From d91dd20470b7319fd5ce94e5594f85af3331255c Mon Sep 17 00:00:00 2001
From: gggaa2152 <60614405+gggaa2152@users.noreply.github.com>
Date: Mon, 6 Apr 2026 04:20:01 +0800
Subject: [PATCH] Update injector.cpp

---
 injector.cpp | 68 ++++++++++++++++++++++++++--------------------------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/injector.cpp b/injector.cpp
index 482e80269..94d4ecfe8 100644
--- a/injector.cpp
+++ b/injector.cpp
@@ -18,11 +18,9 @@
 #endif
 
 // --- 配置区 ---
-// 注意：根据你之前的记录，包名可能是 com.tencent.tmgp.sgame 或 com.tencent.jkchess
 const char* TARGET_PKG = "com.tencent.tmgp.sgame"; 
 const char* LIB_PATH   = "/data/1/libJKMenu.so";
 
-// 获取模块基址 (支持 APEX 路径)
 uintptr_t get_module_base(pid_t pid, const char* module_name) {
     FILE* fp;
     uintptr_t addr = 0;
@@ -41,25 +39,18 @@ uintptr_t get_module_base(pid_t pid, const char* module_name) {
     return addr;
 }
 
-// 计算远程 dlopen 地址
 uintptr_t get_remote_dlopen(pid_t pid) {
     const char* linker_name = "linker64";
     uintptr_t local_linker = get_module_base(getpid(), linker_name);
     uintptr_t remote_linker = get_module_base(pid, linker_name);
-
-    if (!local_linker || !remote_linker) {
-        printf("[-] Error: Linker not found. Local: %lx, Remote: %lx\n", local_linker, remote_linker);
-        return 0;
-    }
+    if (!local_linker || !remote_linker) return 0;
 
     void* local_func = dlsym(RTLD_DEFAULT, "__loader_dlopen");
     if (!local_func) local_func = dlsym(RTLD_DEFAULT, "dlopen");
 
-    uintptr_t offset = (uintptr_t)local_func - local_linker;
-    return remote_linker + offset;
+    return remote_linker + ((uintptr_t)local_func - local_linker);
 }
 
-// 查找进程 PID
 pid_t find_pid(const char* pkg) {
     DIR* dir = opendir("/proc");
     if (!dir) return -1;
@@ -81,56 +72,65 @@ pid_t find_pid(const char* pkg) {
 }
 
 int main() {
-    printf("[*] JKMenu Injector Starting...\n");
+    printf("[*] JKMenu Injector v3.0 (BRK Trap Mode)\n");
     
     pid_t pid = find_pid(TARGET_PKG);
-    if (pid == -1) { 
-        printf("[-] Target %s not found!\n", TARGET_PKG); 
-        return 1; 
-    }
+    if (pid == -1) { printf("[-] Target not found!\n"); return 1; }
 
     uintptr_t dlopen_addr = get_remote_dlopen(pid);
     if (!dlopen_addr) return 1;
-    printf("[+] Remote dlopen: %lx\n", dlopen_addr);
 
-    if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) {
-        perror("[-] Attach failed");
-        return 1;
-    }
+    if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) { perror("[-] Attach"); return 1; }
     waitpid(pid, NULL, WUNTRACED);
-    printf("[+] Attached to %d\n", pid);
 
     struct user_pt_regs regs, old_regs;
     struct iovec iov = { .iov_base = &regs, .iov_len = sizeof(regs) };
     ptrace(PTRACE_GETREGSET, pid, (void*)(uintptr_t)NT_PRSTATUS, &iov);
     memcpy(&old_regs, &regs, sizeof(regs));
 
-    uintptr_t sp_path = (regs.sp - 512) & ~0xF;
+    // 1. 准备栈空间：写入 SO 路径和断点指令
+    uintptr_t sp_base = (regs.sp - 512) & ~0xF;
+    uintptr_t brk_addr = sp_base;             // 断点指令位置
+    uintptr_t path_addr = sp_base + 8;        // 路径字符串位置
+
+    // 写入 AArch64 断点指令: brk #0 (0xd4200000)
+    uint32_t brk_ins = 0xd4200000;
+    ptrace(PTRACE_POKETEXT, pid, (void*)brk_addr, (void*)(uintptr_t)brk_ins);
+
+    // 写入 SO 路径
     size_t len = strlen(LIB_PATH) + 1;
     for (size_t i = 0; i < len; i += 8) {
         long data = 0;
         memcpy(&data, LIB_PATH + i, (len - i) < 8 ? (len - i) : 8);
-        ptrace(PTRACE_POKETEXT, pid, (void*)(sp_path + i), (void*)data);
+        ptrace(PTRACE_POKETEXT, pid, (void*)(path_addr + i), (void*)data);
     }
 
-    regs.regs[0] = sp_path;       
-    regs.regs[1] = 2;             
-    regs.pc = dlopen_addr;        
-    regs.regs[30] = 0;            
+    // 2. 设置寄存器：调用 dlopen(path, RTLD_NOW)
+    regs.regs[0] = path_addr;     // x0 = path
+    regs.regs[1] = 2;             // x1 = RTLD_NOW
+    regs.pc = dlopen_addr;        // pc = dlopen
+    regs.regs[30] = brk_addr;     // lr = 断点地址 (执行完跳到这里)
 
     ptrace(PTRACE_SETREGSET, pid, (void*)(uintptr_t)NT_PRSTATUS, &iov);
     
-    printf("[*] Calling remote dlopen...\n");
+    printf("[*] Executing remote dlopen...\n");
     ptrace(PTRACE_CONT, pid, NULL, NULL);
 
+    // 3. 等待断点信号 (SIGTRAP)
     int status;
-    waitpid(pid, &status, WUNTRACED); 
+    waitpid(pid, &status, WUNTRACED);
 
-    printf("[+] Restoring original state...\n");
+    if (WIFSTOPPED(status) && (WSTOPSIG(status) == SIGTRAP || WSTOPSIG(status) == SIGILL)) {
+        printf("[+] dlopen call finished successfully.\n");
+    } else {
+        printf("[!] Warning: Process stopped with signal %d\n", WSTOPSIG(status));
+    }
+
+    // 4. 彻底恢复原始现场
+    printf("[+] Restoring registers and detaching...\n");
     ptrace(PTRACE_SETREGSET, pid, (void*)(uintptr_t)NT_PRSTATUS, (struct iovec *)&old_regs);
-    
     ptrace(PTRACE_DETACH, pid, NULL, NULL);
-    printf("[+] Done!\n");
-
+    
+    printf("[+] Injection Complete!\n");
     return 0;
 }