solohsu 2020-07-30 23:39:59 +08:00
parent e4f24e4674
commit 8d7a6627ab
12 changed files with 40 additions and 84 deletions

View File

@ -12,7 +12,7 @@ public class Yahfa {
// JNI.ToReflectedMethod() could return either Method or Constructor
public static native Object findMethodNative(Class targetClass, String methodName, String methodSig);
public static native void init(int SDK_version);
public static native void init(int sdkVersion);
public static native void setMethodNonCompilable(Member member);

View File

@ -5,7 +5,6 @@
#include <stdbool.h>
#include "common.h"
#include "env.h"
#include "trampoline.h"
#include "HookMain.h"
@ -22,10 +21,6 @@ static int kAccNative = 0x0100;
static int kAccCompileDontBother = 0x01000000;
static int kAccFastInterpreterToInterpreterInvoke = 0x40000000;
static inline uint16_t read16(void *addr) {
return *((uint16_t *) addr);
}
static inline uint32_t read32(void *addr) {
return *((uint32_t *) addr);
}
@ -34,13 +29,17 @@ static inline void write32(void *addr, uint32_t value) {
*((uint32_t *) addr) = value;
}
static inline void* readAddr(void *addr) {
return *((void**) addr);
}
void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVersion) {
int i;
SDKVersion = sdkVersion;
LOGI("init to SDK %d", sdkVersion);
switch (sdkVersion) {
case ANDROID_Q:
case ANDROID_P:
case __ANDROID_API_Q__:
case __ANDROID_API_P__:
kAccCompileDontBother = 0x02000000;
OFFSET_ArtMehod_in_Object = 0;
OFFSET_access_flags_in_ArtMethod = 4;
@ -50,9 +49,9 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size;
ArtMethodSize = roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size * 2;
break;
case ANDROID_O2:
case __ANDROID_API_O_MR1__:
kAccCompileDontBother = 0x02000000;
case ANDROID_O:
case __ANDROID_API_O__:
OFFSET_ArtMehod_in_Object = 0;
OFFSET_access_flags_in_ArtMethod = 4;
OFFSET_dex_method_index_in_ArtMethod = 4 * 3;
@ -62,8 +61,8 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size * 2;
ArtMethodSize = roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size * 3;
break;
case ANDROID_N2:
case ANDROID_N:
case __ANDROID_API_N_MR1__:
case __ANDROID_API_N__:
OFFSET_ArtMehod_in_Object = 0;
OFFSET_access_flags_in_ArtMethod = 4; // sizeof(GcRoot<mirror::Class>) = 4
OFFSET_dex_method_index_in_ArtMethod = 4 * 3;
@ -76,7 +75,7 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
ArtMethodSize = roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size * 4;
break;
case ANDROID_M:
case __ANDROID_API_M__:
OFFSET_ArtMehod_in_Object = 0;
OFFSET_entry_point_from_interpreter_in_ArtMethod = roundUpToPtrSize(4 * 7);
OFFSET_entry_point_from_quick_compiled_code_in_ArtMethod =
@ -86,7 +85,7 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
OFFSET_array_in_PointerArray = 4 * 3;
ArtMethodSize = roundUpToPtrSize(4 * 7) + pointer_size * 3;
break;
case ANDROID_L2:
case __ANDROID_API_L_MR1__:
OFFSET_ArtMehod_in_Object = 4 * 2;
OFFSET_entry_point_from_interpreter_in_ArtMethod = roundUpToPtrSize(
OFFSET_ArtMehod_in_Object + 4 * 7);
@ -97,7 +96,7 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
OFFSET_array_in_PointerArray = 12;
ArtMethodSize = OFFSET_entry_point_from_interpreter_in_ArtMethod + pointer_size * 3;
break;
case ANDROID_L:
case __ANDROID_API_L__:
OFFSET_ArtMehod_in_Object = 4 * 2;
OFFSET_entry_point_from_interpreter_in_ArtMethod = OFFSET_ArtMehod_in_Object + 4 * 4;
OFFSET_entry_point_from_quick_compiled_code_in_ArtMethod =
@ -117,7 +116,7 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
}
void setNonCompilable(void *method) {
if (SDKVersion < ANDROID_N) {
if (SDKVersion < __ANDROID_API_N__) {
return;
}
int access_flags = read32((char *) method + OFFSET_access_flags_in_ArtMethod);
@ -132,7 +131,7 @@ bool setNativeFlag(void *method, bool isNative) {
int old_access_flags = access_flags;
if (isNative) {
access_flags |= kAccNative;
if (SDKVersion >= ANDROID_Q) {
if (SDKVersion >= __ANDROID_API_Q__) {
// On API 29 whether to use the fast path or not is cached in the ART method structure
access_flags &= ~kAccFastInterpreterToInterpreterInvoke;
}
@ -162,7 +161,7 @@ static int doBackupAndHook(JNIEnv *env, void *targetMethod, void *hookMethod, vo
// set kAccCompileDontBother for a method we do not want the compiler to compile
// so that we don't need to worry about hotness_count_
if (SDKVersion >= ANDROID_N) {
if (SDKVersion >= __ANDROID_API_N__) {
setNonCompilable(targetMethod);
setNonCompilable(hookMethod);
}
@ -199,7 +198,7 @@ static int doBackupAndHook(JNIEnv *env, void *targetMethod, void *hookMethod, vo
}
// set the target method to native so that Android O wouldn't invoke it with interpreter
if (SDKVersion >= ANDROID_O) {
if (SDKVersion >= __ANDROID_API_O__) {
setNativeFlag(targetMethod, true);
LOGI("access flags is 0x%x", access_flags);
}
@ -231,7 +230,7 @@ static void ensureMethodCached(void *hookMethod, void *backupMethod,
}
// finally the addr of backup method is put at the corresponding location in cached methods array
if (SDKVersion >= ANDROID_O2) {
if (SDKVersion >= __ANDROID_API_O_MR1__) {
// array of MethodDexCacheType is used as dexCacheResolvedMethods in Android 8.1
// struct:
// struct NativeDexCachePair<T> = { T*, size_t idx }
@ -319,11 +318,11 @@ static void *getResolvedMethodsAddr(JNIEnv *env, jobject hook) {
jobject dexCacheObj = (*env)->GetObjectField(env, backupClass, dexCacheFid);
// get resolvedMethods address
jclass dexCacheClass = (*env)->GetObjectClass(env, dexCacheObj);
if (SDKVersion >= ANDROID_N) {
if (SDKVersion >= __ANDROID_API_N__) {
jfieldID resolvedMethodsFid = (*env)->GetFieldID(env, dexCacheClass, "resolvedMethods",
"J");
return (void *) (*env)->GetLongField(env, dexCacheObj, resolvedMethodsFid);
} else if (SDKVersion >= ANDROID_L) {
} else if (SDKVersion >= __ANDROID_API_L__) {
LOGE("this should has been done in java world: %d", SDKVersion);
return 0;
} else {

View File

@ -26,4 +26,7 @@
#endif // DEBUG
#endif // LOG_DISABLED
#define pointer_size sizeof(void*)
#define roundUpToPtrSize(v) (v + pointer_size - 1 - ((v + pointer_size - 1) & (pointer_size - 1)))
#endif //YAHFA_COMMON_H

View File

@ -1,33 +0,0 @@
//
// Created by liuruikai756 on 05/07/2017.
//
#ifndef YAHFA_ENV_H
#define YAHFA_ENV_H
#define ANDROID_L 21
#define ANDROID_L2 22
#define ANDROID_M 23
#define ANDROID_N 24
#define ANDROID_N2 25
#define ANDROID_O 26
#define ANDROID_O2 27
#define ANDROID_P 28
#define ANDROID_Q 29
#define roundUpTo4(v) ((v+4-1) - ((v+4-1)&3))
#define roundUpTo8(v) ((v+8-1) - ((v+8-1)&7))
#if defined(__i386__) || defined(__arm__)
#define pointer_size 4
#define readAddr(addr) read32(addr)
#define roundUpToPtrSize(x) roundUpTo4(x)
#elif defined(__aarch64__) || defined(__x86_64__)
#define pointer_size 8
#define readAddr(addr) read64(addr)
#define roundUpToPtrSize(x) roundUpTo8(x)
#else
#error Unsupported architecture
#endif
#endif //YAHFA_ENV_H

View File

@ -12,7 +12,6 @@
#include <sys/syscall.h>
#include "common.h"
#include "env.h"
#include "trampoline.h"
static unsigned char *trampolineCode; // place where trampolines are saved
@ -89,6 +88,9 @@ void *genTrampoline(void *hookMethod) {
#elif defined(__aarch64__)
memcpy(targetAddr + 12, &hookMethod, pointer_size);
#else
#error Unsupported architecture
#endif
return targetAddr;
@ -106,6 +108,8 @@ void setupTrampoline() {
((unsigned char) OFFSET_entry_point_from_quick_compiled_code_in_ArtMethod) << 4;
trampoline[6] |=
((unsigned char) OFFSET_entry_point_from_quick_compiled_code_in_ArtMethod) >> 4;
#else
#error Unsupported architecture
#endif
}

View File

@ -5,23 +5,6 @@
#include <cstdlib>
#include <sys/system_properties.h>
#define ANDROID_ICE_CREAM_SANDWICH 14
#define ANDROID_ICE_CREAM_SANDWICH_MR1 15
#define ANDROID_JELLY_BEAN 16
#define ANDROID_JELLY_BEAN_MR1 17
#define ANDROID_JELLY_BEAN_MR2 18
#define ANDROID_KITKAT 19
#define ANDROID_KITKAT_WATCH 20
#define ANDROID_LOLLIPOP 21
#define ANDROID_LOLLIPOP_MR1 22
#define ANDROID_M 23
#define ANDROID_N 24
#define ANDROID_N_MR1 25
#define ANDROID_O 26
#define ANDROID_O_MR1 27
#define ANDROID_P 28
#define ANDROID_Q 29
static inline int32_t GetAndroidApiLevel() {
char prop_value[PROP_VALUE_MAX];
__system_property_get("ro.build.version.sdk", prop_value);

View File

@ -32,10 +32,10 @@ namespace art {
static void DisableHiddenApi(void *handle, HookFunType hook_func) {
const int api_level = GetAndroidApiLevel();
if (api_level < ANDROID_P) {
if (api_level < __ANDROID_API_P__) {
return;
}
if (api_level == ANDROID_P) {
if (api_level == __ANDROID_API_P__) {
HOOK_FUNC(GetMethodActionImpl,
"_ZN3art9hiddenapi6detail19GetMemberActionImplINS_9ArtMethodEEENS0_"
"6ActionEPT_NS_20HiddenApiAccessFlags7ApiListES4_NS0_12AccessMethodE");

View File

@ -14,11 +14,11 @@ namespace art {
// http://androidxref.com/9.0.0_r3/xref/art/runtime/oat_file_manager.cc#637
static void DisableOnlyUseSystemOatFiles(void *handle, HookFunType hook_func) {
const int api_level = GetAndroidApiLevel();
if (api_level == ANDROID_P) {
if (api_level == __ANDROID_API_P__) {
HOOK_FUNC(SetOnlyUseSystemOatFiles,
"_ZN3art14OatFileManager24SetOnlyUseSystemOatFilesEv");
}
if (api_level == ANDROID_Q) {
if (api_level == __ANDROID_API_Q__) {
HOOK_FUNC(SetOnlyUseSystemOatFiles,
"_ZN3art14OatFileManager24SetOnlyUseSystemOatFilesEbb");
}

View File

@ -37,7 +37,7 @@ namespace edxp {
LP_SELECT("/apex/com.android.runtime/lib/", "/apex/com.android.runtime/lib64/"));
static const auto kLibArtPath =
(GetAndroidApiLevel() >= ANDROID_Q ? kLibRuntimeBasePath : kLibBasePath) + kLibArtName;
(GetAndroidApiLevel() >= __ANDROID_API_Q__ ? kLibRuntimeBasePath : kLibBasePath) + kLibArtName;
static const auto kLibWhalePath = kLibBasePath + kLibWhaleName;
static const auto kLibSandHookPath = kLibBasePath + kLibSandHookName;

View File

@ -214,7 +214,7 @@ namespace edxp {
};
ConfigManager::ConfigManager() {
use_prot_storage_ = GetAndroidApiLevel() >= ANDROID_N;
use_prot_storage_ = GetAndroidApiLevel() >= __ANDROID_API_N__;
last_user_ = 0;
UpdateConfigPath(last_user_);
}

View File

@ -46,7 +46,7 @@ namespace edxp {
}
LOGI("Start to install inline hooks");
int api_level = GetAndroidApiLevel();
if (UNLIKELY(api_level < ANDROID_LOLLIPOP)) {
if (UNLIKELY(api_level < __ANDROID_API_L__)) {
LOGE("API level not supported: %d, skip inline hooks", api_level);
return;
}
@ -66,7 +66,7 @@ namespace edxp {
}
hook_func = reinterpret_cast<HookFunType>(hook_func_symbol);
if (api_level > ANDROID_P) {
if (api_level > __ANDROID_API_P__) {
ScopedDlHandle dl_handle(kLibDlPath.c_str());
void *handle = dl_handle.Get();
HOOK_FUNC(mydlopen, "__loader_dlopen");

View File

@ -54,7 +54,7 @@ namespace edxp {
if (api_level == ANDROID_O_MR1) {
if (api_level == __ANDROID_API_O_MR1__) {
// https://android.googlesource.com/platform/art/+/f5516d38736fb97bfd0435ad03bbab17ddabbe4e
// Android 8.1 add a fatal check for debugging (removed in Android 9.0),
// which will be triggered by EdXposed in cases where target method is hooked
@ -106,7 +106,7 @@ namespace edxp {
}
if (api_level == ANDROID_O_MR1) {
if (api_level == __ANDROID_API_O_MR1__) {
// see __system_property_get hook above for explanations
if (strcmp(kPropKeyUseJitProfiles, key.c_str()) == 0) {
res = "false";
@ -126,7 +126,7 @@ namespace edxp {
XHOOK_REGISTER(__system_property_get);
if (GetAndroidApiLevel() >= ANDROID_P) {
if (GetAndroidApiLevel() >= __ANDROID_API_P__) {
XHOOK_REGISTER(
_ZN7android4base11GetPropertyERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEES9_);
}