Android下的挂钩(hook)和代码注入(inject)

void* get_remote_addr(pid_t target_pid, const char* module_name, void* local_addr)    
    {    
        void* local_handle, *remote_handle;    
        
        local_handle = get_module_base(-1, module_name);    
        remote_handle = get_module_base(target_pid, module_name);    
        
        DEBUG_PRINT("[+] get_remote_addr: local[%x], remote[%x]\n", local_handle, remote_handle);    
        
        void * ret_addr = (void *)((uint32_t)local_addr + (uint32_t)remote_handle - (uint32_t)local_handle);    
        
        #if defined(__i386__)    
        if (!strcmp(module_name, libc_path)) {    
            ret_addr += 2;    
        }    
        #endif    
        return ret_addr;    
    } 

    int ptrace_call_wrapper(pid_t target_pid, const char * func_name, void * func_addr, long * parameters, int param_num, struct pt by ZoomApp"  rel="nofollow noopener">REGS *  by ZoomApp"  rel="nofollow noopener">REGS)     
    {    
        DEBUG_PRINT("[+] Calling %s in target process.\n", func_name);    
        if (ptrace_call(target_pid, (uint32_t)func_addr, parameters, param_num,  by ZoomApp"  rel="nofollow noopener">REGS) == -1)    
            return -1;    
        
        if (ptrace_getregs(target_pid, regs) == -1)    
            return -1;    
        DEBUG_PRINT("[+] Target process returned from %s, return value=%x, pc=%x \n",     
                func_name, ptrace_retval(regs), ptrace_ip(regs));    
        return 0;    
    }

#elif defined(__i386__) 
    long ptrace_call(pid_t pid, uint32_t addr, long *params, uint32_t num_params, struct user by ZoomApp"  rel="nofollow noopener">REGS_struct *  by ZoomApp"  rel="nofollow noopener">REGS)    
    {    
         by ZoomApp"  rel="nofollow noopener">REGS->esp -= (num_params) * sizeof(long) ;    
        ptrace_writedata(pid, (void *)regs->esp, (uint8_t *)params, (num_params) * sizeof(long));    
        
        long tmp_addr = 0x00;    
        regs->esp -= sizeof(long);    
        ptrace_writedata(pid, regs->esp, (char *)&tmp_addr, sizeof(tmp_addr));     
        
        regs->eip = addr;    
        
        if (ptrace_setregs(pid, regs) == -1     
                || ptrace_continue( pid) == -1) {    
            printf("error\n");    
            return -1;    
        }    
        
        int stat = 0;  
        waitpid(pid, &stat, WUNTRACED);  
        while (stat != 0xb7f) {  
            if (ptrace_continue(pid) == -1) {  
                printf("error\n");  
                return -1;  
            }  
            waitpid(pid, &stat, WUNTRACED);  
        }  
        
        return 0;    
    }

unsigned int orig=0;  
    unsigned int store[3] = {0,0,0};  
    int jump_code[3] = {0xe59ff000, 0xe1a08008, 0};  
    //addr:目标函数地址，hookf:hook函数。 
    int hook_direct(unsigned int addr, void *hookf) 
    {  
        //设置hook函数 
        jump_code[2] = (unsigned int)hookf; 
        orig = addr;//保持好目标函数的地址 
        //备份前3个int
        for (i = 0; i < 3; i++)  
            store[i] = ((int*)addr)[i];  
        for (i = 0; i < 3; i++)  
            //修改为我们的跳转指令
            ((int*)orig)[i] = jump_code[i]   
        return 1;  
    }  
    void hook_func()//hook函数 
    {  
        printf(“hello\n”);
        //还原目标函数的头12个字节 
        for (i = 0; i < 3; i++)  
            ((int*)orig)[i] = store[i]  
        void(*orig_func)() = (void*)orig;  
        orig_func();//执行目标函数 
        //重新修改目标函数的头12个字节。
        for (i = 0; i < 3; i++)   
            ((int*)orig)[i] = jump_code[i];  
    }

int jump_pre_code[12] = {  
          0xe92d0008, 0xe1a0300f, 0xe283301c, 0xe583e000, 0xe89d0008,   
          0xe28dd004, 0xe1a0e00f, 0xe59ff008, 0xe59fe000, 0xe1a0f00e,0,0  
        };  
    Jump_pre_code[11]= (unsigned int)hookf;  
    for(int i = 0; i<12; i++)
         jump_code[i+2] = jump_pre_code[i];

int (*my_lua_call)(lua_State *, int, int) = NULL;  
    int (*my_luaL_loadstring)(lua_State*, const char *) =NULL;  
    //目标进程lua_pushstring的hook函数，调用lua_pushstring时会先调用它 
    void my_lua_pushstring (lua_State *L, const char* str); 
    {  
        int (*orig_lua_isuserdata)(lua_State *L, int idx);  
        //得到原函数 
        orig_lua_pushstring = (void*)eph.orig;  
        log("start hook func..precall...\n");  
        hook_precall(&eph);  //还原原函数首地址 
        orig_lua_pushstring (L, str);//调用原函数。 
        if (counter) {  
            log("lua_pushstring() called\n");  
            counter--;  
            if (!counter)  
                log("removing hook for lua_pushstring ()\n");  
        }  
        //如果找到了lua_call和luaL_loadstring的话就执行自己的lua代码。
        if(my_lua_call!=NULL&&my_luaL_loadstring!=NULL)   
        {  
            my_luaL_loadstring(L, LUACODE);  
            my_lua_call(L,0,0);  
        }  
        hook_postcall(&eph);//备份 
    }  
    void my_init(void) //so注入成功后会调用这个函数 
    {  
        counter = 3;  
      
        log("%s my_init started\n", __FILE__);  
        set_logfunction(my_log);  
        unsigned long int lua_call_addr;  
        unsigned long int lua_loadstring_addr;  
        //在进程中找lua_call函数地址 
        find_name(getpid(),"lua_call", soname, &lua_call_addr);  
        //在目标进程中找luaL_loadstring函数地址.
        find_name(getpid(), "luaL_loadstring",soname, 
        &lua_loadstring_addr);  
        my_lua_call = lua_call_addr;  
        my_luaL_loadstring = lua_loadstring_addr;  
        log("lua_call addr:%p, luaL_loadstring addr:%p\n", lua_call_addr, lua_loadstring_addr);  
        //执行hook。
        hook(&eph, getpid(), soname, "lua_pushstring", my_lua_pushstring_arm, my_lua_pushstring);  
    }