EngineDev/imgui-mirror
1
0
Fork 0
mirror of https://github.com/ocornut/imgui.git synced 2026-11-07 23:15:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update injector.cpp

Browse Source
This commit is contained in:
gggaa2152 2026-04-06 02:51:24 +08:00 committed by GitHub
parent ea771008f7
commit 549ee7014e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 9 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
injector.cpp
View File

@ -8,15 +8,12 @@
#include <dirent.h>
#include <dlfcn.h>
#include <sys/uio.h>
#include <elf.h>
// 目标包名
const char* TARGET_PKG = "com.tencent.jkchess";
const char* TARGET_PKG = "com.tencent.tmgp.sgame";
const char* LIB_PATH = "/data/local/tmp/libJKMenu.so";
pid_t find_pid_by_name(const char* package_name) {
pid_t find_pid(const char* pkg) {
DIR* dir = opendir("/proc");
if (!dir) return -1;
struct dirent* entry;
while ((entry = readdir(dir))) {
pid_t pid = atoi(entry->d_name);
@ -25,7 +22,7 @@ pid_t find_pid_by_name(const char* package_name) {
snprintf(path, sizeof(path), "/proc/%d/cmdline", pid);
FILE* f = fopen(path, "r");
if (f) {
if (fgets(cmd, sizeof(cmd), f) && strstr(cmd, package_name)) {
if (fgets(cmd, sizeof(cmd), f) && strstr(cmd, pkg)) {
fclose(f); closedir(dir); return pid;
}
fclose(f);
@ -35,20 +32,19 @@ pid_t find_pid_by_name(const char* package_name) {
}
int main() {
pid_t pid = find_pid_by_name(TARGET_PKG);
if (pid == -1) { printf("[-] Target process %s not found!\n", TARGET_PKG); return 1; }
pid_t pid = find_pid(TARGET_PKG);
if (pid == -1) { printf("[-] SGame not found!\n"); return 1; }
if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) { perror("[-] Attach failed"); return 1; }
ptrace(PTRACE_ATTACH, pid, NULL, NULL);
waitpid(pid, NULL, WUNTRACED);
struct user_pt_regs regs;
struct iovec iov = { .iov_base = &regs, .iov_len = sizeof(regs) };
ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov);
// 简单获取远程 dlopen (在 linker64 中)
uintptr_t remote_dlopen = (uintptr_t)dlsym(RTLD_DEFAULT, "__loader_dlopen");
// 获取远程 dlopen
uintptr_t remote_dlopen = (uintptr_t)dlsym(RTL_DEFAULT, "__loader_dlopen");
// 远程写入 SO 路径并调用
uintptr_t sp = (regs.sp - 256) & ~0xF;
size_t len = strlen(LIB_PATH) + 1;
for (size_t i = 0; i < len; i += 8) {
@ -63,6 +59,6 @@ int main() {
ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov);
ptrace(PTRACE_DETACH, pid, NULL, NULL);
printf("[+] Injection request sent to PID %d\n", pid);
printf("[+] Injecting into SGame (PID: %d)...\n", pid);
return 0;
}