iqiyi / xHook

🔥 A PLT hook library for Android native ELF.
Other
4.1k stars 762 forks source link

我用xhook,在zygote启动时hook __loader_dlopen,arm32可以成功但是arm64不能成功 #84

Closed bwmaples closed 4 years ago

bwmaples commented 4 years ago
void* my_dlopen(const char* path, int mode, const void* caller_addr){
    void* result = NULL;

#ifdef __aarch64__
    result = originDlopen64(path,mode,caller_addr);
#else

    result = originDlopen32(path,mode,caller_addr);

#endif
    return result;
}

void* hookFunc(){
xhook_enable_debug(1);
    err = xhook_register("/system/lib64/libdl\\.so$","__loader_dlopen",(void*)my_dlopen,(void**)&originDlopen64);
    if(err!=0){
        LOGE("[-]hook failed errno is %d",err);
        return NULL;
    }

    err = xhook_refresh(0);
    LOGI("after dlopen is 0x%llx 0x%llx",*(unsigned long long*)dlopenaddr,*(((unsigned long long*)dlopenaddr)+1));
    if(err!=0){
        LOGE("refresh error no is %d",err);
        return NULL;
    }
    xhook_clear();
}

arm64会在__start_thread中跳到一个奇怪的地址

bwmaples commented 4 years ago

好了,我知道为什么了,因为我把hook代码直接写在了 native_bridge里,这个东西内存里不是常驻的,加载一个自己的so文件就好了