Magisk/jni/magiskhide/proc_monitor.c

193 lines
4.4 KiB
C
Raw Normal View History

2017-04-06 00:12:29 +02:00
/* proc_monitor.c - Monitor am_proc_start events
*
* We monitor the logcat am_proc_start events, pause it,
* and send the target PID to hide daemon ASAP
*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <signal.h>
#include <pthread.h>
#include <sys/types.h>
#include <sys/wait.h>
2017-04-06 00:12:29 +02:00
#include "magisk.h"
#include "utils.h"
2016-12-30 19:44:24 +01:00
#include "magiskhide.h"
2017-07-02 17:04:57 +02:00
static int zygote_num;
2017-04-07 01:50:02 +02:00
static char init_ns[32], zygote_ns[2][32];
2017-07-02 17:04:57 +02:00
static int log_pid, log_fd;
2017-05-07 21:11:14 +02:00
static char *buffer;
2017-04-07 01:50:02 +02:00
2017-04-06 00:12:29 +02:00
// Workaround for the lack of pthread_cancel
static void quit_pthread(int sig) {
2017-05-12 09:28:15 +02:00
err_handler = do_nothing;
LOGD("proc_monitor: running cleanup\n");
2017-04-20 16:45:56 +02:00
destroy_list();
2017-05-07 21:11:14 +02:00
free(buffer);
2017-04-20 16:45:56 +02:00
hideEnabled = 0;
2017-05-07 21:11:14 +02:00
// Kill the logging if needed
2017-04-18 13:32:50 +02:00
if (log_pid) {
kill(log_pid, SIGTERM);
waitpid(log_pid, NULL, 0);
close(log_fd);
2017-06-07 21:20:49 +02:00
log_fd = log_pid = 0;
2017-04-18 13:32:50 +02:00
}
int kill = -1;
// If process monitor dies, kill hide daemon too
write(sv[0], &kill, sizeof(kill));
close(sv[0]);
waitpid(hide_pid, NULL, 0);
2017-04-21 18:54:08 +02:00
pthread_mutex_destroy(&hide_lock);
2017-05-07 21:11:14 +02:00
pthread_mutex_destroy(&file_lock);
LOGD("proc_monitor: terminating...\n");
pthread_exit(NULL);
2017-04-06 00:12:29 +02:00
}
2017-01-01 11:54:13 +01:00
2017-07-02 19:02:11 +02:00
static void proc_monitor_err() {
LOGD("proc_monitor: error occured, stopping magiskhide services\n");
quit_pthread(SIGUSR1);
}
static void read_namespace(const int pid, char* target, const size_t size) {
char path[32];
snprintf(path, sizeof(path), "/proc/%d/ns/mnt", pid);
if (access(path, R_OK) == -1) {
LOGE("proc_monitor: Your kernel doesn't support mount namespace :(\n");
proc_monitor_err();
return;
}
xreadlink(path, target, size);
}
2017-04-07 01:50:02 +02:00
static void store_zygote_ns(int pid) {
2017-04-18 13:32:50 +02:00
if (zygote_num == 2) return;
2017-04-07 01:50:02 +02:00
do {
usleep(500);
read_namespace(pid, zygote_ns[zygote_num], 32);
} while (strcmp(zygote_ns[zygote_num], init_ns) == 0);
++zygote_num;
}
2017-04-21 18:54:08 +02:00
void proc_monitor() {
2017-04-06 00:12:29 +02:00
// Register the cancel signal
2017-05-07 21:11:14 +02:00
struct sigaction act;
memset(&act, 0, sizeof(act));
act.sa_handler = quit_pthread;
2017-05-12 09:28:15 +02:00
sigaction(SIGUSR1, &act, NULL);
2017-05-07 21:11:14 +02:00
2017-04-24 15:43:30 +02:00
// The error handler should stop magiskhide services
err_handler = proc_monitor_err;
2017-04-07 01:50:02 +02:00
int pid;
2017-05-07 21:11:14 +02:00
buffer = xmalloc(PATH_MAX);
2017-04-06 00:12:29 +02:00
// Get the mount namespace of init
read_namespace(1, init_ns, 32);
LOGI("proc_monitor: init ns=%s\n", init_ns);
// Get the mount namespace of zygote
2017-07-02 17:04:57 +02:00
zygote_num = 0;
2017-04-17 10:36:49 +02:00
while(!zygote_num) {
// Check zygote every 2 secs
sleep(2);
ps_filter_proc_name("zygote", store_zygote_ns);
}
2017-05-03 20:58:37 +02:00
ps_filter_proc_name("zygote64", store_zygote_ns);
2017-04-06 00:12:29 +02:00
switch(zygote_num) {
case 1:
LOGI("proc_monitor: zygote ns=%s\n", zygote_ns[0]);
break;
case 2:
2017-05-03 20:58:37 +02:00
LOGI("proc_monitor: zygote (32-bit) ns=%s (64-bit) ns=%s\n", zygote_ns[0], zygote_ns[1]);
2017-04-06 00:12:29 +02:00
break;
}
2017-06-02 22:31:01 +02:00
while (1) {
// Clear previous buffer
system("logcat -b events -c");
// Monitor am_proc_start
char *const command[] = { "logcat", "-b", "events", "-v", "raw", "-s", "am_proc_start", NULL };
2017-07-02 17:04:57 +02:00
log_fd = 0;
2017-06-07 21:20:49 +02:00
log_pid = run_command(0, &log_fd, "/system/bin/logcat", command);
2017-06-02 22:31:01 +02:00
2017-07-02 17:04:57 +02:00
if (log_pid < 0) continue;
if (kill(log_pid, 0)) continue;
2017-06-02 22:31:01 +02:00
while(fdgets(buffer, PATH_MAX, log_fd)) {
int ret, comma = 0;
char *pos = buffer, *line, processName[256];
while(1) {
pos = strchr(pos, ',');
if(pos == NULL)
break;
pos[0] = ' ';
++comma;
}
2016-12-30 19:44:24 +01:00
2017-06-02 22:31:01 +02:00
if (comma == 6)
ret = sscanf(buffer, "[%*d %d %*d %*d %256s", &pid, processName);
else
ret = sscanf(buffer, "[%*d %d %*d %256s", &pid, processName);
if(ret != 2)
continue;
ret = 0;
// Critical region
pthread_mutex_lock(&hide_lock);
vec_for_each(hide_list, line) {
if (strcmp(processName, line) == 0) {
while(1) {
ret = 1;
for (int i = 0; i < zygote_num; ++i) {
read_namespace(pid, buffer, 32);
if (strcmp(buffer, zygote_ns[i]) == 0) {
usleep(50);
ret = 0;
break;
}
2017-01-01 11:54:13 +01:00
}
2017-06-02 22:31:01 +02:00
if (ret) break;
2017-01-01 11:54:13 +01:00
}
2017-06-02 22:31:01 +02:00
ret = 0;
2017-06-02 22:31:01 +02:00
// Send pause signal ASAP
if (kill(pid, SIGSTOP) == -1) continue;
2017-01-01 11:54:13 +01:00
2017-06-02 22:31:01 +02:00
LOGI("proc_monitor: %s (PID=%d ns=%s)\n", processName, pid, buffer);
2017-01-01 11:54:13 +01:00
2017-06-02 22:31:01 +02:00
// Unmount start
xwrite(sv[0], &pid, sizeof(pid));
2017-06-02 22:31:01 +02:00
// Get the hide daemon return code
xxread(sv[0], &ret, sizeof(ret));
LOGD("proc_monitor: hide daemon response code: %d\n", ret);
break;
}
2016-12-30 19:44:24 +01:00
}
2017-06-02 22:31:01 +02:00
pthread_mutex_unlock(&hide_lock);
2017-04-20 16:45:56 +02:00
2017-06-02 22:31:01 +02:00
if (ret) {
// Wait hide process to kill itself
waitpid(hide_pid, NULL, 0);
quit_pthread(SIGUSR1);
}
}
2016-12-30 19:44:24 +01:00
2017-06-02 22:31:01 +02:00
// For some reason it went here, restart logging
kill(log_pid, SIGTERM);
waitpid(log_pid, NULL, 0);
close(log_fd);
log_pid = 0;
}
}