From 549ee7014e924b87f9b0c4c7b1758622ab9f4859 Mon Sep 17 00:00:00 2001
From: gggaa2152 <60614405+gggaa2152@users.noreply.github.com>
Date: Mon, 6 Apr 2026 02:51:24 +0800
Subject: [PATCH] Update injector.cpp

---
 injector.cpp | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/injector.cpp b/injector.cpp
index da862c551..d7e847760 100644
--- a/injector.cpp
+++ b/injector.cpp
@@ -8,15 +8,12 @@
 #include <dirent.h>
 #include <dlfcn.h>
 #include <sys/uio.h>
-#include <elf.h>
 
-// 目标包名
-const char* TARGET_PKG = "com.tencent.jkchess"; 
+const char* TARGET_PKG = "com.tencent.tmgp.sgame"; 
 const char* LIB_PATH = "/data/local/tmp/libJKMenu.so";
 
-pid_t find_pid_by_name(const char* package_name) {
+pid_t find_pid(const char* pkg) {
     DIR* dir = opendir("/proc");
-    if (!dir) return -1;
     struct dirent* entry;
     while ((entry = readdir(dir))) {
         pid_t pid = atoi(entry->d_name);
@@ -25,7 +22,7 @@ pid_t find_pid_by_name(const char* package_name) {
         snprintf(path, sizeof(path), "/proc/%d/cmdline", pid);
         FILE* f = fopen(path, "r");
         if (f) {
-            if (fgets(cmd, sizeof(cmd), f) && strstr(cmd, package_name)) {
+            if (fgets(cmd, sizeof(cmd), f) && strstr(cmd, pkg)) {
                 fclose(f); closedir(dir); return pid;
             }
             fclose(f);
@@ -35,20 +32,19 @@ pid_t find_pid_by_name(const char* package_name) {
 }
 
 int main() {
-    pid_t pid = find_pid_by_name(TARGET_PKG);
-    if (pid == -1) { printf("[-] Target process %s not found!\n", TARGET_PKG); return 1; }
+    pid_t pid = find_pid(TARGET_PKG);
+    if (pid == -1) { printf("[-] SGame not found!\n"); return 1; }
 
-    if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) { perror("[-] Attach failed"); return 1; }
+    ptrace(PTRACE_ATTACH, pid, NULL, NULL);
     waitpid(pid, NULL, WUNTRACED);
 
     struct user_pt_regs regs;
     struct iovec iov = { .iov_base = &regs, .iov_len = sizeof(regs) };
     ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov);
 
-    // 简单获取远程 dlopen (在 linker64 中)
-    uintptr_t remote_dlopen = (uintptr_t)dlsym(RTLD_DEFAULT, "__loader_dlopen"); 
+    // 获取远程 dlopen
+    uintptr_t remote_dlopen = (uintptr_t)dlsym(RTL_DEFAULT, "__loader_dlopen"); 
 
-    // 远程写入 SO 路径并调用
     uintptr_t sp = (regs.sp - 256) & ~0xF;
     size_t len = strlen(LIB_PATH) + 1;
     for (size_t i = 0; i < len; i += 8) {
@@ -63,6 +59,6 @@ int main() {
     ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov);
     ptrace(PTRACE_DETACH, pid, NULL, NULL);
 
-    printf("[+] Injection request sent to PID %d\n", pid);
+    printf("[+] Injecting into SGame (PID: %d)...\n", pid);
     return 0;
 }