diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..03a5ecb --- /dev/null +++ b/.gitignore @@ -0,0 +1,16 @@ +*.iml +.gradle +/local.properties +/.idea/caches +/.idea/libraries +/.idea/modules.xml +/.idea/workspace.xml +/.idea/navEditor.xml +/.idea/assetWizardSettings.xml +.DS_Store +/build +/captures +.externalNativeBuild +.cxx +local.properties +/.idea diff --git a/README.md b/README.md new file mode 100644 index 0000000..7560fe5 --- /dev/null +++ b/README.md @@ -0,0 +1,39 @@ + +### 简介 + +在Android7.0以及以上的版本中，dlfcn.h头文件中dlopen, dlsym函数已经无法在系统库上使用。 +比较常见的规避方法是，先通过maps文件找到so文件对应起始地址，然后通过解析elf 文件，得到函数的偏移量，起始地址加上偏移量就算出函数的真实地址。 +具体实现方式是：[Nougat_dlfunctions](https://github.com/avs333/Nougat_dlfunctions)。不过，这种方法偶尔会不太靠谱，要么是起始地址计算错误，要么是偏移量计算不准确。 + +这里，通过修改入口函数的LR寄存器的值，欺骗系统这是从系统库里发起调用的，从而实现绕过调用的限制。 + +### 支持版本 + +Android 4,5,6,7,8,9,10,11 + +### 使用 +在cmake文件中引入： +``` +set(bypass_dlfcn_root_dir ${CMAKE_CURRENT_SOURCE_DIR}/../../../../lib) +add_subdirectory(${bypass_dlfcn_root_dir} bypasss_dlfcn) +include_directories(${bypass_dlfcn_root_dir}/include/) +target_link_libraries( + your_lib + bypass_dlfcn) +``` +在代码中导入头文件: +``` +#include "bypass_dlfcn.h" +``` +使用头文件中的接口代替dlfcn.h中的接口: +``` +void *bp_dlopen(const char *filename, int flag); +int bp_dlclose(void *handle); +const char *bp_dlerror(void); +void *bp_dlsym(void *handle, const char *symbol); +int bp_dladdr(const void *ddr, Dl_info *info); +``` + +### 致谢 + +1. [Nougat_dlfunctions](https://github.com/avs333/Nougat_dlfunctions) \ No newline at end of file diff --git a/app/.gitignore b/app/.gitignore new file mode 100644 index 0000000..42afabf --- /dev/null +++ b/app/.gitignore @@ -0,0 +1 @@ +/build \ No newline at end of file diff --git a/app/build.gradle b/app/build.gradle new file mode 100644 index 0000000..3b3ce8b --- /dev/null +++ b/app/build.gradle @@ -0,0 +1,59 @@ +plugins { + id 'com.android.application' + id 'kotlin-android' +} + +android { + compileSdk 30 + buildToolsVersion "30.0.3" + + defaultConfig { + applicationId "com.example.bypass.dlfunctions" + minSdk 21 + targetSdk 30 + versionCode 1 + versionName "1.0" + + externalNativeBuild { + cmake { + cppFlags '' + } + } + + ndk { + abiFilter("armeabi-v7a") +// abiFilter("arm64-v8a") + } + } + + buildTypes { + release { + minifyEnabled false + proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro' + } + } + compileOptions { + sourceCompatibility JavaVersion.VERSION_1_8 + targetCompatibility JavaVersion.VERSION_1_8 + } + kotlinOptions { + jvmTarget = '1.8' + } + externalNativeBuild { + cmake { + path file('src/main/cpp/CMakeLists.txt') + version '3.10.2' + } + } + buildFeatures { + viewBinding true + } +} + +dependencies { + + implementation 'androidx.core:core-ktx:1.3.2' + implementation 'androidx.appcompat:appcompat:1.2.0' + implementation 'com.google.android.material:material:1.2.1' + implementation 'androidx.constraintlayout:constraintlayout:2.0.4' +} \ No newline at end of file diff --git a/app/proguard-rules.pro b/app/proguard-rules.pro new file mode 100644 index 0000000..481bb43 --- /dev/null +++ b/app/proguard-rules.pro @@ -0,0 +1,21 @@ +# Add project specific ProGuard rules here. +# You can control the set of applied configuration files using the +# proguardFiles setting in build.gradle. +# +# For more details, see +# http://developer.android.com/guide/developing/tools/proguard.html + +# If your project uses WebView with JS, uncomment the following +# and specify the fully qualified class name to the JavaScript interface +# class: +#-keepclassmembers class fqcn.of.javascript.interface.for.webview { +# public *; +#} + +# Uncomment this to preserve the line number information for +# debugging stack traces. +#-keepattributes SourceFile,LineNumberTable + +# If you keep the line number information, uncomment this to +# hide the original source file name. +#-renamesourcefileattribute SourceFile \ No newline at end of file diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml new file mode 100644 index 0000000..98b22e6 --- /dev/null +++ b/app/src/main/AndroidManifest.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/app/src/main/cpp/CMakeLists.txt b/app/src/main/cpp/CMakeLists.txt new file mode 100644 index 0000000..344ebfe --- /dev/null +++ b/app/src/main/cpp/CMakeLists.txt @@ -0,0 +1,26 @@ +cmake_minimum_required(VERSION 3.10.2) + +project("bypass_dlfunctions_sample") + +set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fno-stack-protector") + +set(bypass_dlfcn_root_dir ${CMAKE_CURRENT_SOURCE_DIR}/../../../../lib) +add_subdirectory(${bypass_dlfcn_root_dir} bypasss_dlfcn) + +include_directories( + ${bypass_dlfcn_root_dir}/include/ +) + +add_library( + bypass_dlfunctions_sample + SHARED + sample.cpp) + +find_library( + log-lib + log) + +target_link_libraries( + bypass_dlfunctions_sample + bypass_dlfcn + ${log-lib}) \ No newline at end of file diff --git a/app/src/main/cpp/sample.cpp b/app/src/main/cpp/sample.cpp new file mode 100644 index 0000000..d000392 --- /dev/null +++ b/app/src/main/cpp/sample.cpp @@ -0,0 +1,51 @@ +#include +#include +#include +#include +#include "bypass_dlfcn.h" + +#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG, "Test_DlFunctions", __VA_ARGS__) + +template +inline std::string format_string(const char *format, Args... args) { + constexpr size_t oldlen = BUFSIZ; + char buffer[oldlen]; + size_t newlen = snprintf(&buffer[0], oldlen, format, args...); + newlen++; + if (newlen > oldlen) { + std::vector newbuffer(newlen); + snprintf(newbuffer.data(), newlen, format, args...); + return std::string(newbuffer.data()); + } + return buffer; +} + +extern "C" JNIEXPORT jstring JNICALL +Java_com_example_bypass_dlfunctions_MainActivity_test_1bypass_1dlfcn( + JNIEnv *env, jclass clazz) { + + std::string so_file_name = "libart.so"; + std::string target_function_name = "_ZN3art10ObjectLockINS_6mirror6ObjectEED2Ev"; + + void *handle = bp_dlopen(so_file_name.c_str(), RTLD_NOW); + + void *func_address = bp_dlsym(handle, target_function_name.c_str()); + + LOGD(" bypass dlopen, dlopen result: %p, dlsym result: %p", handle, func_address); + + Dl_info info; + bp_dladdr(func_address, &info); + + std::string result; + result += info.dli_fname; + result += format_string(" dlopen result: %p", handle); + result += "\n"; + result += "function name: "; + result += info.dli_sname; + result += "\n"; + result += format_string(" dlsym result: %p", func_address); + + LOGD(" result: \n %s", result.c_str()); + + return env->NewStringUTF(result.c_str()); +} \ No newline at end of file diff --git a/app/src/main/java/com/example/bypass/dlfunctions/MainActivity.kt b/app/src/main/java/com/example/bypass/dlfunctions/MainActivity.kt new file mode 100644 index 0000000..9aab9ad --- /dev/null +++ b/app/src/main/java/com/example/bypass/dlfunctions/MainActivity.kt @@ -0,0 +1,36 @@ +package com.example.bypass.dlfunctions + +import androidx.appcompat.app.AppCompatActivity +import android.os.Bundle +import android.view.View +import android.widget.Toast +import androidx.annotation.Keep +import com.example.bypass.dlfunctions.databinding.ActivityMainBinding + +@Keep +class MainActivity : AppCompatActivity() { + + private lateinit var binding: ActivityMainBinding + + override fun onCreate(savedInstanceState: Bundle?) { + super.onCreate(savedInstanceState) + binding = ActivityMainBinding.inflate(layoutInflater) + setContentView(binding.root) + } + + + fun clickedBtn(view: View) { + val result = test_bypass_dlfcn() + Toast.makeText(this, result, Toast.LENGTH_LONG).show() + } + + companion object { + init { + System.loadLibrary("bypass_dlfunctions_sample") + } + + @JvmStatic + @Keep + external fun test_bypass_dlfcn(): String + } +} \ No newline at end of file diff --git a/app/src/main/res/drawable-v24/ic_launcher_foreground.xml b/app/src/main/res/drawable-v24/ic_launcher_foreground.xml new file mode 100644 index 0000000..2b068d1 --- /dev/null +++ b/app/src/main/res/drawable-v24/ic_launcher_foreground.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + \ No newline at end of file diff --git a/app/src/main/res/drawable/ic_launcher_background.xml b/app/src/main/res/drawable/ic_launcher_background.xml new file mode 100644 index 0000000..07d5da9 --- /dev/null +++ b/app/src/main/res/drawable/ic_launcher_background.xml @@ -0,0 +1,170 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/app/src/main/res/layout/activity_main.xml b/app/src/main/res/layout/activity_main.xml new file mode 100644 index 0000000..3e8fd97 --- /dev/null +++ b/app/src/main/res/layout/activity_main.xml @@ -0,0 +1,21 @@ + + + +