EngineDev/imgui-mirror
1
0
Fork 0
mirror of https://github.com/ocornut/imgui.git synced 2026-11-08 23:45:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update injector.cpp

Browse Source
This commit is contained in:
gggaa2152 2026-04-06 04:20:01 +08:00 committed by GitHub
parent 4dff31756c
commit d91dd20470
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 34 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
injector.cpp
View File

@ -18,11 +18,9 @@
#endif
// --- 配置区 ---
// 注意：根据你之前的记录，包名可能是 com.tencent.tmgp.sgame 或 com.tencent.jkchess
const char* TARGET_PKG = "com.tencent.tmgp.sgame";
const char* LIB_PATH = "/data/1/libJKMenu.so";
// 获取模块基址 (支持 APEX 路径)
uintptr_t get_module_base(pid_t pid, const char* module_name) {
FILE* fp;
uintptr_t addr = 0;
@ -41,25 +39,18 @@ uintptr_t get_module_base(pid_t pid, const char* module_name) {
return addr;
}
// 计算远程 dlopen 地址
uintptr_t get_remote_dlopen(pid_t pid) {
const char* linker_name = "linker64";
uintptr_t local_linker = get_module_base(getpid(), linker_name);
uintptr_t remote_linker = get_module_base(pid, linker_name);
if (!local_linker || !remote_linker) {
printf("[-] Error: Linker not found. Local: %lx, Remote: %lx\n", local_linker, remote_linker);
return 0;
}
if (!local_linker || !remote_linker) return 0;
void* local_func = dlsym(RTLD_DEFAULT, "__loader_dlopen");
if (!local_func) local_func = dlsym(RTLD_DEFAULT, "dlopen");
uintptr_t offset = (uintptr_t)local_func - local_linker;
return remote_linker + offset;
return remote_linker + ((uintptr_t)local_func - local_linker);
}
// 查找进程 PID
pid_t find_pid(const char* pkg) {
DIR* dir = opendir("/proc");
if (!dir) return -1;
@ -81,56 +72,65 @@ pid_t find_pid(const char* pkg) {
}
int main() {
printf("[*] JKMenu Injector Starting...\n");
printf("[*] JKMenu Injector v3.0 (BRK Trap Mode)\n");
pid_t pid = find_pid(TARGET_PKG);
if (pid == -1) {
printf("[-] Target %s not found!\n", TARGET_PKG);
return 1;
}
if (pid == -1) { printf("[-] Target not found!\n"); return 1; }
uintptr_t dlopen_addr = get_remote_dlopen(pid);
if (!dlopen_addr) return 1;
printf("[+] Remote dlopen: %lx\n", dlopen_addr);
if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) {
perror("[-] Attach failed");
return 1;
}
if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) { perror("[-] Attach"); return 1; }
waitpid(pid, NULL, WUNTRACED);
printf("[+] Attached to %d\n", pid);
struct user_pt_regs regs, old_regs;
struct iovec iov = { .iov_base = &regs, .iov_len = sizeof(regs) };
ptrace(PTRACE_GETREGSET, pid, (void*)(uintptr_t)NT_PRSTATUS, &iov);
memcpy(&old_regs, &regs, sizeof(regs));
uintptr_t sp_path = (regs.sp - 512) & ~0xF;
// 1. 准备栈空间：写入 SO 路径和断点指令
uintptr_t sp_base = (regs.sp - 512) & ~0xF;
uintptr_t brk_addr = sp_base; // 断点指令位置
uintptr_t path_addr = sp_base + 8; // 路径字符串位置
// 写入 AArch64 断点指令: brk #0 (0xd4200000)
uint32_t brk_ins = 0xd4200000;
ptrace(PTRACE_POKETEXT, pid, (void*)brk_addr, (void*)(uintptr_t)brk_ins);
// 写入 SO 路径
size_t len = strlen(LIB_PATH) + 1;
for (size_t i = 0; i < len; i += 8) {
long data = 0;
memcpy(&data, LIB_PATH + i, (len - i) < 8 ? (len - i) : 8);
ptrace(PTRACE_POKETEXT, pid, (void*)(sp_path + i), (void*)data);
ptrace(PTRACE_POKETEXT, pid, (void*)(path_addr + i), (void*)data);
}
regs.regs[0] = sp_path;
regs.regs[1] = 2;
regs.pc = dlopen_addr;
regs.regs[30] = 0;
// 2. 设置寄存器：调用 dlopen(path, RTLD_NOW)
regs.regs[0] = path_addr; // x0 = path
regs.regs[1] = 2; // x1 = RTLD_NOW
regs.pc = dlopen_addr; // pc = dlopen
regs.regs[30] = brk_addr; // lr = 断点地址 (执行完跳到这里)
ptrace(PTRACE_SETREGSET, pid, (void*)(uintptr_t)NT_PRSTATUS, &iov);
printf("[*] Calling remote dlopen...\n");
printf("[*] Executing remote dlopen...\n");
ptrace(PTRACE_CONT, pid, NULL, NULL);
// 3. 等待断点信号 (SIGTRAP)
int status;
waitpid(pid, &status, WUNTRACED);
waitpid(pid, &status, WUNTRACED);
printf("[+] Restoring original state...\n");
if (WIFSTOPPED(status) && (WSTOPSIG(status) == SIGTRAP || WSTOPSIG(status) == SIGILL)) {
printf("[+] dlopen call finished successfully.\n");
} else {
printf("[!] Warning: Process stopped with signal %d\n", WSTOPSIG(status));
}
// 4. 彻底恢复原始现场
printf("[+] Restoring registers and detaching...\n");
ptrace(PTRACE_SETREGSET, pid, (void*)(uintptr_t)NT_PRSTATUS, (struct iovec *)&old_regs);
ptrace(PTRACE_DETACH, pid, NULL, NULL);
printf("[+] Done!\n");
printf("[+] Injection Complete!\n");
return 0;
}