From fd923cf7eaa7118f434bf172e0b180a794e35598 Mon Sep 17 00:00:00 2001 From: gggaa2152 <60614405+gggaa2152@users.noreply.github.com> Date: Thu, 23 Jul 2026 08:41:49 +0800 Subject: [PATCH] Update injector.cpp --- injector.cpp | 57 ++++++++++++++++++++++++++-------------------------- 1 file changed, 29 insertions(+), 28 deletions(-) diff --git a/injector.cpp b/injector.cpp index a5bc7bb66..002f63820 100644 --- a/injector.cpp +++ b/injector.cpp @@ -1,11 +1,8 @@ /** - * injector.cpp – Android arm64 ptrace 注入器（支持 Android 8~14） + * injector.cpp – Android arm64 ptrace 注入器（纯 ptrace 方式） * 编译: aarch64-linux-android-clang++ -static -std=c++17 injector.cpp -o injector - * 用法: - * ./injector - * 示例: - * ./injector /data/1/libMyMenu.so com.tencent.jkchess - * ./injector /data/1/libMyMenu.so 12345 + * 用法: ./injector + * 示例: ./injector /data/1/libMyMenu.so com.tencent.jkchess */ #include @@ -61,17 +58,24 @@ int find_pid_by_name(const char* proc_name) { return pid; } -// ---------- 远程内存读写（使用 process_vm 系列，更高效） ---------- -ssize_t remote_read(int pid, unsigned long addr, void* buffer, size_t size) { - struct iovec local = { buffer, size }; - struct iovec remote = { (void*)addr, size }; - return process_vm_readv(pid, &local, 1, &remote, 1, 0); +// ---------- 远程内存读写（纯 ptrace） ---------- +long ptrace_readdata(int pid, unsigned long addr, void* buffer, size_t size) { + for (size_t i = 0; i < size; i += sizeof(long)) { + long data = ptrace(PTRACE_PEEKDATA, pid, addr + i, 0); + if (data == -1 && errno) return -1; + memcpy((char*)buffer + i, &data, std::min(sizeof(long), size - i)); + } + return 0; } -ssize_t remote_write(int pid, unsigned long addr, const void* buffer, size_t size) { - struct iovec local = { (void*)buffer, size }; - struct iovec remote = { (void*)addr, size }; - return process_vm_writev(pid, &local, 1, &remote, 1, 0); +long ptrace_writedata(int pid, unsigned long addr, const void* buffer, size_t size) { + for (size_t i = 0; i < size; i += sizeof(long)) { + long data = 0; + memcpy(&data, (char*)buffer + i, std::min(sizeof(long), size - i)); + if (ptrace(PTRACE_POKEDATA, pid, addr + i, data) == -1) + return -1; + } + return 0; } // ---------- 执行系统调用（ptrace） ---------- @@ -91,7 +95,7 @@ int remote_syscall(int pid, struct user_pt_regs& regs) { fprintf(stderr, "process not stopped after syscall\n"); return -1; } - // 再执行一次 PTRACE_SYSCALL 以获取返回值（Linux 在 syscall 进入和退出都会停住） + // 再次 syscall 以获取返回值 if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1) { perror("ptrace syscall exit"); return -1; @@ -139,13 +143,13 @@ int inject_so(int pid, const char* so_path) { // 3. 在远程进程分配内存（mmap） size_t path_len = strlen(so_path) + 1; - regs.regs[0] = 0; // addr - regs.regs[1] = path_len; // length + regs.regs[0] = 0; + regs.regs[1] = path_len; regs.regs[2] = PROT_READ | PROT_WRITE; regs.regs[3] = MAP_PRIVATE | MAP_ANONYMOUS; - regs.regs[4] = -1; // fd - regs.regs[5] = 0; // offset - regs.regs[8] = 222; // __NR_mmap (arm64) + regs.regs[4] = -1; + regs.regs[5] = 0; + regs.regs[8] = 222; // __NR_mmap (arm64) if (remote_syscall(pid, regs) != 0) { fprintf(stderr, "mmap syscall failed\n"); ptrace(PTRACE_DETACH, pid, 0, 0); @@ -159,16 +163,15 @@ int inject_so(int pid, const char* so_path) { } printf("[+] Allocated memory at 0x%lx (size=%zu)\n", remote_addr, path_len); - // 4. 写入 so 路径 - if (remote_write(pid, remote_addr, so_path, path_len) != (ssize_t)path_len) { - perror("remote_write"); + // 4. 写入 so 路径（使用 ptrace） + if (ptrace_writedata(pid, remote_addr, so_path, path_len) == -1) { + perror("ptrace_writedata"); ptrace(PTRACE_DETACH, pid, 0, 0); return -1; } printf("[+] Wrote SO path into remote memory\n"); // 5. 计算远程 dlopen 地址 - // 获取本机 dlopen 相对于 libdl.so 的偏移 void* local_dlopen = (void*)dlopen; unsigned long local_libdl_base = 0; FILE* fp = fopen("/proc/self/maps", "r"); @@ -222,7 +225,7 @@ int inject_so(int pid, const char* so_path) { regs.regs[0] = remote_addr; // path regs.regs[1] = RTLD_LAZY; // flag regs.pc = remote_dlopen; - regs.regs[30] = 0x0; // LR = 0 (导致返回后 segfault) + regs.regs[30] = 0x0; // LR = 0 (导致 segfault) iov.iov_base = ®s; iov.iov_len = sizeof(regs); if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) { perror("setregset for dlopen"); @@ -270,7 +273,6 @@ int main(int argc, char** argv) { const char* target = argv[2]; int pid = 0; - // 检查 target 是否为纯数字（PID） bool is_digit = true; for (int i = 0; target[i]; i++) { if (!isdigit(target[i])) { is_digit = false; break; } @@ -288,7 +290,6 @@ int main(int argc, char** argv) { printf("[+] Found PID: %d\n", pid); } - // 检查 SO 文件是否存在 if (access(so_path, F_OK) != 0) { fprintf(stderr, "SO file '%s' does not exist\n", so_path); return 1;