EngineDev/imgui-mirror
1
0
Fork 0
mirror of https://github.com/ocornut/imgui.git synced 2026-11-06 06:25:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update injector.cpp

Browse Source
This commit is contained in:
gggaa2152 2026-07-23 08:32:29 +08:00 committed by GitHub
parent 4761dbf629
commit e00138a686
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 79 additions and 62 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

141
injector.cpp
View File

@ -1,7 +1,11 @@
// injector.cpp – Android ptrace 注入器 (arm64)
// 使用 PTRACE_GETREGSET / PTRACE_SETREGSET 兼容 Android NDK
// injector.cpp – 改进版 Android ptrace 注入器 (arm64)
// 编译: arm64-linux-android-clang++ -static -std=c++17 injector.cpp -o injector
// 运行: adb push injector /data/local/tmp/ && adb shell su -c /data/local/tmp/injector [so_path] [package_name]
// 用法:
// ./injector [so_path] [package_name] // 自动查找进程
// ./injector [so_path] [pid] // 直接指定 PID（第三个参数为数字）
// 示例:
// ./injector /data/local/tmp/libcheat.so com.tencent.jkchess
// ./injector /data/local/tmp/libcheat.so 12345
#include <stdio.h>
#include <stdlib.h>
@ -17,14 +21,14 @@
#include <dirent.h>
#include <dlfcn.h>
#include <errno.h>
#include <linux/elf.h> // NT_PRSTATUS
#include <asm/ptrace.h> // user_pt_regs
#include <linux/elf.h>
#include <asm/ptrace.h>
#include <ctype.h>
#include <string>
#include <vector>
#include <algorithm>
// ---------- 工具函数 ----------
// 根据进程名获取 PID
// ---------- 通过 cmdline 精确查找进程 ----------
int find_pid_by_name(const char* proc_name) {
DIR* dir = opendir("/proc");
if (!dir) return -1;
@ -34,27 +38,32 @@ int find_pid_by_name(const char* proc_name) {
if (entry->d_type != DT_DIR) continue;
int tmp_pid = atoi(entry->d_name);
if (tmp_pid <= 0) continue;
char path[256];
snprintf(path, sizeof(path), "/proc/%d/comm", tmp_pid);
FILE* fp = fopen(path, "r");
char cmdline_path[256];
snprintf(cmdline_path, sizeof(cmdline_path), "/proc/%d/cmdline", tmp_pid);
FILE* fp = fopen(cmdline_path, "r");
if (fp) {
char comm[64] = {0};
if (fgets(comm, sizeof(comm), fp)) {
comm[strcspn(comm, "\n")] = 0;
if (strcmp(comm, proc_name) == 0) {
char cmdline[256] = {0};
size_t n = fread(cmdline, 1, sizeof(cmdline) - 1, fp);
fclose(fp);
if (n > 0) {
// cmdline 的第一个字符串是命令（包含路径）
char* pkg = cmdline;
// 去除路径前缀
char* last_slash = strrchr(pkg, '/');
if (last_slash) pkg = last_slash + 1;
// 比较完整包名
if (strcmp(pkg, proc_name) == 0) {
pid = tmp_pid;
fclose(fp);
break;
}
}
fclose(fp);
}
}
closedir(dir);
return pid;
}
// 读取远程进程内存
// ---------- 远程内存读写辅助 ----------
long ptrace_readdata(int pid, unsigned long addr, void* buffer, size_t size) {
for (size_t i = 0; i < size; i += sizeof(long)) {
long data = ptrace(PTRACE_PEEKDATA, pid, addr + i, 0);
@ -64,7 +73,6 @@ long ptrace_readdata(int pid, unsigned long addr, void* buffer, size_t size) {
return 0;
}
// 写入远程进程内存
long ptrace_writedata(int pid, unsigned long addr, const void* buffer, size_t size) {
for (size_t i = 0; i < size; i += sizeof(long)) {
long data = 0;
@ -75,8 +83,7 @@ long ptrace_writedata(int pid, unsigned long addr, const void* buffer, size_t si
return 0;
}
// 在远程进程中调用 dlopen 并加载库
// 成功返回 0，失败返回 -1
// ---------- 注入主逻辑 ----------
int ptrace_inject(int pid, const char* so_path) {
// 1. 附加进程
if (ptrace(PTRACE_ATTACH, pid, 0, 0) == -1) {
@ -91,7 +98,7 @@ int ptrace_inject(int pid, const char* so_path) {
return -1;
}
// 2. 保存原始寄存器（用于恢复）
// 2. 保存原始寄存器
struct user_pt_regs regs, orig_regs;
struct iovec iov = { &regs, sizeof(regs) };
if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
@ -101,23 +108,21 @@ int ptrace_inject(int pid, const char* so_path) {
}
orig_regs = regs;
// 3. 在远程进程中分配内存，用于存放 so 路径
// 3. 在远程进程中分配内存存放 SO 路径
size_t path_len = strlen(so_path) + 1;
// 使用 mmap 分配匿名内存 (ARM64 系统调用号 222)
regs.regs[0] = 0; // addr
regs.regs[1] = path_len; // length
regs.regs[2] = PROT_READ | PROT_WRITE;// prot
regs.regs[3] = MAP_PRIVATE | MAP_ANONYMOUS; // flags
regs.regs[4] = -1; // fd
regs.regs[5] = 0; // offset
regs.regs[8] = 222; // syscall number (mmap)
regs.regs[0] = 0;
regs.regs[1] = path_len;
regs.regs[2] = PROT_READ | PROT_WRITE;
regs.regs[3] = MAP_PRIVATE | MAP_ANONYMOUS;
regs.regs[4] = -1;
regs.regs[5] = 0;
regs.regs[8] = 222; // mmap syscall
iov.iov_base = &regs; iov.iov_len = sizeof(regs);
if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
perror("ptrace setregset for mmap");
ptrace(PTRACE_DETACH, pid, 0, 0);
return -1;
}
// 执行系统调用
if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1) {
perror("ptrace syscall");
ptrace(PTRACE_DETACH, pid, 0, 0);
@ -129,7 +134,6 @@ int ptrace_inject(int pid, const char* so_path) {
ptrace(PTRACE_DETACH, pid, 0, 0);
return -1;
}
// 获取返回值（分配的地址）
struct user_pt_regs ret_regs;
iov.iov_base = &ret_regs; iov.iov_len = sizeof(ret_regs);
if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
@ -145,17 +149,15 @@ int ptrace_inject(int pid, const char* so_path) {
}
printf("Allocated remote memory at 0x%lx\n", remote_addr);
// 4. 将 so 路径写入远程内存
// 4. 写入 SO 路径
if (ptrace_writedata(pid, remote_addr, so_path, path_len) == -1) {
perror("ptrace writedata");
ptrace(PTRACE_DETACH, pid, 0, 0);
return -1;
}
// 5. 获取远程进程中 dlopen 的地址
// 方法：从本地 dlopen 地址减去本地 libdl.so 基址，再加上远程 libdl.so 基址
// 5. 获取远程 dlopen 地址
void* local_dlopen = (void*)dlopen;
// 获取本地 libdl.so 基址
FILE* maps = fopen("/proc/self/maps", "r");
if (!maps) {
perror("fopen self maps");
@ -178,7 +180,6 @@ int ptrace_inject(int pid, const char* so_path) {
}
unsigned long local_dlopen_offset = (unsigned long)local_dlopen - local_libdl_base;
// 获取远程 libdl.so 基址
char remote_maps_path[64];
snprintf(remote_maps_path, sizeof(remote_maps_path), "/proc/%d/maps", pid);
maps = fopen(remote_maps_path, "r");
@ -203,20 +204,18 @@ int ptrace_inject(int pid, const char* so_path) {
unsigned long remote_dlopen_addr = remote_libdl_base + local_dlopen_offset;
printf("Remote dlopen address: 0x%lx\n", remote_dlopen_addr);
// 6. 调用远程 dlopen(so_path, RTLD_LAZY)
regs = orig_regs; // 恢复成刚 attach 时的状态
regs.regs[0] = remote_addr; // 路径指针
regs.regs[1] = RTLD_LAZY; // 第二个参数
regs.pc = remote_dlopen_addr; // 跳转到 dlopen
regs.regs[30] = 0x0; // LR = 0，执行完会 crash
// 6. 调用远程 dlopen
regs = orig_regs;
regs.regs[0] = remote_addr;
regs.regs[1] = RTLD_LAZY;
regs.pc = remote_dlopen_addr;
regs.regs[30] = 0x0; // LR = 0，执行后崩溃以便我们捕获
iov.iov_base = &regs; iov.iov_len = sizeof(regs);
if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
perror("ptrace setregset for dlopen");
ptrace(PTRACE_DETACH, pid, 0, 0);
return -1;
}
// 让远程进程继续执行 dlopen，然后会因 PC=0 而 crash
if (ptrace(PTRACE_CONT, pid, 0, 0) == -1) {
perror("ptrace cont");
ptrace(PTRACE_DETACH, pid, 0, 0);
@ -224,7 +223,6 @@ int ptrace_inject(int pid, const char* so_path) {
}
waitpid(pid, &status, 0);
if (WIFSIGNALED(status) && WTERMSIG(status) == SIGSEGV) {
// 预期的段错误，因为 LR=0
printf("dlopen executed (segfault expected)\n");
} else {
fprintf(stderr, "unexpected stop: status=%d\n", status);
@ -232,9 +230,7 @@ int ptrace_inject(int pid, const char* so_path) {
return -1;
}
// 7. 清理：远程内存可以不释放，进程会继续运行，so 已加载
// 8. 恢复原始寄存器并 detach
// 7. 恢复寄存器并 detach
iov.iov_base = &orig_regs; iov.iov_len = sizeof(orig_regs);
if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
perror("restore regs");
@ -248,25 +244,46 @@ int ptrace_inject(int pid, const char* so_path) {
return 0;
}
// ---------- 主函数 ----------
int main(int argc, char** argv) {
const char* target_name = "com.tencent.jkchess";
const char* so_path = "/data/data/com.tencent.jkchess/libcheat.so"; // 默认路径
const char* so_path = "/data/local/tmp/libcheat.so"; // 默认路径
const char* target = "com.tencent.jkchess"; // 默认包名
int pid = -1;
if (argc >= 2) so_path = argv[1];
if (argc >= 3) target_name = argv[2];
printf("Injecting %s into %s ...\n", so_path, target_name);
int pid = find_pid_by_name(target_name);
if (pid <= 0) {
fprintf(stderr, "Process %s not found\n", target_name);
return 1;
if (argc >= 3) {
// 检查第三个参数是否为纯数字（PID）
bool is_number = true;
for (int i = 0; argv[2][i]; i++) {
if (!isdigit(argv[2][i])) { is_number = false; break; }
}
if (is_number) {
pid = atoi(argv[2]);
printf("Using specified PID: %d\n", pid);
} else {
target = argv[2];
}
}
if (argc >= 4) {
// 如果第四个参数存在，则作为 PID（覆盖之前的推断）
pid = atoi(argv[3]);
printf("Using specified PID (from arg4): %d\n", pid);
}
printf("Found PID: %d\n", pid);
// 检查 so 文件是否存在
if (pid <= 0) {
printf("Searching for process '%s' ...\n", target);
pid = find_pid_by_name(target);
if (pid <= 0) {
fprintf(stderr, "Process '%s' not found. Please ensure the game is running.\n", target);
fprintf(stderr, "You can also specify PID manually: %s <so_path> <pid>\n", argv[0]);
return 1;
}
printf("Found PID: %d\n", pid);
}
// 检查 SO 文件是否存在
if (access(so_path, F_OK) == -1) {
fprintf(stderr, "SO file %s does not exist\n", so_path);
fprintf(stderr, "SO file '%s' does not exist\n", so_path);
return 1;
}