#define OFFSET_INLINE_ORIGIN_ART_METHOD 4 * 15
#define OFFSET_INLINE_ADDR_ORIGIN_CODE_ENTRY 4 * 17
#define OFFSET_INLINE_HOOK_ART_METHOD 4 * 19
#define OFFSET_INLINE_ADDR_HOOK_CODE_ENTRY 4 * 21
#define SIZE_CALL_ORIGIN_TRAMPOLINE 4 * 7
#define OFFSET_CALL_ORIGIN_ART_METHOD 4 * 3
...
...
@@ -128,6 +129,11 @@ namespace SandHook {
memcpy
(
code
,
tempCode
,
codeLen
);
flushCache
(
reinterpret_cast
<
Size
>
(
code
),
codeLen
);
}
void
setEntryCodeOffset
(
Size
offSet
)
{
this
->
codeEntryOffSet
=
offSet
;
}
void
codeCopy
(
Code
src
,
Size
targetOffset
,
Size
len
)
{
memcpy
(
reinterpret_cast
<
void
*>
((
Size
)
code
+
targetOffset
),
src
,
len
);
flushCache
((
Size
)
code
+
targetOffset
,
len
);
...
...
@@ -194,12 +200,22 @@ namespace SandHook {
return
reinterpret_cast
<
Code
>
(
addr
+
1
);
}
void
*
getEntryCodeAddr
(
void
*
method
)
{
return
reinterpret_cast
<
void
*>
((
Size
)
method
+
codeEntryOffSet
);
}
Code
getEntryCode
(
void
*
method
)
{
Code
entryCode
=
*
reinterpret_cast
<
Code
*>
((
Size
)
method
+
codeEntryOffSet
);
return
entryCode
;
}
protected
:
virtual
Size
codeLength
()
=
0
;
virtual
Code
templateCode
()
=
0
;
private
:
Code
tempCode
;
Size
codeLen
;
Size
codeEntryOffSet
;
bool
isThumb
=
false
;
};
...
...
hooklib/src/main/cpp/trampoline/trampoline_manager.cpp
View file @
eb548da8
...
...
@@ -88,9 +88,9 @@ namespace SandHook {
if
(
inlineHookTrampolineSpace
==
0
)
goto
label_error
;
inlineHookTrampoline
->
setExecuteSpace
(
inlineHookTrampolineSpace
);
inlineHookTrampoline
->
setEntryCodeOffset
(
quickCompileOffset
);
inlineHookTrampoline
->
setOriginMethod
(
reinterpret_cast
<
Code
>
(
originMethod
));
inlineHookTrampoline
->
setHookMethod
(
reinterpret_cast
<
Code
>
(
hookMethod
));
inlineHookTrampoline
->
setEntryCodeOffset
(
quickCompileOffset
);
if
(
inlineHookTrampoline
->
isThumbCode
())
{
inlineHookTrampoline
->
setOriginCode
(
inlineHookTrampoline
->
getThumbCodeAddress
(
getEntryCode
(
originMethod
)));
}
else
{
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment