xhook使用記録

1.プロジェクト情報
プロジェクトのソース:https://github.com/iqiyi/xHook
対応ドキュメント:https://github.com/iqiyi/xHook/blob/master/docs/overview/android_plt_hook_overview.zh-CN.md
2.使用
hook mmapを例に挙げると、

#include "gothook/xhook.h"

void* (*old_mmap)(void* start,size_t length,int prot,int flags,int fd,off_t offset);

void* testmmap(void* start,size_t length,int prot,int flags,int fd,off_t offset) {
    __android_log_print(ANDROID_LOG_INFO, "Wooo", "this is test hook mmap : %x", length);
    void* addr =  old_mmap(start, length, prot, flags, fd, offset);
    __android_log_print(ANDROID_LOG_INFO, "Wooo", "real hook mmap : %x", addr);
    return 1003;
}

void native_register(JNIEnv* env, jobject obj) {
    xhook_register(".*/libmainNative\\.so$", "mmap", testmmap, (void **)(&old_mmap));
    xhook_refresh(0);    //        。       。
    __android_log_print(ANDROID_LOG_INFO, "Wooo", "native register finish");
}

xhook_refresh関数のパラメータは、1がステップ、0が同期です.これでhookがトリガーされました.テストではhookをキャンセルできないので、元の関数を保持して呼び出します.
いくつかのオリジナル関数宣言は次のように対応します.

int (*old_open)(const char* pathname,int flags,mode_t mode);
int (*old_fstat)(int fildes,struct stat *buf);
ssize_t (*old_read_chk)(int fd, void * buf, size_t nbytes, size_t buflen);
ssize_t (*old_read)(int fd,void * buf ,size_t count);
void* (*old_mmap)(void* start,size_t length,int prot,int flags,int fd,off_t offset);
int (*old_munmap)(void *start,size_t length);
pid_t (*old_fork)( void);

新しい関数は次のとおりです.

int hook(uint32_t addr,uint32_t fakeaddr,uint32_t** old_addr);
int new_open(const char* pathname,int flags,mode_t mode);
int new_fstat(int fildes,struct stat *buf);
ssize_t new_read(int fd,void * buf ,size_t count);
ssize_t new_read_chk(int fd, void * buf, size_t nbytes, size_t buflen);
void* new_mmap(void* start,size_t length,int prot,int flags,int fd,off_t offset);
int new_munmap(void *start,size_t length);
pid_t new_fork( void);

hookのelfファイルパスの例:

//detect memory leaks
xhook_register(".*\\.so$", "malloc",  my_malloc,  NULL);
xhook_register(".*\\.so$", "calloc",  my_calloc,  NULL);
xhook_register(".*\\.so$", "realloc", my_realloc, NULL);
xhook_register(".*\\.so$", "free",    my_free,    NULL);

//inspect sockets lifecycle
xhook_register(".*\\.so$", "getaddrinfo", my_getaddrinfo, NULL);
xhook_register(".*\\.so$", "socket",      my_socket,      NULL);
xhook_register(".*\\.so$", "setsockopt"   my_setsockopt,  NULL);
xhook_register(".*\\.so$", "bind",        my_bind,        NULL);
xhook_register(".*\\.so$", "listen",      my_listen,      NULL);
xhook_register(".*\\.so$", "connect",     my_connect,     NULL);
xhook_register(".*\\.so$", "shutdown",    my_shutdown,    NULL);
xhook_register(".*\\.so$", "close",       my_close,       NULL);

//filter off and save some android log to local file
xhook_register(".*\\.so$", "__android_log_write",  my_log_write,  NULL);
xhook_register(".*\\.so$", "__android_log_print",  my_log_print,  NULL);
xhook_register(".*\\.so$", "__android_log_vprint", my_log_vprint, NULL);
xhook_register(".*\\.so$", "__android_log_assert", my_log_assert, NULL);

//tracking (ignore linker and linker64)
xhook_register("^/system/.*$", "mmap",   my_mmap,   NULL);
xhook_register("^/vendor/.*$", "munmap", my_munmap, NULL);
xhook_ignore  (".*/linker$",   "mmap");
xhook_ignore  (".*/linker$",   "munmap");
xhook_ignore  (".*/linker64$", "mmap");
xhook_ignore  (".*/linker64$", "munmap");

//defense to some injection attacks
xhook_register(".*com\\.hacker.*\\.so$", "malloc",  my_malloc_always_return_NULL, NULL);
xhook_register(".*/libhacker\\.so$",     "connect", my_connect_with_recorder,     NULL);

//fix some system bug
xhook_register(".*some_vendor.*/libvictim\\.so$", "bad_func", my_nice_func, NULL);

//ignore all hooks in libwebviewchromium.so
xhook_ignore(".*/libwebviewchromium.so$", NULL);

//hook now!
xhook_refresh(1);

3.試験説明
テストはできますsoのmmap関数ですが、hook soファイル内の内部関数testfindsmはできません.内部呼び出し関数は呼び出せません.