From 9c0ef289dcfda1e762cde3e88fe75400d85ed6f8 Mon Sep 17 00:00:00 2001 From: gggaa2152 <60614405+gggaa2152@users.noreply.github.com> Date: Mon, 6 Apr 2026 08:17:54 +0800 Subject: [PATCH] Update injector.cpp --- injector.cpp | 73 +++++++++++++++++++++++++++++++++------------------- 1 file changed, 47 insertions(+), 26 deletions(-) diff --git a/injector.cpp b/injector.cpp index 56a500037..5f2c543da 100644 --- a/injector.cpp +++ b/injector.cpp @@ -11,11 +11,19 @@ #include #include #include +#include +#include // 修复 NT_PRSTATUS 未定义问题 +#include // 备用包含 #define TAG "AndKitty_Injector" #define LOGI(...) __android_log_print(ANDROID_LOG_INFO, TAG, __VA_ARGS__) #define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, TAG, __VA_ARGS__) +// 确保 NT_PRSTATUS 在某些 NDK 版本中被正确定义 +#ifndef NT_PRSTATUS +#define NT_PRSTATUS 1 +#endif + using namespace std; // 获取目标进程 PID @@ -31,12 +39,14 @@ pid_t get_pid(const char* package_name) { FILE* f = fopen(path, "r"); if (f) { char cmdline[256]; - fgets(cmdline, sizeof(cmdline), f); - fclose(f); - if (strncmp(cmdline, package_name, strlen(package_name)) == 0) { - closedir(dir); - return pid; + if (fgets(cmdline, sizeof(cmdline), f)) { + if (strncmp(cmdline, package_name, strlen(package_name)) == 0) { + fclose(f); + closedir(dir); + return pid; + } } + fclose(f); } } closedir(dir); @@ -53,7 +63,7 @@ uintptr_t get_module_base(pid_t pid, const char* module_name) { uintptr_t base = 0; while (fgets(line, sizeof(line), f)) { if (strstr(line, module_name)) { - base = strtoull(line, NULL, 16); + base = (uintptr_t)strtoull(line, NULL, 16); break; } } @@ -82,22 +92,29 @@ bool ptrace_write(pid_t pid, uintptr_t addr, void* buf, size_t len) { // Ptrace 调用远程函数 (ARM64) uint64_t ptrace_call(pid_t pid, uintptr_t func_addr, uint64_t* args, int nargs) { struct user_pt_regs regs, old_regs; - struct iovec iov = {®s, sizeof(struct user_pt_regs)}; - ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov); + struct iovec iov; + + iov.iov_base = ®s; + iov.iov_len = sizeof(struct user_pt_regs); + if (ptrace(PTRACE_GETREGSET, pid, (void*)NT_PRSTATUS, &iov) < 0) return 0; + memcpy(&old_regs, ®s, sizeof(regs)); for (int i = 0; i < nargs && i < 8; i++) regs.regs[i] = args[i]; - regs.regs[30] = 0; // LR 置零以便触发停止 + regs.regs[30] = 0; // LR set to 0 to trigger crash/stop regs.pc = func_addr; iov.iov_base = ®s; - ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov); + if (ptrace(PTRACE_SETREGSET, pid, (void*)NT_PRSTATUS, &iov) < 0) return 0; + ptrace(PTRACE_CONT, pid, NULL, NULL); waitpid(pid, NULL, WUNTRACED); - ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov); + ptrace(PTRACE_GETREGSET, pid, (void*)NT_PRSTATUS, &iov); uint64_t res = regs.regs[0]; - ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &old_regs); + + iov.iov_base = &old_regs; + ptrace(PTRACE_SETREGSET, pid, (void*)NT_PRSTATUS, &iov); return res; } @@ -110,54 +127,58 @@ int main(int argc, char** argv) { const char* pkg = argv[1]; const char* so_path = argv[2]; - LOGI("开始注入: %s -> %s", pkg, so_path); + LOGI("Starting injection: %s -> %s", pkg, so_path); pid_t pid = get_pid(pkg); if (pid < 0) { - LOGE("未找到进程 PID"); + LOGE("Process PID not found for %s", pkg); return -1; } if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) { - LOGE("Ptrace Attach 失败: %s", strerror(errno)); + LOGE("Ptrace Attach failed: %s", strerror(errno)); return -1; } waitpid(pid, NULL, WUNTRACED); - LOGI("成功附加到 PID: %d", pid); + LOGI("Attached to PID: %d", pid); - // 尝试从不同的库寻找 dlopen uintptr_t remote_dlopen = get_remote_addr(pid, "libdl.so", (void*)dlopen); if (!remote_dlopen) remote_dlopen = get_remote_addr(pid, "linker64", (void*)dlopen); if (!remote_dlopen) { - LOGE("无法定位远程 dlopen 地址"); + LOGE("Could not locate remote dlopen"); ptrace(PTRACE_DETACH, pid, NULL, NULL); return -1; } - LOGI("远程 dlopen 地址: %p", (void*)remote_dlopen); + LOGI("Remote dlopen: %p", (void*)remote_dlopen); struct user_pt_regs regs; struct iovec iov = {®s, sizeof(struct user_pt_regs)}; - ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov); - uintptr_t remote_str_addr = regs.sp - 1024; // 在栈下方写入路径 + if (ptrace(PTRACE_GETREGSET, pid, (void*)NT_PRSTATUS, &iov) < 0) { + LOGE("GetRegset failed"); + ptrace(PTRACE_DETACH, pid, NULL, NULL); + return -1; + } + + uintptr_t remote_str_addr = regs.sp - 1024; if (!ptrace_write(pid, remote_str_addr, (void*)so_path, strlen(so_path) + 1)) { - LOGE("写入路径到远程内存失败"); + LOGE("Write remote memory failed"); ptrace(PTRACE_DETACH, pid, NULL, NULL); return -1; } uint64_t args[2] = { remote_str_addr, RTLD_NOW }; - LOGI("正在执行远程 dlopen..."); + LOGI("Calling remote dlopen..."); uint64_t handle = ptrace_call(pid, remote_dlopen, args, 2); if (handle == 0) { - LOGE("注入失败: dlopen 返回 NULL (可能权限不足或路径错误)"); + LOGE("Injection failed: dlopen returned NULL"); } else { - LOGI("注入成功! 句柄: %p", (void*)handle); + LOGI("Injection success! Handle: %p", (void*)handle); } ptrace(PTRACE_DETACH, pid, NULL, NULL); - LOGI("已分离进程."); + LOGI("Detached."); return 0; }