Android-DLL-Injector
Android-DLL-Injector copied to clipboard
Overriding got table
Could the app also be edited to override GOT tables so we can intercept function calls? Obviously speaking about the ptrace injection , since LD_PRELOAD automatically do that .
I've tried doing myself but all of this overcomes me so I gave up after a few attempts.
Well if you are talking about patching memory such as overwriting a function with a nop instruction to make it not execute then yes, you can use ptrace_write for that. I don't recommend doing it with ptrace though. There is a system call called process_vm_writev you should look into that for what you want to do.
Well if you are talking about patching memory such as overwriting a function with a nop instruction to make it not execute then yes, you can use ptrace_write for that. I don't recommend doing it with ptrace though. There is a system call called process_vm_writev you should look into that for what you want to do.
Found a way of doing what I need with funchook, so I can intercepting function calls and editing their value which works perfectly fine. Thanks for suggestion anyway :)
Only issue I have is that I need to manually open the so file and dlsym to load it into the program but that works fine.
Leaving here the code for this if anyone is interested
#include <dlfcn.h>
typedef void* funchook_t;
typedef int (*funchook_prepare_t)(funchook_t*, void**, void*);
typedef int (*funchook_install_t)(funchook_t, int);
void* (*funchook_create)();
funchook_prepare_t funchook_prepare;
funchook_install_t funchook_install;
int load_funchook() {
void* handle = dlopen("/data/local/tmp/libfunchook.so", RTLD_LAZY);
if (!handle) {
// handle error
return -1;
}
funchook_create = (void* (*)()) dlsym(handle, "funchook_create");
funchook_prepare = (funchook_prepare_t) dlsym(handle, "funchook_prepare");
funchook_install = (funchook_install_t) dlsym(handle, "funchook_install");
if (!funchook_create || !funchook_prepare || !funchook_install) {
dlclose(handle);
return -1;
}
return 0;
}
void __attribute__((constructor)) init()
{
int fh = load_funchook();
if (fh == -1)
LOGE("Failed to load funchook");
else
LOGI("Loaded funchook");
}
Another solution that I've found very useful, and which will support all the arches supported by this is bytehook . Only issue is that not being inline, it can only inject only at the start of a function. Another library (this one supports inline hooks) is ShadowHook but only supports armeabi-v7a and arm64-v8a. But they both can now be used starting with the last commits since the hooks need to be done after the library has been constructed (in a separate function for example)