Unverified Commit eb548da8 authored by ganyao114's avatar ganyao114 Committed by GitHub

Merge pull request #1 from ganyao114/trampoline_rewrite

Trampoline rewrite
parents 14200bef e5e9b351
......@@ -2,6 +2,7 @@ package com.swift.sandhook;
import android.app.Application;
import com.swift.sandhook.testHookers.AbsHooker;
import com.swift.sandhook.testHookers.ActivityHooker;
import com.swift.sandhook.testHookers.CtrHook;
import com.swift.sandhook.testHookers.CustmizeHooker;
......@@ -15,11 +16,13 @@ public class MyApp extends Application {
public void onCreate() {
super.onCreate();
try {
SandHook.addHookClass(JniHooker.class,CtrHook.class,
SandHook.addHookClass(JniHooker.class,
CtrHook.class,
LogHooker.class,
CustmizeHooker.class,
ActivityHooker.class,
ObjectHooker.class);
ObjectHooker.class,
AbsHooker.class);
} catch (HookErrorException e) {
e.printStackTrace();
}
......
package com.swift.sandhook.testHookers;
import android.util.Log;
import com.swift.sandhook.wrapper.HookClass;
import com.swift.sandhook.wrapper.HookMethod;
import com.swift.sandhook.wrapper.HookMethodBackup;
@HookClass(Runnable.class)
public class AbsHooker {
@HookMethod("run")
public static void onRun(Object thiz) {
Log.e("AbsHooker", "Runnable hook success ");
onRunBackup(thiz);
}
@HookMethodBackup("run")
public static void onRunBackup(Object thiz) {
onRunBackup(thiz);
}
}
......@@ -9,12 +9,11 @@
FUNCTION_START(REPLACEMENT_HOOK_TRAMPOLINE)
ldr RegMethod, addr_art_method
ldr Reg0, offset_entry_code
add Reg0, RegMethod, Reg0
ldr Reg0, addr_code_entry
ldr pc, [Reg0]
addr_art_method:
.long 0
offset_entry_code:
addr_code_entry:
.long 0
FUNCTION_END(REPLACEMENT_HOOK_TRAMPOLINE)
......@@ -29,34 +28,34 @@ FUNCTION_END(DIRECT_JUMP_TRAMPOLINE)
FUNCTION_START(INLINE_HOOK_TRAMPOLINE)
ldr Reg0, addr_origin_art_method
ldr Reg0, origin_art_method
cmp RegMethod, Reg0
bne origin_code
ldr RegMethod, addr_hook_art_method
ldr Reg0, offset_entry_code2
add Reg0, RegMethod, Reg0
ldr RegMethod, hook_art_method
ldr Reg0, addr_hook_code_entry
ldr pc, [Reg0]
origin_code:
.long 0
.long 0
ldr Reg0, addr_origin_art_method
add Reg0, Reg0, #8
ldr Reg0, addr_origin_code_entry
ldr Reg0, [Reg0]
add Reg0, Reg0, SIZE_JUMP
mov pc, Reg0
addr_origin_art_method:
origin_art_method:
.long 0
addr_origin_code_entry:
.long 0
offset_entry_code2:
hook_art_method:
.long 0
addr_hook_art_method:
addr_hook_code_entry:
.long 0
FUNCTION_END(INLINE_HOOK_TRAMPOLINE)
FUNCTION_START(CALL_ORIGIN_TRAMPOLINE)
ldr RegMethod, origin_art_method
ldr RegMethod, origin_method
ldr pc, addr_origin
origin_art_method:
origin_method:
.long 0
addr_origin:
.long 0
......@@ -72,7 +71,7 @@ FUNCTION_END(DIRECT_JUMP_TRAMPOLINE_T)
FUNCTION_START_T(INLINE_HOOK_TRAMPOLINE_T)
//4 byte
ldr RegT, addr_origin_art_method_t
ldr RegT, origin_art_method_t
//2 byte
cmp RegMethod, RegT
nop
......@@ -80,12 +79,9 @@ FUNCTION_START_T(INLINE_HOOK_TRAMPOLINE_T)
bne origin_code_t
nop
//4 byte
ldr RegMethod, addr_hook_art_method_t
ldr RegMethod, hook_art_method_t
//4 byte
ldr RegT, offset_entry_code2_t
//2 byte
add RegT, RegMethod, RegT
nop
ldr RegT, addr_hook_code_entry_t
//4 byte
ldr pc, [RegT]
origin_code_t:
......@@ -94,9 +90,7 @@ origin_code_t:
//4 byte
.long 0
//4 byte
ldr RegT, addr_origin_art_method_t
//4 byte
add RegT, RegT, #36
ldr RegT, addr_origin_code_entry_t
//4 byte
ldr RegT, [RegT]
//4 byte
......@@ -104,18 +98,20 @@ origin_code_t:
//2 byte
mov pc, RegT
nop
addr_origin_art_method_t:
origin_art_method_t:
.long 0
offset_entry_code2_t:
addr_origin_code_entry_t:
.long 0
addr_hook_art_method_t:
hook_art_method_t:
.long 0
addr_hook_code_entry_t:
.long 0
FUNCTION_END(INLINE_HOOK_TRAMPOLINE_T)
FUNCTION_START_T(CALL_ORIGIN_TRAMPOLINE_T)
ldr RegMethod, origin_art_method_t
ldr RegMethod, origin_method_t
ldr pc, addr_origin_t
origin_art_method_t:
origin_method_t:
.long 0
addr_origin_t:
.long 0
......
......@@ -67,20 +67,19 @@ Stub 中有使用
#if defined(__aarch64__)
#define Reg0 x16
#define Reg1 x17
#define Reg0 x17
#define Reg1 x16
#define RegMethod x0
FUNCTION_START(REPLACEMENT_HOOK_TRAMPOLINE)
ldr RegMethod, addr_art_method
ldr Reg0, offset_entry_code
add Reg0, RegMethod, Reg0
ldr Reg0, addr_code_entry
ldr Reg0, [Reg0]
br Reg0
addr_art_method:
.long 0
.long 0
offset_entry_code:
addr_code_entry:
.long 0
.long 0
FUNCTION_END(REPLACEMENT_HOOK_TRAMPOLINE)
......@@ -95,44 +94,44 @@ addr_target:
FUNCTION_END(DIRECT_JUMP_TRAMPOLINE)
FUNCTION_START(INLINE_HOOK_TRAMPOLINE)
ldr Reg1, addr_origin_art_method
cmp RegMethod, Reg1
ldr Reg0, origin_art_method
cmp RegMethod, Reg0
bne origin_code
ldr RegMethod, addr_hook_art_method
ldr Reg1, offset_entry_code2
add Reg1, RegMethod, Reg1
ldr Reg1, [Reg1]
br Reg1
ldr RegMethod, hook_art_method
ldr Reg0, addr_hook_code_entry
ldr Reg0, [Reg0]
br Reg0
origin_code:
.long 0
.long 0
.long 0
.long 0
ldr Reg0, addr_origin_art_method
ldr Reg1, offset_entry_code2
add Reg1, Reg0, Reg1
ldr Reg1, [Reg1]
add Reg1, Reg1, SIZE_JUMP
br Reg1
addr_origin_art_method:
ldr Reg0, addr_origin_code_entry
ldr Reg0, [Reg0]
add Reg0, Reg0, SIZE_JUMP
br Reg0
origin_art_method:
.long 0
.long 0
addr_origin_code_entry:
.long 0
.long 0
offset_entry_code2:
hook_art_method:
.long 0
.long 0
addr_hook_art_method:
addr_hook_code_entry:
.long 0
.long 0
FUNCTION_END(INLINE_HOOK_TRAMPOLINE)
FUNCTION_START(CALL_ORIGIN_TRAMPOLINE)
ldr RegMethod, origin_art_method
ldr Reg0, addr_origin
ldr RegMethod, call_origin_art_method
ldr Reg0, addr_call_origin_code
br Reg0
origin_art_method:
call_origin_art_method:
.long 0
.long 0
addr_origin:
addr_call_origin_code:
.long 0
.long 0
FUNCTION_END(CALL_ORIGIN_TRAMPOLINE)
......
......@@ -40,11 +40,9 @@ namespace SandHook {
public:
void setHookMethod(Code hookMethod) {
codeCopy(reinterpret_cast<Code>(&hookMethod), OFFSET_REPLACEMENT_ADDR_ART_METHOD, BYTE_POINT);
}
void setEntryCodeOffset(Size offSet) {
codeCopy(reinterpret_cast<Code>(&offSet), OFFSET_REPLACEMENT_OFFSET_ENTRY_CODE, BYTE_POINT);
codeCopy(reinterpret_cast<Code>(&hookMethod), OFFSET_REPLACEMENT_ART_METHOD, BYTE_POINT);
void* codeEntry = getEntryCodeAddr(hookMethod);
codeCopy(reinterpret_cast<Code>(&codeEntry), OFFSET_REPLACEMENT_OFFSET_CODE_ENTRY, BYTE_POINT);
}
protected:
......@@ -61,22 +59,26 @@ namespace SandHook {
public:
void setOriginMethod(Code originMethod) {
codeCopy(reinterpret_cast<Code>(&originMethod), OFFSET_INLINE_ADDR_ORIGIN_METHOD, BYTE_POINT);
codeCopy(reinterpret_cast<Code>(&originMethod), OFFSET_INLINE_ORIGIN_ART_METHOD, BYTE_POINT);
void* codeEntry = getEntryCodeAddr(originMethod);
codeCopy(reinterpret_cast<Code>(&codeEntry), OFFSET_INLINE_ADDR_ORIGIN_CODE_ENTRY, BYTE_POINT);
}
void setHookMethod(Code hookMethod) {
codeCopy(reinterpret_cast<Code>(&hookMethod), OFFSET_INLINE_ADDR_HOOK_METHOD, BYTE_POINT);
}
void setEntryCodeOffset(Size offSet) {
codeCopy(reinterpret_cast<Code>(&offSet), OFFSET_INLINE_OFFSET_ENTRY_CODE, BYTE_POINT);
#if defined(__arm__)
Code32Bit offset32;
offset32.code = offSet;
unsigned char offsetOP = isBigEnd() ? offset32.op.op2 : offset32.op.op1;
tweakOpImm(OFFSET_INLINE_OP_OFFSET_CODE, offsetOP);
#endif
}
codeCopy(reinterpret_cast<Code>(&hookMethod), OFFSET_INLINE_HOOK_ART_METHOD, BYTE_POINT);
void* codeEntry = getEntryCodeAddr(hookMethod);
codeCopy(reinterpret_cast<Code>(&codeEntry), OFFSET_INLINE_ADDR_HOOK_CODE_ENTRY, BYTE_POINT);
}
// void setEntryCodeOffset(Size offSet) {
// codeCopy(reinterpret_cast<Code>(&offSet), OFFSET_INLINE_OFFSET_ENTRY_CODE, BYTE_POINT);
// #if defined(__arm__)
// Code32Bit offset32;
// offset32.code = offSet;
// unsigned char offsetOP = isBigEnd() ? offset32.op.op2 : offset32.op.op1;
// tweakOpImm(OFFSET_INLINE_OP_OFFSET_CODE, offsetOP);
// #endif
// }
void setOriginCode(Code originCode) {
codeCopy(originCode, OFFSET_INLINE_ORIGIN_CODE, SIZE_DIRECT_JUMP_TRAMPOLINE);
......
......@@ -41,37 +41,38 @@
#define OFFSET_INLINE_OFFSET_ENTRY_CODE 4 * 20
#define OFFSET_INLINE_ADDR_HOOK_METHOD 4 * 22
#elif defined(__arm__)
#define SIZE_REPLACEMENT_HOOK_TRAMPOLINE 4 * 6
#define OFFSET_REPLACEMENT_ADDR_ART_METHOD 4 * 4
#define OFFSET_REPLACEMENT_OFFSET_ENTRY_CODE 4 * 5
#define SIZE_REPLACEMENT_HOOK_TRAMPOLINE 4 * 5
#define OFFSET_REPLACEMENT_ART_METHOD 4 * 3
#define OFFSET_REPLACEMENT_OFFSET_CODE_ENTRY 4 * 4
#define SIZE_DIRECT_JUMP_TRAMPOLINE 4 * 2
#define OFFSET_JUMP_ADDR_TARGET 4 * 1
#define SIZE_INLINE_HOOK_TRAMPOLINE 4 * 17
#define OFFSET_INLINE_ORIGIN_CODE 4 * 7
#define OFFSET_INLINE_OP_OFFSET_CODE 4 * 10
#define OFFSET_INLINE_OP_ORIGIN_OFFSET_CODE 4 * 12
#define OFFSET_INLINE_ADDR_ORIGIN_METHOD 4 * 14
#define OFFSET_INLINE_OFFSET_ENTRY_CODE 4 * 15
#define OFFSET_INLINE_ADDR_HOOK_METHOD 4 * 16
#define SIZE_INLINE_HOOK_TRAMPOLINE 4 * 16
#define OFFSET_INLINE_ORIGIN_CODE 4 * 6
#define OFFSET_INLINE_ORIGIN_ART_METHOD 4 * 12
#define OFFSET_INLINE_ADDR_ORIGIN_CODE_ENTRY 4 * 13
#define OFFSET_INLINE_HOOK_ART_METHOD 4 * 14
#define OFFSET_INLINE_ADDR_HOOK_CODE_ENTRY 4 * 15
#define OFFSET_INLINE_OP_ORIGIN_OFFSET_CODE 4 * 10
#define SIZE_CALL_ORIGIN_TRAMPOLINE 4 * 4
#define OFFSET_CALL_ORIGIN_ART_METHOD 4 * 2
#define OFFSET_CALL_ORIGIN_JUMP_ADDR 4 * 3
#elif defined(__aarch64__)
#define SIZE_REPLACEMENT_HOOK_TRAMPOLINE 4 * 9
#define OFFSET_REPLACEMENT_ADDR_ART_METHOD 4 * 5
#define OFFSET_REPLACEMENT_OFFSET_ENTRY_CODE 4 * 7
#define SIZE_REPLACEMENT_HOOK_TRAMPOLINE 4 * 8
#define OFFSET_REPLACEMENT_ART_METHOD 4 * 4
#define OFFSET_REPLACEMENT_OFFSET_CODE_ENTRY 4 * 6
#define SIZE_DIRECT_JUMP_TRAMPOLINE 4 * 4
#define OFFSET_JUMP_ADDR_TARGET 4 * 2
#define SIZE_INLINE_HOOK_TRAMPOLINE 4 * 24
#define OFFSET_INLINE_ORIGIN_CODE 4 * 8
#define OFFSET_INLINE_ADDR_ORIGIN_METHOD 4 * 18
#define OFFSET_INLINE_OFFSET_ENTRY_CODE 4 * 20
#define OFFSET_INLINE_ADDR_HOOK_METHOD 4 * 22
#define SIZE_INLINE_HOOK_TRAMPOLINE 4 * 23
#define OFFSET_INLINE_ORIGIN_CODE 4 * 7
#define OFFSET_INLINE_ORIGIN_ART_METHOD 4 * 15
#define OFFSET_INLINE_ADDR_ORIGIN_CODE_ENTRY 4 * 17
#define OFFSET_INLINE_HOOK_ART_METHOD 4 * 19
#define OFFSET_INLINE_ADDR_HOOK_CODE_ENTRY 4 * 21
#define SIZE_CALL_ORIGIN_TRAMPOLINE 4 * 7
#define OFFSET_CALL_ORIGIN_ART_METHOD 4 * 3
......@@ -128,6 +129,11 @@ namespace SandHook {
memcpy(code, tempCode, codeLen);
flushCache(reinterpret_cast<Size>(code), codeLen);
}
void setEntryCodeOffset(Size offSet) {
this->codeEntryOffSet = offSet;
}
void codeCopy(Code src, Size targetOffset, Size len) {
memcpy(reinterpret_cast<void*>((Size)code + targetOffset), src, len);
flushCache((Size)code + targetOffset, len);
......@@ -194,12 +200,22 @@ namespace SandHook {
return reinterpret_cast<Code>(addr + 1);
}
void* getEntryCodeAddr(void* method) {
return reinterpret_cast<void*>((Size)method + codeEntryOffSet);
}
Code getEntryCode(void* method) {
Code entryCode = *reinterpret_cast<Code*>((Size)method + codeEntryOffSet);
return entryCode;
}
protected:
virtual Size codeLength() = 0;
virtual Code templateCode() = 0;
private:
Code tempCode;
Size codeLen;
Size codeEntryOffSet;
bool isThumb = false;
};
......
......@@ -88,9 +88,9 @@ namespace SandHook {
if (inlineHookTrampolineSpace == 0)
goto label_error;
inlineHookTrampoline->setExecuteSpace(inlineHookTrampolineSpace);
inlineHookTrampoline->setEntryCodeOffset(quickCompileOffset);
inlineHookTrampoline->setOriginMethod(reinterpret_cast<Code>(originMethod));
inlineHookTrampoline->setHookMethod(reinterpret_cast<Code>(hookMethod));
inlineHookTrampoline->setEntryCodeOffset(quickCompileOffset);
if (inlineHookTrampoline->isThumbCode()) {
inlineHookTrampoline->setOriginCode(inlineHookTrampoline->getThumbCodeAddress(getEntryCode(originMethod)));
} else {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment