Update injector.cpp

injector.cpp

@@ -1,297 +1,262 @@
-/**
- * injector.cpp – 稳健注入器（使用 mmap 独立内存，不破坏进程）
- * 编译: aarch64-linux-android-clang++ -static -std=c++17 -O2 injector.cpp -o injector
- */
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <dirent.h>
 #include <sys/ptrace.h>
-#include <sys/uio.h>
 #include <sys/wait.h>
 #include <sys/mman.h>
-#include <sys/user.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <dirent.h>
+#include <sys/uio.h>
+#include <elf.h>
 #include <dlfcn.h>
 #include <errno.h>
-#include <linux/elf.h>
-#include <asm/ptrace.h>
-#include <ctype.h>
 
-#define DEFAULT_SO_PATH   "/data/1/libMyMenu.so"
-#define DEFAULT_PKG_NAME  "com.tencent.jkchess"
+#if defined(__aarch64__)
+#define pt_regs user_pt_regs
+#define uregs regs
+#define ARM_pc pc
+#define ARM_sp sp
+#define ARM_cpsr pstate
+#define ARM_lr regs[30]
+#define ARM_r0 regs[0]
+#else
+#error "This injector currently only supports ARM64 (aarch64) architecture."
+#endif
 
-// ---------- 查找进程 ----------
-int find_pid_by_name(const char* proc_name) {
-    DIR* dir = opendir("/proc");
+const char* TARGET_PROCESS = "com.tencent.jkchess"; // 目标进程名
+const char* PAYLOAD_PATH = "/data/local/tmp/libjk_internal.so"; // 您的动态库路径
+
+// =================================================================
+// 辅助函数：通过进程名获取 PID
+// =================================================================
+pid_t GetPID(const char *process_name) {
+    pid_t pid = -1;
+    DIR *dir = opendir("/proc");
     if (!dir) return -1;
-    struct dirent* entry;
-    int pid = -1;
-    while ((entry = readdir(dir)) != nullptr) {
-        if (entry->d_type != DT_DIR) continue;
-        int tmp_pid = atoi(entry->d_name);
-        if (tmp_pid <= 0) continue;
+
+    struct dirent *entry;
+    while ((entry = readdir(dir)) != NULL) {
+        int current_pid = atoi(entry->d_name);
+        if (current_pid == 0) continue;
+
         char cmdline_path[256];
-        snprintf(cmdline_path, sizeof(cmdline_path), "/proc/%d/cmdline", tmp_pid);
-        FILE* fp = fopen(cmdline_path, "r");
+        snprintf(cmdline_path, sizeof(cmdline_path), "/proc/%d/cmdline", current_pid);
+        
+        FILE *fp = fopen(cmdline_path, "r");
         if (fp) {
-            char cmdline[256] = {0};
-            size_t n = fread(cmdline, 1, sizeof(cmdline) - 1, fp);
-            fclose(fp);
-            if (n > 0) {
-                char* pkg = cmdline;
-                char* last_slash = strrchr(pkg, '/');
-                if (last_slash) pkg = last_slash + 1;
-                if (strcmp(pkg, proc_name) == 0) {
-                    pid = tmp_pid;
+            char cmdline[256];
+            if (fgets(cmdline, sizeof(cmdline), fp) != NULL) {
+                if (strcmp(cmdline, process_name) == 0) {
+                    pid = current_pid;
+                    fclose(fp);
                     break;
                 }
             }
+            fclose(fp);
         }
     }
     closedir(dir);
     return pid;
 }
 
-// ---------- ptrace 读写 ----------
-long ptrace_writedata(int pid, unsigned long addr, const void* buffer, size_t size) {
-    for (size_t i = 0; i < size; i += sizeof(long)) {
-        long data = 0;
-        memcpy(&data, (char*)buffer + i, (size - i) < sizeof(long) ? (size - i) : sizeof(long));
-        if (ptrace(PTRACE_POKEDATA, pid, addr + i, data) == -1) {
-            perror("ptrace_pokedata");
-            return -1;
-        }
-    }
-    return 0;
-}
+// =================================================================
+// 辅助函数：获取模块在指定进程中的基址
+// =================================================================
+uintptr_t GetModuleBase(pid_t pid, const char *module_name) {
+    uintptr_t base_addr = 0;
+    char maps_path[256];
+    snprintf(maps_path, sizeof(maps_path), "/proc/%d/maps", pid);
 
-// ---------- 执行系统调用 ----------
-int remote_syscall(int pid, struct user_pt_regs& regs, unsigned long* result = nullptr) {
-    struct iovec iov = { &regs, sizeof(regs) };
-    if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
-        perror("setregset before syscall");
-        return -1;
-    }
-    if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1) {
-        perror("ptrace syscall enter");
-        return -1;
-    }
-    int status;
-    waitpid(pid, &status, 0);
-    if (!WIFSTOPPED(status)) {
-        fprintf(stderr, "not stopped after syscall enter\n");
-        return -1;
-    }
-    if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1) {
-        perror("ptrace syscall exit");
-        return -1;
-    }
-    waitpid(pid, &status, 0);
-    if (!WIFSTOPPED(status)) {
-        fprintf(stderr, "not stopped after syscall exit\n");
-        return -1;
-    }
-    struct user_pt_regs ret_regs;
-    iov.iov_base = &ret_regs; iov.iov_len = sizeof(ret_regs);
-    if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
-        perror("getregset for return");
-        return -1;
-    }
-    if (result) *result = ret_regs.regs[0];
-    regs = ret_regs;
-    return 0;
-}
+    FILE *fp = fopen(maps_path, "r");
+    if (!fp) return 0;
 
-// ---------- 注入主函数 ----------
-int inject_so(int pid, const char* so_path) {
-    if (ptrace(PTRACE_ATTACH, pid, 0, 0) == -1) {
-        perror("ptrace attach");
-        return -1;
-    }
-    int status;
-    waitpid(pid, &status, 0);
-    if (!WIFSTOPPED(status)) {
-        fprintf(stderr, "process not stopped\n");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-
-    struct user_pt_regs orig_regs, regs;
-    struct iovec iov = { &orig_regs, sizeof(orig_regs) };
-    if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
-        perror("getregset original");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-    regs = orig_regs;
-
-    size_t path_len = strlen(so_path) + 1;
-
-    // 尝试 mmap 多个候选地址
-    unsigned long candidate_addrs[] = { 0x10000000, 0x20000000, 0x30000000, 0x40000000, 0 };
-    unsigned long remote_addr = 0;
-    int retry = 0;
-    while (candidate_addrs[retry] != 0) {
-        regs = orig_regs;
-        regs.regs[0] = candidate_addrs[retry];
-        regs.regs[1] = path_len;
-        regs.regs[2] = PROT_READ | PROT_WRITE;
-        regs.regs[3] = MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE; // 不覆盖已有映射
-        regs.regs[4] = -1;
-        regs.regs[5] = 0;
-        regs.regs[8] = 222; // mmap
-
-        if (remote_syscall(pid, regs, &remote_addr) != 0) {
-            fprintf(stderr, "mmap syscall failed at 0x%lx\n", candidate_addrs[retry]);
-            retry++;
-            continue;
-        }
-        if (remote_addr != (unsigned long)-1 && remote_addr != 0) {
-            printf("[+] mmap succeeded at 0x%lx\n", remote_addr);
-            break;
-        }
-        retry++;
-    }
-    if (remote_addr == 0 || remote_addr == (unsigned long)-1) {
-        fprintf(stderr, "All mmap attempts failed\n");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-
-    // 写入 SO 路径
-    if (ptrace_writedata(pid, remote_addr, so_path, path_len) == -1) {
-        fprintf(stderr, "ptrace_writedata failed\n");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-    printf("[+] Wrote SO path\n");
-
-    // 计算远程 dlopen
-    void* local_dlopen = (void*)dlopen;
-    unsigned long local_libdl_base = 0;
-    FILE* fp = fopen("/proc/self/maps", "r");
-    if (!fp) {
-        perror("open self maps");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-    char line[512];
+    char line[1024];
     while (fgets(line, sizeof(line), fp)) {
-        if (strstr(line, "libdl.so")) {
-            sscanf(line, "%lx", &local_libdl_base);
+        if (strstr(line, module_name) && strstr(line, "r-xp")) {
+            sscanf(line, "%lx", &base_addr);
             break;
         }
     }
     fclose(fp);
-    if (local_libdl_base == 0) {
-        fprintf(stderr, "can't find local libdl.so base\n");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-    unsigned long dlopen_offset = (unsigned long)local_dlopen - local_libdl_base;
-
-    char remote_maps_path[64];
-    snprintf(remote_maps_path, sizeof(remote_maps_path), "/proc/%d/maps", pid);
-    fp = fopen(remote_maps_path, "r");
-    if (!fp) {
-        perror("open remote maps");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-    unsigned long remote_libdl_base = 0;
-    while (fgets(line, sizeof(line), fp)) {
-        if (strstr(line, "libdl.so")) {
-            sscanf(line, "%lx", &remote_libdl_base);
-            break;
-        }
-    }
-    fclose(fp);
-    if (remote_libdl_base == 0) {
-        fprintf(stderr, "can't find remote libdl.so base\n");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-    unsigned long remote_dlopen = remote_libdl_base + dlopen_offset;
-    printf("[+] Remote dlopen: 0x%lx\n", remote_dlopen);
-
-    // 执行 dlopen，LR 设回原 PC+4
-    regs = orig_regs;
-    regs.regs[0] = remote_addr;
-    regs.regs[1] = RTLD_LAZY;
-    regs.pc = remote_dlopen;
-    regs.regs[30] = orig_regs.pc + 4;   // 正常返回
-
-    iov.iov_base = &regs; iov.iov_len = sizeof(regs);
-    if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
-        perror("setregset for dlopen");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-
-    // 继续执行，不等待信号
-    if (ptrace(PTRACE_CONT, pid, 0, 0) == -1) {
-        perror("ptrace cont");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-
-    // 等待一下，让 dlopen 执行
-    usleep(100000); // 100ms
-
-    // 检查进程状态，如果停止则恢复并继续
-    pid_t wpid = waitpid(pid, &status, WNOHANG);
-    if (wpid > 0 && WIFSTOPPED(status)) {
-        printf("[!] Process stopped with signal %d, continuing...\n", WSTOPSIG(status));
-        ptrace(PTRACE_CONT, pid, 0, 0);
-    }
-
-    // 恢复寄存器并 detach
-    iov.iov_base = &orig_regs; iov.iov_len = sizeof(orig_regs);
-    ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov);
-    ptrace(PTRACE_DETACH, pid, 0, 0);
-    printf("[+] Injection completed successfully.\n");
-    return 0;
+    return base_addr;
 }
 
-// ---------- 主函数 ----------
-int main(int argc, char** argv) {
-    const char* so_path = DEFAULT_SO_PATH;
-    const char* target = DEFAULT_PKG_NAME;
-    int pid = -1;
+// =================================================================
+// 辅助函数：计算远程函数的绝对地址
+// =================================================================
+uintptr_t GetRemoteFuncAddr(pid_t target_pid, const char *module_name, void *local_func_addr) {
+    uintptr_t local_base = GetModuleBase(getpid(), module_name);
+    uintptr_t remote_base = GetModuleBase(target_pid, module_name);
+    
+    if (local_base == 0 || remote_base == 0) return 0;
+    return (uintptr_t)local_func_addr - local_base + remote_base;
+}
 
-    if (argc >= 2) so_path = argv[1];
-    if (argc >= 3) {
-        bool is_digit = true;
-        for (int i = 0; argv[2][i]; i++) {
-            if (!isdigit(argv[2][i])) { is_digit = false; break; }
+// =================================================================
+// Ptrace 核心操作
+// =================================================================
+bool PtraceRead(pid_t pid, uintptr_t addr, void *buf, size_t size) {
+    uintptr_t i = 0;
+    long data;
+    while (i < size) {
+        data = ptrace(PTRACE_PEEKTEXT, pid, addr + i, NULL);
+        if (data == -1 && errno != 0) return false;
+        size_t copy_size = (size - i) > sizeof(long) ? sizeof(long) : (size - i);
+        memcpy((uint8_t*)buf + i, &data, copy_size);
+        i += copy_size;
+    }
+    return true;
+}
+
+bool PtraceWrite(pid_t pid, uintptr_t addr, const void *buf, size_t size) {
+    uintptr_t i = 0;
+    long data;
+    while (i < size) {
+        size_t copy_size = (size - i) > sizeof(long) ? sizeof(long) : (size - i);
+        if (copy_size < sizeof(long)) {
+            data = ptrace(PTRACE_PEEKTEXT, pid, addr + i, NULL);
+            memcpy(&data, (uint8_t*)buf + i, copy_size);
+        } else {
+            memcpy(&data, (uint8_t*)buf + i, sizeof(long));
         }
-        if (is_digit) pid = atoi(argv[2]);
-        else target = argv[2];
+        if (ptrace(PTRACE_POKETEXT, pid, addr + i, data) == -1) return false;
+        i += copy_size;
+    }
+    return true;
+}
+
+bool PtraceCall(pid_t pid, uintptr_t func_addr, long *params, int num_params, struct pt_regs *regs) {
+    for (int i = 0; i < num_params && i < 8; i++) {
+        regs->uregs[i] = params[i];
+    }
+    
+    // 设置返回地址为 0，当执行到 0 时会触发 SIGSEGV 被 ptrace 捕获
+    regs->ARM_lr = 0;
+    regs->ARM_pc = func_addr;
+    
+    if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, regs) == -1) return false;
+    if (ptrace(PTRACE_CONT, pid, NULL, 0) == -1) return false;
+    
+    int status = 0;
+    waitpid(pid, &status, WUNTRACED);
+    
+    while (WIFSTOPPED(status)) {
+        if (WSTOPSIG(status) == SIGSEGV) {
+            // 函数执行完毕，读取寄存器获取返回值
+            ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, regs);
+            return true;
+        }
+        ptrace(PTRACE_CONT, pid, NULL, 0);
+        waitpid(pid, &status, WUNTRACED);
+    }
+    return false;
+}
+
+// =================================================================
+// 注入主逻辑
+// =================================================================
+bool InjectLibrary(pid_t pid, const char *library_path) {
+    printf("[+] 开始注入目标进程 PID: %d\n", pid);
+
+    if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) == -1) {
+        printf("[-] Ptrace 附加失败 (需要 root 权限)\n");
+        return false;
+    }
+    waitpid(pid, NULL, WUNTRACED);
+    printf("[+] 成功附加到进程\n");
+
+    struct pt_regs original_regs, regs;
+    struct iovec io;
+    io.iov_base = &original_regs;
+    io.iov_len = sizeof(original_regs);
+    ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &io);
+    memcpy(&regs, &original_regs, sizeof(regs));
+
+    // 1. 获取目标进程 mmap 和 dlopen 的地址
+    // 注意：Android 8.0+ dlopen 受到命名空间限制。若注入失败，建议使用 __loader_dlopen
+    uintptr_t remote_mmap = GetRemoteFuncAddr(pid, "libc.so", (void*)mmap);
+    uintptr_t remote_dlopen = GetRemoteFuncAddr(pid, "libdl.so", (void*)dlopen); // 或 "linker64"
+    
+    if (!remote_mmap || !remote_dlopen) {
+        printf("[-] 无法获取远程函数地址 mmap: %lx, dlopen: %lx\n", remote_mmap, remote_dlopen);
+        ptrace(PTRACE_DETACH, pid, NULL, NULL);
+        return false;
+    }
+    printf("[+] 远程 mmap 地址: 0x%lx\n", remote_mmap);
+    printf("[+] 远程 dlopen 地址: 0x%lx\n", remote_dlopen);
+
+    // 2. 在目标进程调用 mmap 分配空间存放 SO 路径
+    long parameters[6];
+    parameters[0] = 0;                                 // addr
+    parameters[1] = 0x1000;                            // size
+    parameters[2] = PROT_READ | PROT_WRITE | PROT_EXEC;// prot
+    parameters[3] = MAP_ANONYMOUS | MAP_PRIVATE;       // flags
+    parameters[4] = 0;                                 // fd
+    parameters[5] = 0;                                 // offset
+
+    printf("[+] 调用远程 mmap 分配内存...\n");
+    if (!PtraceCall(pid, remote_mmap, parameters, 6, &regs)) {
+        printf("[-] 远程 mmap 调用失败\n");
+        ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &io);
+        ptrace(PTRACE_DETACH, pid, NULL, NULL);
+        return false;
     }
 
-    printf("[Injector] SO: %s\n", so_path);
-    printf("[Injector] Target: %s\n", target);
+    uintptr_t remote_string_addr = regs.ARM_r0;
+    printf("[+] 目标进程内存分配成功，地址: 0x%lx\n", remote_string_addr);
 
-    if (access(so_path, F_OK) != 0) {
-        fprintf(stderr, "SO file not found: %s\n", so_path);
-        return 1;
+    // 3. 将 SO 路径写入目标进程分配的内存中
+    if (!PtraceWrite(pid, remote_string_addr, library_path, strlen(library_path) + 1)) {
+        printf("[-] 写入 SO 路径失败\n");
+        ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &io);
+        ptrace(PTRACE_DETACH, pid, NULL, NULL);
+        return false;
     }
+    printf("[+] SO 路径已写入远程内存\n");
 
-    if (pid <= 0) {
-        printf("[Injector] Searching for process '%s'...\n", target);
-        pid = find_pid_by_name(target);
-        if (pid <= 0) {
-            fprintf(stderr, "Process '%s' not found\n", target);
-            return 1;
-        }
-        printf("[Injector] Found PID: %d\n", pid);
+    // 4. 恢复寄存器，准备调用 dlopen
+    memcpy(&regs, &original_regs, sizeof(regs));
+    parameters[0] = remote_string_addr; // filename
+    parameters[1] = RTLD_NOW | RTLD_LOCAL; // flags
+
+    printf("[+] 调用远程 dlopen 加载 SO...\n");
+    if (!PtraceCall(pid, remote_dlopen, parameters, 2, &regs)) {
+        printf("[-] 远程 dlopen 调用失败\n");
     } else {
-        printf("[Injector] Using specified PID: %d\n", pid);
+        uintptr_t so_handle = regs.ARM_r0;
+        if (so_handle == 0) {
+            printf("[-] dlopen 返回 NULL，注入可能被 linker namespace 阻止！\n");
+        } else {
+            printf("[+] 注入成功! SO Handle: 0x%lx\n", so_handle);
+        }
     }
 
-    return inject_so(pid, so_path);
+    // 5. 恢复目标进程原本的寄存器状态并脱离
+    ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &io);
+    ptrace(PTRACE_DETACH, pid, NULL, NULL);
+    printf("[+] 已脱离目标进程\n");
+
+    return true;
+}
+
+int main(int argc, char *argv[]) {
+    printf("======================================\n");
+    printf("     Android ARM64 Ptrace Injector    \n");
+    printf("======================================\n");
+
+    pid_t target_pid = GetPID(TARGET_PROCESS);
+    if (target_pid == -1) {
+        printf("[-] 未找到目标进程: %s，游戏是否已启动？\n", TARGET_PROCESS);
+        return -1;
+    }
+
+    if (access(PAYLOAD_PATH, F_OK) == -1) {
+        printf("[-] 找不到需要注入的文件: %s\n", PAYLOAD_PATH);
+        printf("[-] 请先将您的 SO 文件 adb push 到该路径。\n");
+        return -1;
+    }
+
+    InjectLibrary(target_pid, PAYLOAD_PATH);
+
+    return 0;
 }