EngineDev/imgui-mirror
1
0
Fork 0
mirror of https://github.com/ocornut/imgui.git synced 2026-11-06 06:25:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update injector.cpp

Browse Source
This commit is contained in:
gggaa2152 2026-07-22 16:24:28 +08:00 committed by GitHub
parent 7674a01a71
commit f23a00ffdc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 32 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

101
injector.cpp
View File

@ -15,35 +15,35 @@
#include <errno.h>
#include <elf.h>
#include <linux/elf.h>
#include <sys/syscall.h> // Added for mmap syscall
#include <sys/syscall.h>
#define TAG "AndKitty_Injector"
#define LOGI(...) __android_log_print(ANDROID_LOG_INFO, TAG, __VA_ARGS__); printf("[INFO] " __VA_ARGS__); printf("\n")
#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, TAG, __VA_ARGS__); printf("[ERROR] " __VA_ARGS__); printf("\n")
// Ensure NT_PRSTATUS is defined for certain NDK versions
#ifndef NT_PRSTATUS
#define NT_PRSTATUS 1
#endif
using namespace std;
// Iterates through /proc to find the PID of the target package name
// 【固定配置】
constexpr const char* TARGET_PACKAGE = "com.tencent.jkchess";
constexpr const char* TARGET_SO_PATH = "/data/1/libhack.so";
pid_t get_pid(const char* package_name) {
DIR* dir = opendir("/proc");
if (!dir) return -1;
struct dirent* entry;
while ((entry = readdir(dir))) {
pid_t pid = atoi(entry->d_name);
if (pid <= 0) continue;
char path[256];
snprintf(path, sizeof(path), "/proc/%d/cmdline", pid);
FILE* f = fopen(path, "r");
if (f) {
char cmdline[256];
if (fgets(cmdline, sizeof(cmdline), f)) {
if (strncmp(cmdline, package_name, strlen(package_name)) == 0) {
if (strstr(cmdline, package_name)) {
fclose(f);
closedir(dir);
return pid;
@ -56,18 +56,15 @@ pid_t get_pid(const char* package_name) {
return -1;
}
// Reads /proc/[pid]/maps to find the base address of a loaded module
uintptr_t get_module_base(pid_t pid, const char* module_name) {
char path[256];
snprintf(path, sizeof(path), "/proc/%d/maps", pid);
FILE* f = fopen(path, "r");
if (!f) return 0;
char line[512];
uintptr_t base = 0;
while (fgets(line, sizeof(line), f)) {
if (strstr(line, module_name)) {
// Parse the first hex value on the line (start address)
base = (uintptr_t)strtoull(line, NULL, 16);
break;
}
@ -76,7 +73,6 @@ uintptr_t get_module_base(pid_t pid, const char* module_name) {
return base;
}
// Calculates the address of a function in the remote process's memory space
uintptr_t get_remote_addr(pid_t pid, const char* module_name, void* local_addr) {
uintptr_t local_base = get_module_base(getpid(), module_name);
uintptr_t remote_base = get_module_base(pid, module_name);
@ -84,7 +80,6 @@ uintptr_t get_remote_addr(pid_t pid, const char* module_name, void* local_addr)
return remote_base + ((uintptr_t)local_addr - local_base);
}
// Read memory from the remote process (useful for verifying writes)
bool ptrace_read(pid_t pid, uintptr_t addr, void* buf, size_t len) {
size_t i;
long* lbuf = (long*)buf;
@ -98,11 +93,9 @@ bool ptrace_read(pid_t pid, uintptr_t addr, void* buf, size_t len) {
return true;
}
// Ptrace 写内存 (improved byte-by-byte alignment handling is omitted for brevity but standard long-aligned writing is kept)
bool ptrace_write(pid_t pid, uintptr_t addr, void* buf, size_t len) {
size_t i;
long* lbuf = (long*)buf;
// We write in word-sized chunks
for (i = 0; i < len; i += sizeof(long)) {
if (ptrace(PTRACE_POKETEXT, pid, addr + i, lbuf[i / sizeof(long)]) < 0) {
LOGE("Ptrace write failed at addr %p, errno: %d", (void*)(addr + i), errno);
@ -112,68 +105,56 @@ bool ptrace_write(pid_t pid, uintptr_t addr, void* buf, size_t len) {
return true;
}
// Ptrace 调用远程函数 (ARM64 specific)
uint64_t ptrace_call(pid_t pid, uintptr_t func_addr, uint64_t* args, int nargs) {
struct user_pt_regs regs, old_regs;
struct iovec iov;
// 1. Get current register state to restore later
iov.iov_base = &regs;
iov.iov_len = sizeof(struct user_pt_regs);
if (ptrace(PTRACE_GETREGSET, pid, (void*)NT_PRSTATUS, &iov) < 0) {
LOGE("ptrace_call: GETREGSET failed");
return 0;
}
memcpy(&old_regs, &regs, sizeof(regs));
for (int i = 0; i < nargs && i < 8; i++) regs.regs[i] = args[i];
regs.regs[30] = 0; // LR set to 0 to trigger SIGSEGV upon return
regs.regs[30] = 0;
regs.pc = func_addr;
iov.iov_base = &regs;
if (ptrace(PTRACE_SETREGSET, pid, (void*)NT_PRSTATUS, &iov) < 0) {
LOGE("ptrace_call: SETREGSET failed");
return 0;
}
if (ptrace(PTRACE_CONT, pid, NULL, NULL) < 0) {
LOGE("ptrace_call: CONT failed");
return 0;
}
int status;
waitpid(pid, &status, WUNTRACED);
// Check if process stopped due to our intentional SIGSEGV
if (WIFSTOPPED(status) && WSTOPSIG(status) != SIGSEGV) {
LOGI("ptrace_call: Process stopped with unexpected signal: %d", WSTOPSIG(status));
// You might need to handle other signals here in a real scenario
}
if (ptrace(PTRACE_GETREGSET, pid, (void*)NT_PRSTATUS, &iov) < 0) {
LOGE("ptrace_call: Final GETREGSET failed");
return 0;
}
uint64_t res = regs.regs[0];
iov.iov_base = &old_regs;
if (ptrace(PTRACE_SETREGSET, pid, (void*)NT_PRSTATUS, &iov) < 0) {
LOGE("ptrace_call: Restore SETREGSET failed");
}
ptrace(PTRACE_SETREGSET, pid, (void*)NT_PRSTATUS, &iov);
return res;
}
int main(int argc, char** argv) {
if (argc < 3) {
printf("Usage: ./injector <package> <so_path>\n");
int main() {
LOGI("===== AndKitty Auto Injector =====");
LOGI("Target Package: %s", TARGET_PACKAGE);
LOGI("Inject SO: %s", TARGET_SO_PATH);
// 修复原代码重大漏洞：先获取PID
pid_t pid = get_pid(TARGET_PACKAGE);
if (pid <= 0) {
LOGE("Cannot find target game process! Start game first.");
return -1;
}
LOGI("Found target PID = %d", pid);
const char* pkg = argv[1];
const char* so_path = argv[2];
LOGI("Starting injection: Target=%s, Payload=%s", pkg, so_path);
if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) {
LOGE("Ptrace Attach failed: %s", strerror(errno));
return -1;
@ -181,7 +162,6 @@ int main(int argc, char** argv) {
waitpid(pid, NULL, WUNTRACED);
LOGI("Attached to PID: %d successfully.", pid);
// Find remote mmap to allocate memory safely
uintptr_t remote_mmap = get_remote_addr(pid, "libc.so", (void*)mmap);
if (!remote_mmap) {
LOGE("Could not locate remote mmap in libc.so");
@ -190,10 +170,8 @@ int main(int argc, char** argv) {
}
LOGI("Remote mmap address: %p", (void*)remote_mmap);
// Find remote dlopen
uintptr_t remote_dlopen = get_remote_addr(pid, "libdl.so", (void*)dlopen);
if (!remote_dlopen) remote_dlopen = get_remote_addr(pid, "linker64", (void*)dlopen);
if (!remote_dlopen) {
LOGE("Could not locate remote dlopen");
ptrace(PTRACE_DETACH, pid, NULL, NULL);
@ -201,25 +179,20 @@ int main(int argc, char** argv) {
}
LOGI("Remote dlopen address: %p", (void*)remote_dlopen);
// Call mmap in the remote process to get a safe buffer
// void* mmap(void* addr, size_t length, int prot, int flags, int fd, off_t offset);
size_t string_len = strlen(so_path) + 1;
// Align length to page size (usually 4096)
size_t alloc_len = (string_len + 4095) & ~4095;
size_t string_len = strlen(TARGET_SO_PATH) + 1;
size_t alloc_len = (string_len + 4095) & ~4095;
uint64_t mmap_args[6] = {
0, // addr: NULL (let OS choose)
alloc_len, // length
PROT_READ | PROT_WRITE | PROT_EXEC, // prot: RWX (Exec might be needed depending on SELinux)
MAP_PRIVATE | MAP_ANONYMOUS, // flags: anonymous memory
(uint64_t)-1, // fd: -1 for anonymous
0 // offset: 0
0,
alloc_len,
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_PRIVATE | MAP_ANONYMOUS,
(uint64_t)-1,
0
};
LOGI("Calling remote mmap to allocate %zu bytes...", alloc_len);
uint64_t remote_buf_addr = ptrace_call(pid, remote_mmap, mmap_args, 6);
// mmap returns MAP_FAILED (-1) on error. We cast to uint64_t for comparison.
if (remote_buf_addr == 0 || remote_buf_addr == (uint64_t)-1) {
LOGE("Remote mmap failed. Cannot allocate safe memory.");
ptrace(PTRACE_DETACH, pid, NULL, NULL);
@ -227,16 +200,12 @@ int main(int argc, char** argv) {
}
LOGI("Allocated remote memory at: %p", (void*)remote_buf_addr);
// Write the .so path into the safely allocated remote memory
// Note: We write string_len, but padded to sizeof(long) for the ptrace_write logic
size_t write_len = (string_len + sizeof(long) - 1) & ~(sizeof(long) - 1);
// Create a temporary buffer padded with nulls to avoid reading junk past the string end
char* padded_path = (char*)calloc(1, write_len);
strcpy(padded_path, so_path);
strcpy(padded_path, TARGET_SO_PATH);
if (!ptrace_write(pid, remote_buf_addr, (void*)padded_path, write_len)) {
LOGE("Write remote memory failed at safely allocated block");
LOGE("Write remote memory failed");
free(padded_path);
ptrace(PTRACE_DETACH, pid, NULL, NULL);
return -1;
@ -244,31 +213,25 @@ int main(int argc, char** argv) {
free(padded_path);
LOGI("Successfully wrote .so path to target process.");
// Prepare arguments for dlopen(remote_buf_addr, RTLD_NOW)
uint64_t dlopen_args[2] = { remote_buf_addr, RTLD_NOW };
LOGI("Calling remote dlopen...");
// Execute the remote call
uint64_t handle = ptrace_call(pid, remote_dlopen, dlopen_args, 2);
if (handle == 0) {
LOGE("==========================================================");
LOGE("Injection failed: dlopen returned NULL.");
LOGE("Reason 1: Linker Namespace restrictions (Android 7+).");
LOGE("Reason 2: Target app cannot access %s due to SELinux/Permissions.", so_path);
LOGE("Reason 3: Architecture mismatch (32/64 bit).");
LOGE("1. Linker Namespace 命名空间拦截");
LOGE("2. 游戏进程无权限读取 /data/1/libhack.so");
LOGE("3. CPU架构不匹配");
LOGE("==========================================================");
} else {
LOGI("Injection success! Handle: %p", (void*)handle);
LOGI("✅ Injection success! SO Handle: %p", (void*)handle);
}
// Cleanup: Detach and let the process continue normally
// We intentionally leak the mmaped buffer here, it's tiny and usually fine for injection.
if (ptrace(PTRACE_DETACH, pid, NULL, NULL) < 0) {
LOGE("Failed to detach gracefully.");
} else {
LOGI("Detached successfully.");
}
return 0;
}