EggUncle / PtraceInject

将生成的ptraceMain push到手机的/data/local/tmp 下
./ptrace <目标进程包名> <注入的so的入口函数的名称> <注入的so的绝对路径>

#include <jni.h>
#include <string>
#include <string.h>
#include <sys/mman.h>

extern "C"
char *getkey() {
    static char key[32];
    strcpy(key, "justakeyfromjni");
    return key;
}

extern "C"
JNIEXPORT jstring

JNICALL
Java_com_example_egguncle_hidekeyinjni_MainActivity_stringFromJNI(
        JNIEnv *env,
        jobject /* this */) {
    std::string key = getkey();
    return env->NewStringUTF(key.c_str());
}

pMain.c
#include <stdio.h>

int main(){
    printf("hello ptrace\n");
    return 0;
}

arm-linux-androideabi-gcc pMain.c -o pMain -pie -fPIE

ptrace(PTRACE_ATTACH, pid, NULL, 0)

ptrace(PTRACE_DETACH, pid, NULL, 0)

ptrace(PTRACE_POKETEXT, pid, dest, val);

ptrace(PTRACE_PEEKTEXT, pid, dest, 0)

ptrace(PTRACE_SETREGS, pid, NULL, regs)

ptrace(PTRACE_CONT, pid, 0, signal)

ptraceAttach(pid);

struct pt_regs currentRegs, orgRegs;
// 获取远程进程的寄存器值
if (ptraceGetregs(pid, &currentRegs) == -1) {
    perror("get reg error");
}
memcpy(&orgRegs, &currentRegs, sizeof(currentRegs));

long parameters[6];
    parameters[0] = 0;  // 设置为NULL表示让系统自动选择分配内存的地址
    parameters[1] = 0x1000; // 映射内存的大小
    parameters[2] = PROT_READ | PROT_WRITE | PROT_EXEC;  // 表示映射内存区域可读可写可执行
    parameters[3] = MAP_ANONYMOUS | MAP_PRIVATE; // 建立匿名映射
    parameters[4] = -1; //  若需要映射文件到内存中，则为文件的fd
    parameters[5] = 0; //文件映射偏移量

    if (ptraceCallWrapper(pid, "mmap", remoteMmapAddr, parameters, 6, &currentRegs) < 0) {
        printf("call target mmap error\n");
        return -1;
    }
    uint8_t *mmapBase = (uint8_t *) ptraceRetval(&currentRegs);
printf("mmap ret is %x\n", mmapBase);

   ptraceWriteData(pid, mmapBase, hookSoPath, strlen(hookSoPath) + 1);

parameters[0] = (long) mmapBase;
parameters[1] = RTLD_NOW | RTLD_GLOBAL;
//通过ptrace调用
if (ptraceCallWrapper(pid, "dlopen", remoteDlopen, parameters, 2, &currentRegs) < 0) {
    printf("call target dlopen error");
    return -1;
}

const char *targetFuncName = "hookEntry";
   ptraceWriteData(pid, mmapBase + FUNCTION_NAME_ADDR_OFFSET, targetFuncName, strlen(targetFuncName) + 1);

   parameters[0] = (long) targetSoHandle;
   parameters[1] = (long) (mmapBase + FUNCTION_NAME_ADDR_OFFSET);

   if (ptraceCallWrapper(pid, "dlsym", targetDlsymAddr, parameters, 2, &currentRegs) < 0) {
       printf("call target dlsym error\n");
       return -1;
   }

   void *hookFuncAddr = (void *) (ptraceRetval(&currentRegs));
   printf("hook func addr is %x\n", ptraceRetval(&currentRegs));

if (ptraceCallWrapper(pid, targetFuncName, hookFuncAddr, parameters, 0, &currentRegs) < 0) {
        printf("call target %s error", targetFuncName);
        return -1;
    }

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <android/log.h>
#include <sys/mman.h>
#include <elf.h>
#include <fcntl.h>
#include <dlfcn.h>

#define LOG_TAG "PTRACE_HOOK"
#define LOGD(fmt, args...) __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, fmt, ##args)

const char *targetLibPath = "/data/data/com.example.egguncle.hidekeyinjni/lib/libnative-lib.so";

char* (*getKey)();

int hookEntry() {

    LOGD("success call hook entry\n");
    void *handle = dlopen(targetLibPath, RTLD_NOW | RTLD_GLOBAL);
    if (handle == NULL) {
        LOGD("open target so error!\n");
        return -1;
    }

    void *symbol = dlsym(handle, "getkey");
    if (symbol == NULL) {
        LOGD("get getkey error!\n");
        return -1;
    }
    getKey = symbol;
    LOGD("getkey addr :%x\n", getKey);
    char *key = getKey();
    LOGD("key is  :%s\n", key);
    return 0;

}

parameters[0] = targetSoHandle;

    if (ptraceCallWrapper(pid, "dlclose", targetDlclose, parameters, 1, &currentRegs) < -1) {
        printf("call target dlclose error");
        return -1;
    }
    ptraceSetregs(pid, &orgRegs);
    ptraceDetach(pid);