Closed bwmaples closed 4 years ago
void* my_dlopen(const char* path, int mode, const void* caller_addr){ void* result = NULL; #ifdef __aarch64__ result = originDlopen64(path,mode,caller_addr); #else result = originDlopen32(path,mode,caller_addr); #endif return result; } void* hookFunc(){ xhook_enable_debug(1); err = xhook_register("/system/lib64/libdl\\.so$","__loader_dlopen",(void*)my_dlopen,(void**)&originDlopen64); if(err!=0){ LOGE("[-]hook failed errno is %d",err); return NULL; } err = xhook_refresh(0); LOGI("after dlopen is 0x%llx 0x%llx",*(unsigned long long*)dlopenaddr,*(((unsigned long long*)dlopenaddr)+1)); if(err!=0){ LOGE("refresh error no is %d",err); return NULL; } xhook_clear(); }
arm64会在__start_thread中跳到一个奇怪的地址
好了,我知道为什么了,因为我把hook代码直接写在了 native_bridge里,这个东西内存里不是常驻的,加载一个自己的so文件就好了
arm64会在__start_thread中跳到一个奇怪的地址