├── .vscode └── settings.json ├── README.md ├── STACK1.pdf ├── STACK1.png ├── STACK2.pdf ├── STACK2.png ├── arm64hook.pdf ├── arm64hook.png ├── arm64hook.vsdx ├── arm64hook4.png ├── jni ├── .DS_Store ├── Android.mk ├── Application.mk ├── InlineHook │ ├── .DS_Store │ ├── Android.mk │ ├── Ihook.c │ ├── Ihook.h │ ├── fixPCOpcode.c │ ├── fixPCOpcode.h │ └── ihookstub.s └── Interface │ ├── .DS_Store │ ├── Android.mk │ └── InlineHook.cpp ├── libs └── arm64-v8a │ └── libInlineHook.so ├── obj └── local │ ├── arm64-v8a │ ├── libIHook.a │ ├── libInlineHook.so │ └── objs │ │ ├── IHook │ │ ├── IHook.o │ │ ├── IHook.o.d │ │ ├── fixPCOpcode.o │ │ ├── fixPCOpcode.o.d │ │ └── ihookstub.o │ │ └── InlineHook │ │ ├── InlineHook.o │ │ └── InlineHook.o.d │ └── armeabi-v7a │ ├── libIHook.a │ ├── libInlineArmHook.so │ ├── libInlineHook.so │ └── objs │ ├── IHook │ ├── IHook.o │ ├── IHook.o.d │ ├── fixPCOpcode.o │ ├── fixPCOpcode.o.d │ ├── ihookstub.o │ └── ihookstubthumb.o │ ├── InlineArmHook │ ├── InlineHook.o │ └── InlineHook.o.d │ └── InlineHook │ ├── InlineHook.o │ └── InlineHook.o.d ├── stack.pdf ├── stack.vsdx └── stack.xlsx /.vscode/settings.json: -------------------------------------------------------------------------------- 1 | { 2 | "files.associations": { 3 | "xtr1common": "c", 4 | "type_traits": "c", 5 | "utility": "c", 6 | "xmemory0": "c", 7 | "xutility": "c" 8 | } 9 | } -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Android Inline Hook ARM64 2 | 3 | This is the ARM64 version of [Android Inline Hook](https://github.com/GToad/Android_Inline_Hook.git). I highly recommend you to view [Android Inline Hook](https://github.com/GToad/Android_Inline_Hook.git) first. 4 | 5 | `This arm64-version is almost finished. But I still need some time on the docs and code-fix work. Thank you for your patience!` 6 | 7 | # Android Inline Hook 8 | 9 | This project make an Android .so file that can automatically do some native hook works. 10 | 11 | It mainly use Android Inline Hook, not PLT Hook. 12 | 13 | If you can read Chinese or wanna see more picture, I've wrote some articles about this repo and the first one is the main article. `I highly recommend you to read the articles before reading the code.` These article will save you a lot of time, I promise. 14 | 15 | 1. [Android Inline Hook Practice](https://gtoad.github.io/2018/07/06/Android-Native-Hook-Practice/) 16 | 2. [Opcode Fix In Android Inline Hook](https://gtoad.github.io/2018/07/13/Android-Inline-Hook-Fix/) 17 | 3. [An Introduction to Android Native Hook](https://gtoad.github.io/2018/07/05/Android-Native-Hook/) 18 | 4. [Android Inline Hook ARM64 Practice](https://gtoad.github.io/2018/09/20/Android-Native-Hook-Practice-Arm64/) 19 | 20 | # Articles in English 21 | 22 | I've received several e-mails and all the questions in them have been written in the Chinese articles. So i think it's necessary translate some part of the articles in English. I will try my best to tanslate more part and the parts metioned by the questions in issue will have high priority. 23 | 24 | 1. [Android Inline Hook Practice EN](https://gtoad.github.io/2018/08/03/Android-Native-Hook-Practice-EN/) 25 | 26 | # Features 27 | 28 | 1. No ptrace -- So the anti-debug tech won't affect on this tool. 29 | 2. Auto run -- Just use Xposed or other tools to load it into the memory and it will do the native hook work. 30 | 3. Pure inline hook -- No other imprint left so it's hard to anti. 31 | 4. Flexible -- Fine docs for users to understand the code and change it on your own perpose. 32 | 5. Active support -- Brand new so I'm still keen on fix the bugs and arm32/thumb-2/arm64 has been finished one by one. 33 | 34 | # How To Use 35 | 36 | The only thing you have to change is the code in `InlineHook.cpp`. 37 | 38 | You can name the `__attribute__((constructor)) ModifyIBored()` function at your will and change the follow arg in it: 39 | 40 | 1. `pModuleBaseAddr` is the address of your target so. 41 | 2. `target_offset` is the offset of your hook point in the target so. 42 | 43 | `EvilHookStubFunctionForIBored` function is the thing you really wanna do when the hook works. You can name at your will, but keep the arg `(pt_regs *regs)`. It brings you the power to control the registers, like set r0 to 0x333 : `regs->uregs[0]=0x333;`. 44 | 45 | After you finish the args above, just `ndk-build` and you will get your .so file. 46 | 47 | # ARM64 Design 48 | 49 | ![](https://gtoad.github.io/img/in-post/post-android-native-hook-practice-ARM64/arm64hook.png) 50 | 51 | # Example 52 | 53 | I've make some examples in other repo, it includes code and the target APK file. 54 | 55 | 1. [thumb-2 example](https://github.com/GToad/Android_Inline_Hook_Thumb_Example.git) 56 | 2. [arm32 example](https://github.com/GToad/Android_Inline_Hook_Arm_Example.git) 57 | 58 | # Contact 59 | 60 | I believe that this project still has some problems. If you find some bugs or have some problems, you can send e-mail to `gtoad1994@aliyun.com`. I wish we can fix it together! 61 | 62 | # Reference 63 | 64 | [Game Security Lab of Tencent](http://gslab.qq.com/portal.php?mod=view&aid=168) 65 | 66 | [Ele7enxxh's Blog](http://ele7enxxh.com/Android-Arm-Inline-Hook.html) 67 | 68 | 69 | 70 | 71 | -------------------------------------------------------------------------------- /STACK1.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/STACK1.pdf -------------------------------------------------------------------------------- /STACK1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/STACK1.png -------------------------------------------------------------------------------- /STACK2.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/STACK2.pdf -------------------------------------------------------------------------------- /STACK2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/STACK2.png -------------------------------------------------------------------------------- /arm64hook.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/arm64hook.pdf -------------------------------------------------------------------------------- /arm64hook.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/arm64hook.png -------------------------------------------------------------------------------- /arm64hook.vsdx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/arm64hook.vsdx -------------------------------------------------------------------------------- /arm64hook4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/arm64hook4.png -------------------------------------------------------------------------------- /jni/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/jni/.DS_Store -------------------------------------------------------------------------------- /jni/Android.mk: -------------------------------------------------------------------------------- 1 | include $(call all-subdir-makefiles) -------------------------------------------------------------------------------- /jni/Application.mk: -------------------------------------------------------------------------------- 1 | APP_ABI := arm64-v8a 2 | APP_STL := gnustl_static 3 | APP_CPPFLAGS += -fexceptions -------------------------------------------------------------------------------- /jni/InlineHook/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/jni/InlineHook/.DS_Store -------------------------------------------------------------------------------- /jni/InlineHook/Android.mk: -------------------------------------------------------------------------------- 1 | LOCAL_PATH := $(call my-dir) 2 | 3 | 4 | include $(CLEAR_VARS) 5 | 6 | LOCAL_CXXFLAGS += -g -O0 7 | LOCAL_ARM_MODE := arm 8 | LOCAL_MODULE := IHook 9 | LOCAL_SRC_FILES := IHook.c ihookstub.s fixPCOpcode.c 10 | LOCAL_LDLIBS += -L$(SYSROOT)/usr/lib -llog 11 | 12 | include $(BUILD_STATIC_LIBRARY) 13 | -------------------------------------------------------------------------------- /jni/InlineHook/Ihook.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/jni/InlineHook/Ihook.c -------------------------------------------------------------------------------- /jni/InlineHook/Ihook.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_ARM64/8d0d661d3d7f1718c2ed089c52930bcdba982159/jni/InlineHook/Ihook.h -------------------------------------------------------------------------------- /jni/InlineHook/fixPCOpcode.c: -------------------------------------------------------------------------------- 1 | #include "fixPCOpcode.h" 2 | 3 | //这里的代码建议看文章：《Android Inline Hook中的指令修复详解》（https://gtoad.github.io/2018/07/13/Android-Inline-Hook-Fix/） 4 | 5 | enum INSTRUCTION_TYPE { 6 | 7 | 8 | // BLX