ava代码注入java代码注入_动态注入并执行Android代码到进程

layout: post

title: 动态注入并执行Android代码到进程

categories: Android

description: 动态注入并执行Android代码到进程

keywords: Inject

url: https://lichao890427.github.io/ https://github.com/lichao890427/

动态注入并执行Android代码到进程

背景

网上可以见到很多帖子是如何注入进程并钩取c层api的例子&＃xff0c;而动态的让目标进程加载一个dex并执行这个dex却没看到&＃xff0c;c层的注入很简单&＃xff0c;可以参考adbi&＃xff0c;ptrace进去修改当前指令指针寄存器&＃xff0c;构造一个dlopen的指令并调用&＃xff0c;类似于win上getcontext修改eip&＃xff0c; java层稍复杂一些&＃xff0c;加载dex->解析dex->查找目标类->调用函数,下面是测试用例,我们的目标是打log

代码

import android.util.Log;

public class injectjava {

static void initialize(){

Log.i("INJECTJAVA","injectava called");

}

}

#define LOGI(...) __android_log_print(ANDROID_LOG_ERROR, "INJECTJAVA", __VA_ARGS__)

#define DEXNAME "/data/local/tmp/inject.dex"

typedef void Object;

typedef void ClassObject;

typedef void Thread;

typedef uint8_t u1;

typedef uint32_t u4;

struct JNIEnvExt

{

const struct JNINativeInterface* funcTable;

const struct JNINativeInterface* baseFuncTable;

u4 envThreadId;

Thread* self;

};

typedef void DexOptHeader;

typedef void DexStringId;

typedef void DexTypeId;

typedef void DexFieldId;

typedef void DexMethodId;

typedef void DexProtoId;

typedef void DexLink;

typedef void DexClassLookup;

struct DexHeader

{

u1 magic[8]; /* includes version number */

u4 checksum; /* adler32 checksum */

u1 signature[20]; /* SHA-1 hash */

u4 fileSize; /* length of entire file */

u4 headerSize; /* offset to start of next section */

u4 endianTag;

u4 linkSize;

u4 linkOff;

u4 mapOff;

u4 stringIdsSize;

u4 stringIdsOff;

u4 typeIdsSize;

u4 typeIdsOff;

u4 protoIdsSize;

u4 protoIdsOff;

u4 fieldIdsSize;

u4 fieldIdsOff;

u4 methodIdsSize;

u4 methodIdsOff;

u4 classDefsSize;

u4 classDefsOff;

u4 dataSize;

u4 dataOff;

};

struct DexClassDef

{

u4 classIdx; /* index into typeIds for this class */

u4 accessFlags;

u4 superclassIdx; /* index into typeIds for superclass */

u4 interfacesOff; /* file offset to DexTypeList */

u4 sourceFileIdx; /* index into stringIds for source file name */

u4 annotationsOff; /* file offset to annotations_directory_item */

u4 classDataOff; /* file offset to class_data_item */

u4 staticValuesOff; /* file offset to DexEncodedArray */

};

struct DexFile

{

DexOptHeader *pOptHeader;

DexHeader *pHeader;

DexStringId *pStringIds;

DexTypeId *pTypeIds;

DexFieldId *pFieldIds;

DexMethodId *pMethodIds;

DexProtoId *pProtoIds;

DexClassDef *pClassDefs;

DexLink *pLinkData;

DexClassLookup *pClassLookup;

};

struct DvmDex

{

DexFile* pDexFile;

};

int (*dvmDexFileOpenPartial)(const void* addr, int len, DvmDex** ppDvmDex)&＃61;0;

int (*dexSwapAndVerify)(void* addr, int len)&＃61;0;

JNIEnv* (*dvmGetJNIEnvForThread)()&＃61;0;

Object* (*dvmDecodeIndirectRef)(JNIEnv* env, jobject jobj)&＃61;0;

Object* (*dvmDecodeIndirectRef_)(Thread* self, jobject jobj)&＃61;0;

ClassObject* (*dvmDefineClass)(DvmDex* pDvmDex, const char* descriptor, Object* classLoader)&＃61;0;

DexClassLookup* (*dexCreateClassLookup)(DexFile* pDexFile)&＃61;0;

void inject()

{

/*

* C层hook

*/

/*

* JAVA层hook

*/

//获取关键函数指针

do

{

void* hdvm &＃61; dlopen("libdvm.so", RTLD_LAZY | RTLD_GLOBAL);

if(!hdvm)

{

LOGI("libdvm not exist!");

break;

}

dvmDexFileOpenPartial &＃61; (typeof(dvmDexFileOpenPartial))dlsym(hdvm, "dvmDexFileOpenPartial");

if(!dvmDexFileOpenPartial)

{

dvmDexFileOpenPartial &＃61; (typeof(dvmDexFileOpenPartial))dlsym(hdvm, "_Z21dvmDexFileOpenPartialPKviPP6DvmDex");

if(!dvmDexFileOpenPartial)

LOGI("dvmDexFileOpenPartial not exist!");

}

dexSwapAndVerify &＃61; (typeof(dexSwapAndVerify))dlsym(hdvm, "dexSwapAndVerify");

if(!dexSwapAndVerify)

{

dexSwapAndVerify &＃61; (typeof(dexSwapAndVerify))dlsym(hdvm, "_Z16dexSwapAndVerifyPhi");

if(!dexSwapAndVerify)

LOGI("dexSwapAndVerify not exist!");

}

dvmGetJNIEnvForThread &＃61; (typeof(dvmGetJNIEnvForThread))dlsym(hdvm, "dvmGetJNIEnvForThread");

if(!dvmGetJNIEnvForThread)

{

dvmGetJNIEnvForThread &＃61; (typeof(dvmGetJNIEnvForThread))dlsym(hdvm, "_Z21dvmGetJNIEnvForThreadv");

if(!dvmGetJNIEnvForThread)

LOGI("dvmGetJNIEnvForThread not exist!");

}

dvmDecodeIndirectRef &＃61; (typeof(dvmDecodeIndirectRef))dlsym(hdvm, "dvmDecodeIndirectRef");

if(!dvmDecodeIndirectRef)

{

dvmDecodeIndirectRef &＃61; (typeof(dvmDecodeIndirectRef))dlsym(hdvm, "_Z20dvmDecodeIndirectRefP7_JNIEnvP8_jobject");

if(!dvmDecodeIndirectRef)

{

dvmDecodeIndirectRef_ &＃61; (typeof(dvmDecodeIndirectRef_))dlsym(hdvm, "_Z20dvmDecodeIndirectRefP6ThreadP8_jobject");

if(!dvmDecodeIndirectRef_)

LOGI("dvmDecodeIndirectRef_ not exist!");

}

}

dvmDefineClass &＃61; (typeof(dvmDefineClass))dlsym(hdvm, "dvmDefineClass");

if(!dvmDefineClass)

{

dvmDefineClass &＃61; (typeof(dvmDefineClass))dlsym(hdvm, "_Z14dvmDefineClassP6DvmDexPKcP6Object");

if(!dvmDefineClass)

LOGI("dvmDefineClass not exist!");

}

dexCreateClassLookup &＃61; (typeof(dexCreateClassLookup))dlsym(hdvm, "dexCreateClassLookup");

if(!dexCreateClassLookup)

{

dexCreateClassLookup &＃61; (typeof(dexCreateClassLookup))dlsym(hdvm, "_Z20dexCreateClassLookupP7DexFile");

if(!dexCreateClassLookup)

LOGI("dexCreateClassLookup not exist!");

}

if(!dvmDexFileOpenPartial || !dexSwapAndVerify || !dvmGetJNIEnvForThread || !dvmDefineClass || !dexCreateClassLookup || (!dvmDecodeIndirectRef && !dvmDecodeIndirectRef_))

break;

LOGI("InitOk");

//读取dex以便动态加载

char* dexdata &＃61; 0;

int dexlen;

int dexfd &＃61; open(DEXNAME, O_RDONLY);

if(dexfd &＃61;&＃61; -1)

{

LOGI("can&＃39;t open inject.dex!");

break;

}

struct stat st &＃61; {0};

fstat(dexfd , &st);

if(st.st_size)

{

dexlen &＃61; st.st_size;

dexdata &＃61; (char*)malloc(st.st_size);

if(dexdata)

read(dexfd, dexdata, st.st_size);

}

close(dexfd);

if(!dexdata)

{

LOGI("read inject.dex fail!");

break;

}

int result;

DvmDex* dvmDex &＃61; 0;

JNIEnv* env &＃61;0;

jclass java_lang_Class &＃61;0;

jmethodID java_lang_Class_forName &＃61;0;

jclass java_lang_ClassLoader &＃61;0;

jmethodID java_lang_ClassLoader_getSystemClassLoader &＃61;0;

jobject jSystemClassLoader &＃61;0;

Object* SystemClassLoader &＃61;0;

jstring com_injectjava_str &＃61;0;

jclass com_injectjava &＃61;0;

jmethodID com_injectjava_initialize &＃61;0;

DexFile* pDexFile &＃61; 0;

int csize,i;

dexSwapAndVerify(dexdata, dexlen);

result &＃61; dvmDexFileOpenPartial(dexdata, dexlen, &dvmDex);

if(result !&＃61; 0)

{

LOGI("dvmDexFileOpenPartial fail!");

goto END1;

}

env &＃61; dvmGetJNIEnvForThread();

if(!env)

{

LOGI("dvmGetJNIEnvForThread fail!");

goto END1;

}

java_lang_Class &＃61; env->FindClass("java/lang/Class");

if(!java_lang_Class)

{

LOGI("java_lang_Class null!");

goto END1;

}

java_lang_Class_forName &＃61; env->GetStaticMethodID(java_lang_Class, "forName", "(Ljava/lang/String;ZLjava/lang/ClassLoader;)Ljava/lang/Class;");

if(!java_lang_Class_forName)

{

LOGI("java_lang_Class_forName null!");

goto END1;

}

java_lang_ClassLoader &＃61; env->FindClass("java/lang/ClassLoader");

if(!java_lang_ClassLoader)

{

LOGI("java_lang_ClassLoader null!");

goto END1;

}

java_lang_ClassLoader_getSystemClassLoader &＃61; env->GetStaticMethodID(java_lang_ClassLoader, "getSystemClassLoader", "()Ljava/lang/ClassLoader;");

if(!java_lang_ClassLoader_getSystemClassLoader)

{

LOGI("java_lang_ClassLoader_getSystemClassLoader null!");

goto END1;

}

jSystemClassLoader &＃61; env->CallStaticObjectMethod(java_lang_ClassLoader, java_lang_ClassLoader_getSystemClassLoader, "()Ljava/lang/ClassLoader;");

if(!jSystemClassLoader)

{

LOGI("jSystemClassLoader null!");

goto END1;

}

LOGI("InitOk1");

if(dvmDecodeIndirectRef)

SystemClassLoader &＃61; dvmDecodeIndirectRef(env, jSystemClassLoader);

else

SystemClassLoader &＃61; dvmDecodeIndirectRef_(((JNIEnvExt*)env)->self, jSystemClassLoader);

if(!SystemClassLoader)

{

LOGI("SystemClassLoader null!");

goto END1;

}

pDexFile &＃61; dvmDex->pDexFile;

pDexFile->pClassLookup &＃61; dexCreateClassLookup(dvmDex->pDexFile);

csize &＃61; pDexFile->pHeader->classDefsSize;

for(i&＃61;0;i

{

pDexFile->pClassDefs[i].accessFlags | 0x10000;

}

dvmDefineClass(dvmDex, "Lcom/injectjava;", SystemClassLoader);

com_injectjava_str &＃61; env->NewStringUTF("com.injectjava");

if(!com_injectjava_str)

{

LOGI("com_injectjava null!");

goto END1;

}

com_injectjava &＃61; (jclass)env->CallStaticObjectMethod(java_lang_Class, java_lang_Class_forName, com_injectjava_str, true, jSystemClassLoader);

if(!com_injectjava)

{

LOGI("com_injectjava null!");

goto END1;

}

com_injectjava_initialize &＃61; env->GetStaticMethodID(com_injectjava, "initialize", "()V");

if(!com_injectjava_initialize)

{

LOGI("com_injectjava_initialize null!");

goto END1;

}

env->CallStaticVoidMethod(com_injectjava, com_injectjava_initialize);

LOGI("InitOk2");

END1:

free(dexdata);

}

while(false);

}

结论

将要执行的dex放到/data/local/tmp/inject.dex即可

06-03 15:47:34.984 16197-16197/com.example.hellojni E/INJECTJAVA: InitOk

06-03 15:47:35.074 16197-16197/com.example.hellojni E/INJECTJAVA: InitOk1

06-03 15:54:08.304 16197-16197/com.example.hellojni I/INJECTJAVA: injectava called

这里只是做实验验证Java代码的注入原理分析&＃xff0c;Frida注入框架是这类动态注入的最佳实践框架