本文博客地址：http://blog.csdn.net/qq1084283172/article/details/75200800

一、序言

在前面的博客中，已经分析过了Android Hook框架adbi源码的具体实现，Android Hook框架adbi的实现主要分为两部分，一部分是root权限下的Android跨进程的so注入，一部分是基于Android系统的inline Hook。只要搞清楚了Android系统的跨进程so注入和基于Android系统的inline Hook这两个知识点，理解adbi等Android的Hook框架就不是问题了。Android系统的跨进程so注入和Android的各种Hook非常重要而且它们应用的范围也非常广，Android加固中的反调试对抗、反内存dump对抗，基于ClassLoader的VirtualApp的Hook等等。前面的博客中已经学习了adbi的实现原理，但是仅仅理解原理还不够，实践一下证明adbi的inline Hook是有效的才ok，在接下来的博文将着重记录一下adbi的源码的编译和inlineHook操作实践。

二、Android Hook框架adbi的inline Hook代码的简析

Android Hook框架adbi的inline Hook部分主要代码的简要解析和说明。

• 带有注释分析的Android Hook框架adbi源码下载地址：http://download.csdn.net/detail/qq1084283172/9893002

• util.c文件，只要是用于inline Hook中目标函数所在so库文件的文件路径和内存加载基地址的获取以及解析该so库文件获取被inline Hook目标函数的内存调用地址的实现。虽然代码量有点大，但是作者解析指定so库文件，获取该so库文件的静态库或动态库的符号表即”.symtab”或者”.dynsym”信息和获取目标函数的调用地址的方法还是值得去学习的，与前面提到基于Android的.got表的Hook还是有区别的。下面贴的代码中，有些函数是没有使用的，为了阅读的方便和尊重原作者的编码还是加上了。

  /*

  • Elf parsing code taken from: hijack.c (for x86)
  • by Victor Zandy
    *
  • Elf parsing code slightly modified for this project
  • (c) Collin Mulliner
    *
  • License: LGPL v2.1
    *
  • Termios code taken from glibc with slight modifications for this project
    *
    */
    #define _XOPEN_SOURCE 500
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include
    #include

  #include "hook.h"

  /* memory map for libraries */
  #define MAX_NAME_LEN 256
  #define MEMORY_ONLY "[memory]"

  struct mm {

  // 内存布局的名称
  char name[MAX_NAME_LEN];
  // 内存布局的起始地址和结束地址
  unsigned long start, end;

  };

  typedef struct symtab *symtab_t;
  struct symlist {
  Elf32_Sym *sym; /* symbols */
  char *str; /* symbol strings / unsigned num; / number of symbols */
  };

  struct symtab {
  struct symlist st; / "static" symbols */
  struct symlist *dyn; /* dynamic symbols */
  };

  static void* xmalloc(size_t size)
  {
  void *p;
  p = malloc(size);
  if (!p) {
  printf("Out of memory\n");
  exit(1);
  }
  return p;
  }

  static int my_pread(int fd, void *buf, size_t count, off_t offset)
  {
  lseek(fd, offset, SEEK_SET);
  return read(fd, buf, count);
  }

  static struct symlist* get_syms(int fd, Elf32_Shdr *symh, Elf32_Shdr *strh)
  {
  struct symlist *sl, *ret;
  int rv;

  ret = NULL;
  sl = (struct symlist *) xmalloc(sizeof(struct symlist));
  sl->str = NULL;
  sl->sym = NULL;
  
  /* sanity */
  if (symh->sh_size % sizeof(Elf32_Sym)) {
      //printf("elf_error\n");
      goto out;
  }
  
  /* symbol table */
  sl->num = symh->sh_size / sizeof(Elf32_Sym);
  sl->sym = (Elf32_Sym *) xmalloc(symh->sh_size);
  rv = my_pread(fd, sl->sym, symh->sh_size, symh->sh_offset);
  if (0 > rv) {
      //perror("read");
      goto out;
  }
  if (rv != symh->sh_size) {
      //printf("elf error\n");
      goto out;
  }
  
  /* string table */
  sl->str = (char *) xmalloc(strh->sh_size);
  rv = my_pread(fd, sl->str, strh->sh_size, strh->sh_offset);
  if (0 > rv) {
      //perror("read");
      goto out;
  }
  if (rv != strh->sh_size) {
      //printf("elf error");
      goto out;
  }
  
  ret = sl;

  out:
  return ret;
  }

  static int do_load(int fd, symtab_t symtab)
  {
  int rv;
  size_t size;
  Elf32_Ehdr ehdr;
  Elf32_Shdr *shdr = NULL, *p;
  Elf32_Shdr *dynsymh, *dynstrh;
  Elf32_Shdr *symh, *strh;
  char *shstrtab = NULL;
  int i;
  int ret = -1;

  /* elf header */
  rv = read(fd, &ehdr, sizeof(ehdr));
  if (0 > rv) {
      log("read\n")
      goto out;
  }
  if (rv != sizeof(ehdr)) {
      log("elf error 1\n")
      goto out;
  }
  if (strncmp(ELFMAG, ehdr.e_ident, SELFMAG)) { /* sanity */
      log("not an elf\n")
      goto out;
  }
  if (sizeof(Elf32_Shdr) != ehdr.e_shentsize) { /* sanity */
      log("elf error 2\n")
      goto out;
  }
  
  /* section header table */
  size = ehdr.e_shentsize * ehdr.e_shnum;
  shdr = (Elf32_Shdr *) xmalloc(size);
  rv = my_pread(fd, shdr, size, ehdr.e_shoff);
  if (0 > rv) {
      log("read\n")
      goto out;
  }
  if (rv != size) {
      log("elf error 3 %d %d\n", rv, size)
      goto out;
  }
  
  /* section header string table */
  size = shdr[ehdr.e_shstrndx].sh_size;
  shstrtab = (char *) xmalloc(size);
  rv = my_pread(fd, shstrtab, size, shdr[ehdr.e_shstrndx].sh_offset);
  if (0 > rv) {
      log("read\n")
      goto out;
  }
  if (rv != size) {
      log("elf error 4 %d %d\n", rv, size)
      goto out;
  }
  
  /* symbol table headers */
  symh = dynsymh = NULL;
  strh = dynstrh = NULL;
  for (i = 0, p = shdr; i < ehdr.e_shnum; i++, p++)
      if (SHT_SYMTAB == p->sh_type) {
          if (symh) {
              log("too many symbol tables\n")
              goto out;
          }
          symh = p;
      } else if (SHT_DYNSYM == p->sh_type) {
          if (dynsymh) {
              log("too many symbol tables\n")
              goto out;
          }
          dynsymh = p;
      } else if (SHT_STRTAB == p->sh_type
             && !strncmp(shstrtab+p->sh_name, ".strtab", 7)) {
          if (strh) {
              log("too many string tables\n")
              goto out;
          }
          strh = p;
      } else if (SHT_STRTAB == p->sh_type
             && !strncmp(shstrtab+p->sh_name, ".dynstr", 7)) {
          if (dynstrh) {
              log("too many string tables\n")
              goto out;
          }
          dynstrh = p;
      }
  /* sanity checks */
  if ((!dynsymh && dynstrh) || (dynsymh && !dynstrh)) {
      log("bad dynamic symbol table\n")
      goto out;
  }
  if ((!symh && strh) || (symh && !strh)) {
      log("bad symbol table\n")
      goto out;
  }
  if (!dynsymh && !symh) {
      log("no symbol table\n")
      goto out;
  }
  
  /* symbol tables */
  if (dynsymh)
      symtab->dyn = get_syms(fd, dynsymh, dynstrh);
  if (symh)
      symtab->st = get_syms(fd, symh, strh);
  ret = 0;

  out:
  free(shstrtab);
  free(shdr);
  return ret;
  }

  static symtab_t load_symtab(char *filename)
  {
  int fd;
  symtab_t symtab;

  symtab = (symtab_t) xmalloc(sizeof(*symtab));
  memset(symtab, 0, sizeof(*symtab));
  
  fd = open(filename, O_RDONLY);
  if (0 > fd) {
      log("%s open\n", __func__);
      return NULL;
  }
  
  if (0 > do_load(fd, symtab)) {
  log("Error ELF parsing %s\n", filename)
  free(symtab);
  symtab = NULL;
  }
  
  close(fd);
  
  return symtab;

  }

  // 获取指定pid进程的内存布局的信息
  static int load_memmap(pid_t pid, struct mm *mm, int *nmmp)
  {
  char raw[80000]; // increase this if needed for larger "maps"
  char name[MAX_NAME_LEN];
  char *p;
  unsigned long start, end;
  struct mm *m;
  int nmm = 0;
  int fd, rv;
  int i;

  // 格式字符串"/proc/pid/maps"
  sprintf(raw, "/proc/%d/maps", pid);
  // 获取目标pid进程的内存布局信息
  fd = open(raw, O_RDONLY);
  if (0 > fd) {
  //printf("Can't open %s for reading\n", raw);
  return -1;
  }
  
  // 数组清零
  memset(raw, 0, sizeof(raw));
  
  // 格式：400c2000-400da000 r-xp 00000000 b3:19 949        /system/lib/libm.so
  p = raw;
  while (1) {
  // 分行读取目标pid进程的内存布局信息
  rv = read(fd, p, sizeof(raw)-(p-raw));
  if (0 > rv) {
      //perror("read");
      return -1;
  }
  // 判断内存布局信息是否读取完了
  if (0 == rv)
      break;
  
  // 修改指向内存缓冲区raw中的指针偏移p
  p += rv;
  
  // 判断是否超过内存缓冲区范围
  if (p-raw >= sizeof(raw)) {
  
      //printf("Too many memory mapping\n");
      return -1;
  }
  }
  
  // 关闭文件
  close(fd);
  
  // 分割字符串
  p = strtok(raw, "\n");
  m = mm;
  while (p) {
  // 根据格式解析每一行内存布局信息
  // rv = sscanf函数都将返回成功转换并分配的字段数
  rv = sscanf(p, "%08lx-%08lx %*s %*s %*s %*s %s\n", &start, &end, name);
  
  // 继续分割字符串
  p = strtok(NULL, "\n");
  
  // sscanf函数前两个字段start、end匹配成功的情况即没有名称的情况
  if (rv == 2) {
  
      m = &mm[nmm++];
      // 内存布局起始地址
      m->start = start;
      // 内存布局结束地址
      m->end = end;
      // 设置默认内存布局名称为"[memory]"
      strcpy(m->name, MEMORY_ONLY);
  
      continue;
  }
  
  /* search backward for other mapping with same name */
  // 在前面保存的内存布局行信息中查找相同名称的内存布局
  // 例如：
  // 7739a000-7739c000 r-xp 00000000 b3:19 795        /system/lib/libOpenSLES.so
  // 7739c000-7739d000 r--p 00001000 b3:19 795        /system/lib/libOpenSLES.so
  // 7739d000-7739e000 rw-p 00002000 b3:19 795        /system/lib/libOpenSLES.so
  for (i = nmm-1; i >= 0; i--) {
  
      m = &mm[i];
      if (!strcmp(m->name, name))
          break;
  }
  
  // 进行相同名称的内存布局起始地址和结束地址的合并
  if (i >= 0) {
  
      if (start < m->start)
          m->start = start;
      if (end > m->end)
          m->end = end;
  
  } else {
  
      // 内存起始地址、内存结束地址、内存布局名称
      m = &mm[nmm++];
  
      // 内存起始地址
      m->start = start;
      // 内存结束地址
      m->end = end;
      // 内存布局名称
      strcpy(m->name, name);
  }
  }
  
  // 保存合并后内存布局的个数
  *nmmp = nmm;
  
  return 0;

  }

  /* Find libc in MM, storing no more than LEN-1 chars of
  its name in NAME and set START to its starting
  address. If libc cannot be found return -1 and
  leave NAME and START untouched. Otherwise return 0
  and null-terminated NAME. */
  // libn为要查找的lib库文件的名称字符串，如："libc."
  static int find_libname(char *libn, char *name, int len, unsigned long *start, struct mm *mm, int nmm)
  {
  int i;
  struct mm *m;
  char *p;

  // 遍历获取到的目标pid进程的内存布局的信息
  for (i = 0, m = mm; i < nmm; i++, m++) {
  // 直接跳过内存布局名称为"[memory]"的情况
  if (!strcmp(m-&gt;name, MEMORY_ONLY))
      continue;
  
  // 从右开始搜索'/'符号，获取内存布局的名称
  // 例如/system/lib/libdl.so，获取名称libdl.so
  p = strrchr(m-&gt;name, '/');
  // 跳过不符合要求的情况
  if (!p)
      continue;
  
  // 判断获取到的lib库名称是否是要查找的目标lib库名称libn
  p++;
  if (strncmp(libn, p, strlen(libn)))
      continue;
  
  // 获取查找的例如："libc."的长度
  p += strlen(libn);
  
  /* here comes our crude test -&gt; 'libc.so' or 'libc-[0-9]' */
  // 作者并没有使用
  if (!strncmp("so", p, 2) || 1) // || (p[0] == '-' &amp;&amp; isdigit(p[1])))
      break;
  }
  
  // 判断是否查找到目标lib库libn
  if (i >= nmm)
      /* not found */
      return -1;
  
  // 获取指定lib库文件的内存的起始地址
  *start = m->start;
  
  // 保存查找到的目标lib库文件的路径字符串m->name
  strncpy(name, m->name, len);
  // 判断lib库文件的路径字符串是否超过内存数组的长度
  if (strlen(m->name) >= len)
      // 进行截取
      name[len-1] = '\0';
  
  // 修改指定内存区域内存属性为可读可写可执行
  mprotect((void*)m->start, m->end - m->start, PROT_READ|PROT_WRITE|PROT_EXEC);
  
  return 0;

  }

  static int lookup2(struct symlist *sl, unsigned char type,
  char *name, unsigned long *val)
  {
  Elf32_Sym *p;
  int len;
  int i;

  len = strlen(name);
  for (i = 0, p = sl->sym; i < sl->num; i++, p++) {
      //log("name: %s %x\n", sl->str+p->st_name, p->st_value)
      if (!strncmp(sl->str+p->st_name, name, len) && *(sl->str+p->st_name+len) == 0
          && ELF32_ST_TYPE(p->st_info) == type) {
          //if (p->st_value != 0) {
          *val = p->st_value;
          return 0;
          //}
      }
  }
  return -1;

  }

  //struct symtab {
  // struct symlist st; / "static" symbols */
  // struct symlist *dyn; /* dynamic symbols */
  //};

  static int lookup_sym(symtab_t s, unsigned char type,
  char *name, unsigned long *val)
  {
  // 在动态系统符号表中查找获取目标函数的RVA
  if (s->dyn && !lookup2(s->dyn, type, name, val))
  return 0;

  // 在静态系统符号表中查找获取目标函数的RVA
  if (s->st && !lookup2(s->st, type, name, val))
      return 0;
  
  return -1;

  }

  static int lookup_func_sym(symtab_t s, char *name, unsigned long *val)
  {
  return lookup_sym(s, STT_FUNC, name, val);
  }

  // 在指定pid进程的指定lib库中查找将被Hook的目标函数的地址
  int find_name(pid_t pid, char *name, char *libn, unsigned long *addr)
  {
  struct mm mm[1000];
  unsigned long libcaddr;
  int nmm;
  char libc[1024];
  symtab_t s;

  // 获取指定pid进程的内存布局的信息并保存到mm数组中
  if (0 > load_memmap(pid, mm, &nmm)) {
  log("cannot read memory map\n")
  return -1;
  }
  
  // 获取需要查找的目标lib库libn的内存基地址libcaddr并获取保存libn的全路径字符串
  if (0 > find_libname(libn, libc, sizeof(libc), &libcaddr, mm, nmm)) {
  log("cannot find lib: %s\n", libn)
  return -1;
  }
  //log("lib: >%s<\n", libc)
  
  // 打开查找到的lib目标库文件（路径字符串libc）解析该Elf文件
  // 获取该lib库文件的静态库和动态库的符号表信息".symtab"或者".dynsym".
  s = load_symtab(libc);
  if (!s) {
  log("cannot read symbol table\n");
  return -1;
  }
  
  // 在目标lib库libn的静态库和动态库的符号表查找被Hook的目标函数的RVA即相对地址偏移
  if (0 > lookup_func_sym(s, name, addr)) {
  log("cannot find function: %s\n", name);
  return -1;
  }
  
  // 获取到目标pid进程中被Hook的目标函数的VA即虚拟地址偏移（有效的函数调用地址）
  *addr += libcaddr;
  
  return 0;

  }

  // 获取指定so库文件的内存加载地址
  int find_libbase(pid_t pid, char *libn, unsigned long *addr)
  {
  struct mm mm[1000];
  unsigned long libcaddr;
  int nmm;
  char libc[1024];
  symtab_t s;

  if (0 > load_memmap(pid, mm, &nmm)) {
      log("cannot read memory map\n")
      return -1;
  }
  if (0 > find_libname(libn, libc, sizeof(libc), &libcaddr, mm, nmm)) {
      log("cannot find lib\n");
      return -1;
  }
  *addr = libcaddr;
  return 0;

  }

  // --------------------------------------------------------------
  #if 0

  define IBAUD0 0

  /* Set *T to indicate raw mode. */
  void cfmakeraw (struct termios t) { t->c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP|INLCR|IGNCR|ICRNL|IXON); t->c_oflag &= ~OPOST; t->c_lflag &= ~(ECHO|ECHONL|ICANON|ISIG|IEXTEN); t->c_cflag &= ~(CSIZE|PARENB); t->c_cflag |= CS8; t->c_cc[VMIN] = 1; / read returns when one char is available. / t->c_cc[VTIME] = 0; } #define __KERNEL_NCCS 19 struct __kernel_termios { tcflag_t c_iflag; / input mode flags / tcflag_t c_oflag; / output mode flags / tcflag_t c_cflag; / control mode flags / tcflag_t c_lflag; / local mode flags / cc_t c_line; / line discipline / cc_t c_cc[__KERNEL_NCCS]; / control characters */
  };

  /* Set the state of FD to *TERMIOS_P. */
  int tcsetattr (int fd, int optional_actions, const struct termios *termios_p)
  {
  struct __kernel_termios k_termios;
  unsigned long int cmd;
  int retval;

      switch (optional_actions)
      {
      case TCSANOW:
          cmd = TCSETS;
          break;
      case TCSADRAIN:
          cmd = TCSETSW;
          break;
      case TCSAFLUSH:
          cmd = TCSETSF;
          break;
      default:
          //__set_errno (EINVAL);
          return -1;
      }
  k_termios.c_iflag = termios_p->c_iflag & ~IBAUD0;
  k_termios.c_oflag = termios_p->c_oflag;
  k_termios.c_cflag = termios_p->c_cflag;
  k_termios.c_lflag = termios_p->c_lflag;
  k_termios.c_line = termios_p->c_line;
  #ifdef _HAVE_C_ISPEED
  k_termios.c_ispeed = termios_p->c_ispeed;
  #endif
  #ifdef _HAVE_C_OSPEED
      k_termios.c_ospeed = termios_p->c_ospeed;
  #endif
      memcpy (&k_termios.c_cc[0], &termios_p->c_cc[0],
          __KERNEL_NCCS * sizeof (cc_t));
  retval = ioctl (fd, cmd, &k_termios);
  
  if (retval == 0 && cmd == TCSETS)
  {
  /* The Linux kernel has a bug which silently ignore the invalid
     c_cflag on pty. We have to check it here. */
  int save = 0; //errno;
  retval = ioctl (fd, TCGETS, &k_termios);
  if (retval)
  {
      /* We cannot verify if the setting is ok. We don't return
         an error (?). */
      //__set_errno (save);
      retval = 0;
  }
  else if ((termios_p->c_cflag & (PARENB | CREAD))
      != (k_termios.c_cflag & (PARENB | CREAD))
      || ((termios_p->c_cflag & CSIZE)
          && ((termios_p->c_cflag & CSIZE)
          != (k_termios.c_cflag & CSIZE))))
  {
      /* It looks like the Linux kernel silently changed the
         PARENB/CREAD/CSIZE bits in c_cflag. Report it as an
         error. */
      //__set_errno (EINVAL);
      retval = -1;
  }
  }
  
  return retval;</code></pre>
  }
  int tcgetattr (int fd, struct termios *termios_p)
  
      {
  
          struct __kernel_termios k_termios;
  
          int retval;
      retval = ioctl (fd, TCGETS, &k_termios);
      if(retval == 0) {
          termios_p->c_iflag = k_termios.c_iflag;
          termios_p->c_oflag = k_termios.c_oflag;
          termios_p->c_cflag = k_termios.c_cflag;
          termios_p->c_lflag = k_termios.c_lflag;
          termios_p->c_line = k_termios.c_line;
  #ifdef _HAVE_C_ISPEED
          termios_p->c_ispeed = k_termios.c_ispeed;
  #endif
  #ifdef _HAVE_C_OSPEED
          termios_p->c_ospeed = k_termios.c_ospeed;
  #endif
      if (sizeof (cc_t) == 1 || _POSIX_VDISABLE == 0
          || (unsigned char) _POSIX_VDISABLE == (unsigned char) -1)
      {
      #if 0
      memset (mempcpy (&amp;termios_p-&gt;c_cc[0], &amp;k_termios.c_cc[0],
              __KERNEL_NCCS * sizeof (cc_t)),
          _POSIX_VDISABLE, (NCCS - __KERNEL_NCCS) * sizeof (cc_t));
      #endif
      memset ( (memcpy (&amp;termios_p-&gt;c_cc[0], &amp;k_termios.c_cc[0],
              __KERNEL_NCCS * sizeof (cc_t)) + (__KERNEL_NCCS * sizeof (cc_t))) ,
          _POSIX_VDISABLE, (NCCS - __KERNEL_NCCS) * sizeof (cc_t));
  
      } else {
      size_t cnt;
  
      memcpy (&amp;termios_p-&gt;c_cc[0], &amp;k_termios.c_cc[0],
          __KERNEL_NCCS * sizeof (cc_t));
  
      for (cnt = __KERNEL_NCCS; cnt &lt; NCCS; ++cnt)
          termios_p-&gt;c_cc[cnt] = _POSIX_VDISABLE;
      }
  }
  
  return retval;
  }
  #endif

$ adb push ./hijack /data/local/tmp/
$ adb shell chmod 0777 /data/local/tmp/hijack

$ adb push ./libexample.so /data/local/tmp/
$ adb shell chmod 0777 /data/local/tmp/libexample.so

$ pause

$ adb shell
$ su
$ cd /data/local/tmp

# log日志打印的重定位
$ > /data/local/tmp/adbi_example.log

# GET PID from com.android.phone(用com.android.phone作为目标进程进行so注入)
$ ps | grep com.android.phone

# inject so and inline Hook
$ ./hijack -d -p PID -l /data/local/tmp/libexample.so

# 查看自定义打印的log日志
$ cat ./adbi_example.log

# 查看被so注入的目标进程的内存布局
$ cat /pro/pid/maps