Auto track JNI method hooks

This commit is contained in:
topjohnwu 2021-01-10 05:07:17 -08:00
parent da723b207a
commit 53c3dd5e8b

View File

@ -17,8 +17,10 @@ using namespace std;
extern const JNINativeMethod name##_methods[]; \ extern const JNINativeMethod name##_methods[]; \
extern const int name##_methods_num; extern const int name##_methods_num;
// For some reason static vector won't work, use a pointer instead // For some reason static vectors won't work, use pointers instead
static vector<tuple<const char *, const char *, void **>> *hook_list; static vector<tuple<const char *, const char *, void **>> *xhook_list;
static vector<JNINativeMethod> *jni_list;
static JavaVM *g_jvm; static JavaVM *g_jvm;
static int prev_fork_pid = -1; static int prev_fork_pid = -1;
@ -41,6 +43,7 @@ if (newMethods[i].name == #method##sv) { \
auto orig = new JNINativeMethod(); \ auto orig = new JNINativeMethod(); \
memcpy(orig, &newMethods[i], sizeof(JNINativeMethod)); \ memcpy(orig, &newMethods[i], sizeof(JNINativeMethod)); \
method##_orig = orig; \ method##_orig = orig; \
jni_list->push_back(newMethods[i]); \
for (int j = 0; j < method##_methods_num; ++j) { \ for (int j = 0; j < method##_methods_num; ++j) { \
if (strcmp(newMethods[i].signature, method##_methods[j].signature) == 0) { \ if (strcmp(newMethods[i].signature, method##_methods[j].signature) == 0) { \
newMethods[i] = method##_methods[j]; \ newMethods[i] = method##_methods[j]; \
@ -196,7 +199,7 @@ static int hook_register(const char *path, const char *symbol, void *new_func, v
LOGE("hook: Failed to register hook \"%s\"\n", symbol); LOGE("hook: Failed to register hook \"%s\"\n", symbol);
return ret; return ret;
} }
hook_list->emplace_back(path, symbol, old_func); xhook_list->emplace_back(path, symbol, old_func);
return 0; return 0;
} }
@ -208,41 +211,36 @@ void hook_functions() {
xhook_enable_debug(1); xhook_enable_debug(1);
xhook_enable_sigsegv_protection(0); xhook_enable_sigsegv_protection(0);
#endif #endif
hook_list = new remove_pointer_t<decltype(hook_list)>(); xhook_list = new remove_pointer_t<decltype(xhook_list)>();
jni_list = new remove_pointer_t<decltype(jni_list)>();
XHOOK_REGISTER(".*\\libandroid_runtime.so$", jniRegisterNativeMethods); XHOOK_REGISTER(".*\\libandroid_runtime.so$", jniRegisterNativeMethods);
XHOOK_REGISTER(".*\\libandroid_runtime.so$", fork); XHOOK_REGISTER(".*\\libandroid_runtime.so$", fork);
hook_refresh(); hook_refresh();
} }
#define push_method(method) \
if (method##_orig) methods.emplace_back(*method##_orig)
bool unhook_functions() { bool unhook_functions() {
JNIEnv* env; JNIEnv* env;
if (g_jvm->GetEnv(reinterpret_cast<void**>(&env), JNI_VERSION_1_6) != JNI_OK) if (g_jvm->GetEnv(reinterpret_cast<void**>(&env), JNI_VERSION_1_6) != JNI_OK)
return false; return false;
// Unhook JNI methods // Unhook JNI methods
vector<JNINativeMethod> methods; if (!jni_list->empty() && old_jniRegisterNativeMethods(env,
push_method(nativeForkAndSpecialize);
push_method(nativeSpecializeAppProcess);
push_method(nativeForkSystemServer);
if (!methods.empty() && old_jniRegisterNativeMethods(env,
"com/android/internal/os/Zygote", "com/android/internal/os/Zygote",
methods.data(), methods.size()) != 0) { jni_list->data(), jni_list->size()) != 0) {
LOGE("hook: Failed to register JNI hook for Zygote\n"); LOGE("hook: Failed to register JNI hook\n");
return false; return false;
} }
delete jni_list;
// Unhook xhook // Unhook xhook
for (auto &[path, sym, old_func] : *hook_list) { for (auto &[path, sym, old_func] : *xhook_list) {
if (xhook_register(path, sym, *old_func, nullptr) != 0) { if (xhook_register(path, sym, *old_func, nullptr) != 0) {
LOGE("hook: Failed to register hook \"%s\"\n", sym); LOGE("hook: Failed to register hook \"%s\"\n", sym);
return false; return false;
} }
} }
delete hook_list; delete xhook_list;
return hook_refresh(); return hook_refresh();
} }