Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Overriding got table #10

Closed
nitanmarcel opened this issue Apr 23, 2023 · 3 comments
Closed

Overriding got table #10

nitanmarcel opened this issue Apr 23, 2023 · 3 comments
Labels
documentation Improvements or additions to documentation

Comments

@nitanmarcel
Copy link
Contributor

Could the app also be edited to override GOT tables so we can intercept function calls? Obviously speaking about the ptrace injection , since LD_PRELOAD automatically do that .

I've tried doing myself but all of this overcomes me so I gave up after a few attempts.

@reveny
Copy link
Owner

reveny commented Apr 26, 2023

Well if you are talking about patching memory such as overwriting a function with a nop instruction to make it not execute then yes, you can use ptrace_write for that. I don't recommend doing it with ptrace though. There is a system call called process_vm_writev you should look into that for what you want to do.

@nitanmarcel
Copy link
Contributor Author

nitanmarcel commented Apr 26, 2023

Well if you are talking about patching memory such as overwriting a function with a nop instruction to make it not execute then yes, you can use ptrace_write for that. I don't recommend doing it with ptrace though. There is a system call called process_vm_writev you should look into that for what you want to do.

Found a way of doing what I need with funchook, so I can intercepting function calls and editing their value which works perfectly fine. Thanks for suggestion anyway :)

Only issue I have is that I need to manually open the so file and dlsym to load it into the program but that works fine.

Leaving here the code for this if anyone is interested

#include <dlfcn.h>

typedef void* funchook_t;
typedef int (*funchook_prepare_t)(funchook_t*, void**, void*);
typedef int (*funchook_install_t)(funchook_t, int);

void* (*funchook_create)();
funchook_prepare_t funchook_prepare;
funchook_install_t funchook_install;

int load_funchook() {
    void* handle = dlopen("/data/local/tmp/libfunchook.so", RTLD_LAZY);

    if (!handle) {
        // handle error
        return -1;
    }

    funchook_create = (void* (*)()) dlsym(handle, "funchook_create");
    funchook_prepare = (funchook_prepare_t) dlsym(handle, "funchook_prepare");
    funchook_install = (funchook_install_t) dlsym(handle, "funchook_install");

    if (!funchook_create || !funchook_prepare || !funchook_install) {
        dlclose(handle);
        return -1;
    }
    return 0;
}

void __attribute__((constructor)) init()
{
	int fh = load_funchook();
    if (fh == -1)
		LOGE("Failed to load funchook");
    else
		LOGI("Loaded funchook");
}

@nitanmarcel
Copy link
Contributor Author

nitanmarcel commented Apr 30, 2023

Another solution that I've found very useful, and which will support all the arches supported by this is bytehook . Only issue is that not being inline, it can only inject only at the start of a function. Another library (this one supports inline hooks) is ShadowHook but only supports armeabi-v7a and arm64-v8a. But they both can now be used starting with the last commits since the hooks need to be done after the library has been constructed (in a separate function for example)

@reveny reveny added the documentation Improvements or additions to documentation label May 22, 2024
@reveny reveny closed this as completed Jun 5, 2024
@reveny reveny pinned this issue Jun 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to documentation
Projects
None yet
Development

No branches or pull requests

2 participants