-
Notifications
You must be signed in to change notification settings - Fork 82
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Overriding got table #10
Comments
Well if you are talking about patching memory such as overwriting a function with a nop instruction to make it not execute then yes, you can use ptrace_write for that. I don't recommend doing it with ptrace though. There is a system call called process_vm_writev you should look into that for what you want to do. |
Found a way of doing what I need with funchook, so I can intercepting function calls and editing their value which works perfectly fine. Thanks for suggestion anyway :) Only issue I have is that I need to manually open the so file and dlsym to load it into the program but that works fine. Leaving here the code for this if anyone is interested #include <dlfcn.h>
typedef void* funchook_t;
typedef int (*funchook_prepare_t)(funchook_t*, void**, void*);
typedef int (*funchook_install_t)(funchook_t, int);
void* (*funchook_create)();
funchook_prepare_t funchook_prepare;
funchook_install_t funchook_install;
int load_funchook() {
void* handle = dlopen("/data/local/tmp/libfunchook.so", RTLD_LAZY);
if (!handle) {
// handle error
return -1;
}
funchook_create = (void* (*)()) dlsym(handle, "funchook_create");
funchook_prepare = (funchook_prepare_t) dlsym(handle, "funchook_prepare");
funchook_install = (funchook_install_t) dlsym(handle, "funchook_install");
if (!funchook_create || !funchook_prepare || !funchook_install) {
dlclose(handle);
return -1;
}
return 0;
}
void __attribute__((constructor)) init()
{
int fh = load_funchook();
if (fh == -1)
LOGE("Failed to load funchook");
else
LOGI("Loaded funchook");
} |
Another solution that I've found very useful, and which will support all the arches supported by this is bytehook . Only issue is that not being inline, it can only inject only at the start of a function. Another library (this one supports inline hooks) is ShadowHook but only supports armeabi-v7a and arm64-v8a. But they both can now be used starting with the last commits since the hooks need to be done after the library has been constructed (in a separate function for example) |
Could the app also be edited to override GOT tables so we can intercept function calls? Obviously speaking about the ptrace injection , since LD_PRELOAD automatically do that .
I've tried doing myself but all of this overcomes me so I gave up after a few attempts.
The text was updated successfully, but these errors were encountered: