From 71b6f370540ac86ed7933b6fe138cd2b45c8f3a7 Mon Sep 17 00:00:00 2001
From: gggaa2152 <60614405+gggaa2152@users.noreply.github.com>
Date: Mon, 6 Apr 2026 02:46:05 +0800
Subject: [PATCH] Update injector.cpp

---
 injector.cpp | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/injector.cpp b/injector.cpp
index c82ddd5b1..da862c551 100644
--- a/injector.cpp
+++ b/injector.cpp
@@ -10,11 +10,13 @@
 #include <sys/uio.h>
 #include <elf.h>
 
+// 目标包名
 const char* TARGET_PKG = "com.tencent.jkchess"; 
 const char* LIB_PATH = "/data/local/tmp/libJKMenu.so";
 
-pid_t find_pid() {
+pid_t find_pid_by_name(const char* package_name) {
     DIR* dir = opendir("/proc");
+    if (!dir) return -1;
     struct dirent* entry;
     while ((entry = readdir(dir))) {
         pid_t pid = atoi(entry->d_name);
@@ -23,7 +25,7 @@ pid_t find_pid() {
         snprintf(path, sizeof(path), "/proc/%d/cmdline", pid);
         FILE* f = fopen(path, "r");
         if (f) {
-            if (fgets(cmd, sizeof(cmd), f) && strstr(cmd, TARGET_PKG)) {
+            if (fgets(cmd, sizeof(cmd), f) && strstr(cmd, package_name)) {
                 fclose(f); closedir(dir); return pid;
             }
             fclose(f);
@@ -33,31 +35,34 @@ pid_t find_pid() {
 }
 
 int main() {
-    pid_t pid = find_pid();
-    if (pid == -1) { printf("Process not found!\n"); return 1; }
+    pid_t pid = find_pid_by_name(TARGET_PKG);
+    if (pid == -1) { printf("[-] Target process %s not found!\n", TARGET_PKG); return 1; }
 
-    ptrace(PTRACE_ATTACH, pid, NULL, NULL);
+    if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) { perror("[-] Attach failed"); return 1; }
     waitpid(pid, NULL, WUNTRACED);
 
     struct user_pt_regs regs;
     struct iovec iov = { .iov_base = &regs, .iov_len = sizeof(regs) };
     ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov);
 
-    // 远程定位 dlopen (简单示例逻辑)
+    // 简单获取远程 dlopen (在 linker64 中)
     uintptr_t remote_dlopen = (uintptr_t)dlsym(RTLD_DEFAULT, "__loader_dlopen"); 
 
-    // 写入路径并调用 (x0=path, x1=RTLD_NOW)
+    // 远程写入 SO 路径并调用
     uintptr_t sp = (regs.sp - 256) & ~0xF;
-    for (int i = 0; i < strlen(LIB_PATH) + 1; i += 8) {
-        ptrace(PTRACE_POKETEXT, pid, sp + i, *(long*)(LIB_PATH + i));
+    size_t len = strlen(LIB_PATH) + 1;
+    for (size_t i = 0; i < len; i += 8) {
+        long data = 0;
+        memcpy(&data, LIB_PATH + i, (len - i) < 8 ? (len - i) : 8);
+        ptrace(PTRACE_POKETEXT, pid, sp + i, (void*)data);
     }
 
-    regs.regs[0] = sp;
-    regs.regs[1] = 2; // RTLD_NOW
+    regs.regs[0] = sp;  // x0: path
+    regs.regs[1] = 2;   // x1: RTLD_NOW
     regs.pc = remote_dlopen;
     ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov);
     ptrace(PTRACE_DETACH, pid, NULL, NULL);
 
-    printf("Injection command sent to PID %d\n", pid);
+    printf("[+] Injection request sent to PID %d\n", pid);
     return 0;
 }