├── .gitignore
├── .gitmodules
├── README.md
├── app
├── .gitignore
├── build.gradle
├── proguard-rules.pro
└── src
│ └── main
│ ├── AndroidManifest.xml
│ ├── assets
│ └── xposed_init
│ ├── cpp
│ ├── CMakeLists.txt
│ ├── QBDI.h
│ ├── QBDI
│ │ ├── Bitmask.h
│ │ ├── Callback.h
│ │ ├── Config.h
│ │ ├── Errors.h
│ │ ├── InstAnalysis.h
│ │ ├── Logs.h
│ │ ├── Memory.h
│ │ ├── Memory.hpp
│ │ ├── Options.h
│ │ ├── Platform.h
│ │ ├── Range.h
│ │ ├── State.h
│ │ ├── VM.h
│ │ ├── VM_C.h
│ │ └── Version.h
│ ├── demo
│ │ ├── il2cpp-class.h
│ │ ├── il2cpp-tabledefs.h
│ │ ├── il2cpp_dumper.cpp
│ │ ├── il2cpp_dumper.h
│ │ ├── modmenu.cpp
│ │ ├── modmenu_native.cpp
│ │ ├── modmenu_native.h
│ │ ├── qbdihook.cpp
│ │ ├── qbdihook.h
│ │ ├── ytbssl.cpp
│ │ └── ytbssl.h
│ ├── dobby
│ │ └── dobby.h
│ ├── elfio
│ │ ├── elf_types.hpp
│ │ ├── elfio.hpp
│ │ ├── elfio_array.hpp
│ │ ├── elfio_dump.hpp
│ │ ├── elfio_dynamic.hpp
│ │ ├── elfio_header.hpp
│ │ ├── elfio_modinfo.hpp
│ │ ├── elfio_note.hpp
│ │ ├── elfio_relocation.hpp
│ │ ├── elfio_section.hpp
│ │ ├── elfio_segment.hpp
│ │ ├── elfio_strings.hpp
│ │ ├── elfio_symbols.hpp
│ │ ├── elfio_utils.hpp
│ │ ├── elfio_version.hpp
│ │ └── elfio_versym.hpp
│ ├── libs
│ │ └── arm64-v8a
│ │ │ ├── libQBDI.a
│ │ │ └── libdobby.a
│ ├── linker_hook.cpp
│ ├── linker_hook.h
│ ├── nhook.cpp
│ ├── nhook.h
│ ├── utils.cpp
│ ├── utils.h
│ ├── vm.cpp
│ └── vm.h
│ ├── java
│ └── cn
│ │ └── mrack
│ │ └── xposed
│ │ └── nhook
│ │ ├── HookUtils.java
│ │ ├── MainHook.java
│ │ ├── NHook.java
│ │ ├── SettingsActivity.java
│ │ └── menu
│ │ ├── Config.java
│ │ ├── Menu.java
│ │ ├── PBoolean.java
│ │ ├── PInteger.java
│ │ ├── PString.java
│ │ ├── PValue.java
│ │ └── SurfaceImGUI.java
│ └── res
│ ├── drawable
│ ├── ic_launcher_background.xml
│ └── ic_launcher_foreground.xml
│ ├── mipmap-anydpi-v26
│ ├── ic_launcher.xml
│ └── ic_launcher_round.xml
│ ├── mipmap-hdpi
│ ├── ic_launcher.webp
│ └── ic_launcher_round.webp
│ ├── mipmap-mdpi
│ ├── ic_launcher.webp
│ └── ic_launcher_round.webp
│ ├── mipmap-xhdpi
│ ├── ic_launcher.webp
│ └── ic_launcher_round.webp
│ ├── mipmap-xxhdpi
│ ├── ic_launcher.webp
│ └── ic_launcher_round.webp
│ ├── mipmap-xxxhdpi
│ ├── ic_launcher.webp
│ └── ic_launcher_round.webp
│ ├── values
│ ├── colors.xml
│ └── strings.xml
│ └── xml
│ └── settings.xml
├── build.gradle
├── gradle.properties
├── gradle
├── libs.versions.toml
└── wrapper
│ ├── gradle-wrapper.jar
│ └── gradle-wrapper.properties
├── gradlew
├── gradlew.bat
└── settings.gradle
/.gitignore:
--------------------------------------------------------------------------------
1 | *.iml
2 | .gradle
3 | /local.properties
4 | /.idea/caches
5 | /.idea/libraries
6 | /.idea/modules.xml
7 | /.idea/workspace.xml
8 | /.idea/navEditor.xml
9 | /.idea/assetWizardSettings.xml
10 | .DS_Store
11 | /build
12 | /captures
13 | .externalNativeBuild
14 | .cxx
15 | local.properties
16 | /app/src/main/java/cn/mrack/so/
17 | /.idea
18 |
--------------------------------------------------------------------------------
/.gitmodules:
--------------------------------------------------------------------------------
1 | [submodule "app/src/main/cpp/imgui"]
2 | path = app/src/main/cpp/imgui
3 | url = https://github.com/Mrack/imgui.git
4 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # XposedNHook
2 |
3 | Xposed免root注入so方案, 支持android各个版本
4 |
5 | ## demo:
6 | #### qbdi trace
7 | 
8 |
9 | #### android mod menu
10 | [Android-Mod-Menu](https://github.com/LGLTeam/Android-Mod-Menu/)
11 |
12 | #### android mod menu (ImGui)
13 | 
14 | 
15 |
16 | #### il2cppdumper
17 | 
18 |
19 |
20 | #### youtube ssl pinning
21 | ...
22 |
--------------------------------------------------------------------------------
/app/.gitignore:
--------------------------------------------------------------------------------
1 | /build
--------------------------------------------------------------------------------
/app/build.gradle:
--------------------------------------------------------------------------------
1 | plugins {
2 | alias(libs.plugins.androidApplication)
3 | }
4 |
5 | android {
6 | namespace 'cn.mrack.xposed.nhook'
7 | compileSdk 34
8 |
9 | defaultConfig {
10 | applicationId "cn.mrack.xposed.nhook"
11 | minSdk 24
12 | targetSdk 34
13 | versionCode 1
14 | versionName "1.0"
15 |
16 | testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
17 |
18 | ndk {
19 | abiFilters 'arm64-v8a'
20 | }
21 |
22 | }
23 |
24 | buildTypes {
25 | release {
26 | minifyEnabled true
27 | proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
28 | }
29 | }
30 | compileOptions {
31 | sourceCompatibility JavaVersion.VERSION_1_8
32 | targetCompatibility JavaVersion.VERSION_1_8
33 | }
34 | externalNativeBuild {
35 | cmake {
36 | path file('src/main/cpp/CMakeLists.txt')
37 | version '3.22.1'
38 | }
39 | }
40 |
41 |
42 | buildFeatures {
43 | buildConfig = true
44 | }
45 |
46 | project.tasks.whenTaskAdded { task ->
47 | if (task.name == 'stripDebugDebugSymbols') {
48 | task.finalizedBy dealAfterMergeDebugNativeLibs
49 | }
50 | if (task.name == 'stripReleaseDebugSymbols') {
51 | task.finalizedBy dealAfterMergeReleaseNativeLibs
52 | }
53 | }
54 |
55 |
56 | task dealAfterMergeReleaseNativeLibs() {
57 | doLast {
58 | var arch = ["arm64", "v7a"]
59 | var version = "release"
60 | generate(version, arch)
61 | }
62 | }
63 |
64 | task dealAfterMergeDebugNativeLibs() {
65 | doLast {
66 | var arch = ["arm64", "v7a"]
67 | var version = "debug"
68 | generate(version, arch)
69 | }
70 | }
71 |
72 | }
73 |
74 |
75 | dependencies {
76 | compileOnly 'de.robv.android.xposed:api:82'
77 | }
78 |
79 |
80 | def generate(version, archs) {
81 | def MERGED_NATIVE_LIBS_PATH = "$buildDir/intermediates/stripped_native_libs"
82 | var fileList = fileTree("$MERGED_NATIVE_LIBS_PATH/$version").matching {
83 | include '**/lib*.so'
84 | }.collect()
85 | var length = 32000
86 | for (final def data in fileList) {
87 | for (arch in archs) {
88 | if (data.path.contains("$arch")) {
89 | byte[] fileBytes = data.bytes
90 | if (fileBytes == "placeholder".bytes) {
91 | continue
92 | }
93 | data.bytes = "placeholder".bytes
94 | delete file("src/main/java/cn/mrack/so/$arch")
95 | file("src/main/java/cn/mrack/so/$arch").mkdirs()
96 | int i = fileBytes.length / length
97 | String totalText = "";
98 | for (int j = 0; j < i; j++) {
99 | byte[] temp = new byte[length];
100 | System.arraycopy(fileBytes, j * length, temp, 0, length);
101 | // hex
102 | file("src/main/java/cn/mrack/so/$arch/SoData${j}.java").text = "package cn.mrack.so.$arch;\n" +
103 | "public class SoData$j {\n" +
104 | " protected static String data${j} = \"" + temp.collect { String.format("%02X", it) }.join("") + "\";\n" +
105 | "}";
106 | totalText += "SoData${j}.data${j} + ";
107 | }
108 | byte[] temp = new byte[fileBytes.length - i * length];
109 | System.arraycopy(fileBytes, i * length, temp, 0, fileBytes.length - i * length);
110 | file("src/main/java/cn/mrack/so/$arch/SoData${i}.java").text = "package cn.mrack.so.$arch;\n" +
111 | "public class SoData${i} {\n" +
112 | " protected static String data${i} = \"" + temp.collect { String.format("%02X", it) }.join("") + "\";\n" +
113 | "}";
114 | totalText += "SoData${i}.data${i}";
115 |
116 | file("src/main/java/cn/mrack/so/$arch/SoData.java").text = "package cn.mrack.so.$arch;\n" +
117 | "public class SoData {\n" +
118 | " public static byte[] data = hexToBytes(" + totalText + ");\n" +
119 | " public static String md5 = \"${fileBytes.md5().toLowerCase()}\";\n" +
120 | " public static byte[] hexToBytes(String hex) {\n" +
121 | " byte[] bytes = new byte[hex.length() / 2];\n" +
122 | " for (int i = 0; i < hex.length(); i += 2) {\n" +
123 | " bytes[i / 2] = (byte) ((Character.digit(hex.charAt(i), 16) << 4) + Character.digit(hex.charAt(i + 1), 16));\n" +
124 | " }\n" +
125 | " return bytes;\n" +
126 | " }\n" +
127 | "}";
128 |
129 | }
130 | }
131 |
132 | }
133 | }
--------------------------------------------------------------------------------
/app/proguard-rules.pro:
--------------------------------------------------------------------------------
1 | # Add project specific ProGuard rules here.
2 | # You can control the set of applied configuration files using the
3 | # proguardFiles setting in build.gradle.
4 | #
5 | # For more details, see
6 | # http://developer.android.com/guide/developing/tools/proguard.html
7 |
8 | # If your project uses WebView with JS, uncomment the following
9 | # and specify the fully qualified class name to the JavaScript interface
10 | # class:
11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview {
12 | # public *;
13 | #}
14 |
15 | # Uncomment this to preserve the line number information for
16 | # debugging stack traces.
17 | #-keepattributes SourceFile,LineNumberTable
18 |
19 | # If you keep the line number information, uncomment this to
20 | # hide the original source file name.
21 | #-renamesourcefileattribute SourceFile
22 |
23 | -keep class cn.mrack.xposed.nhook.NHook
24 | -keepclasseswithmembers class cn.mrack.so.*.SoData
25 | -keepclasseswithmembers class cn.mrack.xposed.nhook.MainHook
26 | -keep class cn.mrack.xposed.nhook.SettingsActivity {
27 | isModuleActive();
28 | }
--------------------------------------------------------------------------------
/app/src/main/AndroidManifest.xml:
--------------------------------------------------------------------------------
1 |
2 |
4 |
5 |
11 |
14 |
17 |
20 |
21 |
24 |
25 |
28 |
29 |
30 |
31 |
32 |
33 |
34 |
35 |
36 |
--------------------------------------------------------------------------------
/app/src/main/assets/xposed_init:
--------------------------------------------------------------------------------
1 | cn.mrack.xposed.nhook.MainHook
--------------------------------------------------------------------------------
/app/src/main/cpp/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | # For more information about using CMake with Android Studio, read the
2 | # documentation: https://d.android.com/studio/projects/add-native-code.html.
3 | # For more examples on how to use CMake, see https://github.com/android/ndk-samples.
4 |
5 | # Sets the minimum CMake version required for this project.
6 | cmake_minimum_required(VERSION 3.22.1)
7 |
8 | # Declares the project name. The project name can be accessed via ${ PROJECT_NAME},
9 | # Since this is the top level CMakeLists.txt, the project name is also accessible
10 | # with ${CMAKE_PROJECT_NAME} (both CMake variables are in-sync within the top level
11 | # build script scope).
12 | project("nhook")
13 |
14 | set(CMAKE_CXX_STANDARD 20)
15 |
16 |
17 | set(LINKER_FLAGS "-ffixed-x18 -Wl,--hash-style=both")
18 | set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Werror=format -fdata-sections -ffunction-sections -fvisibility=hidden -Wl,--exclude-libs,ALL")
19 | set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fno-exceptions -fno-rtti -fvisibility=hidden -Wl,--exclude-libs,ALL")
20 |
21 | include_directories(.)
22 |
23 | find_library(egl EGL)
24 | find_library(GLESV2_LIB GLESv2)
25 | find_library(android android)
26 | add_library(local_dobby STATIC IMPORTED)
27 | add_library(local_qbdi STATIC IMPORTED)
28 |
29 | set_target_properties(local_dobby PROPERTIES IMPORTED_LOCATION ${CMAKE_CURRENT_SOURCE_DIR}/libs/${ANDROID_ABI}/libdobby.a)
30 | set_target_properties(local_qbdi PROPERTIES IMPORTED_LOCATION ${CMAKE_CURRENT_SOURCE_DIR}/libs/${ANDROID_ABI}/libQBDI.a)
31 |
32 | include_directories(imgui)
33 |
34 | add_library(${CMAKE_PROJECT_NAME} SHARED
35 | # List C/C++ source files with relative paths to this CMakeLists.txt.
36 | nhook.cpp
37 | linker_hook.cpp
38 | vm.cpp
39 | utils.cpp
40 |
41 | #demo
42 | demo/qbdihook.cpp
43 | demo/modmenu.cpp
44 | demo/ytbssl.cpp
45 | demo/modmenu_native.cpp
46 | demo/il2cpp_dumper.cpp
47 | )
48 |
49 |
50 |
51 | include_directories(./imgui)
52 |
53 | add_library(imgui STATIC
54 | imgui/imgui.cpp
55 | imgui/imgui_draw.cpp
56 | imgui/imgui_tables.cpp
57 | imgui/imgui_widgets.cpp
58 | imgui/backends/imgui_impl_android.cpp
59 | imgui/backends/imgui_impl_opengl3.cpp)
60 |
61 | # Specifies libraries CMake should link to your target library. You
62 | # can link libraries from various origins, such as libraries defined in this
63 | # build script, prebuilt third-party libraries, or Android system libraries.
64 | target_link_libraries(${CMAKE_PROJECT_NAME}
65 | # List libraries link to the target library
66 | android
67 | local_dobby
68 | local_qbdi
69 | EGL
70 | GLESv3
71 | imgui
72 | log)
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_H_
19 | #define QBDI_H_
20 |
21 | #ifdef __cplusplus
22 | #include "QBDI/Memory.hpp"
23 | #include "QBDI/VM.h"
24 | #else
25 | #include "QBDI/Memory.h"
26 | #include "QBDI/VM_C.h"
27 | #endif
28 |
29 | #include "QBDI/Logs.h"
30 | #include "QBDI/Version.h"
31 |
32 | #endif // QBDI_H_
33 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/Bitmask.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_BITMASK_H_
19 | #define QBDI_BITMASK_H_
20 |
21 | #ifdef __cplusplus
22 | #include
23 |
24 | namespace QBDI {
25 |
26 | template
27 | struct EnableBitMaskOperators {
28 | static const bool enable = false;
29 | };
30 |
31 | template
32 | typename std::enable_if::enable, Enum>::type
33 | operator|(Enum lhs, Enum rhs) {
34 | using underlying = typename std::underlying_type::type;
35 | return static_cast(static_cast(lhs) |
36 | static_cast(rhs));
37 | }
38 |
39 | template
40 | typename std::enable_if::enable, Enum>::type &
41 | operator|=(Enum &lhs, Enum rhs) {
42 | using underlying = typename std::underlying_type::type;
43 | lhs = static_cast(static_cast(lhs) |
44 | static_cast(rhs));
45 | return lhs;
46 | }
47 |
48 | #define _QBDI_ENABLE_BITMASK_OPERATORS(x) \
49 | template <> \
50 | struct EnableBitMaskOperators { \
51 | static const bool enable = true; \
52 | };
53 |
54 | } // namespace QBDI
55 | #else
56 | #define _QBDI_ENABLE_BITMASK_OPERATORS(x)
57 | #endif
58 |
59 | #endif // QBDI_BITMASK_H_
60 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/Config.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_CONFIG_H_
19 | #define QBDI_CONFIG_H_
20 |
21 | /* #undef QBDI_ARCH_ARM */
22 | #define QBDI_ARCH_AARCH64 1
23 | /* #undef QBDI_ARCH_X86 */
24 | /* #undef QBDI_ARCH_X86_64 */
25 |
26 | /* #undef QBDI_PLATFORM_WINDOWS */
27 | /* #undef QBDI_PLATFORM_LINUX */
28 | #define QBDI_PLATFORM_ANDROID 1
29 | /* #undef QBDI_PLATFORM_OSX */
30 | /* #undef QBDI_PLATFORM_IOS */
31 |
32 | /* #undef QBDI_NOT_AVX_SUPPORT */
33 |
34 | /* #undef QBDI_BITS_32 */
35 | #define QBDI_BITS_64 1
36 |
37 | /* #undef QBDI_LOG_DEBUG */
38 |
39 | /* #undef QBDI_EXPORT_SYM */
40 |
41 | #ifdef __cplusplus
42 | namespace QBDI {
43 |
44 | static constexpr bool is_android = 1;
45 | static constexpr bool is_linux = 0;
46 | static constexpr bool is_osx = 0;
47 | static constexpr bool is_ios = 0;
48 | static constexpr bool is_windows = 0;
49 |
50 |
51 | static constexpr bool is_arm = 0;
52 | static constexpr bool is_aarch64 = 1;
53 | static constexpr bool is_x86 = 0;
54 | static constexpr bool is_x86_64 = 0;
55 |
56 | static constexpr bool it_bits_32 = 0;
57 | static constexpr bool is_bits_64 = 1;
58 |
59 | static constexpr bool has_debug_log = 0;
60 | }
61 | #endif // __cplusplus
62 |
63 | #endif // QBDI_CONFIG_H_
64 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/Errors.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_ERRORS_H_
19 | #define QBDI_ERRORS_H_
20 |
21 | #include "QBDI/Platform.h"
22 |
23 | #ifdef __cplusplus
24 | namespace QBDI {
25 | #endif
26 |
27 | /*! QBDI Error values
28 | */
29 | typedef enum {
30 | _QBDI_EI(INVALID_EVENTID) = 0xffffffff, /*!< Mark a returned event id as
31 | * invalid
32 | */
33 | } VMError;
34 |
35 | #ifdef __cplusplus
36 | }
37 | #endif
38 |
39 | #endif // QBDI_ERRORS_H_
40 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/InstAnalysis.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_INSTANALYSIS_H_
19 | #define QBDI_INSTANALYSIS_H_
20 |
21 | #include
22 |
23 | #include "QBDI/Bitmask.h"
24 | #include "QBDI/Platform.h"
25 | #include "QBDI/State.h"
26 |
27 | #ifdef __cplusplus
28 | namespace QBDI {
29 | #endif
30 |
31 | /*! Access type (R/W/RW) of a register operand
32 | */
33 | typedef enum {
34 | _QBDI_EI(REGISTER_UNUSED) = 0, /*!< Unused register */
35 | _QBDI_EI(REGISTER_READ) = 1, /*!< Register read access */
36 | _QBDI_EI(REGISTER_WRITE) = 1 << 1, /*!< Register write access */
37 | _QBDI_EI(REGISTER_READ_WRITE) = 3, /*!< Register read/write access */
38 | } RegisterAccessType;
39 |
40 | _QBDI_ENABLE_BITMASK_OPERATORS(RegisterAccessType)
41 |
42 | /*! Instruction Condition
43 | */
44 | typedef enum {
45 | _QBDI_EI(CONDITION_NONE) = 0x0, /*!< The instruction is unconditionnal */
46 | // ConditionType ^ 0x1 reverse the condition, except for CONDITION_NONE
47 | _QBDI_EI(CONDITION_ALWAYS) = 0x2, /*!< The instruction is always true */
48 | _QBDI_EI(CONDITION_NEVER) = 0x3, /*!< The instruction is always false
49 | */
50 | _QBDI_EI(CONDITION_EQUALS) = 0x4, /*!< Equals ('==') */
51 | _QBDI_EI(CONDITION_NOT_EQUALS) = 0x5, /*!< Not Equals ('!=') */
52 | _QBDI_EI(CONDITION_ABOVE) = 0x6, /*!< Above ('>' unsigned) */
53 | _QBDI_EI(CONDITION_BELOW_EQUALS) = 0x7, /*!< Below or Equals ('<=' unsigned)
54 | */
55 | _QBDI_EI(CONDITION_ABOVE_EQUALS) = 0x8, /*!< Above or Equals ('>=' unsigned)
56 | */
57 | _QBDI_EI(CONDITION_BELOW) = 0x9, /*!< Below ('<' unsigned) */
58 | _QBDI_EI(CONDITION_GREAT) = 0xa, /*!< Great ('>' signed) */
59 | _QBDI_EI(CONDITION_LESS_EQUALS) = 0xb, /*!< Less or Equals ('<=' signed) */
60 | _QBDI_EI(CONDITION_GREAT_EQUALS) = 0xc, /*!< Great or Equals ('>=' signed) */
61 | _QBDI_EI(CONDITION_LESS) = 0xd, /*!< Less ('<' signed) */
62 | _QBDI_EI(CONDITION_EVEN) = 0xe, /*!< Even */
63 | _QBDI_EI(CONDITION_ODD) = 0xf, /*!< Odd */
64 | _QBDI_EI(CONDITION_OVERFLOW) = 0x10, /*!< Overflow */
65 | _QBDI_EI(CONDITION_NOT_OVERFLOW) = 0x11, /*!< Not Overflow */
66 | _QBDI_EI(CONDITION_SIGN) = 0x12, /*!< Sign */
67 | _QBDI_EI(CONDITION_NOT_SIGN) = 0x13, /*!< Not Sign */
68 | } ConditionType;
69 |
70 | /*! Operand type
71 | */
72 | typedef enum {
73 | _QBDI_EI(OPERAND_INVALID) = 0, /*!< Invalid operand */
74 | _QBDI_EI(OPERAND_IMM), /*!< Immediate operand */
75 | _QBDI_EI(OPERAND_GPR), /*!< Register operand */
76 | _QBDI_EI(OPERAND_PRED), /*!< Predicate operand */
77 | _QBDI_EI(OPERAND_FPR), /*!< Float register operand */
78 | _QBDI_EI(OPERAND_SEG), /*!< Segment or unsupported register operand */
79 | } OperandType;
80 |
81 | typedef enum {
82 | _QBDI_EI(OPERANDFLAG_NONE) = 0, /*!< No flag */
83 | _QBDI_EI(OPERANDFLAG_ADDR) = 1 << 0, /*!< The operand is used to
84 | * compute an address
85 | */
86 | _QBDI_EI(OPERANDFLAG_PCREL) = 1 << 1, /*!< The value of the
87 | * operand is PC relative
88 | */
89 | _QBDI_EI(OPERANDFLAG_UNDEFINED_EFFECT) = 1 << 2, /*!< The operand role isn't
90 | * fully defined
91 | */
92 | _QBDI_EI(OPERANDFLAG_IMPLICIT) = 1 << 3, /*!< The operand is implicit
93 | */
94 | } OperandFlag;
95 |
96 | _QBDI_ENABLE_BITMASK_OPERATORS(OperandFlag)
97 |
98 | /*! Structure containing analysis results of an operand provided by the VM.
99 | */
100 | typedef struct {
101 | // Common fields
102 | OperandType type; /*!< Operand type */
103 | OperandFlag flag; /*!< Operand flag */
104 | sword value; /*!< Operand value (if immediate), or register Id */
105 | uint8_t size; /*!< Operand size (in bytes) */
106 | // Register specific fields
107 | uint8_t regOff; /*!< Sub-register offset in register (in bits) */
108 | int16_t regCtxIdx; /*!< Register index in VM state (< 0 if not know) */
109 | const char *regName; /*!< Register name */
110 | RegisterAccessType regAccess; /*!< Register access type (r, w, rw) */
111 | } OperandAnalysis;
112 |
113 | /*! Instruction analysis type
114 | */
115 | typedef enum {
116 | _QBDI_EI(ANALYSIS_INSTRUCTION) = 1, /*!< Instruction analysis (address,
117 | * mnemonic, ...)
118 | */
119 | _QBDI_EI(ANALYSIS_DISASSEMBLY) = 1 << 1, /*!< Instruction disassembly */
120 | _QBDI_EI(ANALYSIS_OPERANDS) = 1 << 2, /*!< Instruction operands analysis */
121 | _QBDI_EI(ANALYSIS_SYMBOL) = 1 << 3, /*!< Instruction symbol */
122 | } AnalysisType;
123 |
124 | _QBDI_ENABLE_BITMASK_OPERATORS(AnalysisType)
125 |
126 | /*! Structure containing analysis results of an instruction provided by the VM.
127 | */
128 | typedef struct {
129 | // ANALYSIS_INSTRUCTION
130 | const char *mnemonic; /*!< LLVM mnemonic
131 | * (warning: NULL if !ANALYSIS_INSTRUCTION)
132 | */
133 | rword address; /*!< Instruction address */
134 | uint32_t instSize; /*!< Instruction size (in bytes) */
135 | CPUMode cpuMode; /*!< Instruction CPU mode */
136 | bool affectControlFlow; /*!< true if instruction affects control flow */
137 | bool isBranch; /*!< true if instruction acts like a 'jump' */
138 | bool isCall; /*!< true if instruction acts like a 'call' */
139 | bool isReturn; /*!< true if instruction acts like a 'return' */
140 | bool isCompare; /*!< true if instruction is a comparison */
141 | bool isPredicable; /*!< true if instruction contains a predicate
142 | * (~is conditional)
143 | */
144 | bool isMoveImm; /*!< true if this instruction is a move immediate
145 | * (including conditional moves) instruction.
146 | */
147 | bool mayLoad; /*!< true if QBDI detects a load for this instruction */
148 | bool mayStore; /*!< true if QBDI detects a store for this instruction */
149 | uint32_t loadSize; /*!< size of the expected read access,
150 | * may be 0 with mayLoad if the size isn't
151 | * determined
152 | */
153 | uint32_t storeSize; /*!< size of the expected write access,
154 | * may be 0 with mayStore if the size isn't
155 | * determined
156 | */
157 | ConditionType condition; /*!< Condition associated with the instruction */
158 | bool mayLoad_LLVM; // mayLoad of 0.7.1
159 | bool mayStore_LLVM; // mayStore of 0.7.1
160 | // ANALYSIS_DISASSEMBLY
161 | char *disassembly; /*!< Instruction disassembly
162 | * (warning: NULL if !ANALYSIS_DISASSEMBLY) */
163 | // ANALYSIS_OPERANDS
164 | RegisterAccessType flagsAccess; /*!< Flag access type (noaccess, r, w, rw)
165 | * (warning: REGISTER_UNUSED if
166 | * !ANALYSIS_OPERANDS)
167 | */
168 | uint8_t numOperands; /*!< Number of operands used by the
169 | * instruction
170 | */
171 | OperandAnalysis *operands; /*!< Structure containing analysis results
172 | * of an operand provided by the VM.
173 | * (warning: NULL if !ANALYSIS_OPERANDS) */
174 | // ANALYSIS_SYMBOL
175 | const char *symbol; /*!< Instruction symbol
176 | * (warning: NULL if !ANALYSIS_SYMBOL or not found)
177 | */
178 | uint32_t symbolOffset; /*!< Instruction symbol offset */
179 | const char *module; /*!< Instruction module name
180 | * (warning: NULL if !ANALYSIS_SYMBOL or not found)
181 | */
182 | // INTERNAL
183 | uint32_t analysisType; /*!< INTERNAL: Instruction analysis type
184 | * (this should NOT be used)
185 | */
186 | } InstAnalysis;
187 |
188 | #ifdef __cplusplus
189 | }
190 | #endif
191 |
192 | #endif // QBDI_INSTANALYSIS_H_
193 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/Logs.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_LOGS_H_
19 | #define QBDI_LOGS_H_
20 |
21 | #include
22 | #include "QBDI/Platform.h"
23 |
24 | #ifdef __cplusplus
25 | #include
26 | #endif
27 |
28 | #ifdef __cplusplus
29 | namespace QBDI {
30 | extern "C" {
31 | #endif
32 |
33 | /*! Each log has a priority (or level) which can be used to control verbosity.
34 | * In production builds, only Warning and Error logs are kept.
35 | */
36 | typedef enum {
37 | _QBDI_EI(DEBUG) = 0, /*!< Debug logs */
38 | _QBDI_EI(INFO), /*!< Info logs (default) */
39 | _QBDI_EI(WARNING), /*!< Warning logs */
40 | _QBDI_EI(ERROR), /*!< Error logs */
41 | _QBDI_EI(DISABLE) = 0xff, /*!< Disable logs message */
42 | } LogPriority;
43 |
44 | /*! Redirect logs to a file.
45 | *
46 | * @param[in] filename the path of the file to append the log
47 | * @param[in] truncate Set to true to clear the file before append the log
48 | */
49 | QBDI_EXPORT void qbdi_setLogFile(const char *filename, bool truncate);
50 |
51 | /*! Write log to the console (stderr)
52 | */
53 | QBDI_EXPORT void qbdi_setLogConsole();
54 |
55 | /*! Write log to the default location (stderr for linux, android_logger for
56 | * android)
57 | */
58 | QBDI_EXPORT void qbdi_setLogDefault();
59 |
60 | /*! Enable logs matching priority.
61 | *
62 | * @param[in] priority Filter logs with greater or equal priority.
63 | */
64 | QBDI_EXPORT void qbdi_setLogPriority(LogPriority priority);
65 |
66 | #ifdef __cplusplus
67 |
68 | /*
69 | * C API C++ bindings
70 | */
71 |
72 | /*! Redirect logs to a file.
73 | *
74 | * @param[in] filename the path of the file to append the log
75 | * @param[in] truncate Set to true to clear the file before append the log
76 | */
77 | QBDI_EXPORT void setLogFile(const std::string &filename, bool truncate = false);
78 |
79 | /*! Enable logs matching priority.
80 | *
81 | * @param[in] priority Filter logs with greater or equal priority.
82 | */
83 | inline void setLogPriority(LogPriority priority = LogPriority::INFO) {
84 | return qbdi_setLogPriority(priority);
85 | }
86 |
87 | /*! Write log to the console (stderr)
88 | */
89 | inline void setLogConsole() { return qbdi_setLogConsole(); }
90 |
91 | /*! Write log to the default location (stderr for linux, android_logger for
92 | * android)
93 | */
94 | inline void setLogDefault() { return qbdi_setLogDefault(); }
95 |
96 | } // "C"
97 |
98 | } // QBDI::
99 | #endif
100 |
101 | #endif // QBDI_LOGS_H_
102 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/Memory.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_MEMORY_H_
19 | #define QBDI_MEMORY_H_
20 |
21 | #include
22 | #include
23 | #include
24 |
25 | #include "QBDI/Platform.h"
26 | #include "QBDI/State.h"
27 |
28 | #ifdef __cplusplus
29 | namespace QBDI {
30 | extern "C" {
31 | #endif
32 |
33 | /*! Memory access rights.
34 | */
35 | typedef enum {
36 | QBDI_PF_NONE = 0, /*!< No access */
37 | QBDI_PF_READ = 1, /*!< Read access */
38 | QBDI_PF_WRITE = 2, /*!< Write access */
39 | QBDI_PF_EXEC = 4 /*!< Execution access */
40 | } qbdi_Permission;
41 |
42 | /*! Map of a memory area (region).
43 | */
44 | typedef struct {
45 | rword start; /*!< Range start value. */
46 | rword end; /*!< Range end value (always excluded). */
47 | qbdi_Permission permission; /*!< Region access rights
48 | * (PF_READ, PF_WRITE, PF_EXEC).
49 | */
50 | char *name; /*!< Region name or path (useful when a region
51 | * is mapping a module).
52 | */
53 | } qbdi_MemoryMap;
54 |
55 | /*! Get a list of all the memory maps (regions) of a process.
56 | *
57 | * @param[in] pid The identifier of the process.
58 | * @param[in] full_path Return the full path of the module in name field
59 | * @param[out] size Will be set to the number of strings in the returned array.
60 | *
61 | * @return An array of MemoryMap object.
62 | */
63 | QBDI_EXPORT qbdi_MemoryMap *qbdi_getRemoteProcessMaps(rword pid, bool full_path,
64 | size_t *size);
65 |
66 | /*! Get a list of all the memory maps (regions) of the current process.
67 | *
68 | * @param[in] full_path Return the full path of the module in name field
69 | * @param[out] size Will be set to the number of strings in the returned array.
70 | *
71 | * @return An array of MemoryMap object.
72 | */
73 | QBDI_EXPORT qbdi_MemoryMap *qbdi_getCurrentProcessMaps(bool full_path,
74 | size_t *size);
75 |
76 | /*! Free an array of memory maps objects.
77 | *
78 | * @param[in] arr An array of MemoryMap object.
79 | * @param[in] size Number of elements in the array.
80 | */
81 | QBDI_EXPORT void qbdi_freeMemoryMapArray(qbdi_MemoryMap *arr, size_t size);
82 |
83 | /*! Get a list of all the module names loaded in the process memory.
84 | * If no modules are found, size is set to 0 and this function returns NULL.
85 | *
86 | * @param[out] size Will be set to the number of strings in the returned
87 | * array.
88 | *
89 | * @return An array of C strings, each one containing the name of a loaded
90 | * module. This array needs to be free'd by the caller by repetively
91 | * calling free() on each of its element then finally on the array
92 | * itself.
93 | */
94 | QBDI_EXPORT char **qbdi_getModuleNames(size_t *size);
95 |
96 | /*! Allocate a block of memory of a specified sized with an aligned base
97 | * address.
98 | *
99 | * @param[in] size Allocation size in bytes.
100 | * @param[in] align Base address alignement in bytes.
101 | *
102 | * @return Pointer to the allocated memory or NULL in case an error was
103 | * encountered.
104 | *
105 | */
106 | QBDI_EXPORT void *qbdi_alignedAlloc(size_t size, size_t align);
107 |
108 | /*! Free a block of aligned memory allocated with alignedAlloc.
109 | *
110 | * @param[in] ptr Pointer to the allocated memory.
111 | *
112 | */
113 | QBDI_EXPORT void qbdi_alignedFree(void *ptr);
114 |
115 | /*! Allocate a new stack and setup the GPRState accordingly.
116 | * The allocated stack needs to be freed with alignedFree().
117 | *
118 | * @param[in] ctx GPRState which will be setup to use the new stack.
119 | * @param[in] stackSize Size of the stack to be allocated.
120 | * @param[out] stack The newly allocated stack pointer will be returned
121 | * in the variable pointed by stack.
122 | *
123 | * @return True if stack allocation was successfull.
124 | */
125 | QBDI_EXPORT bool qbdi_allocateVirtualStack(GPRState *ctx, uint32_t stackSize,
126 | uint8_t **stack);
127 |
128 | /*! Simulate a call by modifying the stack and registers accordingly.
129 | *
130 | * @param[in] ctx GPRState where the simulated call will be setup.
131 | * The state needs to point to a valid stack for
132 | * example setup with allocateVirtualStack().
133 | * @param[in] returnAddress Return address of the call to simulate.
134 | * @param[in] argNum The number of arguments in the variadic list.
135 | * @param[in] ... A variadic list of arguments.
136 | */
137 | QBDI_EXPORT void qbdi_simulateCall(GPRState *ctx, rword returnAddress,
138 | uint32_t argNum, ...);
139 |
140 | /*! Simulate a call by modifying the stack and registers accordingly
141 | * (stdarg version).
142 | *
143 | * @param[in] ctx GPRState where the simulated call will be setup.
144 | * The state needs to point to a valid stack
145 | * for example setup with allocateVirtualStack().
146 | * @param[in] returnAddress Return address of the call to simulate.
147 | * @param[in] argNum The number of arguments in the va_list object.
148 | * @param[in] ap An stdarg va_list object.
149 | */
150 | QBDI_EXPORT void qbdi_simulateCallV(GPRState *ctx, rword returnAddress,
151 | uint32_t argNum, va_list ap);
152 |
153 | /*! Simulate a call by modifying the stack and registers accordingly
154 | * (C array version).
155 | *
156 | * @param[in] ctx GPRState where the simulated call will be setup.
157 | * The state needs to point to a valid stack for
158 | * example setup with allocateVirtualStack().
159 | * @param[in] returnAddress Return address of the call to simulate.
160 | * @param[in] argNum The number of arguments in the array args.
161 | * @param[in] args An array or arguments.
162 | */
163 | QBDI_EXPORT void qbdi_simulateCallA(GPRState *ctx, rword returnAddress,
164 | uint32_t argNum, const rword *args);
165 |
166 | #ifdef __cplusplus
167 | }
168 | }
169 | #endif
170 |
171 | #endif // QBDI_MEMORY_H_
172 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/Memory.hpp:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_MEMORY_HPP_
19 | #define QBDI_MEMORY_HPP_
20 |
21 | #include
22 | #include
23 | #include
24 | #include
25 | #include
26 |
27 | #include "QBDI/Bitmask.h"
28 | #include "QBDI/Platform.h"
29 | #include "QBDI/Range.h"
30 | #include "QBDI/State.h"
31 |
32 | namespace QBDI {
33 |
34 | /*! Memory access rights.
35 | */
36 | typedef enum {
37 | PF_NONE = 0, /*!< No access */
38 | PF_READ = 1, /*!< Read access */
39 | PF_WRITE = 2, /*!< Write access */
40 | PF_EXEC = 4 /*!< Execution access */
41 | } Permission;
42 |
43 | _QBDI_ENABLE_BITMASK_OPERATORS(Permission)
44 |
45 | /*! Map of a memory area (region).
46 | */
47 | struct MemoryMap {
48 |
49 | Range range; /*!< A range of memory (region), delimited between
50 | * a start and an (excluded) end address.
51 | */
52 | Permission permission; /*!< Region access rights
53 | * (PF_READ, PF_WRITE, PF_EXEC).
54 | */
55 | std::string name; /*!< Region name or path (useful when a region
56 | * is mapping a module).
57 | */
58 |
59 | /* Construct a new (empty) MemoryMap.
60 | */
61 | MemoryMap() : range(0, 0), permission(QBDI::PF_NONE){};
62 |
63 | /*! Construct a new MemoryMap (given some properties).
64 | *
65 | * @param[in] start Range start value.
66 | * @param[in] end Range end value (always excluded).
67 | * @param[in] permission Region access rights (PF_READ, PF_WRITE, PF_EXEC).
68 | * @param[in] name Region name (useful when a region is mapping
69 | * a module).
70 | */
71 | MemoryMap(rword start, rword end, Permission permission, std::string name)
72 | : range(start, end), permission(permission), name(name) {}
73 |
74 | /*! Construct a new MemoryMap (given some properties).
75 | *
76 | * @param[in] range A range of memory (region), delimited between
77 | * a start and an (excluded) end address.
78 | * @param[in] permission Region access rights (PF_READ, PF_WRITE, PF_EXEC).
79 | * @param[in] name Region name (useful when a region is mapping
80 | * a module).
81 | */
82 | MemoryMap(Range range, Permission permission, std::string name)
83 | : range(range), permission(permission), name(name) {}
84 | };
85 |
86 | /*! Get a list of all the memory maps (regions) of a process.
87 | *
88 | * @param[in] pid The identifier of the process.
89 | * @param[in] full_path Return the full path of the module in name field
90 | *
91 | * @return A vector of MemoryMap object.
92 | */
93 | QBDI_EXPORT std::vector getRemoteProcessMaps(QBDI::rword pid,
94 | bool full_path = false);
95 |
96 | /*! Get a list of all the memory maps (regions) of the current process.
97 | *
98 | * @param[in] full_path Return the full path of the module in name field
99 | * @return A vector of MemoryMap object.
100 | */
101 | QBDI_EXPORT std::vector
102 | getCurrentProcessMaps(bool full_path = false);
103 |
104 | /*! Get a list of all the module names loaded in the process memory.
105 | *
106 | * @return A vector of string of module names.
107 | */
108 | QBDI_EXPORT std::vector getModuleNames();
109 |
110 | /*! Allocate a block of memory of a specified sized with an aligned base
111 | * address.
112 | *
113 | * @param[in] size Allocation size in bytes.
114 | * @param[in] align Base address alignement in bytes.
115 | *
116 | * @return Pointer to the allocated memory or NULL in case an error was
117 | * encountered.
118 | *
119 | */
120 | QBDI_EXPORT void *alignedAlloc(size_t size, size_t align);
121 |
122 | /*! Free a block of aligned memory allocated with alignedAlloc.
123 | *
124 | * @param[in] ptr Pointer to the allocated memory.
125 | *
126 | */
127 | QBDI_EXPORT void alignedFree(void *ptr);
128 |
129 | /*! Allocate a new stack and setup the GPRState accordingly.
130 | * The allocated stack needs to be freed with alignedFree().
131 | *
132 | * @param[in] ctx GPRState which will be setup to use the new stack.
133 | * @param[in] stackSize Size of the stack to be allocated.
134 | * @param[out] stack The newly allocated stack pointer will be returned in
135 | * the variable pointed by stack.
136 | *
137 | * @return True if stack allocation was successfull.
138 | */
139 | QBDI_EXPORT bool allocateVirtualStack(GPRState *ctx, uint32_t stackSize,
140 | uint8_t **stack);
141 |
142 | /*! Simulate a call by modifying the stack and registers accordingly
143 | * (std::vector version).
144 | *
145 | * @param[in] ctx GPRState where the simulated call will be setup.
146 | * The state needs to point to a valid stack for
147 | * example setup with allocateVirtualStack().
148 | * @param[in] returnAddress Return address of the call to simulate.
149 | * @param[in] args A list of arguments.
150 | */
151 | QBDI_EXPORT void simulateCall(GPRState *ctx, rword returnAddress,
152 | const std::vector &args = {});
153 |
154 | /*! Simulate a call by modifying the stack and registers accordingly
155 | * (stdarg version).
156 | *
157 | * @param[in] ctx GPRState where the simulated call will be setup.
158 | * The state needs to point to a valid stack for
159 | * example setup with allocateVirtualStack().
160 | * @param[in] returnAddress Return address of the call to simulate.
161 | * @param[in] argNum The number of arguments in the va_list object.
162 | * @param[in] ap An stdarg va_list object.
163 | */
164 | QBDI_EXPORT void simulateCallV(GPRState *ctx, rword returnAddress,
165 | uint32_t argNum, va_list ap);
166 |
167 | /*! Simulate a call by modifying the stack and registers accordingly
168 | * (C array version).
169 | *
170 | * @param[in] ctx GPRState where the simulated call will be setup.
171 | * The state needs to point to a valid stack for
172 | * example setup with allocateVirtualStack().
173 | * @param[in] returnAddress Return address of the call to simulate.
174 | * @param[in] argNum The number of arguments in the array args.
175 | * @param[in] args An array or arguments.
176 | */
177 | QBDI_EXPORT void simulateCallA(GPRState *ctx, rword returnAddress,
178 | uint32_t argNum, const rword *args);
179 |
180 | } // namespace QBDI
181 |
182 | #endif // QBDI_MEMORY_HPP_
183 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/Options.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_OPTION_AARCH64_H_
19 | #define QBDI_OPTION_AARCH64_H_
20 |
21 | #include
22 |
23 | #include "QBDI/Bitmask.h"
24 | #include "QBDI/Platform.h"
25 |
26 | #ifdef __cplusplus
27 | namespace QBDI {
28 | #endif
29 |
30 | typedef enum {
31 | _QBDI_EI(NO_OPT) = 0, /*!< Default value */
32 | // general options between 0 and 23
33 | _QBDI_EI(OPT_DISABLE_FPR) = 1 << 0, /*!< Disable all operation on FPU
34 | * (SSE, AVX, SIMD). May break
35 | * the execution if the target
36 | * use the FPU
37 | */
38 | _QBDI_EI(OPT_DISABLE_OPTIONAL_FPR) = 1 << 1, /*!< Disable context switch
39 | * optimisation when the target
40 | * execblock doesn't used FPR
41 | */
42 | // architecture specific option between 24 and 31
43 | _QBDI_EI(OPT_DISABLE_LOCAL_MONITOR) =
44 | 1 << 24, /*!< Disable the local monitor for instruction like stxr */
45 | _QBDI_EI(OPT_BYPASS_PAUTH) = 1 << 25, /*!< Disable pointeur authentication */
46 | _QBDI_EI(OPT_ENABLE_BTI) = 1 << 26, /*!< Enable BTI on instrumented code*/
47 | } Options;
48 |
49 | _QBDI_ENABLE_BITMASK_OPERATORS(Options)
50 |
51 | #ifdef __cplusplus
52 | }
53 | #endif
54 |
55 | #endif /* QBDI_OPTION_AARCH64_H_ */
56 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/Platform.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_PLATFORM_H_
19 | #define QBDI_PLATFORM_H_
20 |
21 | #include "QBDI/Config.h"
22 |
23 | #ifdef QBDI_PLATFORM_WINDOWS
24 | #define QBDI_ALIGNED(n) __declspec(align(n))
25 | #define QBDI_NOINLINE __declspec(noinline)
26 | #define QBDI_NOSTACKPROTECTOR
27 | #define _QBDI_FORCE_USE
28 | #define _QBDI_UNREACHABLE() __assume(0)
29 | #define QBDI_DISABLE_ASAN __declspec(no_sanitize_address)
30 | #define QBDI_FORCE_EXPORT __declspec(dllexport)
31 | #else
32 | #define QBDI_ALIGNED(n) __attribute__((aligned(n)))
33 | #define QBDI_NOINLINE __attribute__((noinline))
34 | #define QBDI_NOSTACKPROTECTOR __attribute__((no_stack_protector))
35 | #define _QBDI_FORCE_USE __attribute__((__used__))
36 | #define _QBDI_UNREACHABLE() __builtin_unreachable()
37 | #define QBDI_DISABLE_ASAN __attribute__((no_sanitize_address))
38 | #define QBDI_FORCE_EXPORT __attribute__((visibility("default")))
39 | #endif
40 |
41 | #ifdef QBDI_EXPORT_SYM
42 | #define QBDI_EXPORT QBDI_FORCE_EXPORT
43 | #else
44 | #define QBDI_EXPORT
45 | #endif
46 |
47 | #if defined(__has_feature)
48 | #if __has_feature(address_sanitizer)
49 | #define _QBDI_ASAN_ENABLED_
50 | #endif
51 | #endif
52 |
53 | #ifdef __cplusplus
54 | #define _QBDI_EI(X) X
55 | #else
56 | #define _QBDI_EI(X) QBDI_##X
57 | #endif
58 |
59 | #endif // QBDI_PLATFORM_H_
60 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/State.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_STATE_AARCH64_H_
19 | #define QBDI_STATE_AARCH64_H_
20 |
21 | #ifdef __cplusplus
22 | #include
23 | #endif
24 | #include
25 | #include
26 | #include "QBDI/Platform.h"
27 |
28 | // ============================================================================
29 | // AARCH64 Context
30 | // ============================================================================
31 |
32 | #define PRIRWORD PRIx64
33 |
34 | #define QBDI_NUM_FPR 32
35 |
36 | #ifdef __cplusplus
37 | namespace QBDI {
38 | #endif // __cplusplus
39 |
40 | /*! ARM CPU modes.
41 | */
42 | typedef enum { AARCH64 = 0, DEFAULT = 0, COUNT } CPUMode;
43 |
44 | typedef uint64_t rword;
45 | typedef int64_t sword;
46 |
47 | // SPHINX_AARCH64_FPRSTATE_BEGIN
48 | /*! ARM Floating Point Register context.
49 | */
50 | typedef struct QBDI_ALIGNED(8) {
51 | __uint128_t v0;
52 | __uint128_t v1;
53 | __uint128_t v2;
54 | __uint128_t v3;
55 |
56 | __uint128_t v4;
57 | __uint128_t v5;
58 | __uint128_t v6;
59 | __uint128_t v7;
60 |
61 | __uint128_t v8;
62 | __uint128_t v9;
63 | __uint128_t v10;
64 | __uint128_t v11;
65 |
66 | __uint128_t v12;
67 | __uint128_t v13;
68 | __uint128_t v14;
69 | __uint128_t v15;
70 |
71 | __uint128_t v16;
72 | __uint128_t v17;
73 | __uint128_t v18;
74 | __uint128_t v19;
75 |
76 | __uint128_t v20;
77 | __uint128_t v21;
78 | __uint128_t v22;
79 | __uint128_t v23;
80 |
81 | __uint128_t v24;
82 | __uint128_t v25;
83 | __uint128_t v26;
84 | __uint128_t v27;
85 |
86 | __uint128_t v28;
87 | __uint128_t v29;
88 | __uint128_t v30;
89 | __uint128_t v31;
90 |
91 | rword fpcr;
92 | rword fpsr;
93 | } FPRState;
94 | // SPHINX_AARCH64_FPRSTATE_END
95 |
96 | // SPHINX_AARCH64_GPRSTATE_BEGIN
97 | /*! ARM General Purpose Register context.
98 | */
99 | typedef struct QBDI_ALIGNED(8) {
100 | rword x0;
101 | rword x1;
102 | rword x2;
103 | rword x3;
104 | rword x4;
105 | rword x5;
106 | rword x6;
107 | rword x7;
108 | rword x8;
109 | rword x9;
110 | rword x10;
111 | rword x11;
112 | rword x12;
113 | rword x13;
114 | rword x14;
115 | rword x15;
116 | rword x16;
117 | rword x17;
118 | rword x18;
119 | rword x19;
120 | rword x20;
121 | rword x21;
122 | rword x22;
123 | rword x23;
124 | rword x24;
125 | rword x25;
126 | rword x26;
127 | rword x27;
128 | rword x28;
129 | rword x29; // FP (x29)
130 | rword lr; // LR (x30)
131 |
132 | rword sp;
133 | rword nzcv;
134 | rword pc;
135 | // ? rword daif; ?
136 |
137 | /* Internal CPU state
138 | * Local monitor state for exclusive load/store instruction
139 | */
140 | struct {
141 | rword addr;
142 | rword enable; /* 0=>disable, 1=>exclusive state, use a rword to not break
143 | align */
144 | } localMonitor;
145 |
146 | } GPRState;
147 | // SPHINX_AARCH64_GPRSTATE_END
148 |
149 | static const char *const GPR_NAMES[] = {
150 | "X0", "X1", "X2", "X3", "X4", "X5", "X6", "X7", "X8", "X9",
151 | "X10", "X11", "X12", "X13", "X14", "X15", "X16", "X17", "X18", "X19",
152 | "X20", "X21", "X22", "X23", "X24", "X25", "X26", "X27", "X28",
153 | "X29", // FP
154 | "LR",
155 |
156 | "SP", "NZCV", "PC",
157 | };
158 |
159 | static const unsigned int NUM_GPR = 32;
160 | static const unsigned int AVAILABLE_GPR = 28;
161 | static const unsigned int REG_RETURN = 0;
162 | static const unsigned int REG_BP = 29;
163 | static const unsigned int REG_LR = 30;
164 | static const unsigned int REG_SP = 31;
165 | static const unsigned int REG_PC = 33;
166 | static const unsigned int REG_FLAG = 32;
167 |
168 | #ifdef __cplusplus
169 | #define QBDI_GPR_GET(state, i) (reinterpret_cast(state)[i])
170 | #define QBDI_GPR_SET(state, i, v) \
171 | (reinterpret_cast(state)[i] = v)
172 | #else
173 | #define QBDI_GPR_GET(state, i) (((rword *)state)[i])
174 | #define QBDI_GPR_SET(state, i, v) (((rword *)state)[i] = v)
175 | #endif
176 |
177 | #ifdef __cplusplus
178 | } // namespace QBDI
179 | #endif // __cplusplus
180 |
181 | #endif // QBDI_STATE_AARCH64_H_
182 |
--------------------------------------------------------------------------------
/app/src/main/cpp/QBDI/Version.h:
--------------------------------------------------------------------------------
1 | /*
2 | * This file is part of QBDI.
3 | *
4 | * Copyright 2017 - 2023 Quarkslab
5 | *
6 | * Licensed under the Apache License, Version 2.0 (the "License");
7 | * you may not use this file except in compliance with the License.
8 | * You may obtain a copy of the License at
9 | *
10 | * http://www.apache.org/licenses/LICENSE-2.0
11 | *
12 | * Unless required by applicable law or agreed to in writing, software
13 | * distributed under the License is distributed on an "AS IS" BASIS,
14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 | * See the License for the specific language governing permissions and
16 | * limitations under the License.
17 | */
18 | #ifndef QBDI_VERSION_H_
19 | #define QBDI_VERSION_H_
20 |
21 | #include
22 | #include "QBDI/Platform.h"
23 |
24 | #ifdef __cplusplus
25 | namespace QBDI {
26 | extern "C" {
27 | #endif
28 |
29 | #define QBDI_VERSION ((0 << 16 ) | \
30 | (10 << 8 ) | \
31 | (0 << 0 ))
32 | #define QBDI_VERSION_STRING "0.10.0"
33 |
34 | #define QBDI_VERSION_MAJOR 0
35 | #define QBDI_VERSION_MINOR 10
36 | #define QBDI_VERSION_PATCH 0
37 | #define QBDI_VERSION_DEV 0
38 |
39 | #define QBDI_ARCHITECTURE_STRING "AARCH64"
40 | #define QBDI_PLATFORM_STRING "android"
41 |
42 | /*! Return QBDI version.
43 | *
44 | * @param[out] version QBDI version encoded as an unsigned integer (0xMMmmpp).
45 | * @return QBDI version as a string (major.minor.patch).
46 | */
47 | QBDI_EXPORT const char* qbdi_getVersion(uint32_t* version);
48 |
49 | #ifdef __cplusplus
50 | /*! Return QBDI version.
51 | *
52 | * @param[out] version QBDI version encoded as an unsigned integer (0xMMmmpp).
53 | * @return QBDI version as a string (major.minor.patch).
54 | */
55 | inline const char* getVersion(uint32_t* version) {
56 | return qbdi_getVersion(version);
57 | }
58 |
59 | } // "C"
60 | } // QBDI::
61 | #endif
62 |
63 | #endif // QBDI_VERSION_H_
64 |
--------------------------------------------------------------------------------
/app/src/main/cpp/demo/il2cpp-class.h:
--------------------------------------------------------------------------------
1 | #ifndef IL2CPP_CLASS
2 | #define IL2CPP_CLASS
3 |
4 | typedef uint16_t Il2CppChar;
5 | typedef uintptr_t il2cpp_array_size_t;
6 | typedef int32_t TypeDefinitionIndex;
7 | typedef int32_t GenericParameterIndex;
8 | typedef char Il2CppNativeChar;
9 |
10 | typedef struct Il2CppMemoryCallbacks Il2CppMemoryCallbacks;
11 | typedef struct Il2CppImage Il2CppImage;
12 | typedef struct Il2CppClass Il2CppClass;
13 | typedef struct Il2CppArrayBounds Il2CppArrayBounds;
14 | typedef struct Il2CppAssembly Il2CppAssembly;
15 | typedef struct Il2CppArrayType Il2CppArrayType;
16 | typedef struct Il2CppGenericClass Il2CppGenericClass;
17 | typedef struct Il2CppReflectionType Il2CppReflectionType;
18 | typedef struct MonitorData MonitorData;
19 | typedef Il2CppClass Il2CppVTable;
20 | typedef struct EventInfo EventInfo;
21 | typedef struct FieldInfo FieldInfo;
22 | typedef struct PropertyInfo PropertyInfo;
23 | typedef struct Il2CppDomain Il2CppDomain;
24 | typedef struct Il2CppException Il2CppException;
25 | typedef struct Il2CppObject Il2CppObject;
26 | typedef struct Il2CppReflectionMethod Il2CppReflectionMethod;
27 | typedef struct Il2CppString Il2CppString;
28 | typedef struct Il2CppThread Il2CppThread;
29 | typedef struct Il2CppStackFrameInfo Il2CppStackFrameInfo;
30 | typedef struct Il2CppManagedMemorySnapshot Il2CppManagedMemorySnapshot;
31 | typedef struct Il2CppDebuggerTransport Il2CppDebuggerTransport;
32 | typedef struct Il2CppMethodDebugInfo Il2CppMethodDebugInfo;
33 | typedef struct Il2CppCustomAttrInfo Il2CppCustomAttrInfo;
34 | typedef const struct ___Il2CppMetadataTypeHandle *Il2CppMetadataTypeHandle;
35 | typedef const struct ___Il2CppMetadataGenericParameterHandle *Il2CppMetadataGenericParameterHandle;
36 |
37 | typedef void (*Il2CppMethodPointer)();
38 |
39 | typedef void (*il2cpp_register_object_callback)(Il2CppObject **arr, int size, void *userdata);
40 |
41 | typedef void *(*il2cpp_liveness_reallocate_callback)(void *ptr, size_t size, void *userdata);
42 |
43 | typedef void (*Il2CppFrameWalkFunc)(const Il2CppStackFrameInfo *info, void *user_data);
44 |
45 | typedef size_t(*Il2CppBacktraceFunc)(Il2CppMethodPointer *buffer, size_t maxSize);
46 |
47 | typedef const Il2CppNativeChar *(*Il2CppSetFindPlugInCallback)(const Il2CppNativeChar *);
48 |
49 | typedef void (*Il2CppLogCallback)(const char *);
50 |
51 | typedef enum {
52 | IL2CPP_UNHANDLED_POLICY_LEGACY,
53 | IL2CPP_UNHANDLED_POLICY_CURRENT
54 | } Il2CppRuntimeUnhandledExceptionPolicy;
55 |
56 | typedef enum {
57 | IL2CPP_GC_MODE_DISABLED = 0,
58 | IL2CPP_GC_MODE_ENABLED = 1,
59 | IL2CPP_GC_MODE_MANUAL = 2
60 | } Il2CppGCMode;
61 |
62 | typedef enum Il2CppStat {
63 | IL2CPP_STAT_NEW_OBJECT_COUNT,
64 | IL2CPP_STAT_INITIALIZED_CLASS_COUNT,
65 | IL2CPP_STAT_METHOD_COUNT,
66 | IL2CPP_STAT_CLASS_STATIC_DATA_SIZE,
67 | IL2CPP_STAT_GENERIC_INSTANCE_COUNT,
68 | IL2CPP_STAT_GENERIC_CLASS_COUNT,
69 | IL2CPP_STAT_INFLATED_METHOD_COUNT,
70 | IL2CPP_STAT_INFLATED_TYPE_COUNT,
71 | } Il2CppStat;
72 |
73 | typedef enum Il2CppTypeEnum {
74 | IL2CPP_TYPE_END = 0x00,
75 | IL2CPP_TYPE_VOID = 0x01,
76 | IL2CPP_TYPE_BOOLEAN = 0x02,
77 | IL2CPP_TYPE_CHAR = 0x03,
78 | IL2CPP_TYPE_I1 = 0x04,
79 | IL2CPP_TYPE_U1 = 0x05,
80 | IL2CPP_TYPE_I2 = 0x06,
81 | IL2CPP_TYPE_U2 = 0x07,
82 | IL2CPP_TYPE_I4 = 0x08,
83 | IL2CPP_TYPE_U4 = 0x09,
84 | IL2CPP_TYPE_I8 = 0x0a,
85 | IL2CPP_TYPE_U8 = 0x0b,
86 | IL2CPP_TYPE_R4 = 0x0c,
87 | IL2CPP_TYPE_R8 = 0x0d,
88 | IL2CPP_TYPE_STRING = 0x0e,
89 | IL2CPP_TYPE_PTR = 0x0f,
90 | IL2CPP_TYPE_BYREF = 0x10,
91 | IL2CPP_TYPE_VALUETYPE = 0x11,
92 | IL2CPP_TYPE_CLASS = 0x12,
93 | IL2CPP_TYPE_VAR = 0x13,
94 | IL2CPP_TYPE_ARRAY = 0x14,
95 | IL2CPP_TYPE_GENERICINST = 0x15,
96 | IL2CPP_TYPE_TYPEDBYREF = 0x16,
97 | IL2CPP_TYPE_I = 0x18,
98 | IL2CPP_TYPE_U = 0x19,
99 | IL2CPP_TYPE_FNPTR = 0x1b,
100 | IL2CPP_TYPE_OBJECT = 0x1c,
101 | IL2CPP_TYPE_SZARRAY = 0x1d,
102 | IL2CPP_TYPE_MVAR = 0x1e,
103 | IL2CPP_TYPE_CMOD_REQD = 0x1f,
104 | IL2CPP_TYPE_CMOD_OPT = 0x20,
105 | IL2CPP_TYPE_INTERNAL = 0x21,
106 | IL2CPP_TYPE_MODIFIER = 0x40,
107 | IL2CPP_TYPE_SENTINEL = 0x41,
108 | IL2CPP_TYPE_PINNED = 0x45,
109 | IL2CPP_TYPE_ENUM = 0x55,
110 | IL2CPP_TYPE_IL2CPP_TYPE_INDEX = 0xff
111 | } Il2CppTypeEnum;
112 |
113 | typedef struct Il2CppType {
114 | union {
115 | void *dummy;
116 | TypeDefinitionIndex klassIndex;
117 | const Il2CppType *type;
118 | Il2CppArrayType *array;
119 | GenericParameterIndex genericParameterIndex;
120 | Il2CppGenericClass *generic_class;
121 | } data;
122 | unsigned int attrs: 16;
123 | Il2CppTypeEnum type: 8;
124 | unsigned int num_mods: 6;
125 | unsigned int byref: 1;
126 | unsigned int pinned: 1;
127 | } Il2CppType;
128 |
129 | typedef struct MethodInfo {
130 | Il2CppMethodPointer methodPointer;
131 | } MethodInfo;
132 |
133 | typedef struct Il2CppObject {
134 | union {
135 | Il2CppClass *klass;
136 | Il2CppVTable *vtable;
137 | };
138 | MonitorData *monitor;
139 | } Il2CppObject;
140 |
141 | typedef struct Il2CppArray {
142 | Il2CppObject obj;
143 | Il2CppArrayBounds *bounds;
144 | il2cpp_array_size_t max_length;
145 | void *vector[32];
146 | } Il2CppArray;
147 |
148 | #endif
149 |
--------------------------------------------------------------------------------
/app/src/main/cpp/demo/il2cpp-tabledefs.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 |
3 | /*
4 | * Field Attributes (21.1.5).
5 | */
6 |
7 | #define FIELD_ATTRIBUTE_FIELD_ACCESS_MASK 0x0007
8 | #define FIELD_ATTRIBUTE_COMPILER_CONTROLLED 0x0000
9 | #define FIELD_ATTRIBUTE_PRIVATE 0x0001
10 | #define FIELD_ATTRIBUTE_FAM_AND_ASSEM 0x0002
11 | #define FIELD_ATTRIBUTE_ASSEMBLY 0x0003
12 | #define FIELD_ATTRIBUTE_FAMILY 0x0004
13 | #define FIELD_ATTRIBUTE_FAM_OR_ASSEM 0x0005
14 | #define FIELD_ATTRIBUTE_PUBLIC 0x0006
15 |
16 | #define FIELD_ATTRIBUTE_STATIC 0x0010
17 | #define FIELD_ATTRIBUTE_INIT_ONLY 0x0020
18 | #define FIELD_ATTRIBUTE_LITERAL 0x0040
19 | #define FIELD_ATTRIBUTE_NOT_SERIALIZED 0x0080
20 | #define FIELD_ATTRIBUTE_SPECIAL_NAME 0x0200
21 | #define FIELD_ATTRIBUTE_PINVOKE_IMPL 0x2000
22 |
23 | /* For runtime use only */
24 | #define FIELD_ATTRIBUTE_RESERVED_MASK 0x9500
25 | #define FIELD_ATTRIBUTE_RT_SPECIAL_NAME 0x0400
26 | #define FIELD_ATTRIBUTE_HAS_FIELD_MARSHAL 0x1000
27 | #define FIELD_ATTRIBUTE_HAS_DEFAULT 0x8000
28 | #define FIELD_ATTRIBUTE_HAS_FIELD_RVA 0x0100
29 |
30 | /*
31 | * Method Attributes (22.1.9)
32 | */
33 |
34 | #define METHOD_IMPL_ATTRIBUTE_CODE_TYPE_MASK 0x0003
35 | #define METHOD_IMPL_ATTRIBUTE_IL 0x0000
36 | #define METHOD_IMPL_ATTRIBUTE_NATIVE 0x0001
37 | #define METHOD_IMPL_ATTRIBUTE_OPTIL 0x0002
38 | #define METHOD_IMPL_ATTRIBUTE_RUNTIME 0x0003
39 |
40 | #define METHOD_IMPL_ATTRIBUTE_MANAGED_MASK 0x0004
41 | #define METHOD_IMPL_ATTRIBUTE_UNMANAGED 0x0004
42 | #define METHOD_IMPL_ATTRIBUTE_MANAGED 0x0000
43 |
44 | #define METHOD_IMPL_ATTRIBUTE_FORWARD_REF 0x0010
45 | #define METHOD_IMPL_ATTRIBUTE_PRESERVE_SIG 0x0080
46 | #define METHOD_IMPL_ATTRIBUTE_INTERNAL_CALL 0x1000
47 | #define METHOD_IMPL_ATTRIBUTE_SYNCHRONIZED 0x0020
48 | #define METHOD_IMPL_ATTRIBUTE_NOINLINING 0x0008
49 | #define METHOD_IMPL_ATTRIBUTE_MAX_METHOD_IMPL_VAL 0xffff
50 |
51 | #define METHOD_ATTRIBUTE_MEMBER_ACCESS_MASK 0x0007
52 | #define METHOD_ATTRIBUTE_COMPILER_CONTROLLED 0x0000
53 | #define METHOD_ATTRIBUTE_PRIVATE 0x0001
54 | #define METHOD_ATTRIBUTE_FAM_AND_ASSEM 0x0002
55 | #define METHOD_ATTRIBUTE_ASSEM 0x0003
56 | #define METHOD_ATTRIBUTE_FAMILY 0x0004
57 | #define METHOD_ATTRIBUTE_FAM_OR_ASSEM 0x0005
58 | #define METHOD_ATTRIBUTE_PUBLIC 0x0006
59 |
60 | #define METHOD_ATTRIBUTE_STATIC 0x0010
61 | #define METHOD_ATTRIBUTE_FINAL 0x0020
62 | #define METHOD_ATTRIBUTE_VIRTUAL 0x0040
63 | #define METHOD_ATTRIBUTE_HIDE_BY_SIG 0x0080
64 |
65 | #define METHOD_ATTRIBUTE_VTABLE_LAYOUT_MASK 0x0100
66 | #define METHOD_ATTRIBUTE_REUSE_SLOT 0x0000
67 | #define METHOD_ATTRIBUTE_NEW_SLOT 0x0100
68 |
69 | #define METHOD_ATTRIBUTE_STRICT 0x0200
70 | #define METHOD_ATTRIBUTE_ABSTRACT 0x0400
71 | #define METHOD_ATTRIBUTE_SPECIAL_NAME 0x0800
72 |
73 | #define METHOD_ATTRIBUTE_PINVOKE_IMPL 0x2000
74 | #define METHOD_ATTRIBUTE_UNMANAGED_EXPORT 0x0008
75 |
76 | /*
77 | * For runtime use only
78 | */
79 | #define METHOD_ATTRIBUTE_RESERVED_MASK 0xd000
80 | #define METHOD_ATTRIBUTE_RT_SPECIAL_NAME 0x1000
81 | #define METHOD_ATTRIBUTE_HAS_SECURITY 0x4000
82 | #define METHOD_ATTRIBUTE_REQUIRE_SEC_OBJECT 0x8000
83 |
84 | /*
85 | * Type Attributes (21.1.13).
86 | */
87 | #define TYPE_ATTRIBUTE_VISIBILITY_MASK 0x00000007
88 | #define TYPE_ATTRIBUTE_NOT_PUBLIC 0x00000000
89 | #define TYPE_ATTRIBUTE_PUBLIC 0x00000001
90 | #define TYPE_ATTRIBUTE_NESTED_PUBLIC 0x00000002
91 | #define TYPE_ATTRIBUTE_NESTED_PRIVATE 0x00000003
92 | #define TYPE_ATTRIBUTE_NESTED_FAMILY 0x00000004
93 | #define TYPE_ATTRIBUTE_NESTED_ASSEMBLY 0x00000005
94 | #define TYPE_ATTRIBUTE_NESTED_FAM_AND_ASSEM 0x00000006
95 | #define TYPE_ATTRIBUTE_NESTED_FAM_OR_ASSEM 0x00000007
96 |
97 | #define TYPE_ATTRIBUTE_LAYOUT_MASK 0x00000018
98 | #define TYPE_ATTRIBUTE_AUTO_LAYOUT 0x00000000
99 | #define TYPE_ATTRIBUTE_SEQUENTIAL_LAYOUT 0x00000008
100 | #define TYPE_ATTRIBUTE_EXPLICIT_LAYOUT 0x00000010
101 |
102 | #define TYPE_ATTRIBUTE_CLASS_SEMANTIC_MASK 0x00000020
103 | #define TYPE_ATTRIBUTE_CLASS 0x00000000
104 | #define TYPE_ATTRIBUTE_INTERFACE 0x00000020
105 |
106 | #define TYPE_ATTRIBUTE_ABSTRACT 0x00000080
107 | #define TYPE_ATTRIBUTE_SEALED 0x00000100
108 | #define TYPE_ATTRIBUTE_SPECIAL_NAME 0x00000400
109 |
110 | #define TYPE_ATTRIBUTE_IMPORT 0x00001000
111 | #define TYPE_ATTRIBUTE_SERIALIZABLE 0x00002000
112 |
113 | #define TYPE_ATTRIBUTE_STRING_FORMAT_MASK 0x00030000
114 | #define TYPE_ATTRIBUTE_ANSI_CLASS 0x00000000
115 | #define TYPE_ATTRIBUTE_UNICODE_CLASS 0x00010000
116 | #define TYPE_ATTRIBUTE_AUTO_CLASS 0x00020000
117 |
118 | #define TYPE_ATTRIBUTE_BEFORE_FIELD_INIT 0x00100000
119 | #define TYPE_ATTRIBUTE_FORWARDER 0x00200000
120 |
121 | #define TYPE_ATTRIBUTE_RESERVED_MASK 0x00040800
122 | #define TYPE_ATTRIBUTE_RT_SPECIAL_NAME 0x00000800
123 | #define TYPE_ATTRIBUTE_HAS_SECURITY 0x00040000
124 |
125 | /*
126 | * Flags for Params (22.1.12)
127 | */
128 | #define PARAM_ATTRIBUTE_IN 0x0001
129 | #define PARAM_ATTRIBUTE_OUT 0x0002
130 | #define PARAM_ATTRIBUTE_OPTIONAL 0x0010
131 | #define PARAM_ATTRIBUTE_RESERVED_MASK 0xf000
132 | #define PARAM_ATTRIBUTE_HAS_DEFAULT 0x1000
133 | #define PARAM_ATTRIBUTE_HAS_FIELD_MARSHAL 0x2000
134 | #define PARAM_ATTRIBUTE_UNUSED 0xcfe0
135 |
136 | // Flags for Generic Parameters (II.23.1.7)
137 | #define IL2CPP_GENERIC_PARAMETER_ATTRIBUTE_NON_VARIANT 0x00
138 | #define IL2CPP_GENERIC_PARAMETER_ATTRIBUTE_COVARIANT 0x01
139 | #define IL2CPP_GENERIC_PARAMETER_ATTRIBUTE_CONTRAVARIANT 0x02
140 | #define IL2CPP_GENERIC_PARAMETER_ATTRIBUTE_VARIANCE_MASK 0x03
141 | #define IL2CPP_GENERIC_PARAMETER_ATTRIBUTE_REFERENCE_TYPE_CONSTRAINT 0x04
142 | #define IL2CPP_GENERIC_PARAMETER_ATTRIBUTE_NOT_NULLABLE_VALUE_TYPE_CONSTRAINT 0x08
143 | #define IL2CPP_GENERIC_PARAMETER_ATTRIBUTE_DEFAULT_CONSTRUCTOR_CONSTRAINT 0x10
144 | #define IL2CPP_GENERIC_PARAMETER_ATTRIBUTE_SPECIAL_CONSTRAINT_MASK 0x1C
145 |
146 | /**
147 | * 21.5 AssemblyRefs
148 | */
149 | #define ASSEMBLYREF_FULL_PUBLIC_KEY_FLAG 0x00000001
150 | #define ASSEMBLYREF_RETARGETABLE_FLAG 0x00000100
151 | #define ASSEMBLYREF_ENABLEJITCOMPILE_TRACKING_FLAG 0x00008000
152 | #define ASSEMBLYREF_DISABLEJITCOMPILE_OPTIMIZER_FLAG 0x00004000
153 |
--------------------------------------------------------------------------------
/app/src/main/cpp/demo/il2cpp_dumper.h:
--------------------------------------------------------------------------------
1 | //
2 | // Created by Mrack on 2024/4/30.
3 | //
4 |
5 | #ifndef XPOSEDNHOOK_IL2CPP_DUMPER_H
6 | #define XPOSEDNHOOK_IL2CPP_DUMPER_H
7 |
8 | #include
9 | #include
10 | #include