Magisk/native/jni/inject/hook.cpp

276 lines
8.7 KiB
C++
Raw Normal View History

2021-01-08 09:53:24 +01:00
#include <jni.h>
#include <xhook.h>
#include <utils.hpp>
#include <flags.hpp>
#include <daemon.hpp>
2021-01-08 09:53:24 +01:00
#include "inject.hpp"
using namespace std;
#define DCL_HOOK_FUNC(ret, func, ...) \
static ret (*old_##func)(__VA_ARGS__); \
static ret new_##func(__VA_ARGS__)
#define DCL_JNI_FUNC(name) \
static const JNINativeMethod *name##_orig = nullptr; \
extern const JNINativeMethod name##_methods[]; \
extern const int name##_methods_num;
2021-01-08 14:25:44 +01:00
2021-01-10 02:41:25 +01:00
namespace {
struct HookContext {
int pid;
bool do_hide;
2021-01-10 02:41:25 +01:00
};
// JNI method declarations
DCL_JNI_FUNC(nativeForkAndSpecialize)
DCL_JNI_FUNC(nativeSpecializeAppProcess)
DCL_JNI_FUNC(nativeForkSystemServer)
2021-01-10 02:41:25 +01:00
}
// For some reason static vectors won't work, use pointers instead
static vector<tuple<const char *, const char *, void **>> *xhook_list;
static vector<JNINativeMethod> *jni_list;
static JavaVM *g_jvm;
static int prev_fork_pid = -1;
static HookContext *current_ctx;
#define HOOK_JNI(method) \
2021-01-08 14:25:44 +01:00
if (newMethods[i].name == #method##sv) { \
2021-01-10 02:41:25 +01:00
auto orig = new JNINativeMethod(); \
memcpy(orig, &newMethods[i], sizeof(JNINativeMethod)); \
method##_orig = orig; \
2021-01-10 14:07:17 +01:00
jni_list->push_back(newMethods[i]); \
for (int j = 0; j < method##_methods_num; ++j) { \
if (strcmp(newMethods[i].signature, method##_methods[j].signature) == 0) { \
newMethods[i] = method##_methods[j]; \
LOGI("hook: replaced #" #method "\n"); \
2021-01-08 14:25:44 +01:00
++hooked; \
break; \
} \
} \
continue; \
}
DCL_HOOK_FUNC(int, jniRegisterNativeMethods,
2021-01-08 09:53:24 +01:00
JNIEnv *env, const char *className, const JNINativeMethod *methods, int numMethods) {
LOGD("hook: jniRegisterNativeMethods %s", className);
2021-01-08 14:25:44 +01:00
unique_ptr<JNINativeMethod[]> newMethods;
int hooked = 0;
if (g_jvm == nullptr) {
// Save for later unhooking
env->GetJavaVM(&g_jvm);
}
2021-01-08 09:53:24 +01:00
2021-01-08 14:25:44 +01:00
if (className == "com/android/internal/os/Zygote"sv) {
newMethods = make_unique<JNINativeMethod[]>(numMethods);
memcpy(newMethods.get(), methods, sizeof(JNINativeMethod) * numMethods);
2021-01-08 14:25:44 +01:00
for (int i = 0; i < numMethods && hooked < 3; ++i) {
HOOK_JNI(nativeForkAndSpecialize);
HOOK_JNI(nativeSpecializeAppProcess);
HOOK_JNI(nativeForkSystemServer);
2021-01-08 14:25:44 +01:00
}
}
return old_jniRegisterNativeMethods(env, className, newMethods.get() ?: methods, numMethods);
2021-01-08 09:53:24 +01:00
}
DCL_HOOK_FUNC(int, fork) {
if (prev_fork_pid < 0)
return old_fork();
// Skip an actual fork and return the previous fork result
int pid = prev_fork_pid;
prev_fork_pid = -1;
return pid;
}
DCL_HOOK_FUNC(int, selinux_android_setcontext,
uid_t uid, int isSystemServer, const char *seinfo, const char *pkgname) {
if (current_ctx && current_ctx->do_hide) {
// Ask magiskd to hide ourselves before switching context
// because magiskd socket is not accessible on Android 8.0+
remote_request_hide();
LOGD("hook: process successfully hidden\n");
}
return old_selinux_android_setcontext(uid, isSystemServer, seinfo, pkgname);
}
static int sigmask(int how, int signum) {
sigset_t set;
sigemptyset(&set);
sigaddset(&set, signum);
return sigprocmask(how, &set, nullptr);
}
static int pre_specialize_fork() {
// First block SIGCHLD, unblock after original fork is done
sigmask(SIG_BLOCK, SIGCHLD);
prev_fork_pid = old_fork();
return prev_fork_pid;
}
// -----------------------------------------------------------------
static void nativeSpecializeAppProcess_pre(HookContext *ctx,
2021-01-10 02:41:25 +01:00
JNIEnv *env, jclass clazz, jint &uid, jint &gid, jintArray &gids, jint &runtime_flags,
jobjectArray &rlimits, jint &mount_external, jstring &se_info, jstring &nice_name,
jboolean &is_child_zygote, jstring &instruction_set, jstring &app_data_dir,
jboolean &is_top_app, jobjectArray &pkg_data_info_list,
jobjectArray &whitelisted_data_info_list, jboolean &mount_data_dirs,
jboolean &mount_storage_dirs) {
current_ctx = ctx;
const char *process = env->GetStringUTFChars(nice_name, nullptr);
LOGD("hook: %s %s\n", __FUNCTION__, process);
2021-01-10 02:41:25 +01:00
if (mount_external != 0 /* TODO: Handle MOUNT_EXTERNAL_NONE cases */
&& remote_check_hide(uid, process)) {
ctx->do_hide = true;
LOGI("hook: [%s] should be hidden\n", process);
}
env->ReleaseStringUTFChars(nice_name, process);
}
static void nativeSpecializeAppProcess_post(HookContext *ctx, JNIEnv *env, jclass clazz) {
2021-01-10 02:41:25 +01:00
LOGD("hook: %s\n", __FUNCTION__);
if (ctx->do_hide)
2021-01-10 02:41:25 +01:00
self_unload();
current_ctx = nullptr;
2021-01-10 02:41:25 +01:00
}
// -----------------------------------------------------------------
static void nativeForkAndSpecialize_pre(HookContext *ctx,
JNIEnv *env, jclass clazz, jint &uid, jint &gid, jintArray &gids, jint &runtime_flags,
jobjectArray &rlimits, jint &mount_external, jstring &se_info, jstring &nice_name,
jintArray fds_to_close, jintArray fds_to_ignore, /* These 2 arguments are unique to fork */
jboolean &is_child_zygote, jstring &instruction_set, jstring &app_data_dir,
jboolean &is_top_app, jobjectArray &pkg_data_info_list,
jobjectArray &whitelisted_data_info_list, jboolean &mount_data_dirs,
jboolean &mount_storage_dirs) {
// Do our own fork before loading any 3rd party code
ctx->pid = pre_specialize_fork();
if (ctx->pid != 0)
return;
nativeSpecializeAppProcess_pre(
ctx, env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info,
nice_name, is_child_zygote, instruction_set, app_data_dir, is_top_app,
pkg_data_info_list, whitelisted_data_info_list, mount_data_dirs, mount_storage_dirs);
2021-01-10 02:41:25 +01:00
}
static void nativeForkAndSpecialize_post(HookContext *ctx, JNIEnv *env, jclass clazz) {
// Unblock SIGCHLD in case the original method didn't
sigmask(SIG_UNBLOCK, SIGCHLD);
if (ctx->pid != 0)
return;
nativeSpecializeAppProcess_post(ctx, env, clazz);
2021-01-10 02:41:25 +01:00
}
// -----------------------------------------------------------------
static void nativeForkSystemServer_pre(HookContext *ctx,
JNIEnv *env, jclass clazz, uid_t &uid, gid_t &gid, jintArray &gids, jint &runtime_flags,
jobjectArray &rlimits, jlong &permitted_capabilities, jlong &effective_capabilities) {
// Do our own fork before loading any 3rd party code
ctx->pid = pre_specialize_fork();
if (ctx->pid != 0)
return;
current_ctx = ctx;
2021-01-10 02:41:25 +01:00
LOGD("hook: %s\n", __FUNCTION__);
}
static void nativeForkSystemServer_post(HookContext *ctx, JNIEnv *env, jclass clazz) {
// Unblock SIGCHLD in case the original method didn't
sigmask(SIG_UNBLOCK, SIGCHLD);
if (ctx->pid != 0)
return;
2021-01-10 02:41:25 +01:00
LOGD("hook: %s\n", __FUNCTION__);
current_ctx = nullptr;
2021-01-10 02:41:25 +01:00
}
// -----------------------------------------------------------------
2021-01-08 09:53:24 +01:00
static bool hook_refresh() {
if (xhook_refresh(0) == 0) {
xhook_clear();
LOGI("hook: xhook success\n");
return true;
} else {
LOGE("hook: xhook failed\n");
return false;
}
}
static int hook_register(const char *path, const char *symbol, void *new_func, void **old_func) {
int ret = xhook_register(path, symbol, new_func, old_func);
if (ret != 0) {
LOGE("hook: Failed to register hook \"%s\"\n", symbol);
return ret;
}
2021-01-10 14:07:17 +01:00
xhook_list->emplace_back(path, symbol, old_func);
2021-01-08 09:53:24 +01:00
return 0;
}
#define XHOOK_REGISTER(PATH_REGEX, NAME) \
hook_register(PATH_REGEX, #NAME, (void*) new_##NAME, (void **) &old_##NAME)
void hook_functions() {
#ifdef MAGISK_DEBUG
xhook_enable_debug(1);
xhook_enable_sigsegv_protection(0);
#endif
2021-01-10 14:07:17 +01:00
xhook_list = new remove_pointer_t<decltype(xhook_list)>();
jni_list = new remove_pointer_t<decltype(jni_list)>();
2021-01-08 09:53:24 +01:00
XHOOK_REGISTER(".*\\libandroid_runtime.so$", jniRegisterNativeMethods);
XHOOK_REGISTER(".*\\libandroid_runtime.so$", fork);
XHOOK_REGISTER(".*\\libandroid_runtime.so$", selinux_android_setcontext);
2021-01-08 09:53:24 +01:00
hook_refresh();
}
bool unhook_functions() {
2021-01-08 14:25:44 +01:00
JNIEnv* env;
if (g_jvm->GetEnv(reinterpret_cast<void**>(&env), JNI_VERSION_1_6) != JNI_OK)
return false;
2021-01-10 02:41:25 +01:00
// Unhook JNI methods
2021-01-10 14:07:17 +01:00
if (!jni_list->empty() && old_jniRegisterNativeMethods(env,
2021-01-08 14:25:44 +01:00
"com/android/internal/os/Zygote",
2021-01-10 14:07:17 +01:00
jni_list->data(), jni_list->size()) != 0) {
LOGE("hook: Failed to register JNI hook\n");
2021-01-08 14:25:44 +01:00
return false;
}
2021-01-10 14:07:17 +01:00
delete jni_list;
2021-01-08 14:25:44 +01:00
2021-01-10 02:41:25 +01:00
// Unhook xhook
2021-01-10 14:07:17 +01:00
for (auto &[path, sym, old_func] : *xhook_list) {
2021-01-08 09:53:24 +01:00
if (xhook_register(path, sym, *old_func, nullptr) != 0) {
2021-01-08 14:25:44 +01:00
LOGE("hook: Failed to register hook \"%s\"\n", sym);
2021-01-08 09:53:24 +01:00
return false;
}
}
2021-01-10 14:07:17 +01:00
delete xhook_list;
2021-01-08 09:53:24 +01:00
return hook_refresh();
}
2021-01-10 02:41:25 +01:00
#include "jni_hooks.hpp"