├── jni ├── Android.mk ├── .DS_Store ├── Application.mk ├── InlineHook │ ├── Ihook.c │ ├── Ihook.h │ ├── .DS_Store │ ├── Android.mk │ ├── ihookstub.s │ ├── fixPCOpcode.h │ ├── ihookstubthumb.s │ └── fixPCOpcode.c └── Interface │ ├── .DS_Store │ ├── InlineHook.cpp │ └── Android.mk ├── .DS_Store ├── todo.txt ├── armhook.pdf ├── ArmHooked.mp4 ├── arm32-example.apk ├── arm32-example.zip ├── notArmHooked.mp4 ├── obj └── local │ └── armeabi-v7a │ ├── libIHook.a │ ├── libInlineHook.so │ ├── objs │ ├── IHook │ │ ├── IHook.o │ │ ├── ihookstub.o │ │ ├── fixPCOpcode.o │ │ ├── ihookstubthumb.o │ │ ├── IHook.o.d │ │ └── fixPCOpcode.o.d │ ├── InlineHook │ │ ├── InlineHook.o │ │ └── InlineHook.o.d │ └── InlineArmHook │ │ ├── InlineHook.o │ │ └── InlineHook.o.d │ └── libInlineArmHook.so ├── libs └── armeabi-v7a │ └── libInlineArmHook.so ├── arm32-example └── armeabi-v7a │ ├── libhellojni.so │ └── libhellojni.idb └── README.md /jni/Android.mk: -------------------------------------------------------------------------------- 1 | include $(call all-subdir-makefiles) -------------------------------------------------------------------------------- /.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/.DS_Store -------------------------------------------------------------------------------- /todo.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/todo.txt -------------------------------------------------------------------------------- /armhook.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/armhook.pdf -------------------------------------------------------------------------------- /ArmHooked.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/ArmHooked.mp4 -------------------------------------------------------------------------------- /jni/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/jni/.DS_Store -------------------------------------------------------------------------------- /jni/Application.mk: -------------------------------------------------------------------------------- 1 | APP_ABI := armeabi-v7a 2 | APP_STL := gnustl_static 3 | APP_CPPFLAGS += -fexceptions -------------------------------------------------------------------------------- /arm32-example.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/arm32-example.apk -------------------------------------------------------------------------------- /arm32-example.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/arm32-example.zip -------------------------------------------------------------------------------- /notArmHooked.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/notArmHooked.mp4 -------------------------------------------------------------------------------- /jni/InlineHook/Ihook.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/jni/InlineHook/Ihook.c -------------------------------------------------------------------------------- /jni/InlineHook/Ihook.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/jni/InlineHook/Ihook.h -------------------------------------------------------------------------------- /jni/InlineHook/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/jni/InlineHook/.DS_Store -------------------------------------------------------------------------------- /jni/Interface/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/jni/Interface/.DS_Store -------------------------------------------------------------------------------- /jni/Interface/InlineHook.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/jni/Interface/InlineHook.cpp -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/libIHook.a: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/obj/local/armeabi-v7a/libIHook.a -------------------------------------------------------------------------------- /libs/armeabi-v7a/libInlineArmHook.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/libs/armeabi-v7a/libInlineArmHook.so -------------------------------------------------------------------------------- /arm32-example/armeabi-v7a/libhellojni.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/arm32-example/armeabi-v7a/libhellojni.so -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/libInlineHook.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/obj/local/armeabi-v7a/libInlineHook.so -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/IHook/IHook.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/obj/local/armeabi-v7a/objs/IHook/IHook.o -------------------------------------------------------------------------------- /arm32-example/armeabi-v7a/libhellojni.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/arm32-example/armeabi-v7a/libhellojni.idb -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/libInlineArmHook.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/obj/local/armeabi-v7a/libInlineArmHook.so -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/IHook/ihookstub.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/obj/local/armeabi-v7a/objs/IHook/ihookstub.o -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/IHook/fixPCOpcode.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/obj/local/armeabi-v7a/objs/IHook/fixPCOpcode.o -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/IHook/ihookstubthumb.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/obj/local/armeabi-v7a/objs/IHook/ihookstubthumb.o -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/InlineHook/InlineHook.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/obj/local/armeabi-v7a/objs/InlineHook/InlineHook.o -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/InlineArmHook/InlineHook.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/GToad/Android_Inline_Hook_Arm_Example/HEAD/obj/local/armeabi-v7a/objs/InlineArmHook/InlineHook.o -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/IHook/IHook.o.d: -------------------------------------------------------------------------------- 1 | ./obj/local/armeabi-v7a/objs/IHook/IHook.o: jni/InlineHook/IHook.c \ 2 | jni/InlineHook/Ihook.h jni/InlineHook/fixPCOpcode.h 3 | 4 | jni/InlineHook/Ihook.h: 5 | 6 | jni/InlineHook/fixPCOpcode.h: 7 | -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/IHook/fixPCOpcode.o.d: -------------------------------------------------------------------------------- 1 | ./obj/local/armeabi-v7a/objs/IHook/fixPCOpcode.o: \ 2 | jni/InlineHook/fixPCOpcode.c jni/InlineHook/fixPCOpcode.h \ 3 | jni/InlineHook/Ihook.h 4 | 5 | jni/InlineHook/fixPCOpcode.h: 6 | 7 | jni/InlineHook/Ihook.h: 8 | -------------------------------------------------------------------------------- /jni/InlineHook/Android.mk: -------------------------------------------------------------------------------- 1 | LOCAL_PATH := $(call my-dir) 2 | 3 | 4 | include $(CLEAR_VARS) 5 | 6 | LOCAL_CXXFLAGS += -g -O0 7 | LOCAL_ARM_MODE := arm 8 | LOCAL_MODULE := IHook 9 | LOCAL_SRC_FILES := IHook.c ihookstub.s ihookstubthumb.s fixPCOpcode.c 10 | LOCAL_LDLIBS += -L$(SYSROOT)/usr/lib -llog 11 | 12 | include $(BUILD_STATIC_LIBRARY) 13 | -------------------------------------------------------------------------------- /jni/Interface/Android.mk: -------------------------------------------------------------------------------- 1 | LOCAL_PATH := $(call my-dir) 2 | 3 | 4 | include $(CLEAR_VARS) 5 | 6 | LOCAL_CXXFLAGS += -g -O0 7 | LOCAL_ARM_MODE := arm 8 | LOCAL_MODULE := InlineArmHook 9 | LOCAL_STATIC_LIBRARIES:= IHook 10 | LOCAL_C_INCLUDES := $(LOCAL_PATH)/../InlineHook 11 | LOCAL_SRC_FILES := InlineHook.cpp 12 | LOCAL_LDLIBS += -L$(SYSROOT)/usr/lib -llog 13 | 14 | include $(BUILD_SHARED_LIBRARY) -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/InlineHook/InlineHook.o.d: -------------------------------------------------------------------------------- 1 | ./obj/local/armeabi-v7a/objs/InlineHook/InlineHook.o: \ 2 | jni/Interface/InlineHook.cpp \ 3 | C:/Users/GToad/AppData/Local/Android/Sdk/ndk-bundle/build//../sources/cxx-stl/gnu-libstdc++/4.9/include\vector \ 4 | jni/Interface/../InlineHook\Ihook.h 5 | 6 | C:/Users/GToad/AppData/Local/Android/Sdk/ndk-bundle/build//../sources/cxx-stl/gnu-libstdc++/4.9/include\vector: 7 | 8 | jni/Interface/../InlineHook\Ihook.h: 9 | -------------------------------------------------------------------------------- /obj/local/armeabi-v7a/objs/InlineArmHook/InlineHook.o.d: -------------------------------------------------------------------------------- 1 | ./obj/local/armeabi-v7a/objs/InlineArmHook/InlineHook.o: \ 2 | jni/Interface/InlineHook.cpp \ 3 | C:/Users/GToad/AppData/Local/Android/Sdk/ndk-bundle/build//../sources/cxx-stl/gnu-libstdc++/4.9/include\vector \ 4 | jni/Interface/../InlineHook\Ihook.h 5 | 6 | C:/Users/GToad/AppData/Local/Android/Sdk/ndk-bundle/build//../sources/cxx-stl/gnu-libstdc++/4.9/include\vector: 7 | 8 | jni/Interface/../InlineHook\Ihook.h: 9 | -------------------------------------------------------------------------------- /jni/InlineHook/ihookstub.s: -------------------------------------------------------------------------------- 1 | .global _shellcode_start_s 2 | .global _shellcode_end_s 3 | .global _hookstub_function_addr_s 4 | .global _old_function_addr_s 5 | 6 | .data 7 | 8 | _shellcode_start_s: 9 | push {r0, r1, r2, r3} 10 | mrs r0, cpsr 11 | str r0, [sp, #0xC] 12 | str r14, [sp, #8] 13 | add r14, sp, #0x10 14 | str r14, [sp, #4] 15 | pop {r0} 16 | push {r0-r12} 17 | mov r0, sp 18 | ldr r3, _hookstub_function_addr_s 19 | blx r3 20 | ldr r0, [sp, #0x3C] 21 | msr cpsr, r0 22 | ldmfd sp!, {r0-r12} 23 | ldr r14, [sp, #4] 24 | ldr sp, [r13] 25 | ldr pc, _old_function_addr_s 26 | 27 | _hookstub_function_addr_s: 28 | .word 0xffffffff 29 | 30 | _old_function_addr_s: 31 | .word 0xffffffff 32 | 33 | _shellcode_end_s: 34 | 35 | .end 36 | -------------------------------------------------------------------------------- /jni/InlineHook/fixPCOpcode.h: -------------------------------------------------------------------------------- 1 | #ifndef _FIXOPCODE_H 2 | #define _FIXOPCODE_H 3 | 4 | #include 5 | #include "Ihook.h" 6 | 7 | #define ALIGN_PC(pc) (pc & 0xFFFFFFFC) 8 | 9 | bool isThumb32(uint16_t opcode); 10 | bool isTargetAddrInBackup(uint32_t target_addr, uint32_t hook_addr, int backup_length); 11 | 12 | int lengthFixThumb32(uint32_t opcode); 13 | int lengthFixArm32(uint32_t opcode); 14 | int lengthFixThumb16(uint16_t opcode); 15 | 16 | static int getTypeInArm32(uint32_t instruction); 17 | static int getTypeInThumb16(uint16_t instruction); 18 | static int getTypeInThumb32(uint32_t instruction); 19 | 20 | 21 | int fixPCOpcodeArm(void *fixOpcodes , INLINE_HOOK_INFO* pstInlineHook); 22 | int fixPCOpcodeThumb(void *fixOpcodes , INLINE_HOOK_INFO* pstInlineHook); 23 | int fixPCOpcodeArm32(uint32_t pc, uint32_t lr, uint32_t instruction, uint32_t *trampoline_instructions, INLINE_HOOK_INFO* pstInlineHook); 24 | int fixPCOpcodeThumb16(uint32_t pc, uint16_t instruction, uint16_t *trampoline_instructions, INLINE_HOOK_INFO* pstInlineHook); 25 | int fixPCOpcodeThumb32(uint32_t pc, uint16_t high_instruction, uint16_t low_instruction, uint16_t *trampoline_instructions, INLINE_HOOK_INFO* pstInlineHook); 26 | 27 | #endif -------------------------------------------------------------------------------- /jni/InlineHook/ihookstubthumb.s: -------------------------------------------------------------------------------- 1 | .global _shellcode_start_s_thumb 2 | .global _shellcode_end_s_thumb 3 | .global _hookstub_function_addr_s_thumb 4 | .global _old_function_addr_s_thumb 5 | 6 | .data 7 | 8 | _shellcode_start_s_thumb: 9 | push {r0, r1, r2, r3} 10 | mrs r0, cpsr 11 | str r0, [sp, #0xC] 12 | str r14, [sp, #8] 13 | add r14, sp, #0x10 14 | str r14, [sp, #4] 15 | pop {r0} 16 | push {r0-r12} 17 | mov r0, sp //pass the reg 18 | ldr r3, _hookstub_function_addr_s_thumb //to protect r3， then i notice the reg is passed by r0. 19 | blx r3 20 | ldr r3, _old_function_addr_s_thumb 21 | and r3, r3, #0xfffffffe //bic r3, r3, #1 22 | add r3, r3, #0x1 23 | str r3, _old_function_addr_s_thumb 24 | ldr r3, [sp, #-0x34] 25 | ldr r0, [sp, #0x3C] 26 | msr cpsr, r0 27 | ldmfd sp!, {r0-r12} 28 | ldr r14, [sp, #4] 29 | ldr sp, [r13] 30 | ldr pc, _old_function_addr_s_thumb 31 | 32 | _hookstub_function_addr_s_thumb: 33 | .word 0xffffffff 34 | 35 | _old_function_addr_s_thumb: 36 | .word 0xffffffff 37 | 38 | _shellcode_end_s_thumb: 39 | 40 | .end 41 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | This is the example of my [Android Inline Hook Project](https://github.com/GToad/Android_Inline_Hook.git) in arm mode. So I will only update that repo. 2 | 3 | The target APP is `arm32-example.apk` and our .so file has already been compiled in `/libs/armeabi-v7a/libInlineArmHook.so`. 4 | 5 | In this APP, you should touch the button more than 10 and it will show `Enough` in a toast. After the example `libInlineArmHook.so` is effective, the register R0 will be set to 0x333 (>10) so you can touch it just once to get `Enough`. 6 | 7 | `notArmHooked.mp4` shows the APP run in a normal environment. 8 | 9 | `ArmHooked.mp4` shows the APP run in a hooked environment. 10 | 11 | The pictures of effect are showed below: 12 | 13 | ![](https://gtoad.github.io/img/in-post/post-android-native-hook-practice/notArmHooked.png) 14 | ![](https://gtoad.github.io/img/in-post/post-android-native-hook-practice/ArmHooked.png) 15 | 16 | 17 | # Android Inline Hook 18 | 19 | This project make an Android .so file that can automatically do some native hook works. 20 | 21 | It mainly use Android Inline Hook, not PLT Hook. 22 | 23 | If you can read Chinese or wanna see more picture, I've wrote some articles about this repo and the first one is the main article. `I highly recommend you to read the articles before reading the code.` These article will save you a lot of time, I promise. 24 | 25 | 1. [Android Inline Hook Practice](https://gtoad.github.io/2018/07/06/Android-Native-Hook-Practice/) 26 | 2. [Opcode Fix In Android Inline Hook](https://gtoad.github.io/2018/07/13/Android-Inline-Hook-Fix/) 27 | 3. [An Introduction to Android Native Hook](https://gtoad.github.io/2018/07/05/Android-Native-Hook/) 28 | 29 | # How To Use 30 | 31 | The only thing you have to change is the code in `InlineHook.cpp`. 32 | 33 | You can name the `__attribute__((constructor)) ModifyIBored()` function at your will and change the follow arg in it: 34 | 35 | 1. `pModuleBaseAddr` is the address of your target so. 36 | 2. `target_offset` is the offset of your hook point in the target so. 37 | 3. `is_target_thumb` shows the hook point's CPU mode. You can know this information in the work of reversing before the hook work. 38 | 39 | `EvilHookStubFunctionForIBored` function is the thing you really wanna do when the hook works. You can name at your will, but keep the arg `(pt_regs *regs)`. It brings you the power to control the registers, like set r0 to 0x333 : `regs->uregs[0]=0x333;`. 40 | 41 | After you finish the args above, just `ndk-build` and you will get your .so file. 42 | 43 | # Example 44 | 45 | I've make some examples in other repo, it includes code and the target APK file. 46 | 47 | 1. [thumb-2 example](https://github.com/GToad/Android_Inline_Hook_Thumb_Example.git) 48 | 2. [arm32 example](https://github.com/GToad/Android_Inline_Hook_Arm_Example.git) 49 | 50 | # Contact 51 | 52 | I believe that this project still has some problems. If you find some bugs or have some problems, you can send e-mail to `gtoad1994@aliyun.com`. I wish we can fix it together! 53 | 54 | # Reference 55 | 56 | [Game Security Lab of Tencent](http://gslab.qq.com/portal.php?mod=view&aid=168) 57 | 58 | [Ele7enxxh's Blog](http://ele7enxxh.com/Android-Arm-Inline-Hook.html) 59 | 60 | 61 | 62 | 63 | -------------------------------------------------------------------------------- /jni/InlineHook/fixPCOpcode.c: -------------------------------------------------------------------------------- 1 | #include "fixPCOpcode.h" 2 | 3 | //这里的代码建议看文章：《Android Inline Hook中的指令修复详解》（https://gtoad.github.io/2018/07/13/Android-Inline-Hook-Fix/） 4 | 5 | enum INSTRUCTION_TYPE { 6 | // B