diff --git a/injector.cpp b/injector.cpp index 1c565dc59..75c31fed2 100644 --- a/injector.cpp +++ b/injector.cpp @@ -1,297 +1,262 @@ -/** - * injector.cpp – 稳健注入器（使用 mmap 独立内存，不破坏进程） - * 编译: aarch64-linux-android-clang++ -static -std=c++17 -O2 injector.cpp -o injector - */ - #include #include #include #include +#include #include -#include #include #include -#include -#include -#include -#include +#include +#include #include #include -#include -#include -#include -#define DEFAULT_SO_PATH "/data/1/libMyMenu.so" -#define DEFAULT_PKG_NAME "com.tencent.jkchess" +#if defined(__aarch64__) +#define pt_regs user_pt_regs +#define uregs regs +#define ARM_pc pc +#define ARM_sp sp +#define ARM_cpsr pstate +#define ARM_lr regs[30] +#define ARM_r0 regs[0] +#else +#error "This injector currently only supports ARM64 (aarch64) architecture." +#endif -// ---------- 查找进程 ---------- -int find_pid_by_name(const char* proc_name) { - DIR* dir = opendir("/proc"); +const char* TARGET_PROCESS = "com.tencent.jkchess"; // 目标进程名 +const char* PAYLOAD_PATH = "/data/local/tmp/libjk_internal.so"; // 您的动态库路径 + +// ================================================================= +// 辅助函数：通过进程名获取 PID +// ================================================================= +pid_t GetPID(const char *process_name) { + pid_t pid = -1; + DIR *dir = opendir("/proc"); if (!dir) return -1; - struct dirent* entry; - int pid = -1; - while ((entry = readdir(dir)) != nullptr) { - if (entry->d_type != DT_DIR) continue; - int tmp_pid = atoi(entry->d_name); - if (tmp_pid <= 0) continue; + + struct dirent *entry; + while ((entry = readdir(dir)) != NULL) { + int current_pid = atoi(entry->d_name); + if (current_pid == 0) continue; + char cmdline_path[256]; - snprintf(cmdline_path, sizeof(cmdline_path), "/proc/%d/cmdline", tmp_pid); - FILE* fp = fopen(cmdline_path, "r"); + snprintf(cmdline_path, sizeof(cmdline_path), "/proc/%d/cmdline", current_pid); + + FILE *fp = fopen(cmdline_path, "r"); if (fp) { - char cmdline[256] = {0}; - size_t n = fread(cmdline, 1, sizeof(cmdline) - 1, fp); - fclose(fp); - if (n > 0) { - char* pkg = cmdline; - char* last_slash = strrchr(pkg, '/'); - if (last_slash) pkg = last_slash + 1; - if (strcmp(pkg, proc_name) == 0) { - pid = tmp_pid; + char cmdline[256]; + if (fgets(cmdline, sizeof(cmdline), fp) != NULL) { + if (strcmp(cmdline, process_name) == 0) { + pid = current_pid; + fclose(fp); break; } } + fclose(fp); } } closedir(dir); return pid; } -// ---------- ptrace 读写 ---------- -long ptrace_writedata(int pid, unsigned long addr, const void* buffer, size_t size) { - for (size_t i = 0; i < size; i += sizeof(long)) { - long data = 0; - memcpy(&data, (char*)buffer + i, (size - i) < sizeof(long) ? (size - i) : sizeof(long)); - if (ptrace(PTRACE_POKEDATA, pid, addr + i, data) == -1) { - perror("ptrace_pokedata"); - return -1; - } - } - return 0; -} +// ================================================================= +// 辅助函数：获取模块在指定进程中的基址 +// ================================================================= +uintptr_t GetModuleBase(pid_t pid, const char *module_name) { + uintptr_t base_addr = 0; + char maps_path[256]; + snprintf(maps_path, sizeof(maps_path), "/proc/%d/maps", pid); -// ---------- 执行系统调用 ---------- -int remote_syscall(int pid, struct user_pt_regs& regs, unsigned long* result = nullptr) { - struct iovec iov = { ®s, sizeof(regs) }; - if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) { - perror("setregset before syscall"); - return -1; - } - if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1) { - perror("ptrace syscall enter"); - return -1; - } - int status; - waitpid(pid, &status, 0); - if (!WIFSTOPPED(status)) { - fprintf(stderr, "not stopped after syscall enter\n"); - return -1; - } - if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1) { - perror("ptrace syscall exit"); - return -1; - } - waitpid(pid, &status, 0); - if (!WIFSTOPPED(status)) { - fprintf(stderr, "not stopped after syscall exit\n"); - return -1; - } - struct user_pt_regs ret_regs; - iov.iov_base = &ret_regs; iov.iov_len = sizeof(ret_regs); - if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) { - perror("getregset for return"); - return -1; - } - if (result) *result = ret_regs.regs[0]; - regs = ret_regs; - return 0; -} + FILE *fp = fopen(maps_path, "r"); + if (!fp) return 0; -// ---------- 注入主函数 ---------- -int inject_so(int pid, const char* so_path) { - if (ptrace(PTRACE_ATTACH, pid, 0, 0) == -1) { - perror("ptrace attach"); - return -1; - } - int status; - waitpid(pid, &status, 0); - if (!WIFSTOPPED(status)) { - fprintf(stderr, "process not stopped\n"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - - struct user_pt_regs orig_regs, regs; - struct iovec iov = { &orig_regs, sizeof(orig_regs) }; - if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) { - perror("getregset original"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - regs = orig_regs; - - size_t path_len = strlen(so_path) + 1; - - // 尝试 mmap 多个候选地址 - unsigned long candidate_addrs[] = { 0x10000000, 0x20000000, 0x30000000, 0x40000000, 0 }; - unsigned long remote_addr = 0; - int retry = 0; - while (candidate_addrs[retry] != 0) { - regs = orig_regs; - regs.regs[0] = candidate_addrs[retry]; - regs.regs[1] = path_len; - regs.regs[2] = PROT_READ | PROT_WRITE; - regs.regs[3] = MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE; // 不覆盖已有映射 - regs.regs[4] = -1; - regs.regs[5] = 0; - regs.regs[8] = 222; // mmap - - if (remote_syscall(pid, regs, &remote_addr) != 0) { - fprintf(stderr, "mmap syscall failed at 0x%lx\n", candidate_addrs[retry]); - retry++; - continue; - } - if (remote_addr != (unsigned long)-1 && remote_addr != 0) { - printf("[+] mmap succeeded at 0x%lx\n", remote_addr); - break; - } - retry++; - } - if (remote_addr == 0 || remote_addr == (unsigned long)-1) { - fprintf(stderr, "All mmap attempts failed\n"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - - // 写入 SO 路径 - if (ptrace_writedata(pid, remote_addr, so_path, path_len) == -1) { - fprintf(stderr, "ptrace_writedata failed\n"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - printf("[+] Wrote SO path\n"); - - // 计算远程 dlopen - void* local_dlopen = (void*)dlopen; - unsigned long local_libdl_base = 0; - FILE* fp = fopen("/proc/self/maps", "r"); - if (!fp) { - perror("open self maps"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - char line[512]; + char line[1024]; while (fgets(line, sizeof(line), fp)) { - if (strstr(line, "libdl.so")) { - sscanf(line, "%lx", &local_libdl_base); + if (strstr(line, module_name) && strstr(line, "r-xp")) { + sscanf(line, "%lx", &base_addr); break; } } fclose(fp); - if (local_libdl_base == 0) { - fprintf(stderr, "can't find local libdl.so base\n"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - unsigned long dlopen_offset = (unsigned long)local_dlopen - local_libdl_base; - - char remote_maps_path[64]; - snprintf(remote_maps_path, sizeof(remote_maps_path), "/proc/%d/maps", pid); - fp = fopen(remote_maps_path, "r"); - if (!fp) { - perror("open remote maps"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - unsigned long remote_libdl_base = 0; - while (fgets(line, sizeof(line), fp)) { - if (strstr(line, "libdl.so")) { - sscanf(line, "%lx", &remote_libdl_base); - break; - } - } - fclose(fp); - if (remote_libdl_base == 0) { - fprintf(stderr, "can't find remote libdl.so base\n"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - unsigned long remote_dlopen = remote_libdl_base + dlopen_offset; - printf("[+] Remote dlopen: 0x%lx\n", remote_dlopen); - - // 执行 dlopen，LR 设回原 PC+4 - regs = orig_regs; - regs.regs[0] = remote_addr; - regs.regs[1] = RTLD_LAZY; - regs.pc = remote_dlopen; - regs.regs[30] = orig_regs.pc + 4; // 正常返回 - - iov.iov_base = ®s; iov.iov_len = sizeof(regs); - if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) { - perror("setregset for dlopen"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - - // 继续执行，不等待信号 - if (ptrace(PTRACE_CONT, pid, 0, 0) == -1) { - perror("ptrace cont"); - ptrace(PTRACE_DETACH, pid, 0, 0); - return -1; - } - - // 等待一下，让 dlopen 执行 - usleep(100000); // 100ms - - // 检查进程状态，如果停止则恢复并继续 - pid_t wpid = waitpid(pid, &status, WNOHANG); - if (wpid > 0 && WIFSTOPPED(status)) { - printf("[!] Process stopped with signal %d, continuing...\n", WSTOPSIG(status)); - ptrace(PTRACE_CONT, pid, 0, 0); - } - - // 恢复寄存器并 detach - iov.iov_base = &orig_regs; iov.iov_len = sizeof(orig_regs); - ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov); - ptrace(PTRACE_DETACH, pid, 0, 0); - printf("[+] Injection completed successfully.\n"); - return 0; + return base_addr; } -// ---------- 主函数 ---------- -int main(int argc, char** argv) { - const char* so_path = DEFAULT_SO_PATH; - const char* target = DEFAULT_PKG_NAME; - int pid = -1; +// ================================================================= +// 辅助函数：计算远程函数的绝对地址 +// ================================================================= +uintptr_t GetRemoteFuncAddr(pid_t target_pid, const char *module_name, void *local_func_addr) { + uintptr_t local_base = GetModuleBase(getpid(), module_name); + uintptr_t remote_base = GetModuleBase(target_pid, module_name); + + if (local_base == 0 || remote_base == 0) return 0; + return (uintptr_t)local_func_addr - local_base + remote_base; +} - if (argc >= 2) so_path = argv[1]; - if (argc >= 3) { - bool is_digit = true; - for (int i = 0; argv[2][i]; i++) { - if (!isdigit(argv[2][i])) { is_digit = false; break; } +// ================================================================= +// Ptrace 核心操作 +// ================================================================= +bool PtraceRead(pid_t pid, uintptr_t addr, void *buf, size_t size) { + uintptr_t i = 0; + long data; + while (i < size) { + data = ptrace(PTRACE_PEEKTEXT, pid, addr + i, NULL); + if (data == -1 && errno != 0) return false; + size_t copy_size = (size - i) > sizeof(long) ? sizeof(long) : (size - i); + memcpy((uint8_t*)buf + i, &data, copy_size); + i += copy_size; + } + return true; +} + +bool PtraceWrite(pid_t pid, uintptr_t addr, const void *buf, size_t size) { + uintptr_t i = 0; + long data; + while (i < size) { + size_t copy_size = (size - i) > sizeof(long) ? sizeof(long) : (size - i); + if (copy_size < sizeof(long)) { + data = ptrace(PTRACE_PEEKTEXT, pid, addr + i, NULL); + memcpy(&data, (uint8_t*)buf + i, copy_size); + } else { + memcpy(&data, (uint8_t*)buf + i, sizeof(long)); } - if (is_digit) pid = atoi(argv[2]); - else target = argv[2]; + if (ptrace(PTRACE_POKETEXT, pid, addr + i, data) == -1) return false; + i += copy_size; + } + return true; +} + +bool PtraceCall(pid_t pid, uintptr_t func_addr, long *params, int num_params, struct pt_regs *regs) { + for (int i = 0; i < num_params && i < 8; i++) { + regs->uregs[i] = params[i]; + } + + // 设置返回地址为 0，当执行到 0 时会触发 SIGSEGV 被 ptrace 捕获 + regs->ARM_lr = 0; + regs->ARM_pc = func_addr; + + if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, regs) == -1) return false; + if (ptrace(PTRACE_CONT, pid, NULL, 0) == -1) return false; + + int status = 0; + waitpid(pid, &status, WUNTRACED); + + while (WIFSTOPPED(status)) { + if (WSTOPSIG(status) == SIGSEGV) { + // 函数执行完毕，读取寄存器获取返回值 + ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, regs); + return true; + } + ptrace(PTRACE_CONT, pid, NULL, 0); + waitpid(pid, &status, WUNTRACED); + } + return false; +} + +// ================================================================= +// 注入主逻辑 +// ================================================================= +bool InjectLibrary(pid_t pid, const char *library_path) { + printf("[+] 开始注入目标进程 PID: %d\n", pid); + + if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) == -1) { + printf("[-] Ptrace 附加失败 (需要 root 权限)\n"); + return false; + } + waitpid(pid, NULL, WUNTRACED); + printf("[+] 成功附加到进程\n"); + + struct pt_regs original_regs, regs; + struct iovec io; + io.iov_base = &original_regs; + io.iov_len = sizeof(original_regs); + ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &io); + memcpy(®s, &original_regs, sizeof(regs)); + + // 1. 获取目标进程 mmap 和 dlopen 的地址 + // 注意：Android 8.0+ dlopen 受到命名空间限制。若注入失败，建议使用 __loader_dlopen + uintptr_t remote_mmap = GetRemoteFuncAddr(pid, "libc.so", (void*)mmap); + uintptr_t remote_dlopen = GetRemoteFuncAddr(pid, "libdl.so", (void*)dlopen); // 或 "linker64" + + if (!remote_mmap || !remote_dlopen) { + printf("[-] 无法获取远程函数地址 mmap: %lx, dlopen: %lx\n", remote_mmap, remote_dlopen); + ptrace(PTRACE_DETACH, pid, NULL, NULL); + return false; + } + printf("[+] 远程 mmap 地址: 0x%lx\n", remote_mmap); + printf("[+] 远程 dlopen 地址: 0x%lx\n", remote_dlopen); + + // 2. 在目标进程调用 mmap 分配空间存放 SO 路径 + long parameters[6]; + parameters[0] = 0; // addr + parameters[1] = 0x1000; // size + parameters[2] = PROT_READ | PROT_WRITE | PROT_EXEC;// prot + parameters[3] = MAP_ANONYMOUS | MAP_PRIVATE; // flags + parameters[4] = 0; // fd + parameters[5] = 0; // offset + + printf("[+] 调用远程 mmap 分配内存...\n"); + if (!PtraceCall(pid, remote_mmap, parameters, 6, ®s)) { + printf("[-] 远程 mmap 调用失败\n"); + ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &io); + ptrace(PTRACE_DETACH, pid, NULL, NULL); + return false; } - printf("[Injector] SO: %s\n", so_path); - printf("[Injector] Target: %s\n", target); + uintptr_t remote_string_addr = regs.ARM_r0; + printf("[+] 目标进程内存分配成功，地址: 0x%lx\n", remote_string_addr); - if (access(so_path, F_OK) != 0) { - fprintf(stderr, "SO file not found: %s\n", so_path); - return 1; + // 3. 将 SO 路径写入目标进程分配的内存中 + if (!PtraceWrite(pid, remote_string_addr, library_path, strlen(library_path) + 1)) { + printf("[-] 写入 SO 路径失败\n"); + ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &io); + ptrace(PTRACE_DETACH, pid, NULL, NULL); + return false; } + printf("[+] SO 路径已写入远程内存\n"); - if (pid <= 0) { - printf("[Injector] Searching for process '%s'...\n", target); - pid = find_pid_by_name(target); - if (pid <= 0) { - fprintf(stderr, "Process '%s' not found\n", target); - return 1; - } - printf("[Injector] Found PID: %d\n", pid); + // 4. 恢复寄存器，准备调用 dlopen + memcpy(®s, &original_regs, sizeof(regs)); + parameters[0] = remote_string_addr; // filename + parameters[1] = RTLD_NOW | RTLD_LOCAL; // flags + + printf("[+] 调用远程 dlopen 加载 SO...\n"); + if (!PtraceCall(pid, remote_dlopen, parameters, 2, ®s)) { + printf("[-] 远程 dlopen 调用失败\n"); } else { - printf("[Injector] Using specified PID: %d\n", pid); + uintptr_t so_handle = regs.ARM_r0; + if (so_handle == 0) { + printf("[-] dlopen 返回 NULL，注入可能被 linker namespace 阻止！\n"); + } else { + printf("[+] 注入成功! SO Handle: 0x%lx\n", so_handle); + } } - return inject_so(pid, so_path); + // 5. 恢复目标进程原本的寄存器状态并脱离 + ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &io); + ptrace(PTRACE_DETACH, pid, NULL, NULL); + printf("[+] 已脱离目标进程\n"); + + return true; +} + +int main(int argc, char *argv[]) { + printf("======================================\n"); + printf(" Android ARM64 Ptrace Injector \n"); + printf("======================================\n"); + + pid_t target_pid = GetPID(TARGET_PROCESS); + if (target_pid == -1) { + printf("[-] 未找到目标进程: %s，游戏是否已启动？\n", TARGET_PROCESS); + return -1; + } + + if (access(PAYLOAD_PATH, F_OK) == -1) { + printf("[-] 找不到需要注入的文件: %s\n", PAYLOAD_PATH); + printf("[-] 请先将您的 SO 文件 adb push 到该路径。\n"); + return -1; + } + + InjectLibrary(target_pid, PAYLOAD_PATH); + + return 0; }