EngineDev/imgui-mirror
1
0
Fork 0
mirror of https://github.com/ocornut/imgui.git synced 2026-11-09 07:55:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update injector.cpp

Browse Source
This commit is contained in:
gggaa2152 2026-07-23 08:41:49 +08:00 committed by GitHub
parent b9818d1227
commit fd923cf7ea
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 29 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
injector.cpp
View File

@ -1,11 +1,8 @@
/**
* injector.cpp – Android arm64 ptrace 注入器（支持 Android 8~14）
* injector.cpp – Android arm64 ptrace 注入器（纯 ptrace 方式）
* 编译: aarch64-linux-android-clang++ -static -std=c++17 injector.cpp -o injector
* 用法:
* ./injector <so_path> <package_name|pid>
* 示例:
* ./injector /data/1/libMyMenu.so com.tencent.jkchess
* ./injector /data/1/libMyMenu.so 12345
* 用法: ./injector <so_path> <package_name|pid>
* 示例: ./injector /data/1/libMyMenu.so com.tencent.jkchess
*/
#include <stdio.h>
@ -61,17 +58,24 @@ int find_pid_by_name(const char* proc_name) {
return pid;
}
// ---------- 远程内存读写（使用 process_vm 系列，更高效） ----------
ssize_t remote_read(int pid, unsigned long addr, void* buffer, size_t size) {
struct iovec local = { buffer, size };
struct iovec remote = { (void*)addr, size };
return process_vm_readv(pid, &local, 1, &remote, 1, 0);
// ---------- 远程内存读写（纯 ptrace） ----------
long ptrace_readdata(int pid, unsigned long addr, void* buffer, size_t size) {
for (size_t i = 0; i < size; i += sizeof(long)) {
long data = ptrace(PTRACE_PEEKDATA, pid, addr + i, 0);
if (data == -1 && errno) return -1;
memcpy((char*)buffer + i, &data, std::min(sizeof(long), size - i));
}
return 0;
}
ssize_t remote_write(int pid, unsigned long addr, const void* buffer, size_t size) {
struct iovec local = { (void*)buffer, size };
struct iovec remote = { (void*)addr, size };
return process_vm_writev(pid, &local, 1, &remote, 1, 0);
long ptrace_writedata(int pid, unsigned long addr, const void* buffer, size_t size) {
for (size_t i = 0; i < size; i += sizeof(long)) {
long data = 0;
memcpy(&data, (char*)buffer + i, std::min(sizeof(long), size - i));
if (ptrace(PTRACE_POKEDATA, pid, addr + i, data) == -1)
return -1;
}
return 0;
}
// ---------- 执行系统调用（ptrace） ----------
@ -91,7 +95,7 @@ int remote_syscall(int pid, struct user_pt_regs& regs) {
fprintf(stderr, "process not stopped after syscall\n");
return -1;
}
// 再执行一次 PTRACE_SYSCALL 以获取返回值（Linux 在 syscall 进入和退出都会停住）
// 再次 syscall 以获取返回值
if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1) {
perror("ptrace syscall exit");
return -1;
@ -139,13 +143,13 @@ int inject_so(int pid, const char* so_path) {
// 3. 在远程进程分配内存（mmap）
size_t path_len = strlen(so_path) + 1;
regs.regs[0] = 0; // addr
regs.regs[1] = path_len; // length
regs.regs[0] = 0;
regs.regs[1] = path_len;
regs.regs[2] = PROT_READ | PROT_WRITE;
regs.regs[3] = MAP_PRIVATE | MAP_ANONYMOUS;
regs.regs[4] = -1; // fd
regs.regs[5] = 0; // offset
regs.regs[8] = 222; // __NR_mmap (arm64)
regs.regs[4] = -1;
regs.regs[5] = 0;
regs.regs[8] = 222; // __NR_mmap (arm64)
if (remote_syscall(pid, regs) != 0) {
fprintf(stderr, "mmap syscall failed\n");
ptrace(PTRACE_DETACH, pid, 0, 0);
@ -159,16 +163,15 @@ int inject_so(int pid, const char* so_path) {
}
printf("[+] Allocated memory at 0x%lx (size=%zu)\n", remote_addr, path_len);
// 4. 写入 so 路径
if (remote_write(pid, remote_addr, so_path, path_len) != (ssize_t)path_len) {
perror("remote_write");
// 4. 写入 so 路径（使用 ptrace）
if (ptrace_writedata(pid, remote_addr, so_path, path_len) == -1) {
perror("ptrace_writedata");
ptrace(PTRACE_DETACH, pid, 0, 0);
return -1;
}
printf("[+] Wrote SO path into remote memory\n");
// 5. 计算远程 dlopen 地址
// 获取本机 dlopen 相对于 libdl.so 的偏移
void* local_dlopen = (void*)dlopen;
unsigned long local_libdl_base = 0;
FILE* fp = fopen("/proc/self/maps", "r");
@ -222,7 +225,7 @@ int inject_so(int pid, const char* so_path) {
regs.regs[0] = remote_addr; // path
regs.regs[1] = RTLD_LAZY; // flag
regs.pc = remote_dlopen;
regs.regs[30] = 0x0; // LR = 0 (导致返回后 segfault)
regs.regs[30] = 0x0; // LR = 0 (导致 segfault)
iov.iov_base = &regs; iov.iov_len = sizeof(regs);
if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
perror("setregset for dlopen");
@ -270,7 +273,6 @@ int main(int argc, char** argv) {
const char* target = argv[2];
int pid = 0;
// 检查 target 是否为纯数字（PID）
bool is_digit = true;
for (int i = 0; target[i]; i++) {
if (!isdigit(target[i])) { is_digit = false; break; }
@ -288,7 +290,6 @@ int main(int argc, char** argv) {
printf("[+] Found PID: %d\n", pid);
}
// 检查 SO 文件是否存在
if (access(so_path, F_OK) != 0) {
fprintf(stderr, "SO file '%s' does not exist\n", so_path);
return 1;