├── Logcat.bat ├── README.md ├── compile.bat └── jni ├── Android.mk ├── Application.mk ├── Includes ├── Logger.h └── Utils.h ├── Substrate ├── Buffer.hpp ├── CydiaSubstrate.h ├── SubstrateARM.hpp ├── SubstrateDebug.cpp ├── SubstrateDebug.hpp ├── SubstrateHook.cpp ├── SubstrateHook.h ├── SubstrateLog.hpp ├── SubstratePosixMemory.cpp ├── SubstrateX86.hpp ├── hde64.c ├── hde64.h └── table64.h └── main.cpp /Logcat.bat: -------------------------------------------------------------------------------- 1 | @ECHO off 2 | COLOR 00 3 | adb logcat -s "DarkDawn" -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Android Hooking Template 2 | This is a simple template for the usage of Cydia Substrate. 3 | 4 | ### Installation: 5 | * Download Android NDK, Revision 16b from: https://developer.android.com/ndk/downloads/older_releases 6 | * Open compile.bat & paste your ndk-build path location in the first line. (remove mine) 7 | * Download this github files somewhere to your PC. 8 | 9 | 10 | A thread on a forum with mod menu source https://guidedhacking.com/threads/substrate-hooking-template-mod-menu.14674/#post-89655 11 | 12 | 13 | Also consider joining my Discord Server https://discord.gg/bmRCJQ3 14 | -------------------------------------------------------------------------------- /compile.bat: -------------------------------------------------------------------------------- 1 | D:\android-ndk-r16b\ndk-build 2 | NDK_PROJECT_PATH=\ 3 | NDK_APPLICATION_MK=\jni\Application.mk -------------------------------------------------------------------------------- /jni/Android.mk: -------------------------------------------------------------------------------- 1 | LOCAL_PATH := $(call my-dir) 2 | MAIN_LOCAL_PATH := $(call my-dir) 3 | include $(CLEAR_VARS) 4 | LOCAL_MODULE := wolve 5 | 6 | LOCAL_CFLAGS := -Wno-error=format-security -fpermissive 7 | LOCAL_CFLAGS += -fno-rtti -fno-exceptions 8 | 9 | LOCAL_C_INCLUDES += $(MAIN_LOCAL_PATH) 10 | 11 | LOCAL_SRC_FILES := main.cpp \ 12 | Substrate/hde64.c \ 13 | Substrate/SubstrateDebug.cpp \ 14 | Substrate/SubstrateHook.cpp \ 15 | Substrate/SubstratePosixMemory.cpp \ 16 | 17 | LOCAL_LDLIBS := -llog 18 | 19 | include $(BUILD_SHARED_LIBRARY) 20 | -------------------------------------------------------------------------------- /jni/Application.mk: -------------------------------------------------------------------------------- 1 | APP_ABI := armeabi-v7a x86 2 | APP_OPTIM := release 3 | APP_PLATFORM := android-27 4 | APP_STL := system 5 | APP_STL := gnustl_static 6 | APP_THIN_ARCHIVE := true 7 | APP_PIE:= true 8 | 9 | 10 | ifneq ($(APP_OPTIM), debug) 11 | $(info APP_OPTIM is $(APP_OPTIM) ...) 12 | APP_LDFLAGS += -Wl,--strip-all 13 | APP_CFLAGS += -fvisibility=hidden -fvisibility-inlines-hidden 14 | APP_CFLAGS += -g0 -O3 -fomit-frame-pointer -ffunction-sections -fdata-sections 15 | endif 16 | -------------------------------------------------------------------------------- /jni/Includes/Logger.h: -------------------------------------------------------------------------------- 1 | #ifndef DAWN_LOGGER_H 2 | #define DAWN_LOGGER_H 3 | #include 4 | 5 | enum daLogType { 6 | daDEBUG = 3, 7 | daERROR = 6, 8 | daINFO = 4, 9 | daWARN = 5 10 | }; 11 | 12 | //Change this to another Log Tag if ya want. IN the batch script I provide you change the log tag then too 13 | #define TAG "DarkDawn" 14 | 15 | #define LOGD(...) ((void)__android_log_print(daDEBUG, TAG, __VA_ARGS__)) 16 | #define LOGE(...) ((void)__android_log_print(daERROR, TAG, __VA_ARGS__)) 17 | #define LOGI(...) ((void)__android_log_print(daINFO, TAG, __VA_ARGS__)) 18 | #define LOGW(...) ((void)__android_log_print(daWARN, TAG, __VA_ARGS__)) 19 | 20 | #endif //DAWN_LOGGER_H -------------------------------------------------------------------------------- /jni/Includes/Utils.h: -------------------------------------------------------------------------------- 1 | #ifndef UTILS_H 2 | #define UTILS_H 3 | #include 4 | #include 5 | 6 | typedef unsigned long DWORD; 7 | static uintptr_t libBase; 8 | 9 | DWORD findLibrary(const char *library); 10 | DWORD getAbsoluteAddress(const char* libraryName, DWORD relativeAddr); 11 | bool isLibraryLoaded(const char *libraryName); 12 | 13 | DWORD findLibrary(const char *library) { 14 | char filename[0xFF] = {0}, 15 | buffer[1024] = {0}; 16 | FILE *fp = NULL; 17 | DWORD address = 0; 18 | 19 | sprintf( filename, "/proc/self/maps"); 20 | 21 | fp = fopen( filename, "rt" ); 22 | if( fp == NULL ){ 23 | perror("fopen"); 24 | goto done; 25 | } 26 | 27 | while( fgets( buffer, sizeof(buffer), fp ) ) { 28 | if( strstr( buffer, library ) ){ 29 | address = (DWORD)strtoul( buffer, NULL, 16 ); 30 | goto done; 31 | } 32 | } 33 | 34 | done: 35 | 36 | if(fp){ 37 | fclose(fp); 38 | } 39 | 40 | return address; 41 | } 42 | 43 | DWORD getAbsoluteAddress(const char* libraryName, DWORD relativeAddr) { 44 | libBase = findLibrary(libraryName); 45 | if (libBase == 0) 46 | return 0; 47 | return (reinterpret_cast(libBase + relativeAddr)); 48 | } 49 | 50 | bool isLibraryLoaded(const char *libraryName) { 51 | char line[512] = {0}; 52 | FILE *fp = fopen("/proc/self/maps", "rt"); 53 | if (fp != NULL) { 54 | while (fgets(line, sizeof(line), fp)) { 55 | if (strstr(line, libraryName)) 56 | return true; 57 | } 58 | fclose(fp); 59 | } 60 | return false; 61 | } 62 | #endif -------------------------------------------------------------------------------- /jni/Substrate/Buffer.hpp: -------------------------------------------------------------------------------- 1 | /* Cydia Substrate - Powerful Code Insertion Platform 2 | * Copyright (C) 2008-2011 Jay Freeman (saurik) 3 | */ 4 | 5 | /* GNU Lesser General Public License, Version 3 {{{ */ 6 | /* 7 | * Substrate is free software: you can redistribute it and/or modify it under 8 | * the terms of the GNU Lesser General Public License as published by the 9 | * Free Software Foundation, either version 3 of the License, or (at your 10 | * option) any later version. 11 | * 12 | * Substrate is distributed in the hope that it will be useful, but WITHOUT 13 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 15 | * License for more details. 16 | * 17 | * You should have received a copy of the GNU Lesser General Public License 18 | * along with Substrate. If not, see . 19 | **/ 20 | /* }}} */ 21 | 22 | #ifndef SUBSTRATE_BUFFER_HPP 23 | #define SUBSTRATE_BUFFER_HPP 24 | 25 | #include 26 | 27 | template 28 | _disused static _finline void MSWrite(uint8_t *&buffer, Type_ value) { 29 | *reinterpret_cast(buffer) = value; 30 | buffer += sizeof(Type_); 31 | } 32 | 33 | _disused static _finline void MSWrite(uint8_t *&buffer, uint8_t *data, size_t size) { 34 | memcpy(buffer, data, size); 35 | buffer += size; 36 | } 37 | 38 | #endif//SUBSTRATE_BUFFER_HPP 39 | -------------------------------------------------------------------------------- /jni/Substrate/CydiaSubstrate.h: -------------------------------------------------------------------------------- 1 | /* Cydia Substrate - Powerful Code Insertion Platform 2 | * Copyright (C) 2008-2011 Jay Freeman (saurik) 3 | */ 4 | 5 | /* GNU Lesser General Public License, Version 3 {{{ */ 6 | /* 7 | * Substrate is free software: you can redistribute it and/or modify it under 8 | * the terms of the GNU Lesser General Public License as published by the 9 | * Free Software Foundation, either version 3 of the License, or (at your 10 | * option) any later version. 11 | * 12 | * Substrate is distributed in the hope that it will be useful, but WITHOUT 13 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 15 | * License for more details. 16 | * 17 | * You should have received a copy of the GNU Lesser General Public License 18 | * along with Substrate. If not, see . 19 | **/ 20 | /* }}} */ 21 | 22 | #ifndef SUBSTRATE_H_ 23 | #define SUBSTRATE_H_ 24 | 25 | #ifdef __APPLE__ 26 | #ifdef __cplusplus 27 | extern "C" { 28 | #endif 29 | #include 30 | #ifdef __cplusplus 31 | } 32 | #endif 33 | 34 | #include 35 | #include 36 | #endif 37 | 38 | #include 39 | #include 40 | 41 | #define _finline \ 42 | inline __attribute__((__always_inline__)) 43 | #define _disused \ 44 | __attribute__((__unused__)) 45 | 46 | #define _extern \ 47 | extern "C" __attribute__((__visibility__("default"))) 48 | 49 | #ifdef __cplusplus 50 | #define _default(value) = value 51 | #else 52 | #define _default(value) 53 | #endif 54 | 55 | #ifdef __cplusplus 56 | extern "C" { 57 | #endif 58 | 59 | bool MSHookProcess(pid_t pid, const char *library); 60 | 61 | typedef const void *MSImageRef; 62 | 63 | MSImageRef MSGetImageByName(const char *file); 64 | void *MSFindSymbol(MSImageRef image, const char *name); 65 | 66 | void MSHookFunction(void *symbol, void *replace, void **result); 67 | 68 | #ifdef __APPLE__ 69 | #ifdef __arm__ 70 | __attribute__((__deprecated__)) 71 | IMP MSHookMessage(Class _class, SEL sel, IMP imp, const char *prefix _default(NULL)); 72 | #endif 73 | void MSHookMessageEx(Class _class, SEL sel, IMP imp, IMP *result); 74 | #endif 75 | 76 | #ifdef SubstrateInternal 77 | typedef void *SubstrateAllocatorRef; 78 | typedef struct __SubstrateProcess *SubstrateProcessRef; 79 | typedef struct __SubstrateMemory *SubstrateMemoryRef; 80 | 81 | SubstrateProcessRef SubstrateProcessCreate(SubstrateAllocatorRef allocator, pid_t pid); 82 | void SubstrateProcessRelease(SubstrateProcessRef process); 83 | 84 | SubstrateMemoryRef SubstrateMemoryCreate(SubstrateAllocatorRef allocator, SubstrateProcessRef process, void *data, size_t size); 85 | void SubstrateMemoryRelease(SubstrateMemoryRef memory); 86 | #endif 87 | 88 | #ifdef __cplusplus 89 | } 90 | #endif 91 | 92 | #ifdef __cplusplus 93 | 94 | #ifdef SubstrateInternal 95 | struct SubstrateHookMemory { 96 | SubstrateMemoryRef handle_; 97 | 98 | SubstrateHookMemory(SubstrateProcessRef process, void *data, size_t size) : 99 | handle_(SubstrateMemoryCreate(NULL, NULL, data, size)) 100 | { 101 | } 102 | 103 | ~SubstrateHookMemory() { 104 | if (handle_ != NULL) 105 | SubstrateMemoryRelease(handle_); 106 | } 107 | }; 108 | #endif 109 | 110 | 111 | template 112 | static inline void MSHookFunction(Type_ *symbol, Type_ *replace, Type_ **result) { 113 | MSHookFunction( 114 | reinterpret_cast(symbol), 115 | reinterpret_cast(replace), 116 | reinterpret_cast(result) 117 | ); 118 | } 119 | 120 | template 121 | static inline void MSHookFunction(Type_ *symbol, Type_ *replace) { 122 | return MSHookFunction(symbol, replace, reinterpret_cast(NULL)); 123 | } 124 | 125 | template 126 | static inline void MSHookSymbol(Type_ *&value, const char *name, MSImageRef image = NULL) { 127 | value = reinterpret_cast(MSFindSymbol(image, name)); 128 | } 129 | 130 | template 131 | static inline void MSHookFunction(const char *name, Type_ *replace, Type_ **result = NULL) { 132 | Type_ *symbol; 133 | MSHookSymbol(symbol, name); 134 | return MSHookFunction(symbol, replace, result); 135 | } 136 | 137 | #endif 138 | 139 | #define MSHook(type, name, args...) \ 140 | _disused static type (*_ ## name)(args); \ 141 | static type $ ## name(args) 142 | 143 | #ifdef __cplusplus 144 | #define MSHake(name) \ 145 | &$ ## name, &_ ## name 146 | #else 147 | #define MSHake(name) \ 148 | &$ ## name, (void **) &_ ## name 149 | #endif 150 | 151 | 152 | #endif//SUBSTRATE_H_ 153 | -------------------------------------------------------------------------------- /jni/Substrate/SubstrateARM.hpp: -------------------------------------------------------------------------------- 1 | /* Cydia Substrate - Powerful Code Insertion Platform 2 | * Copyright (C) 2008-2011 Jay Freeman (saurik) 3 | */ 4 | 5 | /* GNU Lesser General Public License, Version 3 {{{ */ 6 | /* 7 | * Substrate is free software: you can redistribute it and/or modify it under 8 | * the terms of the GNU Lesser General Public License as published by the 9 | * Free Software Foundation, either version 3 of the License, or (at your 10 | * option) any later version. 11 | * 12 | * Substrate is distributed in the hope that it will be useful, but WITHOUT 13 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 15 | * License for more details. 16 | * 17 | * You should have received a copy of the GNU Lesser General Public License 18 | * along with Substrate. If not, see . 19 | **/ 20 | /* }}} */ 21 | 22 | #ifndef SUBSTRATE_ARM_HPP 23 | #define SUBSTRATE_ARM_HPP 24 | 25 | enum A$r { 26 | A$r0, A$r1, A$r2, A$r3, 27 | A$r4, A$r5, A$r6, A$r7, 28 | A$r8, A$r9, A$r10, A$r11, 29 | A$r12, A$r13, A$r14, A$r15, 30 | A$sp = A$r13, 31 | A$lr = A$r14, 32 | A$pc = A$r15 33 | }; 34 | 35 | enum A$c { 36 | A$eq, A$ne, A$cs, A$cc, 37 | A$mi, A$pl, A$vs, A$vc, 38 | A$hi, A$ls, A$ge, A$lt, 39 | A$gt, A$le, A$al, 40 | A$hs = A$cs, 41 | A$lo = A$cc 42 | }; 43 | 44 | #define A$mrs_rm_cpsr(rd) /* mrs rd, cpsr */ \ 45 | (0xe10f0000 | ((rd) << 12)) 46 | #define A$msr_cpsr_f_rm(rm) /* msr cpsr_f, rm */ \ 47 | (0xe128f000 | (rm)) 48 | #define A$ldr_rd_$rn_im$(rd, rn, im) /* ldr rd, [rn, #im] */ \ 49 | (0xe5100000 | ((im) < 0 ? 0 : 1 << 23) | ((rn) << 16) | ((rd) << 12) | abs(im)) 50 | #define A$str_rd_$rn_im$(rd, rn, im) /* sr rd, [rn, #im] */ \ 51 | (0xe5000000 | ((im) < 0 ? 0 : 1 << 23) | ((rn) << 16) | ((rd) << 12) | abs(im)) 52 | #define A$sub_rd_rn_$im(rd, rn, im) /* sub, rd, rn, #im */ \ 53 | (0xe2400000 | ((rn) << 16) | ((rd) << 12) | (im & 0xff)) 54 | #define A$blx_rm(rm) /* blx rm */ \ 55 | (0xe12fff30 | (rm)) 56 | #define A$mov_rd_rm(rd, rm) /* mov rd, rm */ \ 57 | (0xe1a00000 | ((rd) << 12) | (rm)) 58 | #define A$ldmia_sp$_$rs$(rs) /* ldmia sp!, {rs} */ \ 59 | (0xe8b00000 | (A$sp << 16) | (rs)) 60 | #define A$stmdb_sp$_$rs$(rs) /* stmdb sp!, {rs} */ \ 61 | (0xe9200000 | (A$sp << 16) | (rs)) 62 | #define A$stmia_sp$_$r0$ 0xe8ad0001 /* stmia sp!, {r0} */ 63 | #define A$bx_r0 0xe12fff10 /* bx r0 */ 64 | 65 | #endif//SUBSTRATE_ARM_HPP 66 | -------------------------------------------------------------------------------- /jni/Substrate/SubstrateDebug.cpp: -------------------------------------------------------------------------------- 1 | /* Cydia Substrate - Powerful Code Insertion Platform 2 | * Copyright (C) 2008-2011 Jay Freeman (saurik) 3 | */ 4 | 5 | /* GNU Lesser General Public License, Version 3 {{{ */ 6 | /* 7 | * Substrate is free software: you can redistribute it and/or modify it under 8 | * the terms of the GNU Lesser General Public License as published by the 9 | * Free Software Foundation, either version 3 of the License, or (at your 10 | * option) any later version. 11 | * 12 | * Substrate is distributed in the hope that it will be useful, but WITHOUT 13 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 15 | * License for more details. 16 | * 17 | * You should have received a copy of the GNU Lesser General Public License 18 | * along with Substrate. If not, see . 19 | **/ 20 | /* }}} */ 21 | 22 | #include "SubstrateHook.h" 23 | #include "SubstrateDebug.hpp" 24 | 25 | #include 26 | #include 27 | #include 28 | 29 | static char _MSHexChar(uint8_t value) { 30 | return value < 0x20 || value >= 0x80 ? '.' : value; 31 | } 32 | 33 | #define HexWidth_ 16 34 | #define HexDepth_ 4 35 | 36 | void MSLogHexEx(const void *vdata, size_t size, size_t stride, const char *mark) { 37 | const uint8_t *data((const uint8_t *) vdata); 38 | 39 | size_t i(0), j; 40 | 41 | char d[256]; 42 | size_t b(0); 43 | d[0] = '\0'; 44 | 45 | while (i != size) { 46 | if (i % HexWidth_ == 0) { 47 | if (mark != NULL) 48 | b += sprintf(d + b, "\n[%s] ", mark); 49 | b += sprintf(d + b, "0x%.3zx:", i); 50 | } 51 | 52 | b += sprintf(d + b, " "); 53 | 54 | for (size_t q(0); q != stride; ++q) 55 | b += sprintf(d + b, "%.2x", data[i + stride - q - 1]); 56 | 57 | i += stride; 58 | 59 | for (size_t q(1); q != stride; ++q) 60 | b += sprintf(d + b, " "); 61 | 62 | if (i % HexDepth_ == 0) 63 | b += sprintf(d + b, " "); 64 | 65 | if (i % HexWidth_ == 0) { 66 | b += sprintf(d + b, " "); 67 | for (j = i - HexWidth_; j != i; ++j) 68 | b += sprintf(d + b, "%c", _MSHexChar(data[j])); 69 | 70 | lprintf("%s", d); 71 | b = 0; 72 | d[0] = '\0'; 73 | } 74 | } 75 | 76 | if (i % HexWidth_ != 0) { 77 | for (j = i % HexWidth_; j != HexWidth_; ++j) 78 | b += sprintf(d + b, " "); 79 | for (j = 0; j != (HexWidth_ - i % HexWidth_ + HexDepth_ - 1) / HexDepth_; ++j) 80 | b += sprintf(d + b, " "); 81 | b += sprintf(d + b, " "); 82 | for (j = i / HexWidth_ * HexWidth_; j != i; ++j) 83 | b += sprintf(d + b, "%c", _MSHexChar(data[j])); 84 | 85 | lprintf("%s", d); 86 | b = 0; 87 | d[0] = '\0'; 88 | } 89 | } 90 | 91 | void MSLogHex(const void *vdata, size_t size, const char *mark) { 92 | return MSLogHexEx(vdata, size, 1, mark); 93 | } 94 | -------------------------------------------------------------------------------- /jni/Substrate/SubstrateDebug.hpp: -------------------------------------------------------------------------------- 1 | /* Cydia Substrate - Powerful Code Insertion Platform 2 | * Copyright (C) 2008-2011 Jay Freeman (saurik) 3 | */ 4 | 5 | /* GNU Lesser General Public License, Version 3 {{{ */ 6 | /* 7 | * Substrate is free software: you can redistribute it and/or modify it under 8 | * the terms of the GNU Lesser General Public License as published by the 9 | * Free Software Foundation, either version 3 of the License, or (at your 10 | * option) any later version. 11 | * 12 | * Substrate is distributed in the hope that it will be useful, but WITHOUT 13 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 15 | * License for more details. 16 | * 17 | * You should have received a copy of the GNU Lesser General Public License 18 | * along with Substrate. If not, see . 19 | **/ 20 | /* }}} */ 21 | 22 | #ifndef SUBSTRATE_DEBUG_HPP 23 | #define SUBSTRATE_DEBUG_HPP 24 | 25 | #include "SubstrateLog.hpp" 26 | #define lprintf(format, ...) \ 27 | MSLog(MSLogLevelNotice, format, ## __VA_ARGS__) 28 | 29 | #define MSDebug false 30 | void MSLogHexEx(const void *vdata, size_t size, size_t stride, const char *mark = 0); 31 | void MSLogHex(const void *vdata, size_t size, const char *mark = 0); 32 | 33 | #endif//SUBSTRATE_DEBUG_HPP 34 | -------------------------------------------------------------------------------- /jni/Substrate/SubstrateHook.cpp: -------------------------------------------------------------------------------- 1 | /* Cydia Substrate - Powerful Code Insertion Platform 2 | * Copyright (C) 2008-2011 Jay Freeman (saurik) 3 | */ 4 | 5 | /* GNU Lesser General Public License, Version 3 {{{ */ 6 | /* 7 | * Substrate is free software: you can redistribute it and/or modify it under 8 | * the terms of the GNU Lesser General Public License as published by the 9 | * Free Software Foundation, either version 3 of the License, or (at your 10 | * option) any later version. 11 | * 12 | * Substrate is distributed in the hope that it will be useful, but WITHOUT 13 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 15 | * License for more details. 16 | * 17 | * You should have received a copy of the GNU Lesser General Public License 18 | * along with Substrate. If not, see . 19 | **/ 20 | /* }}} */ 21 | 22 | #define SubstrateInternal 23 | #include "CydiaSubstrate.h" 24 | 25 | #include 26 | 27 | #define _trace() do { \ 28 | MSLog(MSLogLevelNotice, "_trace(%u)", __LINE__); \ 29 | } while (false) 30 | 31 | #if defined(__i386__) || defined(__x86_64__) 32 | #include "hde64.h" 33 | #endif 34 | 35 | #include "SubstrateDebug.hpp" 36 | 37 | #include 38 | #include 39 | #include 40 | 41 | #ifdef __arm__ 42 | /* WebCore (ARM) PC-Relative: 43 | X 1 ldr r*,[pc,r*] != 44 | 2 fldd d*,[pc,#*] 45 | X 5 str r*,[pc,r*] != 46 | 8 flds s*,[pc,#*] 47 | 400 ldr r*,[pc,r*] == 48 | 515 add r*, pc,r* == 49 | X 4790 ldr r*,[pc,#*] */ 50 | 51 | // x=0; while IFS= read -r line; do if [[ ${#line} -ne 0 && $line == +([^\;]): ]]; then x=2; elif [[ $line == ' +'* && $x -ne 0 ]]; then ((--x)); echo "$x${line}"; fi; done WebCore.pc 52 | // grep pc WebCore.pc | cut -c 40- | sed -Ee 's/^ldr *(ip|r[0-9]*),\[pc,\#0x[0-9a-f]*\].*/ ldr r*,[pc,#*]/;s/^add *r[0-9]*,pc,r[0-9]*.*/ add r*, pc,r*/;s/^(st|ld)r *r([0-9]*),\[pc,r([0-9]*)\].*/ \1r r\2,[pc,r\3]/;s/^fld(s|d) *(s|d)[0-9]*,\[pc,#0x[0-9a-f]*].*/fld\1 \2*,[pc,#*]/' | sort | uniq -c | sort -n 53 | 54 | #include "SubstrateARM.hpp" 55 | 56 | #define T$Label(l, r) \ 57 | (((r) - (l)) * 2 - 4 + ((l) % 2 == 0 ? 0 : 2)) 58 | 59 | #define T$pop_$r0$ 0xbc01 // pop {r0} 60 | #define T$b(im) /* b im */ \ 61 | (0xde00 | (im & 0xff)) 62 | #define T$blx(rm) /* blx rm */ \ 63 | (0x4780 | (rm << 3)) 64 | #define T$bx(rm) /* bx rm */ \ 65 | (0x4700 | (rm << 3)) 66 | #define T$nop /* nop */ \ 67 | (0x46c0) 68 | 69 | #define T$add_rd_rm(rd, rm) /* add rd, rm */ \ 70 | (0x4400 | (((rd) & 0x8) >> 3 << 7) | (((rm) & 0x8) >> 3 << 6) | (((rm) & 0x7) << 3) | ((rd) & 0x7)) 71 | #define T$push_r(r) /* push r... */ \ 72 | (0xb400 | (((r) & (1 << A$lr)) >> A$lr << 8) | ((r) & 0xff)) 73 | #define T$pop_r(r) /* pop r... */ \ 74 | (0xbc00 | (((r) & (1 << A$pc)) >> A$pc << 8) | ((r) & 0xff)) 75 | #define T$mov_rd_rm(rd, rm) /* mov rd, rm */ \ 76 | (0x4600 | (((rd) & 0x8) >> 3 << 7) | (((rm) & 0x8) >> 3 << 6) | (((rm) & 0x7) << 3) | ((rd) & 0x7)) 77 | #define T$ldr_rd_$rn_im_4$(rd, rn, im) /* ldr rd, [rn, #im * 4] */ \ 78 | (0x6800 | (((im) & 0x1f) << 6) | ((rn) << 3) | (rd)) 79 | #define T$ldr_rd_$pc_im_4$(rd, im) /* ldr rd, [PC, #im * 4] */ \ 80 | (0x4800 | ((rd) << 8) | ((im) & 0xff)) 81 | #define T$cmp_rn_$im(rn, im) /* cmp rn, #im */ \ 82 | (0x2000 | ((rn) << 8) | ((im) & 0xff)) 83 | #define T$it$_cd(cd, ms) /* it, cd */ \ 84 | (0xbf00 | ((cd) << 4) | (ms)) 85 | #define T$cbz$_rn_$im(op,rn,im) /* cbz rn, #im */ \ 86 | (0xb100 | ((op) << 11) | (((im) & 0x40) >> 6 << 9) | (((im) & 0x3e) >> 1 << 3) | (rn)) 87 | #define T$b$_$im(cond,im) /* b #im */ \ 88 | (cond == A$al ? 0xe000 | (((im) >> 1) & 0x7ff) : 0xd000 | ((cond) << 8) | (((im) >> 1) & 0xff)) 89 | 90 | #define T1$ldr_rt_$rn_im$(rt, rn, im) /* ldr rt, [rn, #im] */ \ 91 | (0xf850 | ((im < 0 ? 0 : 1) << 7) | (rn)) 92 | #define T2$ldr_rt_$rn_im$(rt, rn, im) /* ldr rt, [rn, #im] */ \ 93 | (((rt) << 12) | abs(im)) 94 | 95 | #define T1$mrs_rd_apsr(rd) /* mrs rd, apsr */ \ 96 | (0xf3ef) 97 | #define T2$mrs_rd_apsr(rd) /* mrs rd, apsr */ \ 98 | (0x8000 | ((rd) << 8)) 99 | 100 | #define T1$msr_apsr_nzcvqg_rn(rn) /* msr apsr, rn */ \ 101 | (0xf380 | (rn)) 102 | #define T2$msr_apsr_nzcvqg_rn(rn) /* msr apsr, rn */ \ 103 | (0x8c00) 104 | #define T$msr_apsr_nzcvqg_rn(rn) /* msr apsr, rn */ \ 105 | (T2$msr_apsr_nzcvqg_rn(rn) << 16 | T1$msr_apsr_nzcvqg_rn(rn)) 106 | 107 | static inline bool A$pcrel$r(uint32_t ic) { 108 | return (ic & 0x0c000000) == 0x04000000 && (ic & 0xf0000000) != 0xf0000000 && (ic & 0x000f0000) == 0x000f0000; 109 | } 110 | 111 | static inline bool T$32bit$i(uint16_t ic) { 112 | return ((ic & 0xe000) == 0xe000 && (ic & 0x1800) != 0x0000); 113 | } 114 | 115 | static inline bool T$pcrel$cbz(uint16_t ic) { 116 | return (ic & 0xf500) == 0xb100; 117 | } 118 | 119 | static inline bool T$pcrel$b(uint16_t ic) { 120 | return (ic & 0xf000) == 0xd000 && (ic & 0x0e00) != 0x0e00; 121 | } 122 | 123 | static inline bool T2$pcrel$b(uint16_t *ic) { 124 | return (ic[0] & 0xf800) == 0xf000 && ((ic[1] & 0xd000) == 0x9000 || (ic[1] & 0xd000) == 0x8000 && (ic[0] & 0x0380) != 0x0380); 125 | } 126 | 127 | static inline bool T$pcrel$bl(uint16_t *ic) { 128 | return (ic[0] & 0xf800) == 0xf000 && ((ic[1] & 0xd000) == 0xd000 || (ic[1] & 0xd001) == 0xc000); 129 | } 130 | 131 | static inline bool T$pcrel$ldr(uint16_t ic) { 132 | return (ic & 0xf800) == 0x4800; 133 | } 134 | 135 | static inline bool T$pcrel$add(uint16_t ic) { 136 | return (ic & 0xff78) == 0x4478; 137 | } 138 | 139 | static inline bool T$pcrel$ldrw(uint16_t ic) { 140 | return (ic & 0xff7f) == 0xf85f; 141 | } 142 | 143 | static size_t MSGetInstructionWidthThumb(void *start) { 144 | uint16_t *thumb(reinterpret_cast(start)); 145 | return T$32bit$i(thumb[0]) ? 4 : 2; 146 | } 147 | 148 | static size_t MSGetInstructionWidthARM(void *start) { 149 | return 4; 150 | } 151 | 152 | extern "C" size_t MSGetInstructionWidth(void *start) { 153 | if ((reinterpret_cast(start) & 0x1) == 0) 154 | return MSGetInstructionWidthARM(start); 155 | else 156 | return MSGetInstructionWidthThumb(reinterpret_cast(reinterpret_cast(start) & ~0x1)); 157 | } 158 | 159 | static size_t SubstrateHookFunctionThumb(SubstrateProcessRef process, void *symbol, void *replace, void **result) { 160 | if (symbol == NULL) 161 | return 0; 162 | printf("SubstrateHookFunctionThumb\n"); 163 | uint16_t *area(reinterpret_cast(symbol)); 164 | 165 | unsigned align((reinterpret_cast(area) & 0x2) == 0 ? 0 : 1); 166 | uint16_t *thumb(area + align); 167 | 168 | uint32_t *arm(reinterpret_cast(thumb + 2)); 169 | uint16_t *trail(reinterpret_cast(arm + 2)); 170 | 171 | if ( 172 | (align == 0 || area[0] == T$nop) && 173 | thumb[0] == T$bx(A$pc) && 174 | thumb[1] == T$nop && 175 | arm[0] == A$ldr_rd_$rn_im$(A$pc, A$pc, 4 - 8) 176 | ) { 177 | if (result != NULL) 178 | *result = reinterpret_cast(arm[1]); 179 | 180 | SubstrateHookMemory code(process, arm + 1, sizeof(uint32_t) * 1); 181 | 182 | arm[1] = reinterpret_cast(replace); 183 | 184 | return sizeof(arm[0]); 185 | } 186 | 187 | size_t required((trail - area) * sizeof(uint16_t)); 188 | 189 | size_t used(0); 190 | while (used < required) 191 | used += MSGetInstructionWidthThumb(reinterpret_cast(area) + used); 192 | used = (used + sizeof(uint16_t) - 1) / sizeof(uint16_t) * sizeof(uint16_t); 193 | 194 | size_t blank((used - required) / sizeof(uint16_t)); 195 | 196 | uint16_t backup[used / sizeof(uint16_t)]; 197 | memcpy(backup, area, used); 198 | 199 | if (MSDebug) { 200 | char name[16]; 201 | sprintf(name, "%p", area); 202 | MSLogHexEx(area, used + sizeof(uint16_t), 2, name); 203 | } 204 | 205 | if (result != NULL) { 206 | 207 | size_t length(used); 208 | for (unsigned offset(0); offset != used / sizeof(uint16_t); ++offset) 209 | if (T$pcrel$ldr(backup[offset])) 210 | length += 3 * sizeof(uint16_t); 211 | else if (T$pcrel$b(backup[offset])) 212 | length += 6 * sizeof(uint16_t); 213 | else if (T2$pcrel$b(backup + offset)) { 214 | length += 5 * sizeof(uint16_t); 215 | ++offset; 216 | } else if (T$pcrel$bl(backup + offset)) { 217 | length += 5 * sizeof(uint16_t); 218 | ++offset; 219 | } else if (T$pcrel$cbz(backup[offset])) { 220 | length += 16 * sizeof(uint16_t); 221 | } else if (T$pcrel$ldrw(backup[offset])) { 222 | length += 4 * sizeof(uint16_t); 223 | ++offset; 224 | } else if (T$pcrel$add(backup[offset])) 225 | length += 6 * sizeof(uint16_t); 226 | else if (T$32bit$i(backup[offset])) 227 | ++offset; 228 | 229 | unsigned pad((length & 0x2) == 0 ? 0 : 1); 230 | length += (pad + 2) * sizeof(uint16_t) + 2 * sizeof(uint32_t); 231 | 232 | uint16_t *buffer(reinterpret_cast(mmap( 233 | NULL, length, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0 234 | ))); 235 | 236 | if (buffer == MAP_FAILED) { 237 | MSLog(MSLogLevelError, "MS:Error:mmap() = %d", errno); 238 | *result = NULL; 239 | return 0; 240 | } 241 | 242 | if (false) fail: { 243 | munmap(buffer, length); 244 | *result = NULL; 245 | return 0; 246 | } 247 | 248 | size_t start(pad), end(length / sizeof(uint16_t)); 249 | uint32_t *trailer(reinterpret_cast(buffer + end)); 250 | for (unsigned offset(0); offset != used / sizeof(uint16_t); ++offset) { 251 | if (T$pcrel$ldr(backup[offset])) { 252 | union { 253 | uint16_t value; 254 | 255 | struct { 256 | uint16_t immediate : 8; 257 | uint16_t rd : 3; 258 | uint16_t : 5; 259 | }; 260 | } bits = {backup[offset+0]}; 261 | 262 | buffer[start+0] = T$ldr_rd_$pc_im_4$(bits.rd, T$Label(start+0, end-2) / 4); 263 | buffer[start+1] = T$ldr_rd_$rn_im_4$(bits.rd, bits.rd, 0); 264 | 265 | // XXX: this code "works", but is "wrong": the mechanism is more complex than this 266 | *--trailer = ((reinterpret_cast(area + offset) + 4) & ~0x2) + bits.immediate * 4; 267 | 268 | start += 2; 269 | end -= 2; 270 | } else if (T$pcrel$b(backup[offset])) { 271 | union { 272 | uint16_t value; 273 | 274 | struct { 275 | uint16_t imm8 : 8; 276 | uint16_t cond : 4; 277 | uint16_t /*1101*/ : 4; 278 | }; 279 | } bits = {backup[offset+0]}; 280 | 281 | intptr_t jump(bits.imm8 << 1); 282 | jump |= 1; 283 | jump <<= 23; 284 | jump >>= 23; 285 | 286 | buffer[start+0] = T$b$_$im(bits.cond, (end-6 - (start+0)) * 2 - 4); 287 | 288 | *--trailer = reinterpret_cast(area + offset) + 4 + jump; 289 | *--trailer = A$ldr_rd_$rn_im$(A$pc, A$pc, 4 - 8); 290 | *--trailer = T$nop << 16 | T$bx(A$pc); 291 | 292 | start += 1; 293 | end -= 6; 294 | } else if (T2$pcrel$b(backup + offset)) { 295 | union { 296 | uint16_t value; 297 | 298 | struct { 299 | uint16_t imm6 : 6; 300 | uint16_t cond : 4; 301 | uint16_t s : 1; 302 | uint16_t : 5; 303 | }; 304 | } bits = {backup[offset+0]}; 305 | 306 | union { 307 | uint16_t value; 308 | 309 | struct { 310 | uint16_t imm11 : 11; 311 | uint16_t j2 : 1; 312 | uint16_t a : 1; 313 | uint16_t j1 : 1; 314 | uint16_t : 2; 315 | }; 316 | } exts = {backup[offset+1]}; 317 | 318 | intptr_t jump(1); 319 | jump |= exts.imm11 << 1; 320 | jump |= bits.imm6 << 12; 321 | 322 | if (exts.a) { 323 | jump |= bits.s << 24; 324 | jump |= (~(bits.s ^ exts.j1) & 0x1) << 23; 325 | jump |= (~(bits.s ^ exts.j2) & 0x1) << 22; 326 | jump |= bits.cond << 18; 327 | jump <<= 7; 328 | jump >>= 7; 329 | } else { 330 | jump |= bits.s << 20; 331 | jump |= exts.j2 << 19; 332 | jump |= exts.j1 << 18; 333 | jump <<= 11; 334 | jump >>= 11; 335 | } 336 | 337 | buffer[start+0] = T$b$_$im(exts.a ? A$al : bits.cond, (end-6 - (start+0)) * 2 - 4); 338 | 339 | *--trailer = reinterpret_cast(area + offset) + 4 + jump; 340 | *--trailer = A$ldr_rd_$rn_im$(A$pc, A$pc, 4 - 8); 341 | *--trailer = T$nop << 16 | T$bx(A$pc); 342 | 343 | ++offset; 344 | start += 1; 345 | end -= 6; 346 | } else if (T$pcrel$bl(backup + offset)) { 347 | union { 348 | uint16_t value; 349 | 350 | struct { 351 | uint16_t immediate : 10; 352 | uint16_t s : 1; 353 | uint16_t : 5; 354 | }; 355 | } bits = {backup[offset+0]}; 356 | 357 | union { 358 | uint16_t value; 359 | 360 | struct { 361 | uint16_t immediate : 11; 362 | uint16_t j2 : 1; 363 | uint16_t x : 1; 364 | uint16_t j1 : 1; 365 | uint16_t : 2; 366 | }; 367 | } exts = {backup[offset+1]}; 368 | 369 | int32_t jump(0); 370 | jump |= bits.s << 24; 371 | jump |= (~(bits.s ^ exts.j1) & 0x1) << 23; 372 | jump |= (~(bits.s ^ exts.j2) & 0x1) << 22; 373 | jump |= bits.immediate << 12; 374 | jump |= exts.immediate << 1; 375 | jump |= exts.x; 376 | jump <<= 7; 377 | jump >>= 7; 378 | 379 | buffer[start+0] = T$push_r(1 << A$r7); 380 | buffer[start+1] = T$ldr_rd_$pc_im_4$(A$r7, ((end-2 - (start+1)) * 2 - 4 + 2) / 4); 381 | buffer[start+2] = T$mov_rd_rm(A$lr, A$r7); 382 | buffer[start+3] = T$pop_r(1 << A$r7); 383 | buffer[start+4] = T$blx(A$lr); 384 | 385 | *--trailer = reinterpret_cast(area + offset) + 4 + jump; 386 | 387 | ++offset; 388 | start += 5; 389 | end -= 2; 390 | } else if (T$pcrel$cbz(backup[offset])) { 391 | union { 392 | uint16_t value; 393 | 394 | struct { 395 | uint16_t rn : 3; 396 | uint16_t immediate : 5; 397 | uint16_t : 1; 398 | uint16_t i : 1; 399 | uint16_t : 1; 400 | uint16_t op : 1; 401 | uint16_t : 4; 402 | }; 403 | } bits = {backup[offset+0]}; 404 | 405 | intptr_t jump(1); 406 | jump |= bits.i << 6; 407 | jump |= bits.immediate << 1; 408 | 409 | //jump <<= 24; 410 | //jump >>= 24; 411 | 412 | unsigned rn(bits.rn); 413 | unsigned rt(rn == A$r7 ? A$r6 : A$r7); 414 | 415 | buffer[start+0] = T$push_r(1 << rt); 416 | buffer[start+1] = T1$mrs_rd_apsr(rt); 417 | buffer[start+2] = T2$mrs_rd_apsr(rt); 418 | buffer[start+3] = T$cbz$_rn_$im(bits.op, rn, (end-10 - (start+3)) * 2 - 4); 419 | buffer[start+4] = T1$msr_apsr_nzcvqg_rn(rt); 420 | buffer[start+5] = T2$msr_apsr_nzcvqg_rn(rt); 421 | buffer[start+6] = T$pop_r(1 << rt); 422 | 423 | *--trailer = reinterpret_cast(area + offset) + 4 + jump; 424 | *--trailer = A$ldr_rd_$rn_im$(A$pc, A$pc, 4 - 8); 425 | *--trailer = T$nop << 16 | T$bx(A$pc); 426 | *--trailer = T$nop << 16 | T$pop_r(1 << rt); 427 | *--trailer = T$msr_apsr_nzcvqg_rn(rt); 428 | 429 | #if 0 430 | if ((start & 0x1) == 0) 431 | buffer[start++] = T$nop; 432 | buffer[start++] = T$bx(A$pc); 433 | buffer[start++] = T$nop; 434 | 435 | uint32_t *arm(reinterpret_cast(buffer + start)); 436 | arm[0] = A$add(A$lr, A$pc, 1); 437 | arm[1] = A$ldr_rd_$rn_im$(A$pc, A$pc, (trailer - arm) * sizeof(uint32_t) - 8); 438 | #endif 439 | 440 | start += 7; 441 | end -= 10; 442 | } else if (T$pcrel$ldrw(backup[offset])) { 443 | union { 444 | uint16_t value; 445 | 446 | struct { 447 | uint16_t : 7; 448 | uint16_t u : 1; 449 | uint16_t : 8; 450 | }; 451 | } bits = {backup[offset+0]}; 452 | 453 | union { 454 | uint16_t value; 455 | 456 | struct { 457 | uint16_t immediate : 12; 458 | uint16_t rt : 4; 459 | }; 460 | } exts = {backup[offset+1]}; 461 | 462 | buffer[start+0] = T1$ldr_rt_$rn_im$(exts.rt, A$pc, T$Label(start+0, end-2)); 463 | buffer[start+1] = T2$ldr_rt_$rn_im$(exts.rt, A$pc, T$Label(start+0, end-2)); 464 | 465 | buffer[start+2] = T1$ldr_rt_$rn_im$(exts.rt, exts.rt, 0); 466 | buffer[start+3] = T2$ldr_rt_$rn_im$(exts.rt, exts.rt, 0); 467 | 468 | // XXX: this code "works", but is "wrong": the mechanism is more complex than this 469 | *--trailer = ((reinterpret_cast(area + offset) + 4) & ~0x2) + (bits.u == 0 ? -exts.immediate : exts.immediate); 470 | 471 | ++offset; 472 | start += 4; 473 | end -= 2; 474 | } else if (T$pcrel$add(backup[offset])) { 475 | union { 476 | uint16_t value; 477 | 478 | struct { 479 | uint16_t rd : 3; 480 | uint16_t rm : 3; 481 | uint16_t h2 : 1; 482 | uint16_t h1 : 1; 483 | uint16_t : 8; 484 | }; 485 | } bits = {backup[offset+0]}; 486 | 487 | if (bits.h1) { 488 | MSLog(MSLogLevelError, "MS:Error:pcrel(%u):add (rd > r7)", offset); 489 | goto fail; 490 | } 491 | 492 | unsigned rt(bits.rd == A$r7 ? A$r6 : A$r7); 493 | 494 | buffer[start+0] = T$push_r(1 << rt); 495 | buffer[start+1] = T$mov_rd_rm(rt, (bits.h1 << 3) | bits.rd); 496 | buffer[start+2] = T$ldr_rd_$pc_im_4$(bits.rd, T$Label(start+2, end-2) / 4); 497 | buffer[start+3] = T$add_rd_rm((bits.h1 << 3) | bits.rd, rt); 498 | buffer[start+4] = T$pop_r(1 << rt); 499 | *--trailer = reinterpret_cast(area + offset) + 4; 500 | 501 | start += 5; 502 | end -= 2; 503 | } else if (T$32bit$i(backup[offset])) { 504 | buffer[start++] = backup[offset]; 505 | buffer[start++] = backup[++offset]; 506 | } else { 507 | buffer[start++] = backup[offset]; 508 | } 509 | } 510 | 511 | buffer[start++] = T$bx(A$pc); 512 | buffer[start++] = T$nop; 513 | 514 | uint32_t *transfer = reinterpret_cast(buffer + start); 515 | transfer[0] = A$ldr_rd_$rn_im$(A$pc, A$pc, 4 - 8); 516 | transfer[1] = reinterpret_cast(area + used / sizeof(uint16_t)) + 1; 517 | 518 | if (mprotect(buffer, length, PROT_READ | PROT_EXEC) == -1) { 519 | MSLog(MSLogLevelError, "MS:Error:mprotect():%d", errno); 520 | return 0; 521 | } 522 | 523 | *result = reinterpret_cast(buffer + pad) + 1; 524 | 525 | if (MSDebug) { 526 | char name[16]; 527 | sprintf(name, "%p", *result); 528 | MSLogHexEx(buffer, length, 2, name); 529 | } 530 | 531 | } 532 | 533 | { 534 | SubstrateHookMemory code(process, area, used); 535 | 536 | if (align != 0) 537 | area[0] = T$nop; 538 | 539 | thumb[0] = T$bx(A$pc); 540 | thumb[1] = T$nop; 541 | 542 | arm[0] = A$ldr_rd_$rn_im$(A$pc, A$pc, 4 - 8); 543 | arm[1] = reinterpret_cast(replace); 544 | 545 | for (unsigned offset(0); offset != blank; ++offset) 546 | trail[offset] = T$nop; 547 | } 548 | 549 | if (MSDebug) { 550 | char name[16]; 551 | sprintf(name, "%p", area); 552 | MSLogHexEx(area, used + sizeof(uint16_t), 2, name); 553 | } 554 | 555 | return used; 556 | } 557 | 558 | static size_t SubstrateHookFunctionARM(SubstrateProcessRef process, void *symbol, void *replace, void **result) { 559 | if (symbol == NULL) 560 | return 0; 561 | printf("SubstrateHookFunctionARM\n"); 562 | uint32_t *area(reinterpret_cast(symbol)); 563 | uint32_t *arm(area); 564 | 565 | const size_t used(8); 566 | 567 | uint32_t backup[used / sizeof(uint32_t)] = {arm[0], arm[1]}; 568 | 569 | if (MSDebug) { 570 | char name[16]; 571 | sprintf(name, "%p", area); 572 | MSLogHexEx(area, used + sizeof(uint32_t), 4, name); 573 | } 574 | 575 | if (result != NULL) { 576 | 577 | if (backup[0] == A$ldr_rd_$rn_im$(A$pc, A$pc, 4 - 8)) { 578 | *result = reinterpret_cast(backup[1]); 579 | 580 | return sizeof(backup[0]); 581 | } 582 | 583 | size_t length(used); 584 | for (unsigned offset(0); offset != used / sizeof(uint32_t); ++offset) 585 | if (A$pcrel$r(backup[offset])) { 586 | if ((backup[offset] & 0x02000000) == 0 || (backup[offset] & 0x0000f000 >> 12) != (backup[offset] & 0x0000000f)) 587 | length += 2 * sizeof(uint32_t); 588 | else 589 | length += 4 * sizeof(uint32_t); 590 | } 591 | 592 | length += 2 * sizeof(uint32_t); 593 | 594 | uint32_t *buffer(reinterpret_cast(mmap( 595 | NULL, length, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0 596 | ))); 597 | 598 | if (buffer == MAP_FAILED) { 599 | MSLog(MSLogLevelError, "MS:Error:mmap() = %d", errno); 600 | *result = NULL; 601 | return 0; 602 | } 603 | 604 | if (false) fail: { 605 | munmap(buffer, length); 606 | *result = NULL; 607 | return 0; 608 | } 609 | 610 | size_t start(0), end(length / sizeof(uint32_t)); 611 | uint32_t *trailer(reinterpret_cast(buffer + end)); 612 | for (unsigned offset(0); offset != used / sizeof(uint32_t); ++offset) 613 | if (A$pcrel$r(backup[offset])) { 614 | union { 615 | uint32_t value; 616 | 617 | struct { 618 | uint32_t rm : 4; 619 | uint32_t : 1; 620 | uint32_t shift : 2; 621 | uint32_t shiftamount : 5; 622 | uint32_t rd : 4; 623 | uint32_t rn : 4; 624 | uint32_t l : 1; 625 | uint32_t w : 1; 626 | uint32_t b : 1; 627 | uint32_t u : 1; 628 | uint32_t p : 1; 629 | uint32_t mode : 1; 630 | uint32_t type : 2; 631 | uint32_t cond : 4; 632 | }; 633 | } bits = {backup[offset+0]}, copy(bits); 634 | 635 | bool guard; 636 | if (bits.mode == 0 || bits.rd != bits.rm) { 637 | copy.rn = bits.rd; 638 | guard = false; 639 | } else { 640 | copy.rn = bits.rm != A$r0 ? A$r0 : A$r1; 641 | guard = true; 642 | } 643 | 644 | if (guard) 645 | buffer[start++] = A$stmdb_sp$_$rs$((1 << copy.rn)); 646 | 647 | buffer[start+0] = A$ldr_rd_$rn_im$(copy.rn, A$pc, (end-1 - (start+0)) * 4 - 8); 648 | buffer[start+1] = copy.value; 649 | 650 | start += 2; 651 | 652 | if (guard) 653 | buffer[start++] = A$ldmia_sp$_$rs$((1 << copy.rn)); 654 | 655 | *--trailer = reinterpret_cast(area + offset) + 8; 656 | end -= 1; 657 | } else 658 | buffer[start++] = backup[offset]; 659 | 660 | buffer[start+0] = A$ldr_rd_$rn_im$(A$pc, A$pc, 4 - 8); 661 | buffer[start+1] = reinterpret_cast(area + used / sizeof(uint32_t)); 662 | 663 | if (mprotect(buffer, length, PROT_READ | PROT_EXEC) == -1) { 664 | MSLog(MSLogLevelError, "MS:Error:mprotect():%d", errno); 665 | goto fail; 666 | } 667 | 668 | *result = buffer; 669 | 670 | if (MSDebug) { 671 | char name[16]; 672 | sprintf(name, "%p", *result); 673 | MSLogHexEx(buffer, length, 4, name); 674 | } 675 | 676 | } 677 | 678 | { 679 | SubstrateHookMemory code(process, symbol, used); 680 | 681 | arm[0] = A$ldr_rd_$rn_im$(A$pc, A$pc, 4 - 8); 682 | arm[1] = reinterpret_cast(replace); 683 | } 684 | 685 | if (MSDebug) { 686 | char name[16]; 687 | sprintf(name, "%p", area); 688 | MSLogHexEx(area, used + sizeof(uint32_t), 4, name); 689 | } 690 | 691 | return used; 692 | } 693 | 694 | static size_t SubstrateHookFunction(SubstrateProcessRef process, void *symbol, void *replace, void **result) { 695 | if (MSDebug) 696 | MSLog(MSLogLevelNotice, "SubstrateHookFunction(%p, %p, %p, %p)\n", process, symbol, replace, result); 697 | if ((reinterpret_cast(symbol) & 0x1) == 0) 698 | return SubstrateHookFunctionARM(process, symbol, replace, result); 699 | else 700 | return SubstrateHookFunctionThumb(process, reinterpret_cast(reinterpret_cast(symbol) & ~0x1), replace, result); 701 | } 702 | #endif 703 | 704 | #if defined(__i386__) || defined(__x86_64__) 705 | 706 | #include "SubstrateX86.hpp" 707 | 708 | static size_t MSGetInstructionWidthIntel(void *start) { 709 | hde64s decode; 710 | return hde64_disasm(start, &decode); 711 | } 712 | 713 | static void SubstrateHookFunction(SubstrateProcessRef process, void *symbol, void *replace, void **result) { 714 | if (MSDebug) 715 | MSLog(MSLogLevelNotice, "MSHookFunction(%p, %p, %p)\n", symbol, replace, result); 716 | if (symbol == NULL) 717 | return; 718 | 719 | uintptr_t source(reinterpret_cast(symbol)); 720 | uintptr_t target(reinterpret_cast(replace)); 721 | 722 | uint8_t *area(reinterpret_cast(symbol)); 723 | 724 | size_t required(MSSizeOfJump(target, source)); 725 | 726 | if (MSDebug) { 727 | char name[16]; 728 | sprintf(name, "%p", area); 729 | MSLogHex(area, 32, name); 730 | } 731 | 732 | size_t used(0); 733 | while (used < required) { 734 | size_t width(MSGetInstructionWidthIntel(area + used)); 735 | if (width == 0) { 736 | MSLog(MSLogLevelError, "MS:Error:MSGetInstructionWidthIntel(%p) == 0", area + used); 737 | return; 738 | } 739 | 740 | used += width; 741 | } 742 | 743 | size_t blank(used - required); 744 | 745 | if (MSDebug) { 746 | char name[16]; 747 | sprintf(name, "%p", area); 748 | MSLogHex(area, used + sizeof(uint16_t), name); 749 | } 750 | 751 | uint8_t backup[used]; 752 | memcpy(backup, area, used); 753 | 754 | if (result != NULL) { 755 | 756 | if (backup[0] == 0xe9) { 757 | *result = reinterpret_cast(source + 5 + *reinterpret_cast(backup + 1)); 758 | return; 759 | } 760 | 761 | if (!ia32 && backup[0] == 0xff && backup[1] == 0x25) { 762 | *result = *reinterpret_cast(source + 6 + *reinterpret_cast(backup + 2)); 763 | return; 764 | } 765 | 766 | size_t length(used + MSSizeOfJump(source + used)); 767 | 768 | for (size_t offset(0), width; offset != used; offset += width) { 769 | hde64s decode; 770 | hde64_disasm(backup + offset, &decode); 771 | width = decode.len; 772 | //_assert(width != 0 && offset + width <= used); 773 | 774 | #ifdef __LP64__ 775 | if ((decode.modrm & 0xc7) == 0x05) { 776 | if (decode.opcode == 0x8b) { 777 | void *destiny(area + offset + width + int32_t(decode.disp.disp32)); 778 | uint8_t reg(decode.rex_r << 3 | decode.modrm_reg); 779 | length -= decode.len; 780 | length += MSSizeOfPushPointer(destiny); 781 | length += MSSizeOfPop(reg); 782 | length += MSSizeOfMove64(); 783 | } else { 784 | MSLog(MSLogLevelError, "MS:Error: Unknown RIP-Relative (%.2x %.2x)", decode.opcode, decode.opcode2); 785 | continue; 786 | } 787 | } else 788 | #endif 789 | 790 | if (backup[offset] == 0xe8) { 791 | int32_t relative(*reinterpret_cast(backup + offset + 1)); 792 | void *destiny(area + offset + decode.len + relative); 793 | 794 | if (relative == 0) { 795 | length -= decode.len; 796 | length += MSSizeOfPushPointer(destiny); 797 | } else { 798 | length += MSSizeOfSkip(); 799 | length += MSSizeOfJump(destiny); 800 | } 801 | } else if (backup[offset] == 0xeb) { 802 | length -= decode.len; 803 | length += MSSizeOfJump(area + offset + decode.len + *reinterpret_cast(backup + offset + 1)); 804 | } else if (backup[offset] == 0xe9) { 805 | length -= decode.len; 806 | length += MSSizeOfJump(area + offset + decode.len + *reinterpret_cast(backup + offset + 1)); 807 | } else if ( 808 | backup[offset] == 0xe3 || 809 | (backup[offset] & 0xf0) == 0x70 810 | // XXX: opcode2 & 0xf0 is 0x80? 811 | ) { 812 | length += decode.len; 813 | length += MSSizeOfJump(area + offset + decode.len + *reinterpret_cast(backup + offset + 1)); 814 | } 815 | } 816 | 817 | uint8_t *buffer(reinterpret_cast(mmap( 818 | NULL, length, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0 819 | ))); 820 | 821 | if (buffer == MAP_FAILED) { 822 | MSLog(MSLogLevelError, "MS:Error:mmap() = %d", errno); 823 | *result = NULL; 824 | return; 825 | } 826 | 827 | if (false) fail: { 828 | munmap(buffer, length); 829 | *result = NULL; 830 | return; 831 | } 832 | 833 | { 834 | uint8_t *current(buffer); 835 | 836 | for (size_t offset(0), width; offset != used; offset += width) { 837 | hde64s decode; 838 | hde64_disasm(backup + offset, &decode); 839 | width = decode.len; 840 | //_assert(width != 0 && offset + width <= used); 841 | 842 | #ifdef __LP64__ 843 | if ((decode.modrm & 0xc7) == 0x05) { 844 | if (decode.opcode == 0x8b) { 845 | void *destiny(area + offset + width + int32_t(decode.disp.disp32)); 846 | uint8_t reg(decode.rex_r << 3 | decode.modrm_reg); 847 | MSPushPointer(current, destiny); 848 | MSWritePop(current, reg); 849 | MSWriteMove64(current, reg, reg); 850 | } else { 851 | MSLog(MSLogLevelError, "MS:Error: Unknown RIP-Relative (%.2x %.2x)", decode.opcode, decode.opcode2); 852 | goto copy; 853 | } 854 | } else 855 | #endif 856 | 857 | if (backup[offset] == 0xe8) { 858 | int32_t relative(*reinterpret_cast(backup + offset + 1)); 859 | if (relative == 0) 860 | MSPushPointer(current, area + offset + decode.len); 861 | else { 862 | MSWrite(current, 0xe8); 863 | MSWrite(current, MSSizeOfSkip()); 864 | void *destiny(area + offset + decode.len + relative); 865 | MSWriteSkip(current, MSSizeOfJump(destiny, current + MSSizeOfSkip())); 866 | MSWriteJump(current, destiny); 867 | } 868 | } else if (backup[offset] == 0xeb) 869 | MSWriteJump(current, area + offset + decode.len + *reinterpret_cast(backup + offset + 1)); 870 | else if (backup[offset] == 0xe9) 871 | MSWriteJump(current, area + offset + decode.len + *reinterpret_cast(backup + offset + 1)); 872 | else if ( 873 | backup[offset] == 0xe3 || 874 | (backup[offset] & 0xf0) == 0x70 875 | ) { 876 | MSWrite(current, backup[offset]); 877 | MSWrite(current, 2); 878 | MSWrite(current, 0xeb); 879 | void *destiny(area + offset + decode.len + *reinterpret_cast(backup + offset + 1)); 880 | MSWrite(current, MSSizeOfJump(destiny, current + 1)); 881 | MSWriteJump(current, destiny); 882 | } else 883 | #ifdef __LP64__ 884 | copy: 885 | #endif 886 | { 887 | MSWrite(current, backup + offset, width); 888 | } 889 | } 890 | 891 | MSWriteJump(current, area + used); 892 | } 893 | 894 | if (mprotect(buffer, length, PROT_READ | PROT_EXEC) == -1) { 895 | MSLog(MSLogLevelError, "MS:Error:mprotect():%d", errno); 896 | goto fail; 897 | } 898 | 899 | *result = buffer; 900 | 901 | if (MSDebug) { 902 | char name[16]; 903 | sprintf(name, "%p", *result); 904 | MSLogHex(buffer, length, name); 905 | } 906 | 907 | } 908 | 909 | { 910 | SubstrateHookMemory code(process, area, used); 911 | 912 | uint8_t *current(area); 913 | MSWriteJump(current, target); 914 | for (unsigned offset(0); offset != blank; ++offset) 915 | MSWrite(current, 0x90); 916 | } 917 | 918 | if (MSDebug) { 919 | char name[16]; 920 | sprintf(name, "%p", area); 921 | MSLogHex(area, used + sizeof(uint16_t), name); 922 | } 923 | } 924 | #endif 925 | 926 | _extern void MSHookFunction(void *symbol, void *replace, void **result) { 927 | SubstrateHookFunction(NULL, symbol, replace, result); 928 | } 929 | 930 | #if defined(__APPLE__) && defined(__arm__) 931 | _extern void _Z14MSHookFunctionPvS_PS_(void *symbol, void *replace, void **result) { 932 | return MSHookFunction(symbol, replace, result); 933 | } 934 | #endif 935 | -------------------------------------------------------------------------------- /jni/Substrate/SubstrateHook.h: -------------------------------------------------------------------------------- 1 | #ifndef __SUBSTRATEHOOK_H__ 2 | #define __SUBSTRATEHOOK_H__ 3 | 4 | 5 | #include 6 | 7 | #define _extern extern "C" __attribute__((__visibility__("default"))) 8 | 9 | #ifdef __cplusplus 10 | extern "C" { 11 | #endif 12 | 13 | void MSHookFunction(void *symbol, void *replace, void **result); 14 | 15 | #ifdef __cplusplus 16 | } 17 | #endif 18 | 19 | #endif 20 | -------------------------------------------------------------------------------- /jni/Substrate/SubstrateLog.hpp: -------------------------------------------------------------------------------- 1 | /* Cydia Substrate - Powerful Code Insertion Platform 2 | * Copyright (C) 2008-2011 Jay Freeman (saurik) 3 | */ 4 | 5 | /* GNU Lesser General Public License, Version 3 {{{ */ 6 | /* 7 | * Substrate is free software: you can redistribute it and/or modify it under 8 | * the terms of the GNU Lesser General Public License as published by the 9 | * Free Software Foundation, either version 3 of the License, or (at your 10 | * option) any later version. 11 | * 12 | * Substrate is distributed in the hope that it will be useful, but WITHOUT 13 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 15 | * License for more details. 16 | * 17 | * You should have received a copy of the GNU Lesser General Public License 18 | * along with Substrate. If not, see . 19 | **/ 20 | /* }}} */ 21 | 22 | #ifndef SUBSTRATE_LOG_HPP 23 | #define SUBSTRATE_LOG_HPP 24 | 25 | #if 0 26 | #include 27 | 28 | #define MSLog(level, format, ...) ((void)__android_log_print(level, "NNNN", format, __VA_ARGS__)) 29 | 30 | #define MSLogLevelNotice ANDROID_LOG_INFO 31 | #define MSLogLevelWarning ANDROID_LOG_WARN 32 | #define MSLogLevelError ANDROID_LOG_ERROR 33 | 34 | #else 35 | 36 | #define MSLog(level, format, ...) printf(format, __VA_ARGS__) 37 | 38 | #endif 39 | 40 | #endif//SUBSTRATE_LOG_HPP 41 | -------------------------------------------------------------------------------- /jni/Substrate/SubstratePosixMemory.cpp: -------------------------------------------------------------------------------- 1 | /* Cydia Substrate - Powerful Code Insertion Platform 2 | * Copyright (C) 2008-2011 Jay Freeman (saurik) 3 | */ 4 | 5 | /* GNU Lesser General Public License, Version 3 {{{ */ 6 | /* 7 | * Substrate is free software: you can redistribute it and/or modify it under 8 | * the terms of the GNU Lesser General Public License as published by the 9 | * Free Software Foundation, either version 3 of the License, or (at your 10 | * option) any later version. 11 | * 12 | * Substrate is distributed in the hope that it will be useful, but WITHOUT 13 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 15 | * License for more details. 16 | * 17 | * You should have received a copy of the GNU Lesser General Public License 18 | * along with Substrate. If not, see . 19 | **/ 20 | /* }}} */ 21 | 22 | #define SubstrateInternal 23 | #include "CydiaSubstrate.h" 24 | #include "SubstrateLog.hpp" 25 | 26 | #include 27 | 28 | #include 29 | #include 30 | #include 31 | 32 | extern "C" void __clear_cache (void *beg, void *end); 33 | 34 | struct __SubstrateMemory { 35 | void *address_; 36 | size_t width_; 37 | 38 | __SubstrateMemory(void *address, size_t width) : 39 | address_(address), 40 | width_(width) 41 | { 42 | } 43 | }; 44 | 45 | extern "C" SubstrateMemoryRef SubstrateMemoryCreate(SubstrateAllocatorRef allocator, SubstrateProcessRef process, void *data, size_t size) { 46 | if (allocator != NULL) { 47 | MSLog(MSLogLevelError, "MS:Error:allocator != %d", 0); 48 | return NULL; 49 | } 50 | 51 | if (size == 0) 52 | return NULL; 53 | 54 | long page(sysconf(_SC_PAGESIZE)); // Portable applications should employ sysconf(_SC_PAGESIZE) instead of getpagesize 55 | 56 | uintptr_t base(reinterpret_cast(data) / page * page); 57 | size_t width(((reinterpret_cast(data) + size - 1) / page + 1) * page - base); 58 | void *address(reinterpret_cast(base)); 59 | 60 | if (mprotect(address, width, PROT_READ | PROT_WRITE | PROT_EXEC) == -1) { 61 | MSLog(MSLogLevelError, "MS:Error:mprotect() = %d", errno); 62 | return NULL; 63 | } 64 | 65 | return new __SubstrateMemory(address, width); 66 | } 67 | 68 | extern "C" void SubstrateMemoryRelease(SubstrateMemoryRef memory) { 69 | if (mprotect(memory->address_, memory->width_, PROT_READ | PROT_WRITE | PROT_EXEC) == -1) 70 | MSLog(MSLogLevelError, "MS:Error:mprotect() = %d", errno); 71 | 72 | __clear_cache(reinterpret_cast(memory->address_), reinterpret_cast(memory->address_) + memory->width_); 73 | 74 | delete memory; 75 | } 76 | -------------------------------------------------------------------------------- /jni/Substrate/SubstrateX86.hpp: -------------------------------------------------------------------------------- 1 | /* Cydia Substrate - Powerful Code Insertion Platform 2 | * Copyright (C) 2008-2011 Jay Freeman (saurik) 3 | */ 4 | 5 | /* GNU Lesser General Public License, Version 3 {{{ */ 6 | /* 7 | * Substrate is free software: you can redistribute it and/or modify it under 8 | * the terms of the GNU Lesser General Public License as published by the 9 | * Free Software Foundation, either version 3 of the License, or (at your 10 | * option) any later version. 11 | * 12 | * Substrate is distributed in the hope that it will be useful, but WITHOUT 13 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 15 | * License for more details. 16 | * 17 | * You should have received a copy of the GNU Lesser General Public License 18 | * along with Substrate. If not, see . 19 | **/ 20 | /* }}} */ 21 | 22 | #ifndef SUBSTRATE_X86_HPP 23 | #define SUBSTRATE_X86_HPP 24 | 25 | #include "Buffer.hpp" 26 | 27 | #ifdef __LP64__ 28 | static const bool ia32 = false; 29 | #else 30 | static const bool ia32 = true; 31 | #endif 32 | 33 | enum I$r { 34 | I$rax, I$rcx, I$rdx, I$rbx, 35 | I$rsp, I$rbp, I$rsi, I$rdi, 36 | I$r8, I$r9, I$r10, I$r11, 37 | I$r12, I$r13, I$r14, I$r15, 38 | }; 39 | 40 | _disused static bool MSIs32BitOffset(uintptr_t target, uintptr_t source) { 41 | intptr_t offset(target - source); 42 | return int32_t(offset) == offset; 43 | } 44 | 45 | _disused static size_t MSSizeOfSkip() { 46 | return 5; 47 | } 48 | 49 | _disused static size_t MSSizeOfPushPointer(uintptr_t target) { 50 | return uint64_t(target) >> 32 == 0 ? 5 : 13; 51 | } 52 | 53 | _disused static size_t MSSizeOfPushPointer(void *target) { 54 | return MSSizeOfPushPointer(reinterpret_cast(target)); 55 | } 56 | 57 | _disused static size_t MSSizeOfJump(bool blind, uintptr_t target, uintptr_t source = 0) { 58 | if (ia32 || !blind && MSIs32BitOffset(target, source + 5)) 59 | return MSSizeOfSkip(); 60 | else 61 | return MSSizeOfPushPointer(target) + 1; 62 | } 63 | 64 | _disused static size_t MSSizeOfJump(uintptr_t target, uintptr_t source) { 65 | return MSSizeOfJump(false, target, source); 66 | } 67 | 68 | _disused static size_t MSSizeOfJump(uintptr_t target) { 69 | return MSSizeOfJump(true, target); 70 | } 71 | 72 | _disused static size_t MSSizeOfJump(void *target, void *source) { 73 | return MSSizeOfJump(reinterpret_cast(target), reinterpret_cast(source)); 74 | } 75 | 76 | _disused static size_t MSSizeOfJump(void *target) { 77 | return MSSizeOfJump(reinterpret_cast(target)); 78 | } 79 | 80 | _disused static void MSWriteSkip(uint8_t *¤t, ssize_t size) { 81 | MSWrite(current, 0xe9); 82 | MSWrite(current, size); 83 | } 84 | 85 | _disused static void MSPushPointer(uint8_t *¤t, uintptr_t target) { 86 | MSWrite(current, 0x68); 87 | MSWrite(current, target); 88 | 89 | if (uint32_t high = uint64_t(target) >> 32) { 90 | MSWrite(current, 0xc7); 91 | MSWrite(current, 0x44); 92 | MSWrite(current, 0x24); 93 | MSWrite(current, 0x04); 94 | MSWrite(current, high); 95 | } 96 | } 97 | 98 | _disused static void MSPushPointer(uint8_t *¤t, void *target) { 99 | return MSPushPointer(current, reinterpret_cast(target)); 100 | } 101 | 102 | _disused static void MSWriteCall(uint8_t *¤t, I$r target) { 103 | if (target >> 3 != 0) 104 | MSWrite(current, 0x40 | (target & 0x08) >> 3); 105 | MSWrite(current, 0xff); 106 | MSWrite(current, 0xd0 | target & 0x07); 107 | } 108 | 109 | _disused static void MSWriteCall(uint8_t *¤t, uintptr_t target) { 110 | uintptr_t source(reinterpret_cast(current)); 111 | 112 | if (ia32 || MSIs32BitOffset(target, source + 5)) { 113 | MSWrite(current, 0xe8); 114 | MSWrite(current, target - (source + 5)); 115 | } else { 116 | MSPushPointer(current, target); 117 | 118 | MSWrite(current, 0x83); 119 | MSWrite(current, 0xc4); 120 | MSWrite(current, 0x08); 121 | 122 | MSWrite(current, 0x67); 123 | MSWrite(current, 0xff); 124 | MSWrite(current, 0x54); 125 | MSWrite(current, 0x24); 126 | MSWrite(current, 0xf8); 127 | } 128 | } 129 | 130 | template 131 | _disused static void MSWriteCall(uint8_t *¤t, Type_ *target) { 132 | return MSWriteCall(current, reinterpret_cast(target)); 133 | } 134 | 135 | _disused static void MSWriteJump(uint8_t *¤t, uintptr_t target) { 136 | uintptr_t source(reinterpret_cast(current)); 137 | 138 | if (ia32 || MSIs32BitOffset(target, source + 5)) 139 | MSWriteSkip(current, target - (source + 5)); 140 | else { 141 | MSPushPointer(current, target); 142 | MSWrite(current, 0xc3); 143 | } 144 | } 145 | 146 | _disused static void MSWriteJump(uint8_t *¤t, void *target) { 147 | return MSWriteJump(current, reinterpret_cast(target)); 148 | } 149 | 150 | _disused static void MSWriteJump(uint8_t *¤t, I$r target) { 151 | if (target >> 3 != 0) 152 | MSWrite(current, 0x40 | (target & 0x08) >> 3); 153 | MSWrite(current, 0xff); 154 | MSWrite(current, 0xe0 | target & 0x07); 155 | } 156 | 157 | _disused static void MSWritePop(uint8_t *¤t, uint8_t target) { 158 | if (target >> 3 != 0) 159 | MSWrite(current, 0x40 | (target & 0x08) >> 3); 160 | MSWrite(current, 0x58 | target & 0x07); 161 | } 162 | 163 | _disused static size_t MSSizeOfPop(uint8_t target) { 164 | return target >> 3 != 0 ? 2 : 1; 165 | } 166 | 167 | _disused static void MSWritePush(uint8_t *¤t, I$r target) { 168 | if (target >> 3 != 0) 169 | MSWrite(current, 0x40 | (target & 0x08) >> 3); 170 | MSWrite(current, 0x50 | target & 0x07); 171 | } 172 | 173 | _disused static void MSWriteAdd(uint8_t *¤t, I$r target, uint8_t source) { 174 | MSWrite(current, 0x83); 175 | MSWrite(current, 0xc4 | target & 0x07); 176 | MSWrite(current, source); 177 | } 178 | 179 | _disused static void MSWriteSet64(uint8_t *¤t, I$r target, uintptr_t source) { 180 | MSWrite(current, 0x48 | (target & 0x08) >> 3 << 2); 181 | MSWrite(current, 0xb8 | target & 0x7); 182 | MSWrite(current, source); 183 | } 184 | 185 | template 186 | _disused static void MSWriteSet64(uint8_t *¤t, I$r target, Type_ *source) { 187 | return MSWriteSet64(current, target, reinterpret_cast(source)); 188 | } 189 | 190 | _disused static void MSWriteMove64(uint8_t *¤t, uint8_t source, uint8_t target) { 191 | MSWrite(current, 0x48 | (target & 0x08) >> 3 << 2 | (source & 0x08) >> 3); 192 | MSWrite(current, 0x8b); 193 | MSWrite(current, (target & 0x07) << 3 | source & 0x07); 194 | } 195 | 196 | _disused static size_t MSSizeOfMove64() { 197 | return 3; 198 | } 199 | 200 | #endif//SUBSTRATE_X86_HPP 201 | -------------------------------------------------------------------------------- /jni/Substrate/hde64.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Hacker Disassembler Engine 64 C 3 | * Copyright (c) 2008-2009, Vyacheslav Patkov. 4 | * All rights reserved. 5 | * 6 | */ 7 | 8 | #include 9 | #include 10 | 11 | #include "hde64.h" 12 | #include "table64.h" 13 | 14 | unsigned int hde64_disasm(const void *code, hde64s *hs) 15 | { 16 | uint8_t x, c, *p = (uint8_t *)code, cflags, opcode, pref = 0; 17 | uint8_t *ht = hde64_table, m_mod, m_reg, m_rm, disp_size = 0; 18 | uint8_t op64 = 0; 19 | 20 | memset(hs,0,sizeof(hde64s)); 21 | char *tmp=(char*)hs; 22 | 23 | for (x = 16; x; x--) 24 | switch (c = *p++) { 25 | case 0xf3: 26 | hs->p_rep = c; 27 | pref |= PRE_F3; 28 | break; 29 | case 0xf2: 30 | hs->p_rep = c; 31 | pref |= PRE_F2; 32 | break; 33 | case 0xf0: 34 | hs->p_lock = c; 35 | pref |= PRE_LOCK; 36 | break; 37 | case 0x26: case 0x2e: case 0x36: 38 | case 0x3e: case 0x64: case 0x65: 39 | hs->p_seg = c; 40 | pref |= PRE_SEG; 41 | break; 42 | case 0x66: 43 | hs->p_66 = c; 44 | pref |= PRE_66; 45 | break; 46 | case 0x67: 47 | hs->p_67 = c; 48 | pref |= PRE_67; 49 | break; 50 | default: 51 | goto pref_done; 52 | } 53 | pref_done: 54 | 55 | hs->flags = (uint32_t)pref << 23; 56 | 57 | if (!pref) 58 | pref |= PRE_NONE; 59 | 60 | if ((c & 0xf0) == 0x40) { 61 | hs->flags |= F_PREFIX_REX; 62 | if ((hs->rex_w = (c & 0xf) >> 3) && (*p & 0xf8) == 0xb8) 63 | op64++; 64 | hs->rex_r = (c & 7) >> 2; 65 | hs->rex_x = (c & 3) >> 1; 66 | hs->rex_b = c & 1; 67 | if (((c = *p++) & 0xf0) == 0x40) { 68 | opcode = c; 69 | goto error_opcode; 70 | } 71 | } 72 | 73 | if ((hs->opcode = c) == 0x0f) { 74 | hs->opcode2 = c = *p++; 75 | ht += DELTA_OPCODES; 76 | } else if (c >= 0xa0 && c <= 0xa3) { 77 | op64++; 78 | if (pref & PRE_67) 79 | pref |= PRE_66; 80 | else 81 | pref &= ~PRE_66; 82 | } 83 | 84 | opcode = c; 85 | cflags = ht[ht[opcode / 4] + (opcode % 4)]; 86 | 87 | if (cflags == C_ERROR) { 88 | error_opcode: 89 | hs->flags |= F_ERROR | F_ERROR_OPCODE; 90 | cflags = 0; 91 | if ((opcode & -3) == 0x24) 92 | cflags++; 93 | } 94 | 95 | x = 0; 96 | if (cflags & C_GROUP) { 97 | uint16_t t; 98 | t = *(uint16_t *)(ht + (cflags & 0x7f)); 99 | cflags = (uint8_t)t; 100 | x = (uint8_t)(t >> 8); 101 | } 102 | 103 | if (hs->opcode2) { 104 | ht = hde64_table + DELTA_PREFIXES; 105 | if (ht[ht[opcode / 4] + (opcode % 4)] & pref) 106 | hs->flags |= F_ERROR | F_ERROR_OPCODE; 107 | } 108 | 109 | if (cflags & C_MODRM) { 110 | hs->flags |= F_MODRM; 111 | hs->modrm = c = *p++; 112 | hs->modrm_mod = m_mod = c >> 6; 113 | hs->modrm_rm = m_rm = c & 7; 114 | hs->modrm_reg = m_reg = (c & 0x3f) >> 3; 115 | 116 | if (x && ((x << m_reg) & 0x80)) 117 | hs->flags |= F_ERROR | F_ERROR_OPCODE; 118 | 119 | if (!hs->opcode2 && opcode >= 0xd9 && opcode <= 0xdf) { 120 | uint8_t t = opcode - 0xd9; 121 | if (m_mod == 3) { 122 | ht = hde64_table + DELTA_FPU_MODRM + t*8; 123 | t = ht[m_reg] << m_rm; 124 | } else { 125 | ht = hde64_table + DELTA_FPU_REG; 126 | t = ht[t] << m_reg; 127 | } 128 | if (t & 0x80) 129 | hs->flags |= F_ERROR | F_ERROR_OPCODE; 130 | } 131 | 132 | if (pref & PRE_LOCK) { 133 | if (m_mod == 3) { 134 | hs->flags |= F_ERROR | F_ERROR_LOCK; 135 | } else { 136 | uint8_t *table_end, op = opcode; 137 | if (hs->opcode2) { 138 | ht = hde64_table + DELTA_OP2_LOCK_OK; 139 | table_end = ht + DELTA_OP_ONLY_MEM - DELTA_OP2_LOCK_OK; 140 | } else { 141 | ht = hde64_table + DELTA_OP_LOCK_OK; 142 | table_end = ht + DELTA_OP2_LOCK_OK - DELTA_OP_LOCK_OK; 143 | op &= -2; 144 | } 145 | for (; ht != table_end; ht++) 146 | if (*ht++ == op) { 147 | if (!((*ht << m_reg) & 0x80)) 148 | goto no_lock_error; 149 | else 150 | break; 151 | } 152 | hs->flags |= F_ERROR | F_ERROR_LOCK; 153 | no_lock_error: 154 | ; 155 | } 156 | } 157 | 158 | if (hs->opcode2) { 159 | switch (opcode) { 160 | case 0x20: case 0x22: 161 | m_mod = 3; 162 | if (m_reg > 4 || m_reg == 1) 163 | goto error_operand; 164 | else 165 | goto no_error_operand; 166 | case 0x21: case 0x23: 167 | m_mod = 3; 168 | if (m_reg == 4 || m_reg == 5) 169 | goto error_operand; 170 | else 171 | goto no_error_operand; 172 | } 173 | } else { 174 | switch (opcode) { 175 | case 0x8c: 176 | if (m_reg > 5) 177 | goto error_operand; 178 | else 179 | goto no_error_operand; 180 | case 0x8e: 181 | if (m_reg == 1 || m_reg > 5) 182 | goto error_operand; 183 | else 184 | goto no_error_operand; 185 | } 186 | } 187 | 188 | if (m_mod == 3) { 189 | uint8_t *table_end; 190 | if (hs->opcode2) { 191 | ht = hde64_table + DELTA_OP2_ONLY_MEM; 192 | table_end = ht + sizeof(hde64_table) - DELTA_OP2_ONLY_MEM; 193 | } else { 194 | ht = hde64_table + DELTA_OP_ONLY_MEM; 195 | table_end = ht + DELTA_OP2_ONLY_MEM - DELTA_OP_ONLY_MEM; 196 | } 197 | for (; ht != table_end; ht += 2) 198 | if (*ht++ == opcode) { 199 | if (*ht++ & pref && !((*ht << m_reg) & 0x80)) 200 | goto error_operand; 201 | else 202 | break; 203 | } 204 | goto no_error_operand; 205 | } else if (hs->opcode2) { 206 | switch (opcode) { 207 | case 0x50: case 0xd7: case 0xf7: 208 | if (pref & (PRE_NONE | PRE_66)) 209 | goto error_operand; 210 | break; 211 | case 0xd6: 212 | if (pref & (PRE_F2 | PRE_F3)) 213 | goto error_operand; 214 | break; 215 | case 0xc5: 216 | goto error_operand; 217 | } 218 | goto no_error_operand; 219 | } else 220 | goto no_error_operand; 221 | 222 | error_operand: 223 | hs->flags |= F_ERROR | F_ERROR_OPERAND; 224 | no_error_operand: 225 | 226 | c = *p++; 227 | if (m_reg <= 1) { 228 | if (opcode == 0xf6) 229 | cflags |= C_IMM8; 230 | else if (opcode == 0xf7) 231 | cflags |= C_IMM_P66; 232 | } 233 | 234 | switch (m_mod) { 235 | case 0: 236 | if (pref & PRE_67) { 237 | if (m_rm == 6) 238 | disp_size = 2; 239 | } else 240 | if (m_rm == 5) 241 | disp_size = 4; 242 | break; 243 | case 1: 244 | disp_size = 1; 245 | break; 246 | case 2: 247 | disp_size = 2; 248 | if (!(pref & PRE_67)) 249 | disp_size <<= 1; 250 | } 251 | 252 | if (m_mod != 3 && m_rm == 4) { 253 | hs->flags |= F_SIB; 254 | p++; 255 | hs->sib = c; 256 | hs->sib_scale = c >> 6; 257 | hs->sib_index = (c & 0x3f) >> 3; 258 | if ((hs->sib_base = c & 7) == 5 && !(m_mod & 1)) 259 | disp_size = 4; 260 | } 261 | 262 | p--; 263 | switch (disp_size) { 264 | case 1: 265 | hs->flags |= F_DISP8; 266 | hs->disp.disp8 = *p; 267 | break; 268 | case 2: 269 | hs->flags |= F_DISP16; 270 | hs->disp.disp16 = *(uint16_t *)p; 271 | break; 272 | case 4: 273 | hs->flags |= F_DISP32; 274 | hs->disp.disp32 = *(uint32_t *)p; 275 | } 276 | p += disp_size; 277 | } else if (pref & PRE_LOCK) 278 | hs->flags |= F_ERROR | F_ERROR_LOCK; 279 | 280 | if (cflags & C_IMM_P66) { 281 | if (cflags & C_REL32) { 282 | if (pref & PRE_66) { 283 | hs->flags |= F_IMM16 | F_RELATIVE; 284 | hs->imm.imm16 = *(uint16_t *)p; 285 | p += 2; 286 | goto disasm_done; 287 | } 288 | goto rel32_ok; 289 | } 290 | if (op64) { 291 | hs->flags |= F_IMM64; 292 | hs->imm.imm64 = *(uint64_t *)p; 293 | p += 8; 294 | } else if (!(pref & PRE_66)) { 295 | hs->flags |= F_IMM32; 296 | hs->imm.imm32 = *(uint32_t *)p; 297 | p += 4; 298 | } else 299 | goto imm16_ok; 300 | } 301 | 302 | 303 | if (cflags & C_IMM16) { 304 | imm16_ok: 305 | hs->flags |= F_IMM16; 306 | hs->imm.imm16 = *(uint16_t *)p; 307 | p += 2; 308 | } 309 | if (cflags & C_IMM8) { 310 | hs->flags |= F_IMM8; 311 | hs->imm.imm8 = *p++; 312 | } 313 | 314 | if (cflags & C_REL32) { 315 | rel32_ok: 316 | hs->flags |= F_IMM32 | F_RELATIVE; 317 | hs->imm.imm32 = *(uint32_t *)p; 318 | p += 4; 319 | } else if (cflags & C_REL8) { 320 | hs->flags |= F_IMM8 | F_RELATIVE; 321 | hs->imm.imm8 = *p++; 322 | } 323 | 324 | disasm_done: 325 | 326 | if ((hs->len = (uint8_t)(p-(uint8_t *)code)) > 15) { 327 | hs->flags |= F_ERROR | F_ERROR_LENGTH; 328 | hs->len = 15; 329 | } 330 | 331 | return (unsigned int)hs->len; 332 | } 333 | -------------------------------------------------------------------------------- /jni/Substrate/hde64.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Hacker Disassembler Engine 64 3 | * Copyright (c) 2008-2009, Vyacheslav Patkov. 4 | * All rights reserved. 5 | * 6 | * hde64.h: C/C++ header file 7 | * 8 | */ 9 | 10 | #ifndef _HDE64_H_ 11 | #define _HDE64_H_ 12 | 13 | /* stdint.h - C99 standard header 14 | * http://en.wikipedia.org/wiki/stdint.h 15 | * 16 | * if your compiler doesn't contain "stdint.h" header (for 17 | * example, Microsoft Visual C++), you can download file: 18 | * http://www.azillionmonkeys.com/qed/pstdint.h 19 | * and change next line to: 20 | * #include "pstdint.h" 21 | */ 22 | #include 23 | 24 | #define F_MODRM 0x00000001 25 | #define F_SIB 0x00000002 26 | #define F_IMM8 0x00000004 27 | #define F_IMM16 0x00000008 28 | #define F_IMM32 0x00000010 29 | #define F_IMM64 0x00000020 30 | #define F_DISP8 0x00000040 31 | #define F_DISP16 0x00000080 32 | #define F_DISP32 0x00000100 33 | #define F_RELATIVE 0x00000200 34 | #define F_ERROR 0x00001000 35 | #define F_ERROR_OPCODE 0x00002000 36 | #define F_ERROR_LENGTH 0x00004000 37 | #define F_ERROR_LOCK 0x00008000 38 | #define F_ERROR_OPERAND 0x00010000 39 | #define F_PREFIX_REPNZ 0x01000000 40 | #define F_PREFIX_REPX 0x02000000 41 | #define F_PREFIX_REP 0x03000000 42 | #define F_PREFIX_66 0x04000000 43 | #define F_PREFIX_67 0x08000000 44 | #define F_PREFIX_LOCK 0x10000000 45 | #define F_PREFIX_SEG 0x20000000 46 | #define F_PREFIX_REX 0x40000000 47 | #define F_PREFIX_ANY 0x7f000000 48 | 49 | #define PREFIX_SEGMENT_CS 0x2e 50 | #define PREFIX_SEGMENT_SS 0x36 51 | #define PREFIX_SEGMENT_DS 0x3e 52 | #define PREFIX_SEGMENT_ES 0x26 53 | #define PREFIX_SEGMENT_FS 0x64 54 | #define PREFIX_SEGMENT_GS 0x65 55 | #define PREFIX_LOCK 0xf0 56 | #define PREFIX_REPNZ 0xf2 57 | #define PREFIX_REPX 0xf3 58 | #define PREFIX_OPERAND_SIZE 0x66 59 | #define PREFIX_ADDRESS_SIZE 0x67 60 | 61 | #pragma pack(push,1) 62 | 63 | typedef struct { 64 | uint8_t len; 65 | uint8_t p_rep; 66 | uint8_t p_lock; 67 | uint8_t p_seg; 68 | uint8_t p_66; 69 | uint8_t p_67; 70 | uint8_t rex; 71 | uint8_t rex_w; 72 | uint8_t rex_r; 73 | uint8_t rex_x; 74 | uint8_t rex_b; 75 | uint8_t opcode; 76 | uint8_t opcode2; 77 | uint8_t modrm; 78 | uint8_t modrm_mod; 79 | uint8_t modrm_reg; 80 | uint8_t modrm_rm; 81 | uint8_t sib; 82 | uint8_t sib_scale; 83 | uint8_t sib_index; 84 | uint8_t sib_base; 85 | union { 86 | uint8_t imm8; 87 | uint16_t imm16; 88 | uint32_t imm32; 89 | uint64_t imm64; 90 | } imm; 91 | union { 92 | uint8_t disp8; 93 | uint16_t disp16; 94 | uint32_t disp32; 95 | } disp; 96 | uint32_t flags; 97 | } hde64s; 98 | 99 | #pragma pack(pop) 100 | 101 | #ifdef __cplusplus 102 | extern "C" { 103 | #endif 104 | 105 | /* __cdecl */ 106 | unsigned int hde64_disasm(const void *code, hde64s *hs); 107 | 108 | #ifdef __cplusplus 109 | } 110 | #endif 111 | 112 | #endif /* _HDE64_H_ */ 113 | -------------------------------------------------------------------------------- /jni/Substrate/table64.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Hacker Disassembler Engine 64 C 3 | * Copyright (c) 2008-2009, Vyacheslav Patkov. 4 | * All rights reserved. 5 | * 6 | */ 7 | 8 | #define C_NONE 0x00 9 | #define C_MODRM 0x01 10 | #define C_IMM8 0x02 11 | #define C_IMM16 0x04 12 | #define C_IMM_P66 0x10 13 | #define C_REL8 0x20 14 | #define C_REL32 0x40 15 | #define C_GROUP 0x80 16 | #define C_ERROR 0xff 17 | 18 | #define PRE_ANY 0x00 19 | #define PRE_NONE 0x01 20 | #define PRE_F2 0x02 21 | #define PRE_F3 0x04 22 | #define PRE_66 0x08 23 | #define PRE_67 0x10 24 | #define PRE_LOCK 0x20 25 | #define PRE_SEG 0x40 26 | #define PRE_ALL 0xff 27 | 28 | #define DELTA_OPCODES 0x4a 29 | #define DELTA_FPU_REG 0xfd 30 | #define DELTA_FPU_MODRM 0x104 31 | #define DELTA_PREFIXES 0x13c 32 | #define DELTA_OP_LOCK_OK 0x1ae 33 | #define DELTA_OP2_LOCK_OK 0x1c6 34 | #define DELTA_OP_ONLY_MEM 0x1d8 35 | #define DELTA_OP2_ONLY_MEM 0x1e7 36 | 37 | unsigned char hde64_table[] = { 38 | 0xa5,0xaa,0xa5,0xb8,0xa5,0xaa,0xa5,0xaa,0xa5,0xb8,0xa5,0xb8,0xa5,0xb8,0xa5, 39 | 0xb8,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xac,0xc0,0xcc,0xc0,0xa1,0xa1, 40 | 0xa1,0xa1,0xb1,0xa5,0xa5,0xa6,0xc0,0xc0,0xd7,0xda,0xe0,0xc0,0xe4,0xc0,0xea, 41 | 0xea,0xe0,0xe0,0x98,0xc8,0xee,0xf1,0xa5,0xd3,0xa5,0xa5,0xa1,0xea,0x9e,0xc0, 42 | 0xc0,0xc2,0xc0,0xe6,0x03,0x7f,0x11,0x7f,0x01,0x7f,0x01,0x3f,0x01,0x01,0xab, 43 | 0x8b,0x90,0x64,0x5b,0x5b,0x5b,0x5b,0x5b,0x92,0x5b,0x5b,0x76,0x90,0x92,0x92, 44 | 0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x6a,0x73,0x90, 45 | 0x5b,0x52,0x52,0x52,0x52,0x5b,0x5b,0x5b,0x5b,0x77,0x7c,0x77,0x85,0x5b,0x5b, 46 | 0x70,0x5b,0x7a,0xaf,0x76,0x76,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b, 47 | 0x5b,0x5b,0x86,0x01,0x03,0x01,0x04,0x03,0xd5,0x03,0xd5,0x03,0xcc,0x01,0xbc, 48 | 0x03,0xf0,0x03,0x03,0x04,0x00,0x50,0x50,0x50,0x50,0xff,0x20,0x20,0x20,0x20, 49 | 0x01,0x01,0x01,0x01,0xc4,0x02,0x10,0xff,0xff,0xff,0x01,0x00,0x03,0x11,0xff, 50 | 0x03,0xc4,0xc6,0xc8,0x02,0x10,0x00,0xff,0xcc,0x01,0x01,0x01,0x00,0x00,0x00, 51 | 0x00,0x01,0x01,0x03,0x01,0xff,0xff,0xc0,0xc2,0x10,0x11,0x02,0x03,0x01,0x01, 52 | 0x01,0xff,0xff,0xff,0x00,0x00,0x00,0xff,0x00,0x00,0xff,0xff,0xff,0xff,0x10, 53 | 0x10,0x10,0x10,0x02,0x10,0x00,0x00,0xc6,0xc8,0x02,0x02,0x02,0x02,0x06,0x00, 54 | 0x04,0x00,0x02,0xff,0x00,0xc0,0xc2,0x01,0x01,0x03,0x03,0x03,0xca,0x40,0x00, 55 | 0x0a,0x00,0x04,0x00,0x00,0x00,0x00,0x7f,0x00,0x33,0x01,0x00,0x00,0x00,0x00, 56 | 0x00,0x00,0xff,0xbf,0xff,0xff,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0xff,0x00, 57 | 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff,0xff, 58 | 0x00,0x00,0x00,0xbf,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x7f,0x00,0x00, 59 | 0xff,0x40,0x40,0x40,0x40,0x41,0x49,0x40,0x40,0x40,0x40,0x4c,0x42,0x40,0x40, 60 | 0x40,0x40,0x40,0x40,0x40,0x40,0x4f,0x44,0x53,0x40,0x40,0x40,0x44,0x57,0x43, 61 | 0x5c,0x40,0x60,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40, 62 | 0x40,0x40,0x64,0x66,0x6e,0x6b,0x40,0x40,0x6a,0x46,0x40,0x40,0x44,0x46,0x40, 63 | 0x40,0x5b,0x44,0x40,0x40,0x00,0x00,0x00,0x00,0x06,0x06,0x06,0x06,0x01,0x06, 64 | 0x06,0x02,0x06,0x06,0x00,0x06,0x00,0x0a,0x0a,0x00,0x00,0x00,0x02,0x07,0x07, 65 | 0x06,0x02,0x0d,0x06,0x06,0x06,0x0e,0x05,0x05,0x02,0x02,0x00,0x00,0x04,0x04, 66 | 0x04,0x04,0x05,0x06,0x06,0x06,0x00,0x00,0x00,0x0e,0x00,0x00,0x08,0x00,0x10, 67 | 0x00,0x18,0x00,0x20,0x00,0x28,0x00,0x30,0x00,0x80,0x01,0x82,0x01,0x86,0x00, 68 | 0xf6,0xcf,0xfe,0x3f,0xab,0x00,0xb0,0x00,0xb1,0x00,0xb3,0x00,0xba,0xf8,0xbb, 69 | 0x00,0xc0,0x00,0xc1,0x00,0xc7,0xbf,0x62,0xff,0x00,0x8d,0xff,0x00,0xc4,0xff, 70 | 0x00,0xc5,0xff,0x00,0xff,0xff,0xeb,0x01,0xff,0x0e,0x12,0x08,0x00,0x13,0x09, 71 | 0x00,0x16,0x08,0x00,0x17,0x09,0x00,0x2b,0x09,0x00,0xae,0xff,0x07,0xb2,0xff, 72 | 0x00,0xb4,0xff,0x00,0xb5,0xff,0x00,0xc3,0x01,0x00,0xc7,0xff,0xbf,0xe7,0x08, 73 | 0x00,0xf0,0x02,0x00 74 | }; 75 | -------------------------------------------------------------------------------- /jni/main.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | #include "Includes/Logger.h" 9 | #include "Substrate/CydiaSubstrate.h" 10 | #import "Includes/Utils.h" 11 | 12 | bool PlayerUpdateHookInitialized = false; 13 | const char* libName = "libil2cpp.so"; 14 | 15 | void(*old_Player_Update)(void *instance); 16 | void Player_Update(void *instance) { 17 | //Check if instance is NULL to prevent crashes! If the instance object is NULL, 18 | //this is what the call to update would look like in C++: 19 | //NULL.Update(); and dat doesnt make sense right? 20 | if(instance != NULL) { 21 | if(!PlayerUpdateHookInitialized){ 22 | //Check if this hook initialized. If so log 23 | PlayerUpdateHookInitialized = true; 24 | LOGI("Player_Update hooked"); 25 | } 26 | //Your code here 27 | } 28 | old_Player_Update(instance); 29 | } 30 | 31 | // we will run our patches in a new thread so our while loop doesn't block process main thread 32 | void* hack_thread(void*) { 33 | LOGI("I have been loaded. Mwuahahahaha"); 34 | // loop until our target library is found 35 | do { 36 | sleep(1); 37 | } while (!isLibraryLoaded(libName)); 38 | LOGI("I found the il2cpp lib. Address is: %lu", findLibrary(libName)); 39 | LOGI("Hooking Player_Update"); 40 | MSHookFunction((void*)getAbsoluteAddress(libName, 0xF09F00), (void*)Player_Update, (void**) &old_Player_Update); 41 | 42 | return NULL; 43 | } 44 | 45 | __attribute__((constructor)) 46 | void libwolve_main() { 47 | pthread_t ptid; 48 | pthread_create(&ptid, NULL, hack_thread, NULL); 49 | } 50 | --------------------------------------------------------------------------------