mirror of
https://github.com/ocornut/imgui.git
synced 2026-11-07 23:15:52 +01:00
Update injector.cpp
This commit is contained in:
gggaa2152
GitHub
parent
e6ae533436
commit
bc566a0973
91
injector.cpp
91
injector.cpp
@ -1,10 +1,6 @@
|
||||
/**
|
||||
* injector.cpp – Android arm64 纯 ptrace 注入器（无 SELinux 操作）
|
||||
* injector.cpp – 带诊断的注入器
|
||||
* 编译: aarch64-linux-android-clang++ -static -std=c++17 -O2 injector.cpp -o injector
|
||||
* 用法:
|
||||
* 无参数: 默认 /data/1/libMyMenu.so + com.tencent.jkchess
|
||||
* 带参数: injector <so_path> [package_name|pid]
|
||||
* 注意: 运行前请执行 setenforce 0 关闭 SELinux
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
@ -60,7 +56,7 @@ int find_pid_by_name(const char* proc_name) {
|
||||
return pid;
|
||||
}
|
||||
|
||||
// ---------- ptrace 读写内存 ----------
|
||||
// ---------- ptrace 读写 ----------
|
||||
long ptrace_readdata(int pid, unsigned long addr, void* buffer, size_t size) {
|
||||
for (size_t i = 0; i < size; i += sizeof(long)) {
|
||||
long data = ptrace(PTRACE_PEEKDATA, pid, addr + i, 0);
|
||||
@ -82,7 +78,7 @@ long ptrace_writedata(int pid, unsigned long addr, const void* buffer, size_t si
|
||||
return 0;
|
||||
}
|
||||
|
||||
// ---------- 执行系统调用 ----------
|
||||
// ---------- 执行系统调用（带错误诊断） ----------
|
||||
int remote_syscall(int pid, struct user_pt_regs& regs, unsigned long* result = nullptr) {
|
||||
struct iovec iov = { ®s, sizeof(regs) };
|
||||
if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
|
||||
@ -121,6 +117,7 @@ int remote_syscall(int pid, struct user_pt_regs& regs, unsigned long* result = n
|
||||
|
||||
// ---------- 注入主函数 ----------
|
||||
int inject_so(int pid, const char* so_path) {
|
||||
// 1. 附加
|
||||
if (ptrace(PTRACE_ATTACH, pid, 0, 0) == -1) {
|
||||
perror("ptrace attach");
|
||||
return -1;
|
||||
@ -133,6 +130,18 @@ int inject_so(int pid, const char* so_path) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
// 2. 测试 ptrace 读写能力（读取进程的第一个字节，通常可读）
|
||||
unsigned long test_addr = 0x1000; // 尝试读取低地址
|
||||
char test_buf[1];
|
||||
if (ptrace_readdata(pid, test_addr, test_buf, 1) == -1) {
|
||||
printf("[!] Warning: ptrace_readdata failed at 0x%lx, errno=%d. Maybe ptrace is restricted.\n", test_addr, errno);
|
||||
printf("[!] Please ensure SELinux is Permissive and Yama ptrace_scope=0.\n");
|
||||
ptrace(PTRACE_DETACH, pid, 0, 0);
|
||||
return -1;
|
||||
}
|
||||
printf("[+] ptrace read test passed.\n");
|
||||
|
||||
// 3. 备份寄存器
|
||||
struct user_pt_regs orig_regs, regs;
|
||||
struct iovec iov = { &orig_regs, sizeof(orig_regs) };
|
||||
if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
|
||||
@ -142,29 +151,53 @@ int inject_so(int pid, const char* so_path) {
|
||||
}
|
||||
regs = orig_regs;
|
||||
|
||||
// mmap 分配内存
|
||||
// 4. mmap 分配内存（尝试两次，第一次普通，第二次固定地址）
|
||||
size_t path_len = strlen(so_path) + 1;
|
||||
regs.regs[0] = 0;
|
||||
regs.regs[1] = path_len;
|
||||
regs.regs[2] = PROT_READ | PROT_WRITE;
|
||||
regs.regs[3] = MAP_PRIVATE | MAP_ANONYMOUS;
|
||||
regs.regs[4] = -1;
|
||||
regs.regs[5] = 0;
|
||||
regs.regs[8] = 222; // __NR_mmap (arm64)
|
||||
|
||||
unsigned long remote_addr = 0;
|
||||
if (remote_syscall(pid, regs, &remote_addr) != 0) {
|
||||
fprintf(stderr, "remote_syscall mmap failed\n");
|
||||
ptrace(PTRACE_DETACH, pid, 0, 0);
|
||||
return -1;
|
||||
}
|
||||
if (remote_addr == 0 || remote_addr == (unsigned long)-1) {
|
||||
fprintf(stderr, "mmap returned invalid: 0x%lx, errno=%d\n", remote_addr, errno);
|
||||
ptrace(PTRACE_DETACH, pid, 0, 0);
|
||||
return -1;
|
||||
}
|
||||
int retry = 0;
|
||||
do {
|
||||
regs = orig_regs; // 恢复
|
||||
regs.regs[0] = (retry == 0) ? 0 : 0x10000000; // 第二次指定地址
|
||||
regs.regs[1] = path_len;
|
||||
regs.regs[2] = PROT_READ | PROT_WRITE;
|
||||
regs.regs[3] = (retry == 0) ? (MAP_PRIVATE | MAP_ANONYMOUS) : (MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED);
|
||||
regs.regs[4] = -1;
|
||||
regs.regs[5] = 0;
|
||||
regs.regs[8] = 222; // __NR_mmap
|
||||
|
||||
if (remote_syscall(pid, regs, &remote_addr) != 0) {
|
||||
fprintf(stderr, "remote_syscall mmap failed\n");
|
||||
ptrace(PTRACE_DETACH, pid, 0, 0);
|
||||
return -1;
|
||||
}
|
||||
if (remote_addr == 0 || remote_addr == (unsigned long)-1) {
|
||||
fprintf(stderr, "mmap returned invalid: 0x%lx (retry=%d)\n", remote_addr, retry);
|
||||
if (retry == 0) {
|
||||
retry++;
|
||||
continue;
|
||||
} else {
|
||||
ptrace(PTRACE_DETACH, pid, 0, 0);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
// 检查地址是否可写（尝试写入一个字节）
|
||||
char tmp = 0;
|
||||
if (ptrace_writedata(pid, remote_addr, &tmp, 1) == -1) {
|
||||
printf("[!] mmap address 0x%lx not writable (errno=%d), retrying with fixed address...\n", remote_addr, errno);
|
||||
if (retry == 0) {
|
||||
retry++;
|
||||
continue;
|
||||
} else {
|
||||
ptrace(PTRACE_DETACH, pid, 0, 0);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
break; // 成功
|
||||
} while (retry < 2);
|
||||
|
||||
printf("[+] Allocated remote memory at 0x%lx\n", remote_addr);
|
||||
|
||||
// 5. 写入 SO 路径
|
||||
if (ptrace_writedata(pid, remote_addr, so_path, path_len) == -1) {
|
||||
fprintf(stderr, "ptrace_writedata failed, errno=%d\n", errno);
|
||||
ptrace(PTRACE_DETACH, pid, 0, 0);
|
||||
@ -172,7 +205,7 @@ int inject_so(int pid, const char* so_path) {
|
||||
}
|
||||
printf("[+] Wrote SO path\n");
|
||||
|
||||
// 计算远程 dlopen
|
||||
// 6. 计算远程 dlopen
|
||||
void* local_dlopen = (void*)dlopen;
|
||||
unsigned long local_libdl_base = 0;
|
||||
FILE* fp = fopen("/proc/self/maps", "r");
|
||||
@ -220,12 +253,12 @@ int inject_so(int pid, const char* so_path) {
|
||||
unsigned long remote_dlopen = remote_libdl_base + dlopen_offset;
|
||||
printf("[+] Remote dlopen: 0x%lx\n", remote_dlopen);
|
||||
|
||||
// 执行 dlopen
|
||||
// 7. 执行 dlopen
|
||||
regs = orig_regs;
|
||||
regs.regs[0] = remote_addr;
|
||||
regs.regs[1] = RTLD_LAZY;
|
||||
regs.pc = remote_dlopen;
|
||||
regs.regs[30] = 0x0; // LR=0 → segfault
|
||||
regs.regs[30] = 0x0;
|
||||
|
||||
iov.iov_base = ®s; iov.iov_len = sizeof(regs);
|
||||
if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user