From 69e41bd2cb946657dd7852e0b59ea4aca506d75f Mon Sep 17 00:00:00 2001 From: gggaa2152 <60614405+gggaa2152@users.noreply.github.com> Date: Thu, 23 Jul 2026 09:01:25 +0800 Subject: [PATCH] Update injector.cpp --- injector.cpp | 200 +++++++++++++++++++++++++++------------------------ 1 file changed, 108 insertions(+), 92 deletions(-) diff --git a/injector.cpp b/injector.cpp index 5c655aea7..b74a7a436 100644 --- a/injector.cpp +++ b/injector.cpp @@ -1,7 +1,11 @@ /** - * injector.cpp – 全自动注入器 (arm64) + * injector.cpp – Android arm64 注入器（纯净版，不触碰 SELinux） * 编译: aarch64-linux-android-clang++ -static -std=c++17 injector.cpp -o injector - * 用法: 直接执行 /data/1/injector （无需参数） + * 用法: + * 无参数: 使用默认 /data/1/libMyMenu.so 和 com.tencent.jkchess + * 带参数: injector [package_name|pid] + * 示例: injector /data/1/libMyMenu.so com.tencent.jkchess + * injector /data/1/libMyMenu.so 12345 */ #include @@ -21,20 +25,12 @@ #include #include #include -#include // ---------- 默认配置 ---------- #define DEFAULT_SO_PATH "/data/1/libMyMenu.so" #define DEFAULT_PKG_NAME "com.tencent.jkchess" -// ---------- 关闭/恢复 SELinux ---------- -void set_selinux(int enforce) { - char cmd[64]; - snprintf(cmd, sizeof(cmd), "setenforce %d", enforce); - system(cmd); -} - -// ---------- 查找进程 (通过 cmdline) ---------- +// ---------- 查找进程 ---------- int find_pid_by_name(const char* proc_name) { DIR* dir = opendir("/proc"); if (!dir) return -1; @@ -71,7 +67,7 @@ long ptrace_readdata(int pid, unsigned long addr, void* buffer, size_t size) { for (size_t i = 0; i < size; i += sizeof(long)) { long data = ptrace(PTRACE_PEEKDATA, pid, addr + i, 0); if (data == -1 && errno) return -1; - memcpy((char*)buffer + i, &data, std::min(sizeof(long), size - i)); + memcpy((char*)buffer + i, &data, (size - i) < sizeof(long) ? (size - i) : sizeof(long)); } return 0; } @@ -79,52 +75,64 @@ long ptrace_readdata(int pid, unsigned long addr, void* buffer, size_t size) { long ptrace_writedata(int pid, unsigned long addr, const void* buffer, size_t size) { for (size_t i = 0; i < size; i += sizeof(long)) { long data = 0; - memcpy(&data, (char*)buffer + i, std::min(sizeof(long), size - i)); - if (ptrace(PTRACE_POKEDATA, pid, addr + i, data) == -1) + memcpy(&data, (char*)buffer + i, (size - i) < sizeof(long) ? (size - i) : sizeof(long)); + if (ptrace(PTRACE_POKEDATA, pid, addr + i, data) == -1) { + perror("ptrace_pokedata"); return -1; + } } return 0; } -// ---------- 执行系统调用 ---------- -int remote_syscall(int pid, struct user_pt_regs& regs) { +// ---------- 执行系统调用（修正版） ---------- +int remote_syscall(int pid, struct user_pt_regs& regs, unsigned long* result = nullptr) { struct iovec iov = { ®s, sizeof(regs) }; + + // 设置寄存器 if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) { perror("setregset before syscall"); return -1; } + + // 进入系统调用（第一次停住） if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1) { - perror("ptrace syscall"); + perror("ptrace syscall enter"); return -1; } int status; waitpid(pid, &status, 0); if (!WIFSTOPPED(status)) { - fprintf(stderr, "process not stopped after syscall\n"); + fprintf(stderr, "not stopped after syscall enter\n"); return -1; } + + // 退出系统调用（第二次停住，获取返回值） if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1) { perror("ptrace syscall exit"); return -1; } waitpid(pid, &status, 0); if (!WIFSTOPPED(status)) { - fprintf(stderr, "process not stopped after syscall exit\n"); + fprintf(stderr, "not stopped after syscall exit\n"); return -1; } + + // 读取返回后的寄存器 struct user_pt_regs ret_regs; iov.iov_base = &ret_regs; iov.iov_len = sizeof(ret_regs); if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) { perror("getregset for return"); return -1; } - regs = ret_regs; + + if (result) *result = ret_regs.regs[0]; + regs = ret_regs; // 更新 return 0; } // ---------- 注入主函数 ---------- int inject_so(int pid, const char* so_path) { - // 附加进程 + // 1. 附加 if (ptrace(PTRACE_ATTACH, pid, 0, 0) == -1) { perror("ptrace attach"); return -1; @@ -132,12 +140,12 @@ int inject_so(int pid, const char* so_path) { int status; waitpid(pid, &status, 0); if (!WIFSTOPPED(status)) { - fprintf(stderr, "process not stopped\n"); + fprintf(stderr, "process not stopped after attach\n"); ptrace(PTRACE_DETACH, pid, 0, 0); return -1; } - - // 获取原始寄存器 + + // 2. 备份原始寄存器 struct user_pt_regs orig_regs, regs; struct iovec iov = { &orig_regs, sizeof(orig_regs) }; if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) { @@ -146,42 +154,48 @@ int inject_so(int pid, const char* so_path) { return -1; } regs = orig_regs; - - // 分配内存 + + // 3. 在远程进程分配内存（mmap） size_t path_len = strlen(so_path) + 1; - regs.regs[0] = 0; - regs.regs[1] = path_len; + regs.regs[0] = 0; // addr + regs.regs[1] = path_len; // length regs.regs[2] = PROT_READ | PROT_WRITE; regs.regs[3] = MAP_PRIVATE | MAP_ANONYMOUS; - regs.regs[4] = -1; - regs.regs[5] = 0; - regs.regs[8] = 222; // mmap - if (remote_syscall(pid, regs) != 0) { + regs.regs[4] = -1; // fd + regs.regs[5] = 0; // offset + regs.regs[8] = 222; // __NR_mmap (arm64) + + unsigned long remote_addr = 0; + if (remote_syscall(pid, regs, &remote_addr) != 0) { fprintf(stderr, "mmap syscall failed\n"); ptrace(PTRACE_DETACH, pid, 0, 0); return -1; } - long remote_addr = regs.regs[0]; - if (remote_addr <= 0 || remote_addr == -1) { - fprintf(stderr, "mmap returned invalid: 0x%lx\n", remote_addr); + + if (remote_addr == 0 || remote_addr == (unsigned long)-1) { + fprintf(stderr, "mmap returned invalid address: 0x%lx\n", remote_addr); ptrace(PTRACE_DETACH, pid, 0, 0); return -1; } - printf("[+] Allocated remote memory at 0x%lx\n", remote_addr); - - // 写入 SO 路径 + printf("[+] Allocated remote memory at 0x%lx (size=%zu)\n", remote_addr, path_len); + + // 4. 写入 SO 路径 if (ptrace_writedata(pid, remote_addr, so_path, path_len) == -1) { - perror("ptrace_writedata"); + fprintf(stderr, "ptrace_writedata failed, errno=%d\n", errno); ptrace(PTRACE_DETACH, pid, 0, 0); return -1; } - printf("[+] Wrote SO path\n"); - - // 计算远程 dlopen + printf("[+] Wrote SO path into remote memory\n"); + + // 5. 计算远程 dlopen 地址 void* local_dlopen = (void*)dlopen; unsigned long local_libdl_base = 0; FILE* fp = fopen("/proc/self/maps", "r"); - if (!fp) { perror("self maps"); ptrace(PTRACE_DETACH, pid,0,0); return -1; } + if (!fp) { + perror("open self maps"); + ptrace(PTRACE_DETACH, pid, 0, 0); + return -1; + } char line[512]; while (fgets(line, sizeof(line), fp)) { if (strstr(line, "libdl.so")) { @@ -191,15 +205,21 @@ int inject_so(int pid, const char* so_path) { } fclose(fp); if (local_libdl_base == 0) { - fprintf(stderr, "can't find local libdl.so\n"); - ptrace(PTRACE_DETACH, pid,0,0); return -1; + fprintf(stderr, "can't find local libdl.so base\n"); + ptrace(PTRACE_DETACH, pid, 0, 0); + return -1; } unsigned long dlopen_offset = (unsigned long)local_dlopen - local_libdl_base; - + + // 获取远程 libdl.so 基址 char remote_maps_path[64]; snprintf(remote_maps_path, sizeof(remote_maps_path), "/proc/%d/maps", pid); fp = fopen(remote_maps_path, "r"); - if (!fp) { perror("remote maps"); ptrace(PTRACE_DETACH, pid,0,0); return -1; } + if (!fp) { + perror("open remote maps"); + ptrace(PTRACE_DETACH, pid, 0, 0); + return -1; + } unsigned long remote_libdl_base = 0; while (fgets(line, sizeof(line), fp)) { if (strstr(line, "libdl.so")) { @@ -209,93 +229,89 @@ int inject_so(int pid, const char* so_path) { } fclose(fp); if (remote_libdl_base == 0) { - fprintf(stderr, "can't find remote libdl.so\n"); - ptrace(PTRACE_DETACH, pid,0,0); return -1; + fprintf(stderr, "can't find remote libdl.so base\n"); + ptrace(PTRACE_DETACH, pid, 0, 0); + return -1; } unsigned long remote_dlopen = remote_libdl_base + dlopen_offset; - printf("[+] Remote dlopen at 0x%lx\n", remote_dlopen); - - // 执行 dlopen + printf("[+] Remote dlopen address: 0x%lx\n", remote_dlopen); + + // 6. 设置寄存器执行 dlopen regs = orig_regs; - regs.regs[0] = remote_addr; - regs.regs[1] = RTLD_LAZY; + regs.regs[0] = remote_addr; // path + regs.regs[1] = RTLD_LAZY; // flag regs.pc = remote_dlopen; - regs.regs[30] = 0x0; // LR=0 -> segfault + regs.regs[30] = 0x0; // LR=0 导致 segfault + iov.iov_base = ®s; iov.iov_len = sizeof(regs); if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) { perror("setregset for dlopen"); - ptrace(PTRACE_DETACH, pid,0,0); return -1; + ptrace(PTRACE_DETACH, pid, 0, 0); + return -1; } + + // 7. 继续执行 if (ptrace(PTRACE_CONT, pid, 0, 0) == -1) { perror("ptrace cont"); - ptrace(PTRACE_DETACH, pid,0,0); return -1; + ptrace(PTRACE_DETACH, pid, 0, 0); + return -1; } waitpid(pid, &status, 0); if (WIFSIGNALED(status) && WTERMSIG(status) == SIGSEGV) { - printf("[+] dlopen executed (expected segfault)\n"); + printf("[+] dlopen executed (expected segfault due to LR=0)\n"); } else { - fprintf(stderr, "Unexpected stop: %d\n", status); - ptrace(PTRACE_DETACH, pid,0,0); return -1; + fprintf(stderr, "Unexpected stop: status=%d\n", status); + ptrace(PTRACE_DETACH, pid, 0, 0); + return -1; } - - // 恢复寄存器并 detach + + // 8. 恢复寄存器并 detach iov.iov_base = &orig_regs; iov.iov_len = sizeof(orig_regs); ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov); ptrace(PTRACE_DETACH, pid, 0, 0); + printf("[+] Injection successful!\n"); return 0; } // ---------- 主函数 ---------- int main(int argc, char** argv) { - // 默认参数 const char* so_path = DEFAULT_SO_PATH; - const char* pkg_name = DEFAULT_PKG_NAME; + const char* target = DEFAULT_PKG_NAME; int pid = -1; - - // 如果用户传了参数则覆盖（但全自动模式推荐无参） + if (argc >= 2) so_path = argv[1]; if (argc >= 3) { - // 如果第三个参数是数字则作为 PID，否则作为包名 + // 判断第三个参数是否为数字（PID） bool is_digit = true; for (int i = 0; argv[2][i]; i++) { if (!isdigit(argv[2][i])) { is_digit = false; break; } } if (is_digit) pid = atoi(argv[2]); - else pkg_name = argv[2]; + else target = argv[2]; } - - printf("[Auto] SO: %s\n", so_path); - printf("[Auto] Target: %s\n", pkg_name); - + + printf("[Injector] SO: %s\n", so_path); + printf("[Injector] Target: %s\n", target); + // 检查 SO 是否存在 if (access(so_path, F_OK) != 0) { - fprintf(stderr, "SO file '%s' not found!\n", so_path); + fprintf(stderr, "SO file '%s' does not exist\n", so_path); return 1; } - - // 关闭 SELinux（允许 ptrace） - printf("[Auto] Disabling SELinux...\n"); - set_selinux(0); - + // 查找进程 if (pid <= 0) { - printf("[Auto] Searching for process '%s'...\n", pkg_name); - pid = find_pid_by_name(pkg_name); + printf("[Injector] Searching for process '%s'...\n", target); + pid = find_pid_by_name(target); if (pid <= 0) { - fprintf(stderr, "Process '%s' not found. Is the game running?\n", pkg_name); - set_selinux(1); // 恢复 + fprintf(stderr, "Process '%s' not found. Please ensure the game is running.\n", target); return 1; } - printf("[Auto] Found PID: %d\n", pid); + printf("[Injector] Found PID: %d\n", pid); + } else { + printf("[Injector] Using specified PID: %d\n", pid); } - - // 注入 - int ret = inject_so(pid, so_path); - - // 恢复 SELinux - printf("[Auto] Restoring SELinux...\n"); - set_selinux(1); - - return ret; + + return inject_so(pid, so_path); }