Skip to content

Commit

Permalink
Abandon PLT hook for LSPlant
Browse files Browse the repository at this point in the history
See the previous commit for reasons.
  • Loading branch information
JingMatrix committed Dec 4, 2024
1 parent cc26efe commit c5ff4c0
Show file tree
Hide file tree
Showing 4 changed files with 21 additions and 86 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,8 @@ You can contribute translation [here](https://crowdin.com/project/lsposed_jingma

- [Magisk](https://github.com/topjohnwu/Magisk/): makes all these possible
- [XposedBridge](https://github.com/rovo89/XposedBridge): the OG Xposed framework APIs
- [Dobby](https://github.com/JingMatrix/Dobby): fallback of PLT hook and inline hooker for `native_api` implement
- [LSPlant](https://github.com/JingMatrix/LSPlant): the core ART hooking framework
- [Dobby](https://github.com/JingMatrix/Dobby): inline hooker for `LSPlant` and `native_api` implement
- [EdXposed](https://github.com/ElderDrivers/EdXposed): fork source
- [xz-embedded](https://github.com/tukaani-project/xz-embedded): decompress `.gnu_debugdata` header section of stripped `libart.so`
- ~~[Riru](https://github.com/RikkaApps/Riru): provides a way to inject code into zygote process~~
Expand Down
7 changes: 2 additions & 5 deletions magisk-loader/src/main/jni/api/zygisk_main.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,7 @@
#include <sys/socket.h>

#include "config_impl.h"
#include "loader.h"
#include "logging.h"
#include "magisk_loader.h"
#include "symbol_cache.h"
#include "zygisk.hpp"

namespace lspd {
Expand All @@ -51,7 +48,7 @@ class ZygiskModule : public zygisk::ModuleBase {
}

void postAppSpecialize(const zygisk::AppSpecializeArgs *args) override {
MagiskLoader::GetInstance()->OnNativeForkAndSpecializePost(env_, api_, args->nice_name,
MagiskLoader::GetInstance()->OnNativeForkAndSpecializePost(env_, args->nice_name,
args->app_data_dir);
if (*allowUnload) api_->setOption(zygisk::DLCLOSE_MODULE_LIBRARY);
}
Expand All @@ -69,7 +66,7 @@ class ZygiskModule : public zygisk::ModuleBase {
env_->DeleteLocalRef(name);
env_->DeleteLocalRef(process);
}
MagiskLoader::GetInstance()->OnNativeForkSystemServerPost(env_, api_);
MagiskLoader::GetInstance()->OnNativeForkSystemServerPost(env_);
if (*allowUnload) api_->setOption(zygisk::DLCLOSE_MODULE_LIBRARY);
}
};
Expand Down
75 changes: 2 additions & 73 deletions magisk-loader/src/main/jni/src/magisk_loader.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,9 @@
#include <sys/mman.h>
#include <sys/sysmacros.h>

#include <algorithm>
#include <cinttypes>

#include "../src/native_api.h"
#include "config_impl.h"
#include "elf_util.h"
#include "loader.h"
#include "service.h"
#include "symbol_cache.h"
#include "utils/jni_helper.hpp"
Expand Down Expand Up @@ -93,70 +89,6 @@ std::vector<MapInfo> MapInfo::Scan(std::string_view pid) {
return info;
}

void MagiskLoader::InitializeLSPlant(zygisk::Api *api) {
if (lsplant_initilized) return;
std::vector<std::pair<const char *, void **>> plt_hook_saved = {};

const std::string libArtPath = GetArt()->name();
const auto maps = MapInfo::Scan();
const auto libArtMap = std::find_if(maps.begin(), maps.end(),
[libArtPath](auto it) { return it.path == libArtPath; });
const dev_t dev = libArtMap->dev;
const ino_t inode = libArtMap->inode;

auto HookPLT = [dev, inode, &plt_hook_saved, api](void *art_symbol, void *callback,
void **backup, bool save = true) {
auto symbol = reinterpret_cast<const char *>(art_symbol);

if (GetArt()->isStripped()) {
api->pltHookRegister(dev, inode, symbol, callback, backup);
if (api->pltHookCommit() && *backup != nullptr) {
if (save) plt_hook_saved.emplace_back(symbol, backup);
LOGD("pltHook of {} finished", symbol);
return 0;
}
}

if (auto addr = GetArt()->getSymbAddress(symbol); addr) {
HookInline(addr, callback, backup);
} else if (*backup == nullptr && isDebug) {
LOGW("Failed to {} Art symbol {}", save ? "hook" : "unhook", symbol);
}
return (int)(*backup == nullptr);
};

auto UnhookPLT = [HookPLT, &plt_hook_saved](void *original) {
if (!GetArt()->isStripped()) return UnhookInline(original);

auto symbol = reinterpret_cast<const char *>(original);
auto hook_iter =
std::find_if(plt_hook_saved.begin(), plt_hook_saved.end(),
[symbol](auto record) { return strcmp(record.first, symbol) == 0; });
void *stub = nullptr;
if (hook_iter != plt_hook_saved.end() &&
HookPLT(original, *(hook_iter->second), &stub, false)) {
plt_hook_saved.erase(hook_iter);
return 0;
} else {
return UnhookInline(original);
}
return 1;
};

initInfo = lsplant::InitInfo{
.inline_hooker =
[HookPLT](auto t, auto r) {
void *bk = nullptr;
return HookPLT(t, r, &bk) == 0 ? bk : nullptr;
},
.inline_unhooker = [UnhookPLT](auto t) { return UnhookPLT(t) == 0; },
.art_symbol_resolver = [](auto symbol) { return GetArt()->getSymbAddress(symbol); },
.art_symbol_prefix_resolver =
[](auto symbol) { return GetArt()->getSymbPrefixFirstAddress(symbol); },
.is_plt_hook = true};
lsplant_initilized = true;
}

void MagiskLoader::LoadDex(JNIEnv *env, PreloadedDex &&dex) {
auto classloader = JNI_FindClass(env, "java/lang/ClassLoader");
auto getsyscl_mid = JNI_GetStaticMethodID(env, classloader, "getSystemClassLoader",
Expand Down Expand Up @@ -199,7 +131,7 @@ void MagiskLoader::OnNativeForkSystemServerPre(JNIEnv *env) {
setAllowUnload(skip_);
}

void MagiskLoader::OnNativeForkSystemServerPost(JNIEnv *env, zygisk::Api *api) {
void MagiskLoader::OnNativeForkSystemServerPost(JNIEnv *env) {
if (!skip_) {
auto *instance = Service::instance();
auto system_server_binder = instance->RequestSystemServerBinder(env);
Expand All @@ -222,7 +154,6 @@ void MagiskLoader::OnNativeForkSystemServerPost(JNIEnv *env, zygisk::Api *api) {
instance->HookBridge(*this, env);

// always inject into system server
InitializeLSPlant(api);
InitArtHooker(env, initInfo);
InitHooks(env);
SetupEntryClass(env);
Expand Down Expand Up @@ -277,8 +208,7 @@ void MagiskLoader::OnNativeForkAndSpecializePre(JNIEnv *env, jint uid, jintArray
setAllowUnload(skip_);
}

void MagiskLoader::OnNativeForkAndSpecializePost(JNIEnv *env, zygisk::Api *api, jstring nice_name,
jstring app_dir) {
void MagiskLoader::OnNativeForkAndSpecializePost(JNIEnv *env, jstring nice_name, jstring app_dir) {
const JUTFString process_name(env, nice_name);
auto *instance = Service::instance();
if (is_parasitic_manager) nice_name = JNI_NewStringUTF(env, "org.lsposed.manager").release();
Expand All @@ -290,7 +220,6 @@ void MagiskLoader::OnNativeForkAndSpecializePost(JNIEnv *env, zygisk::Api *api,
ConfigBridge::GetInstance()->obfuscation_map(std::move(obfs_map));
LoadDex(env, PreloadedDex(dex_fd, size));
close(dex_fd);
InitializeLSPlant(api);
InitArtHooker(env, initInfo);
InitHooks(env);
SetupEntryClass(env);
Expand Down
23 changes: 16 additions & 7 deletions magisk-loader/src/main/jni/src/magisk_loader.h
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,10 @@

#pragma once

#include "../api/zygisk.hpp"
#include "../src/native_api.h"
#include "context.h"
#include "elf_util.h"
#include "symbol_cache.h"

namespace lspd {
class MagiskLoader : public Context {
Expand All @@ -38,12 +40,11 @@ class MagiskLoader : public Context {
void OnNativeForkAndSpecializePre(JNIEnv *env, jint uid, jintArray &gids, jstring &nice_name,
jboolean is_child_zygote, jstring app_data_dir);

void OnNativeForkAndSpecializePost(JNIEnv *env, zygisk::Api *api, jstring nice_name,
jstring app_dir);
void OnNativeForkAndSpecializePost(JNIEnv *env, jstring nice_name, jstring app_dir);

void OnNativeForkSystemServerPre(JNIEnv *env);

void OnNativeForkSystemServerPost(JNIEnv *env, zygisk::Api *api);
void OnNativeForkSystemServerPost(JNIEnv *env);

protected:
void LoadDex(JNIEnv *env, PreloadedDex &&dex) override;
Expand All @@ -52,10 +53,18 @@ class MagiskLoader : public Context {

private:
bool skip_ = false;
bool lsplant_initilized = false;
lsplant::InitInfo initInfo;
const lsplant::InitInfo initInfo = lsplant::InitInfo{
.inline_hooker =
[](auto t, auto r) {
void *bk = nullptr;
return HookInline(t, r, &bk) == 0 ? bk : nullptr;
},
.inline_unhooker = [](auto t) { return UnhookInline(t) == 0; },
.art_symbol_resolver = [](auto symbol) { return GetArt()->getSymbAddress(symbol); },
.art_symbol_prefix_resolver =
[](auto symbol) { return GetArt()->getSymbPrefixFirstAddress(symbol); },
.is_plt_hook = true};

void InitializeLSPlant(zygisk::Api *api);
static void setAllowUnload(bool unload);
};

Expand Down

0 comments on commit c5ff4c0

Please sign in to comment.