diff --git a/injector.cpp b/injector.cpp index d7e847760..0c3268b05 100644 --- a/injector.cpp +++ b/injector.cpp @@ -1,3 +1,4 @@ +#define _GNU_SOURCE #include #include #include @@ -8,12 +9,23 @@ #include #include #include +#include + +// 手动定义 NDK 缺失或隐藏的宏,确保 AArch64 编译通过 +#ifndef NT_PRSTATUS +#define NT_PRSTATUS 1 +#endif + +#ifndef RTLD_DEFAULT +#define RTLD_DEFAULT ((void *) 0LL) +#endif const char* TARGET_PKG = "com.tencent.tmgp.sgame"; const char* LIB_PATH = "/data/local/tmp/libJKMenu.so"; pid_t find_pid(const char* pkg) { DIR* dir = opendir("/proc"); + if (!dir) return -1; struct dirent* entry; while ((entry = readdir(dir))) { pid_t pid = atoi(entry->d_name); @@ -33,30 +45,54 @@ pid_t find_pid(const char* pkg) { int main() { pid_t pid = find_pid(TARGET_PKG); - if (pid == -1) { printf("[-] SGame not found!\n"); return 1; } + if (pid == -1) { + printf("[-] SGame not found!\n"); + return 1; + } - ptrace(PTRACE_ATTACH, pid, NULL, NULL); + if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) { + perror("[-] Attach failed"); + return 1; + } waitpid(pid, NULL, WUNTRACED); struct user_pt_regs regs; - struct iovec iov = { .iov_base = ®s, .iov_len = sizeof(regs) }; - ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov); + struct iovec iov; + iov.iov_base = ®s; + iov.iov_len = sizeof(regs); + + // 显式转换参数类型以通过 NDK 编译器检查 + if (ptrace(PTRACE_GETREGSET, pid, (void*)(uintptr_t)NT_PRSTATUS, &iov) < 0) { + perror("[-] PTRACE_GETREGSET failed"); + ptrace(PTRACE_DETACH, pid, NULL, NULL); + return 1; + } - // 获取远程 dlopen - uintptr_t remote_dlopen = (uintptr_t)dlsym(RTL_DEFAULT, "__loader_dlopen"); + // 获取远程 dlopen (在 Android Linker 中) + uintptr_t remote_dlopen = (uintptr_t)dlsym(RTLD_DEFAULT, "__loader_dlopen"); + if (!remote_dlopen) { + remote_dlopen = (uintptr_t)dlsym(RTLD_DEFAULT, "dlopen"); + } - uintptr_t sp = (regs.sp - 256) & ~0xF; + if (!remote_dlopen) { + printf("[-] Failed to locate dlopen symbols.\n"); + ptrace(PTRACE_DETACH, pid, NULL, NULL); + return 1; + } + + uintptr_t sp = (regs.sp - 512) & ~0xF; size_t len = strlen(LIB_PATH) + 1; for (size_t i = 0; i < len; i += 8) { long data = 0; memcpy(&data, LIB_PATH + i, (len - i) < 8 ? (len - i) : 8); - ptrace(PTRACE_POKETEXT, pid, sp + i, (void*)data); + ptrace(PTRACE_POKETEXT, pid, (void*)(sp + i), (void*)data); } regs.regs[0] = sp; // x0: path regs.regs[1] = 2; // x1: RTLD_NOW regs.pc = remote_dlopen; - ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov); + + ptrace(PTRACE_SETREGSET, pid, (void*)(uintptr_t)NT_PRSTATUS, &iov); ptrace(PTRACE_DETACH, pid, NULL, NULL); printf("[+] Injecting into SGame (PID: %d)...\n", pid);