Comments (10)
你是怎么判断new_mmap和new_munmap没有被执行到的?
因为hook是在so库被加载到内存之后才进行的,是否有可能在你的测试中libart.so后续没有再调用mmap了?
from xhook.
我试了另外一个plt hook https://github.com/MelonWXD/ELFHooker,这个可以执行到新的mmap函数
ELFHooker的例子
//got hook
ElfReader elfReader(LIB_ART_PATH, art_base);
if (0 != elfReader.parse()) {
LOGE("failed to parse %s in %d maps at %p", LIB_ART_PATH, getpid(), art_base);
return;
}
elfReader.hook("open", (void *)new_open, (void **)&old_open);
elfReader.hook("read", (void *)new_read, (void **)&old_read);
elfReader.hook("mmap", (void *)new_mmap, (void **)&old_mmap);
elfReader.hook("munmap", (void *)new_munmap, (void **)&old_munmap);
elfReader.hook("__read_chk", (void *)new_read_chk, (void **)&old_read_chk);
elfReader.hook("fstat", (void *)new_fstat, (void **)&old_fstat);
elfReader.hook("fork", (void *)new_fork, (void **)&old_fork);
用ELFHooker可以执行到新的fake函数
用xhook只执行了new_open函数,后面几个函数都没跳过去
from xhook.
@woxihuannisja
Hi,
我看了下https://github.com/MelonWXD/ELFHooker 中ELFHooker部分的代码,PLT/GOT定位的核心逻辑和xhook是一样的。而且你说open是hook成功的,对于 PLT/GOT hook来说,具体hook哪个函数不应该存在差异。
我这里目前没找到可用的Nexus5,找了一台Mi3(也是arm 32bit)试了下,是可以hook到libart.so的mmap的。
怀疑的点有两个,不知道你是否有时间,能否帮忙验证一下:
1。是否触发了 xhook 自身的段错误保护(SFP),这个可以升级到最新版本的xhook,然后在refresh之前调用一次xhook_enable_sigsegv_protection(0)来关闭SFP,再执行refresh,如果APP崩溃了,说明遇到了问题。
2。xhook 和 ELFHooker 的指令缓存刷新操作不同。xhook使用的是__builtin___clear_cache,这个是兼容 32-bit和64-bit arch的调用。ELFHooker使用的是syscall(0xf0002, start, end),这个只能适用于 32-bit arch。能够帮忙试一下,在xh_util.c的xh_util_flush_instruction_cache函数中,将:
__builtin___clear_cache((void *)PAGE_START(addr), (void *)PAGE_END(addr));
修改为:
syscall(0xf0002, (void *)PAGE_START(addr), (void *)PAGE_END(addr));
十分感谢!!
from xhook.
@caikelun
我试了xhook_enable_sigsegv_protection(0)和syscall 还是没有效果
我是想在加载dex之前 hook函数
正常来说加载dex的操作 libart会调用open mmap 函数
使用xhook之后,
我用ida调试 在plt的mmap,open过渡函数下了断点,然后执行加载dex操作,也只有plt中的open函数断下来了
我在nexus5 红米note4x上测试都不行
感觉不是段错误问题,程序执行起来了,只是新的mmap和原mmap都不能执行
from xhook.
@woxihuannisja 比较诡异。。而且根据你最初的描述,你用ida动态调试能看到got里mmap的函数地址其实是替换成功了?
如果只对libart.so hook mmap这一个函数,能被hook到正常跑吗?
from xhook.
@caikelun
hook之后 libart.so里面的got表已经替换为new_mmap函数了
hook之后,执行加载dex的操作,libart.so也没有执行原始的mmap函数了,我在libc的mmap函数也下了断点
xhook只是改了got表吗?
如果没有hook成功我的程序是跑不起来的
from xhook.
@woxihuannisja “libart.so也没有执行原始的mmap函数了”?有点糊涂了 @_@
from xhook.
@woxihuannisja 方便的话能weixin或者qq吗?能把联系方式发我邮箱([email protected])吗?我加你~
from xhook.
qq:1483943306
from xhook.
目前的情况是hook是成功的,但是hook后app逻辑中有一个native崩溃,导致程序逻辑还没有走到hook的新函数中就崩溃退出了。app逻辑有点复杂,目前没有时间配合调试了。。暂时先关闭这个issue了。
from xhook.
Related Issues (20)
- 想问个项目中的代码问题 HOT 1
- 请问哪些数据可以进一步了解更多关于底层编译链接知识。
- arm64的PLT和arm的PLT有啥区别吗?
- error: ‘PAGE_MASK’ undeclared (first use in this function)
- 在二进制文件中使用libxhook对__android_log_print进行hook,hook不成功
- 请问如何知道自己被hook了?
- hook libil2cpp.so 失败,求助 HOT 1
- float args in hooked function
- Can't hook library HOT 1
- Android 11 support
- libc.so (memcmp) xh_core_refresh crash pls help me. HOT 1
- how to hook c++ class instance's method?
- hook libil2cpp.so 失败,求助 HOT 1
- 请问这里的函数返回值为什么是void*,而非void? HOT 1
- 请教两个问题
- 执行demo里面的./gradlew assembleDebug报错
- 在安卓aab包,xhook会失败。。 HOT 2
- xhook not working in some cases
- 希望支持安卓11
- __system_property_get no work in xiaomi android 10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from xhook.