├── settings.gradle
├── app
    ├── .gitignore
    ├── src
    │   ├── main
    │   │   ├── jni
    │   │   │   ├── Application.mk
    │   │   │   ├── relocate.h
    │   │   │   ├── inlineHook.h
    │   │   │   ├── Android.mk
    │   │   │   ├── native-lib.c
    │   │   │   ├── android_log.h
    │   │   │   ├── inlineHook.c
    │   │   │   └── relocate.c
    │   │   ├── res
    │   │   │   ├── values
    │   │   │   │   ├── strings.xml
    │   │   │   │   ├── colors.xml
    │   │   │   │   ├── dimens.xml
    │   │   │   │   └── styles.xml
    │   │   │   ├── mipmap-hdpi
    │   │   │   │   └── ic_launcher.png
    │   │   │   ├── mipmap-mdpi
    │   │   │   │   └── ic_launcher.png
    │   │   │   ├── mipmap-xhdpi
    │   │   │   │   └── ic_launcher.png
    │   │   │   ├── mipmap-xxhdpi
    │   │   │   │   └── ic_launcher.png
    │   │   │   ├── mipmap-xxxhdpi
    │   │   │   │   └── ic_launcher.png
    │   │   │   ├── values-w820dp
    │   │   │   │   └── dimens.xml
    │   │   │   └── layout
    │   │   │   │   └── activity_main.xml
    │   │   ├── AndroidManifest.xml
    │   │   └── java
    │   │   │   └── com
    │   │   │       └── andr0day
    │   │   │           └── androidinlinehook
    │   │   │               └── MainActivity.java
    │   ├── test
    │   │   └── java
    │   │   │   └── com
    │   │   │       └── andr0day
    │   │   │           └── androidinlinehook
    │   │   │               └── ExampleUnitTest.java
    │   └── androidTest
    │   │   └── java
    │   │       └── com
    │   │           └── andr0day
    │   │               └── androidinlinehook
    │   │                   └── ExampleInstrumentedTest.java
    ├── proguard-rules.pro
    └── build.gradle
├── .gitignore
├── gradle
    └── wrapper
    │   ├── gradle-wrapper.jar
    │   └── gradle-wrapper.properties
├── gradle.properties
├── gradlew.bat
└── gradlew


/settings.gradle:
--------------------------------------------------------------------------------
1 | include ':app'
2 | 


--------------------------------------------------------------------------------
/app/.gitignore:
--------------------------------------------------------------------------------
1 | /build
2 | .externalNativeBuild
3 | 


--------------------------------------------------------------------------------
/app/src/main/jni/Application.mk:
--------------------------------------------------------------------------------
1 | APP_ABI := armeabi armeabi-v7a
2 | APP_PIE:= true


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | *.iml
2 | .gradle
3 | /local.properties
4 | /.idea
5 | .DS_Store
6 | /build
7 | /captures
8 | 


--------------------------------------------------------------------------------
/app/src/main/res/values/strings.xml:
--------------------------------------------------------------------------------
1 | <resources>
2 |     <string name="app_name">AndroidInlineHook</string>
3 | </resources>
4 | 


--------------------------------------------------------------------------------
/gradle/wrapper/gradle-wrapper.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/difcareer/AndroidInlineHook/HEAD/gradle/wrapper/gradle-wrapper.jar


--------------------------------------------------------------------------------
/app/src/main/res/mipmap-hdpi/ic_launcher.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/difcareer/AndroidInlineHook/HEAD/app/src/main/res/mipmap-hdpi/ic_launcher.png


--------------------------------------------------------------------------------
/app/src/main/res/mipmap-mdpi/ic_launcher.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/difcareer/AndroidInlineHook/HEAD/app/src/main/res/mipmap-mdpi/ic_launcher.png


--------------------------------------------------------------------------------
/app/src/main/res/mipmap-xhdpi/ic_launcher.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/difcareer/AndroidInlineHook/HEAD/app/src/main/res/mipmap-xhdpi/ic_launcher.png


--------------------------------------------------------------------------------
/app/src/main/res/mipmap-xxhdpi/ic_launcher.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/difcareer/AndroidInlineHook/HEAD/app/src/main/res/mipmap-xxhdpi/ic_launcher.png


--------------------------------------------------------------------------------
/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/difcareer/AndroidInlineHook/HEAD/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png


--------------------------------------------------------------------------------
/app/src/main/res/values/colors.xml:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <resources>
3 |     <color name="colorPrimary">#3F51B5</color>
4 |     <color name="colorPrimaryDark">#303F9F</color>
5 |     <color name="colorAccent">#FF4081</color>
6 | </resources>
7 | 


--------------------------------------------------------------------------------
/app/src/main/res/values/dimens.xml:
--------------------------------------------------------------------------------
1 | <resources>
2 |     <!-- Default screen margins, per the Android Design guidelines. -->
3 |     <dimen name="activity_horizontal_margin">16dp</dimen>
4 |     <dimen name="activity_vertical_margin">16dp</dimen>
5 | </resources>
6 | 


--------------------------------------------------------------------------------
/gradle/wrapper/gradle-wrapper.properties:
--------------------------------------------------------------------------------
1 | #Mon Dec 28 10:00:20 PST 2015
2 | distributionBase=GRADLE_USER_HOME
3 | distributionPath=wrapper/dists
4 | zipStoreBase=GRADLE_USER_HOME
5 | zipStorePath=wrapper/dists
6 | distributionUrl=https\://services.gradle.org/distributions/gradle-2.14.1-all.zip
7 | 


--------------------------------------------------------------------------------
/app/src/main/jni/relocate.h:
--------------------------------------------------------------------------------
1 | #ifndef _RELOCATE_H
2 | #define _RELOCATE_H
3 | 
4 | #include <stdio.h>
5 | 
6 | void relocateInstruction(uint32_t target_addr, void *orig_instructions, int length, void *trampoline_instructions, int *orig_boundaries, int *trampoline_boundaries, int *count);
7 | 
8 | #endif


--------------------------------------------------------------------------------
/app/src/main/res/values-w820dp/dimens.xml:
--------------------------------------------------------------------------------
1 | <resources>
2 |     <!-- Example customization of dimensions originally defined in res/values/dimens.xml
3 |          (such as screen margins) for screens with more than 820dp of available width. This
4 |          would include 7" and 10" devices in landscape (~960dp and ~1280dp respectively). -->
5 |     <dimen name="activity_horizontal_margin">64dp</dimen>
6 | </resources>
7 | 


--------------------------------------------------------------------------------
/app/src/main/res/values/styles.xml:
--------------------------------------------------------------------------------
 1 | <resources>
 2 | 
 3 |     <!-- Base application theme. -->
 4 |     <style name="AppTheme" parent="Theme.AppCompat.Light.DarkActionBar">
 5 |         <!-- Customize your theme here. -->
 6 |         <item name="colorPrimary">@color/colorPrimary</item>
 7 |         <item name="colorPrimaryDark">@color/colorPrimaryDark</item>
 8 |         <item name="colorAccent">@color/colorAccent</item>
 9 |     </style>
10 | 
11 | </resources>
12 | 


--------------------------------------------------------------------------------
/app/src/test/java/com/andr0day/androidinlinehook/ExampleUnitTest.java:
--------------------------------------------------------------------------------
 1 | package com.andr0day.androidinlinehook;
 2 | 
 3 | import org.junit.Test;
 4 | 
 5 | import static org.junit.Assert.*;
 6 | 
 7 | /**
 8 |  * Example local unit test, which will execute on the development machine (host).
 9 |  *
10 |  * @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
11 |  */
12 | public class ExampleUnitTest {
13 |     @Test
14 |     public void addition_isCorrect() throws Exception {
15 |         assertEquals(4, 2 + 2);
16 |     }
17 | }


--------------------------------------------------------------------------------
/app/proguard-rules.pro:
--------------------------------------------------------------------------------
 1 | # Add project specific ProGuard rules here.
 2 | # By default, the flags in this file are appended to flags specified
 3 | # in D:\Tools\AndroidSdk/tools/proguard/proguard-android.txt
 4 | # You can edit the include path and order by changing the proguardFiles
 5 | # directive in build.gradle.
 6 | #
 7 | # For more details, see
 8 | #   http://developer.android.com/guide/developing/tools/proguard.html
 9 | 
10 | # Add any project specific keep options here:
11 | 
12 | # If your project uses WebView with JS, uncomment the following
13 | # and specify the fully qualified class name to the JavaScript interface
14 | # class:
15 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview {
16 | #   public *;
17 | #}
18 | 


--------------------------------------------------------------------------------
/app/src/main/AndroidManifest.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <manifest xmlns:android="http://schemas.android.com/apk/res/android"
 3 |     package="com.andr0day.androidinlinehook">
 4 | 
 5 |     <application
 6 |         android:allowBackup="true"
 7 |         android:icon="@mipmap/ic_launcher"
 8 |         android:label="@string/app_name"
 9 |         android:supportsRtl="true"
10 |         android:theme="@style/AppTheme">
11 |         <activity android:name=".MainActivity">
12 |             <intent-filter>
13 |                 <action android:name="android.intent.action.MAIN" />
14 | 
15 |                 <category android:name="android.intent.category.LAUNCHER" />
16 |             </intent-filter>
17 |         </activity>
18 |     </application>
19 | 
20 | </manifest>


--------------------------------------------------------------------------------
/app/src/main/jni/inlineHook.h:
--------------------------------------------------------------------------------
 1 | #ifndef _INLINEHOOK_H
 2 | #define _INLINEHOOK_H
 3 | 
 4 | #include <stdio.h>
 5 | #include <unistd.h>
 6 | 
 7 | enum ele7en_status {
 8 | 	ELE7EN_ERROR_UNKNOWN = -1,
 9 | 	ELE7EN_OK = 0,
10 | 	ELE7EN_ERROR_NOT_INITIALIZED,
11 | 	ELE7EN_ERROR_NOT_EXECUTABLE,
12 | 	ELE7EN_ERROR_NOT_REGISTERED,
13 | 	ELE7EN_ERROR_NOT_HOOKED,
14 | 	ELE7EN_ERROR_ALREADY_REGISTERED,
15 | 	ELE7EN_ERROR_ALREADY_HOOKED,
16 | 	ELE7EN_ERROR_SO_NOT_FOUND,
17 | 	ELE7EN_ERROR_FUNCTION_NOT_FOUND
18 | };
19 | 
20 | enum ele7en_status registerInlineHook(uint32_t target_addr, uint32_t new_addr, uint32_t **proto_addr);
21 | enum ele7en_status inlineUnHook(uint32_t target_addr);
22 | void inlineUnHookAll();
23 | enum ele7en_status inlineHook(uint32_t target_addr);
24 | void inlineHookAll();
25 | 
26 | #endif


--------------------------------------------------------------------------------
/gradle.properties:
--------------------------------------------------------------------------------
 1 | # Project-wide Gradle settings.
 2 | 
 3 | # IDE (e.g. Android Studio) users:
 4 | # Gradle settings configured through the IDE *will override*
 5 | # any settings specified in this file.
 6 | 
 7 | # For more details on how to configure your build environment visit
 8 | # http://www.gradle.org/docs/current/userguide/build_environment.html
 9 | 
10 | # Specifies the JVM arguments used for the daemon process.
11 | # The setting is particularly useful for tweaking memory settings.
12 | org.gradle.jvmargs=-Xmx1536m
13 | 
14 | # When configured, Gradle will run in incubating parallel mode.
15 | # This option should only be used with decoupled projects. More details, visit
16 | # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
17 | # org.gradle.parallel=true
18 | 


--------------------------------------------------------------------------------
/app/src/main/res/layout/activity_main.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
 3 |     xmlns:tools="http://schemas.android.com/tools"
 4 |     android:id="@+id/activity_main"
 5 |     android:layout_width="match_parent"
 6 |     android:layout_height="match_parent"
 7 |     android:paddingBottom="@dimen/activity_vertical_margin"
 8 |     android:paddingLeft="@dimen/activity_horizontal_margin"
 9 |     android:paddingRight="@dimen/activity_horizontal_margin"
10 |     android:paddingTop="@dimen/activity_vertical_margin"
11 |     tools:context="com.andr0day.androidinlinehook.MainActivity">
12 | 
13 |     <Button
14 |         android:id="@+id/btn"
15 |         android:layout_width="wrap_content"
16 |         android:layout_height="wrap_content"
17 |         android:text="Click Me"/>
18 | </RelativeLayout>
19 | 


--------------------------------------------------------------------------------
/app/src/androidTest/java/com/andr0day/androidinlinehook/ExampleInstrumentedTest.java:
--------------------------------------------------------------------------------
 1 | package com.andr0day.androidinlinehook;
 2 | 
 3 | import android.content.Context;
 4 | import android.support.test.InstrumentationRegistry;
 5 | import android.support.test.runner.AndroidJUnit4;
 6 | 
 7 | import org.junit.Test;
 8 | import org.junit.runner.RunWith;
 9 | 
10 | import static org.junit.Assert.*;
11 | 
12 | /**
13 |  * Instrumentation test, which will execute on an Android device.
14 |  *
15 |  * @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
16 |  */
17 | @RunWith(AndroidJUnit4.class)
18 | public class ExampleInstrumentedTest {
19 |     @Test
20 |     public void useAppContext() throws Exception {
21 |         // Context of the app under test.
22 |         Context appContext = InstrumentationRegistry.getTargetContext();
23 | 
24 |         assertEquals("com.andr0day.androidinlinehook", appContext.getPackageName());
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/app/src/main/jni/Android.mk:
--------------------------------------------------------------------------------
 1 | # Copyright (C) 2009 The Android Open Source Project
 2 | #
 3 | # Licensed under the Apache License, Version 2.0 (the "License");
 4 | # you may not use this file except in compliance with the License.
 5 | # You may obtain a copy of the License at
 6 | #
 7 | #      http://www.apache.org/licenses/LICENSE-2.0
 8 | #
 9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 | #
15 | #
16 | #
17 | LOCAL_PATH := $(call my-dir)
18 | 
19 | include $(CLEAR_VARS)
20 | 
21 | LOCAL_MODULE    := native-lib
22 | LOCAL_SRC_FILES := inlineHook.c relocate.c native-lib.c
23 | 
24 | LOCAL_LDLIBS := -L$(SYSROOT)/usr/lib -llog -lz
25 | 
26 | include $(BUILD_SHARED_LIBRARY)
27 | 
28 | 
29 | 


--------------------------------------------------------------------------------
/app/src/main/java/com/andr0day/androidinlinehook/MainActivity.java:
--------------------------------------------------------------------------------
 1 | package com.andr0day.androidinlinehook;
 2 | 
 3 | import android.support.v7.app.AppCompatActivity;
 4 | import android.os.Bundle;
 5 | import android.view.View;
 6 | import android.widget.TextView;
 7 | 
 8 | public class MainActivity extends AppCompatActivity {
 9 | 
10 |     static {
11 |         System.loadLibrary("native-lib");
12 |     }
13 | 
14 |     @Override
15 |     protected void onCreate(Bundle savedInstanceState) {
16 |         super.onCreate(savedInstanceState);
17 |         setContentView(R.layout.activity_main);
18 | 
19 |         findViewById(R.id.btn).setOnClickListener(new View.OnClickListener() {
20 |             @Override
21 |             public void onClick(View view) {
22 |                 stringFromJNI();
23 |             }
24 |         });
25 | 
26 |     }
27 | 
28 |     /**
29 |      * A native method that is implemented by the 'native-lib' native library,
30 |      * which is packaged with this application.
31 |      */
32 |     public native String stringFromJNI();
33 | }
34 | 


--------------------------------------------------------------------------------
/app/src/main/jni/native-lib.c:
--------------------------------------------------------------------------------
 1 | #include <jni.h>
 2 | #include "inlineHook.h"
 3 | #include "android_log.h"
 4 | 
 5 | void (*old_log)(const char *) = NULL;
 6 | 
 7 | void origin_log(const char *str) {
 8 |     LOGE("%s", str);
 9 |     char buf[10];
10 |     buf[0] = '1';
11 |     buf[1] = '2';
12 |     buf[2] = '3';
13 |     buf[3] = 0;
14 |     LOGE("%s",buf);
15 | }
16 | 
17 | void new_log(const char *str) {
18 |     LOGE("hooked");
19 | //    old_log("log hooked");
20 | }
21 | 
22 | int hook() {
23 |     if (registerInlineHook((uint32_t) origin_log, (uint32_t) new_log, (uint32_t **) &old_log)
24 |         != ELE7EN_OK) {
25 |         return -1;
26 |     }
27 |     if (inlineHook((uint32_t) origin_log) != ELE7EN_OK) {
28 |         return -1;
29 |     }
30 | 
31 |     return 0;
32 | }
33 | 
34 | int unHook() {
35 |     if (inlineUnHook((uint32_t) origin_log) != ELE7EN_OK) {
36 |         return -1;
37 |     }
38 | 
39 |     return 0;
40 | }
41 | 
42 | 
43 | jstring
44 | Java_com_andr0day_androidinlinehook_MainActivity_stringFromJNI(JNIEnv *env, jobject obj) {
45 |     origin_log("test1");
46 |     int ret = hook();
47 |     LOGE("%d", ret);
48 |     origin_log("test2");
49 |     unHook();
50 |     origin_log("test3");
51 |     return (*env)->NewStringUTF(env, "WTF");
52 | }
53 | 


--------------------------------------------------------------------------------
/app/build.gradle:
--------------------------------------------------------------------------------
 1 | apply plugin: 'com.android.application'
 2 | 
 3 | android {
 4 |     compileSdkVersion 25
 5 |     buildToolsVersion "24.0.3"
 6 |     defaultConfig {
 7 |         applicationId "com.andr0day.androidinlinehook"
 8 |         minSdkVersion 19
 9 |         targetSdkVersion 25
10 |         versionCode 1
11 |         versionName "1.0"
12 |         testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
13 |         externalNativeBuild {
14 |             ndkBuild{
15 |                 abiFilters "armeabi-v7a"
16 |                 cFlags "-DNDKLOG"
17 |             }
18 |         }
19 |     }
20 |     buildTypes {
21 |         release {
22 |             minifyEnabled false
23 |             proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
24 |         }
25 |     }
26 |     externalNativeBuild {
27 |         ndkBuild{
28 |             path "src/main/jni/Android.mk"
29 |         }
30 |     }
31 | }
32 | 
33 | dependencies {
34 |     compile fileTree(dir: 'libs', include: ['*.jar'])
35 |     androidTestCompile('com.android.support.test.espresso:espresso-core:2.2.2', {
36 |         exclude group: 'com.android.support', module: 'support-annotations'
37 |     })
38 |     compile 'com.android.support:appcompat-v7:25.0.0'
39 |     testCompile 'junit:junit:4.12'
40 | }
41 | 


--------------------------------------------------------------------------------
/app/src/main/jni/android_log.h:
--------------------------------------------------------------------------------
 1 | /*
 2 |  * Copyright (C) 2015 The Android Open Source Project
 3 |  *
 4 |  * Licensed under the Apache License, Version 2.0 (the "License");
 5 |  * you may not use this file except in compliance with the License.
 6 |  * You may obtain a copy of the License at
 7 |  *
 8 |  *      http://www.apache.org/licenses/LICENSE-2.0
 9 |  *
10 |  * Unless required by applicable law or agreed to in writing, software
11 |  * distributed under the License is distributed on an "AS IS" BASIS,
12 |  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 |  * See the License for the specific language governing permissions and
14 |  * limitations under the License.
15 |  *
16 |  */
17 | #ifndef NATIVE_ANDROID_DEBUG_H_H
18 | #define NATIVE_ANDROID_DEBUG_H_H
19 | 
20 | #include <android/log.h>
21 | 
22 | #ifdef NDKLOG
23 | 
24 | #define MODULE_NAME  "NDKLOG"
25 | #define LOGV(...) __android_log_print(ANDROID_LOG_VERBOSE, MODULE_NAME, __VA_ARGS__)
26 | #define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG, MODULE_NAME, __VA_ARGS__)
27 | #define LOGI(...) __android_log_print(ANDROID_LOG_INFO, MODULE_NAME, __VA_ARGS__)
28 | #define LOGW(...) __android_log_print(ANDROID_LOG_WARN,MODULE_NAME, __VA_ARGS__)
29 | #define LOGE(...) __android_log_print(ANDROID_LOG_ERROR,MODULE_NAME, __VA_ARGS__)
30 | #define LOGF(...) __android_log_print(ANDROID_LOG_FATAL,MODULE_NAME, __VA_ARGS__)
31 | 
32 | #else
33 | 
34 | #define LOGV(...)
35 | #define LOGD(...)
36 | #define LOGI(...)
37 | #define LOGW(...)
38 | #define LOGE(...)
39 | #define LOGF(...)
40 | #endif
41 | 
42 | #endif //NATIVE_AUDIO_ANDROID_DEBUG_H_H
43 | 
44 | 


--------------------------------------------------------------------------------
/gradlew.bat:
--------------------------------------------------------------------------------
 1 | @if "%DEBUG%" == "" @echo off
 2 | @rem ##########################################################################
 3 | @rem
 4 | @rem  Gradle startup script for Windows
 5 | @rem
 6 | @rem ##########################################################################
 7 | 
 8 | @rem Set local scope for the variables with windows NT shell
 9 | if "%OS%"=="Windows_NT" setlocal
10 | 
11 | @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
12 | set DEFAULT_JVM_OPTS=
13 | 
14 | set DIRNAME=%~dp0
15 | if "%DIRNAME%" == "" set DIRNAME=.
16 | set APP_BASE_NAME=%~n0
17 | set APP_HOME=%DIRNAME%
18 | 
19 | @rem Find java.exe
20 | if defined JAVA_HOME goto findJavaFromJavaHome
21 | 
22 | set JAVA_EXE=java.exe
23 | %JAVA_EXE% -version >NUL 2>&1
24 | if "%ERRORLEVEL%" == "0" goto init
25 | 
26 | echo.
27 | echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
28 | echo.
29 | echo Please set the JAVA_HOME variable in your environment to match the
30 | echo location of your Java installation.
31 | 
32 | goto fail
33 | 
34 | :findJavaFromJavaHome
35 | set JAVA_HOME=%JAVA_HOME:"=%
36 | set JAVA_EXE=%JAVA_HOME%/bin/java.exe
37 | 
38 | if exist "%JAVA_EXE%" goto init
39 | 
40 | echo.
41 | echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
42 | echo.
43 | echo Please set the JAVA_HOME variable in your environment to match the
44 | echo location of your Java installation.
45 | 
46 | goto fail
47 | 
48 | :init
49 | @rem Get command-line arguments, handling Windowz variants
50 | 
51 | if not "%OS%" == "Windows_NT" goto win9xME_args
52 | if "%@eval[2+2]" == "4" goto 4NT_args
53 | 
54 | :win9xME_args
55 | @rem Slurp the command line arguments.
56 | set CMD_LINE_ARGS=
57 | set _SKIP=2
58 | 
59 | :win9xME_args_slurp
60 | if "x%~1" == "x" goto execute
61 | 
62 | set CMD_LINE_ARGS=%*
63 | goto execute
64 | 
65 | :4NT_args
66 | @rem Get arguments from the 4NT Shell from JP Software
67 | set CMD_LINE_ARGS=%$
68 | 
69 | :execute
70 | @rem Setup the command line
71 | 
72 | set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
73 | 
74 | @rem Execute Gradle
75 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%
76 | 
77 | :end
78 | @rem End local scope for the variables with windows NT shell
79 | if "%ERRORLEVEL%"=="0" goto mainEnd
80 | 
81 | :fail
82 | rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
83 | rem the _cmd.exe /c_ return code!
84 | if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
85 | exit /b 1
86 | 
87 | :mainEnd
88 | if "%OS%"=="Windows_NT" endlocal
89 | 
90 | :omega
91 | 


--------------------------------------------------------------------------------
/gradlew:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env bash
  2 | 
  3 | ##############################################################################
  4 | ##
  5 | ##  Gradle start up script for UN*X
  6 | ##
  7 | ##############################################################################
  8 | 
  9 | # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 10 | DEFAULT_JVM_OPTS=""
 11 | 
 12 | APP_NAME="Gradle"
 13 | APP_BASE_NAME=`basename "$0"`
 14 | 
 15 | # Use the maximum available, or set MAX_FD != -1 to use that value.
 16 | MAX_FD="maximum"
 17 | 
 18 | warn ( ) {
 19 |     echo "$*"
 20 | }
 21 | 
 22 | die ( ) {
 23 |     echo
 24 |     echo "$*"
 25 |     echo
 26 |     exit 1
 27 | }
 28 | 
 29 | # OS specific support (must be 'true' or 'false').
 30 | cygwin=false
 31 | msys=false
 32 | darwin=false
 33 | case "`uname`" in
 34 |   CYGWIN* )
 35 |     cygwin=true
 36 |     ;;
 37 |   Darwin* )
 38 |     darwin=true
 39 |     ;;
 40 |   MINGW* )
 41 |     msys=true
 42 |     ;;
 43 | esac
 44 | 
 45 | # Attempt to set APP_HOME
 46 | # Resolve links: $0 may be a link
 47 | PRG="$0"
 48 | # Need this for relative symlinks.
 49 | while [ -h "$PRG" ] ; do
 50 |     ls=`ls -ld "$PRG"`
 51 |     link=`expr "$ls" : '.*-> \(.*\)$'`
 52 |     if expr "$link" : '/.*' > /dev/null; then
 53 |         PRG="$link"
 54 |     else
 55 |         PRG=`dirname "$PRG"`"/$link"
 56 |     fi
 57 | done
 58 | SAVED="`pwd`"
 59 | cd "`dirname \"$PRG\"`/" >/dev/null
 60 | APP_HOME="`pwd -P`"
 61 | cd "$SAVED" >/dev/null
 62 | 
 63 | CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
 64 | 
 65 | # Determine the Java command to use to start the JVM.
 66 | if [ -n "$JAVA_HOME" ] ; then
 67 |     if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
 68 |         # IBM's JDK on AIX uses strange locations for the executables
 69 |         JAVACMD="$JAVA_HOME/jre/sh/java"
 70 |     else
 71 |         JAVACMD="$JAVA_HOME/bin/java"
 72 |     fi
 73 |     if [ ! -x "$JAVACMD" ] ; then
 74 |         die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
 75 | 
 76 | Please set the JAVA_HOME variable in your environment to match the
 77 | location of your Java installation."
 78 |     fi
 79 | else
 80 |     JAVACMD="java"
 81 |     which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 82 | 
 83 | Please set the JAVA_HOME variable in your environment to match the
 84 | location of your Java installation."
 85 | fi
 86 | 
 87 | # Increase the maximum file descriptors if we can.
 88 | if [ "$cygwin" = "false" -a "$darwin" = "false" ] ; then
 89 |     MAX_FD_LIMIT=`ulimit -H -n`
 90 |     if [ $? -eq 0 ] ; then
 91 |         if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
 92 |             MAX_FD="$MAX_FD_LIMIT"
 93 |         fi
 94 |         ulimit -n $MAX_FD
 95 |         if [ $? -ne 0 ] ; then
 96 |             warn "Could not set maximum file descriptor limit: $MAX_FD"
 97 |         fi
 98 |     else
 99 |         warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
100 |     fi
101 | fi
102 | 
103 | # For Darwin, add options to specify how the application appears in the dock
104 | if $darwin; then
105 |     GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
106 | fi
107 | 
108 | # For Cygwin, switch paths to Windows format before running java
109 | if $cygwin ; then
110 |     APP_HOME=`cygpath --path --mixed "$APP_HOME"`
111 |     CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
112 |     JAVACMD=`cygpath --unix "$JAVACMD"`
113 | 
114 |     # We build the pattern for arguments to be converted via cygpath
115 |     ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
116 |     SEP=""
117 |     for dir in $ROOTDIRSRAW ; do
118 |         ROOTDIRS="$ROOTDIRS$SEP$dir"
119 |         SEP="|"
120 |     done
121 |     OURCYGPATTERN="(^($ROOTDIRS))"
122 |     # Add a user-defined pattern to the cygpath arguments
123 |     if [ "$GRADLE_CYGPATTERN" != "" ] ; then
124 |         OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
125 |     fi
126 |     # Now convert the arguments - kludge to limit ourselves to /bin/sh
127 |     i=0
128 |     for arg in "$@" ; do
129 |         CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
130 |         CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
131 | 
132 |         if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
133 |             eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
134 |         else
135 |             eval `echo args$i`="\"$arg\""
136 |         fi
137 |         i=$((i+1))
138 |     done
139 |     case $i in
140 |         (0) set -- ;;
141 |         (1) set -- "$args0" ;;
142 |         (2) set -- "$args0" "$args1" ;;
143 |         (3) set -- "$args0" "$args1" "$args2" ;;
144 |         (4) set -- "$args0" "$args1" "$args2" "$args3" ;;
145 |         (5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
146 |         (6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
147 |         (7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
148 |         (8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
149 |         (9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
150 |     esac
151 | fi
152 | 
153 | # Split up the JVM_OPTS And GRADLE_OPTS values into an array, following the shell quoting and substitution rules
154 | function splitJvmOpts() {
155 |     JVM_OPTS=("$@")
156 | }
157 | eval splitJvmOpts $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS
158 | JVM_OPTS[${#JVM_OPTS[*]}]="-Dorg.gradle.appname=$APP_BASE_NAME"
159 | 
160 | exec "$JAVACMD" "${JVM_OPTS[@]}" -classpath "$CLASSPATH" org.gradle.wrapper.GradleWrapperMain "$@"
161 | 


--------------------------------------------------------------------------------
/app/src/main/jni/inlineHook.c:
--------------------------------------------------------------------------------
  1 | /*
  2 | thumb16 thumb32 arm32 inlineHook
  3 | author: ele7enxxh
  4 | mail: ele7enxxh@qq.com
  5 | website: ele7enxxh.com
  6 | modified time: 2015-01-23
  7 | created time: 2015-11-30
  8 | */
  9 | 
 10 | #include <stdlib.h>
 11 | #include <stdbool.h>
 12 | #include <dirent.h>
 13 | #include <signal.h>
 14 | #include <sys/mman.h>
 15 | #include <sys/wait.h>
 16 | #include <sys/ptrace.h>
 17 | 
 18 | #include "relocate.h"
 19 | #include "inlineHook.h"
 20 | 
 21 | #ifndef PAGE_SIZE
 22 | #define PAGE_SIZE 4096
 23 | #endif
 24 | 
 25 | #define PAGE_START(addr)	(~(PAGE_SIZE - 1) & (addr))
 26 | #define SET_BIT0(addr)		(addr | 1)
 27 | #define CLEAR_BIT0(addr)	(addr & 0xFFFFFFFE)
 28 | #define TEST_BIT0(addr)		(addr & 1)
 29 | 
 30 | #define ACTION_ENABLE	0
 31 | #define ACTION_DISABLE	1
 32 | 	
 33 | enum hook_status {
 34 | 	REGISTERED,
 35 | 	HOOKED,
 36 | };
 37 | 
 38 | struct inlineHookItem {
 39 | 	uint32_t target_addr;
 40 | 	uint32_t new_addr;
 41 | 	uint32_t **proto_addr;
 42 | 	void *orig_instructions;
 43 | 	int orig_boundaries[4];
 44 | 	int trampoline_boundaries[20];
 45 | 	int count;
 46 | 	void *trampoline_instructions;
 47 | 	int length;
 48 | 	int status;
 49 | 	int mode;
 50 | };
 51 | 
 52 | struct inlineHookInfo {
 53 | 	struct inlineHookItem item[1024];
 54 | 	int size;
 55 | };
 56 |  
 57 | struct inlineHookInfo info = {0};
 58 | 
 59 | int getAllTids(pid_t pid, pid_t *tids)
 60 | {
 61 | 	char dir_path[32];
 62 | 	DIR *dir;
 63 | 	int i;
 64 | 	struct dirent *entry;
 65 | 	pid_t tid;
 66 | 
 67 | 	if (pid < 0) {
 68 | 		snprintf(dir_path, sizeof(dir_path), "/proc/self/task");
 69 | 	}
 70 | 	else {
 71 | 		snprintf(dir_path, sizeof(dir_path), "/proc/%d/task", pid);
 72 | 	}
 73 | 
 74 | 	dir = opendir(dir_path);
 75 |     if (dir == NULL) {
 76 |     	return 0;
 77 |     }
 78 | 
 79 |     i = 0;
 80 |     while((entry = readdir(dir)) != NULL) {
 81 |     	tid = atoi(entry->d_name);
 82 |     	if (tid != 0 && tid != getpid()) {
 83 |     		tids[i++] = tid;
 84 |     	}
 85 |     }
 86 |     closedir(dir);
 87 |     return i;
 88 | }
 89 | 
 90 | bool doProcessThreadPC(struct inlineHookItem *item, struct pt_regs *regs, int action)
 91 | {
 92 | 	int offset;
 93 | 	int i;
 94 | 
 95 | 	switch (action)
 96 | 	{
 97 | 		case ACTION_ENABLE:
 98 | 			offset = regs->ARM_pc - CLEAR_BIT0(item->target_addr);
 99 | 			for (i = 0; i < item->count; ++i) {
100 | 				if (offset == item->orig_boundaries[i]) {
101 | 					regs->ARM_pc = (uint32_t) item->trampoline_instructions + item->trampoline_boundaries[i];
102 | 					return true;
103 | 				}
104 | 			}
105 | 			break;
106 | 		case ACTION_DISABLE:
107 | 			offset = regs->ARM_pc - (int) item->trampoline_instructions;
108 | 			for (i = 0; i < item->count; ++i) {
109 | 				if (offset == item->trampoline_boundaries[i]) {
110 | 					regs->ARM_pc = CLEAR_BIT0(item->target_addr) + item->orig_boundaries[i];
111 | 					return true;
112 | 				}
113 | 			}
114 | 			break;
115 | 	}
116 | 
117 | 	return false;
118 | }
119 | 
120 | void processThreadPC(pid_t tid, struct inlineHookItem *item, int action)
121 | {
122 | 	struct pt_regs regs;
123 | 
124 | 	if (ptrace(PTRACE_GETREGS, tid, NULL, &regs) == 0) {
125 | 		if (item == NULL) {
126 | 			int pos;
127 | 
128 | 			for (pos = 0; pos < info.size; ++pos) {
129 | 				if (doProcessThreadPC(&info.item[pos], &regs, action) == true) {
130 | 					break;
131 | 				}
132 | 			}
133 | 		}
134 | 		else {
135 | 			doProcessThreadPC(item, &regs, action);
136 | 		}
137 | 
138 | 		ptrace(PTRACE_SETREGS, tid, NULL, &regs);
139 | 	}
140 | }
141 | 
142 | pid_t freeze(struct inlineHookItem *item, int action)
143 | {
144 | 	int count;
145 | 	pid_t tids[1024];
146 | 	pid_t pid;
147 | 
148 | 	pid = -1;
149 | 	count = getAllTids(getpid(), tids);
150 | 	if (count > 0) {
151 | 		pid = fork();
152 | 
153 | 		if (pid == 0) {
154 | 			int i;
155 | 
156 | 			for (i = 0; i < count; ++i) {
157 | 				if (ptrace(PTRACE_ATTACH, tids[i], NULL, NULL) == 0) {
158 | 					waitpid(tids[i], NULL, WUNTRACED);
159 | 					processThreadPC(tids[i], item, action);
160 | 				}
161 | 			}
162 | 			
163 | 			raise(SIGSTOP);
164 | 
165 | 			for (i = 0; i < count; ++i) {
166 | 				ptrace(PTRACE_DETACH, tids[i], NULL, NULL);
167 | 			}
168 | 
169 | 			raise(SIGKILL);
170 | 		}
171 | 
172 | 		else if (pid > 0) {
173 | 			waitpid(pid, NULL, WUNTRACED);
174 | 		}
175 | 	}
176 | 
177 | 	return pid;
178 | }
179 | 
180 | void unFreeze(pid_t pid)
181 | {
182 | 	if (pid < 0) {
183 | 		return;
184 | 	}
185 | 
186 | 	kill(pid, SIGCONT);
187 | 	wait(NULL);
188 | }
189 | 
190 | bool isExecutableAddr(uint32_t addr)
191 | {
192 | 	FILE *fp;
193 | 	char line[1024];
194 | 	uint32_t start;
195 | 	uint32_t end;
196 | 
197 | 	fp = fopen("/proc/self/maps", "r");
198 | 	if (fp == NULL) {
199 | 		return false;
200 | 	}
201 | 
202 | 	while (fgets(line, sizeof(line), fp)) {
203 | 		if (strstr(line, "r-xp")) {
204 | 			start = strtoul(strtok(line, "-"), NULL, 16);
205 | 			end = strtoul(strtok(NULL, " "), NULL, 16);
206 | 			if (addr >= start && addr <= end) {
207 | 				fclose(fp);
208 | 				return true;
209 | 			}
210 | 		}
211 | 	}
212 | 
213 | 	fclose(fp);
214 | 
215 | 	return false;
216 | }
217 | 
218 | struct inlineHookItem *findInlineHookItem(uint32_t target_addr)
219 | {
220 | 	int i;
221 | 
222 | 	for (i = 0; i < info.size; ++i) {
223 | 		if (info.item[i].target_addr == target_addr) {
224 | 			return &info.item[i];
225 | 		}
226 | 	}
227 | 
228 | 	return NULL;
229 | }
230 | 
231 | struct inlineHookItem *addInlineHookItem() {
232 | 	struct inlineHookItem *item;
233 | 
234 | 	if (info.size >= 1024) {
235 | 		return NULL;
236 | 	}
237 | 
238 | 	item = &info.item[info.size];
239 | 	++info.size;
240 | 
241 | 	return item;
242 | }
243 | 
244 | void deleteInlineHookItem(int pos)
245 | {
246 | 	info.item[pos] = info.item[info.size - 1];
247 | 	--info.size;
248 | }
249 | 
250 | enum ele7en_status registerInlineHook(uint32_t target_addr, uint32_t new_addr, uint32_t **proto_addr)
251 | {
252 | 	struct inlineHookItem *item;
253 | 
254 | 	if (!isExecutableAddr(target_addr) || !isExecutableAddr(new_addr)) {
255 | 		return ELE7EN_ERROR_NOT_EXECUTABLE;
256 | 	}
257 | 
258 | 	item = findInlineHookItem(target_addr);
259 | 	if (item != NULL) {
260 | 		if (item->status == REGISTERED) {
261 | 			return ELE7EN_ERROR_ALREADY_REGISTERED;
262 | 		}
263 | 		else if (item->status == HOOKED) {
264 | 			return ELE7EN_ERROR_ALREADY_HOOKED;
265 | 		}
266 | 		else {
267 | 			return ELE7EN_ERROR_UNKNOWN;
268 | 		}
269 | 	}
270 | 
271 | 	item = addInlineHookItem();
272 | //	memset(item, 0, sizeof(struct inlineHookItem));
273 | 
274 | 	item->target_addr = target_addr;
275 | 	item->new_addr = new_addr;
276 | 	item->proto_addr = proto_addr;
277 | 
278 | 	item->length = TEST_BIT0(item->target_addr) ? 10 : 8;
279 | 	item->orig_instructions = malloc((size_t)item->length);
280 | 	memcpy(item->orig_instructions, (void *) CLEAR_BIT0(item->target_addr), (size_t)item->length);
281 | 
282 | 
283 | 	item->trampoline_instructions = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
284 | 	relocateInstruction(item->target_addr, item->orig_instructions, item->length, item->trampoline_instructions, item->orig_boundaries, item->trampoline_boundaries, &item->count);
285 | 
286 | 	item->status = REGISTERED;
287 | 
288 | 	return ELE7EN_OK;
289 | }
290 | 
291 | void doInlineUnHook(struct inlineHookItem *item, int pos)
292 | {
293 | 	mprotect((void *) PAGE_START(CLEAR_BIT0(item->target_addr)), PAGE_SIZE * 2, PROT_READ | PROT_WRITE | PROT_EXEC);
294 | 	memcpy((void *) CLEAR_BIT0(item->target_addr), item->orig_instructions, item->length);
295 | 	mprotect((void *) PAGE_START(CLEAR_BIT0(item->target_addr)), PAGE_SIZE * 2, PROT_READ | PROT_EXEC);
296 | 	munmap(item->trampoline_instructions, PAGE_SIZE);
297 | 	free(item->orig_instructions);
298 | 
299 | 	deleteInlineHookItem(pos);
300 | 
301 | 	cacheflush(CLEAR_BIT0(item->target_addr), CLEAR_BIT0(item->target_addr) + item->length, 0);
302 | }
303 | 
304 | enum ele7en_status inlineUnHook(uint32_t target_addr)
305 | {
306 | 	int i;
307 | 
308 | 	for (i = 0; i < info.size; ++i) {
309 | 		if (info.item[i].target_addr == target_addr && info.item[i].status == HOOKED) {
310 | 			pid_t pid;
311 | 
312 | 			pid = freeze(&info.item[i], ACTION_DISABLE);
313 | 
314 | 			doInlineUnHook(&info.item[i], i);
315 | 
316 | 			unFreeze(pid);
317 | 
318 | 			return ELE7EN_OK;
319 | 		}
320 | 	}
321 | 
322 | 	return ELE7EN_ERROR_NOT_HOOKED;
323 | }
324 | 
325 | void inlineUnHookAll()
326 | {
327 | 	pid_t pid;
328 | 	int i;
329 | 
330 | 	pid = freeze(NULL, ACTION_DISABLE);
331 | 
332 | 	for (i = 0; i < info.size; ++i) {
333 | 		if (info.item[i].status == HOOKED) {
334 | 			doInlineUnHook(&info.item[i], i);
335 | 			--i;
336 | 		}
337 | 	}
338 | 
339 | 	unFreeze(pid);
340 | }
341 | 
342 | void doInlineHook(struct inlineHookItem *item)
343 | {
344 | 	mprotect((void *) PAGE_START(CLEAR_BIT0(item->target_addr)), PAGE_SIZE * 2, PROT_READ | PROT_WRITE | PROT_EXEC);
345 | 
346 | 	if (TEST_BIT0(item->target_addr)) {
347 | 		int i;
348 | 
349 | 		i = 0;
350 | 		if (CLEAR_BIT0(item->target_addr) % 4 != 0) {
351 | 			((uint16_t *) CLEAR_BIT0(item->target_addr))[i++] = 0xBF00;  // NOP
352 | 		}
353 | 		((uint16_t *) CLEAR_BIT0(item->target_addr))[i++] = 0xF8DF;
354 | 		((uint16_t *) CLEAR_BIT0(item->target_addr))[i++] = 0xF000;	// LDR.W PC, [PC]
355 | 		((uint16_t *) CLEAR_BIT0(item->target_addr))[i++] = item->new_addr & 0xFFFF;
356 | 		((uint16_t *) CLEAR_BIT0(item->target_addr))[i++] = item->new_addr >> 16;
357 | 	}
358 | 	else {
359 | 		((uint32_t *) (item->target_addr))[0] = 0xe51ff004;	// LDR PC, [PC, #-4]
360 | 		((uint32_t *) (item->target_addr))[1] = item->new_addr;
361 | 	}
362 | 
363 | 	mprotect((void *) PAGE_START(CLEAR_BIT0(item->target_addr)), PAGE_SIZE * 2, PROT_READ | PROT_EXEC);
364 | 
365 | 	if (item->proto_addr != NULL) {
366 | 		*(item->proto_addr) = TEST_BIT0(item->target_addr) ? (uint32_t *) SET_BIT0((uint32_t) item->trampoline_instructions) : item->trampoline_instructions;
367 | 	}
368 | 
369 | 	item->status = HOOKED;
370 | 	
371 | 	cacheflush(CLEAR_BIT0(item->target_addr), CLEAR_BIT0(item->target_addr) + item->length, 0);
372 | }
373 | 
374 | enum ele7en_status inlineHook(uint32_t target_addr)
375 | {
376 | 	int i;
377 | 	struct inlineHookItem *item;
378 | 
379 | 	item = NULL;
380 | 	for (i = 0; i < info.size; ++i) {
381 | 		if (info.item[i].target_addr == target_addr) {
382 | 			item = &info.item[i];
383 | 			break;
384 | 		}
385 | 	}
386 | 
387 | 	if (item == NULL) {
388 | 		return ELE7EN_ERROR_NOT_REGISTERED;
389 | 	}
390 | 
391 | 	if (item->status == REGISTERED) {
392 | 		pid_t pid;
393 | 
394 | 		pid = freeze(item, ACTION_ENABLE);
395 | 
396 | 		doInlineHook(item);
397 | 
398 | 		unFreeze(pid);
399 | 
400 | 		return ELE7EN_OK;
401 | 	}
402 | 	else if (item->status == HOOKED) {
403 | 		return ELE7EN_ERROR_ALREADY_HOOKED;
404 | 	}
405 | 	else {
406 | 		return ELE7EN_ERROR_UNKNOWN;
407 | 	}
408 | }
409 | 
410 | void inlineHookAll()
411 | {
412 | 	pid_t pid;
413 | 	int i;
414 | 
415 | 	pid = freeze(NULL, ACTION_ENABLE);
416 | 
417 | 	for (i = 0; i < info.size; ++i) {
418 | 		if (info.item[i].status == REGISTERED) {
419 | 			doInlineHook(&info.item[i]);
420 | 		}
421 | 	}
422 | 
423 | 	unFreeze(pid);
424 | }
425 | 


--------------------------------------------------------------------------------
/app/src/main/jni/relocate.c:
--------------------------------------------------------------------------------
  1 | /*
  2 | relocate instruction
  3 | author: ele7enxxh
  4 | mail: ele7enxxh@qq.com
  5 | website: ele7enxxh.com
  6 | modified time: 2016-10-17
  7 | created time: 2015-01-17
  8 | */
  9 | 
 10 | #include "relocate.h"
 11 | 
 12 | #define ALIGN_PC(pc)	(pc & 0xFFFFFFFC)
 13 | 
 14 | enum INSTRUCTION_TYPE {
 15 | 	// B <label>
 16 | 	B1_THUMB16,
 17 | 	// B <label>
 18 | 	B2_THUMB16,
 19 | 	// BX PC
 20 | 	BX_THUMB16,
 21 | 	// ADD <Rdn>, PC (Rd != PC, Rn != PC) 在对ADD进行修正时，采用了替换PC为Rr的方法，当Rd也为PC时，由于之前更改了Rr的值，可能会影响跳转后的正常功能。
 22 | 	ADD_THUMB16,
 23 | 	// MOV Rd, PC
 24 | 	MOV_THUMB16,
 25 | 	// ADR Rd, <label>
 26 | 	ADR_THUMB16,
 27 | 	// LDR Rt, <label>
 28 | 	LDR_THUMB16,
 29 | 
 30 | 	// CB{N}Z <Rn>, <label>
 31 | 	CB_THUMB16,
 32 | 
 33 | 
 34 | 	// BLX <label>
 35 | 	BLX_THUMB32,
 36 | 	// BL <label>
 37 | 	BL_THUMB32,
 38 | 	// B.W <label>
 39 | 	B1_THUMB32,
 40 | 	// B.W <label>
 41 | 	B2_THUMB32,
 42 | 	// ADR.W Rd, <label>
 43 | 	ADR1_THUMB32,
 44 | 	// ADR.W Rd, <label>
 45 | 	ADR2_THUMB32,
 46 | 	// LDR.W Rt, <label>
 47 | 	LDR_THUMB32,
 48 | 	// TBB [PC, Rm]
 49 | 	TBB_THUMB32,
 50 | 	// TBH [PC, Rm, LSL #1]
 51 | 	TBH_THUMB32,
 52 | 
 53 | 	// BLX <label>
 54 | 	BLX_ARM,
 55 | 	// BL <label>
 56 | 	BL_ARM,
 57 | 	// B <label>
 58 | 	B_ARM,
 59 | 	// BX PC
 60 | 	BX_ARM,
 61 | 	// ADD Rd, PC, Rm (Rd != PC, Rm != PC) 在对ADD进行修正时，采用了替换PC为Rr的方法，当Rd也为PC时，由于之前更改了Rr的值，可能会影响跳转后的正常功能;实际汇编中没有发现Rm也为PC的情况，故未做处理。
 62 | 	ADD_ARM,
 63 | 	// ADR Rd, <label>
 64 | 	ADR1_ARM,
 65 | 	// ADR Rd, <label>
 66 | 	ADR2_ARM,
 67 | 	// MOV Rd, PC
 68 | 	MOV_ARM,
 69 | 	// LDR Rt, <label>
 70 | 	LDR_ARM,
 71 | 
 72 | 	UNDEFINE,
 73 | };
 74 | 
 75 | int getTypeInThumb16(uint16_t instruction)
 76 | {
 77 | 	if ((instruction & 0xF000) == 0xD000) {
 78 | 		return B1_THUMB16;
 79 | 	}
 80 | 	if ((instruction & 0xF800) == 0xE000) {
 81 | 		return B2_THUMB16;
 82 | 	}
 83 | 	if ((instruction & 0xFFF8) == 0x4778) {
 84 | 		return BX_THUMB16;
 85 | 	}
 86 | 	if ((instruction & 0xFF78) == 0x4478) {
 87 | 		return ADD_THUMB16;
 88 | 	}
 89 | 	if ((instruction & 0xFF78) == 0x4678) {
 90 | 		return MOV_THUMB16;
 91 | 	}
 92 | 	if ((instruction & 0xF800) == 0xA000) {
 93 | 		return ADR_THUMB16;
 94 | 	}
 95 | 	if ((instruction & 0xF800) == 0x4800) {
 96 | 		return LDR_THUMB16;
 97 | 	}
 98 | 	if ((instruction & 0xF500) == 0xB100) {
 99 | 		return CB_THUMB16;
100 | 	}
101 | 	return UNDEFINE;
102 | }
103 | 
104 | int getTypeInThumb32(uint32_t instruction)
105 | {
106 | 	if ((instruction & 0xF800D000) == 0xF000C000) {
107 | 		return BLX_THUMB32;
108 | 	}
109 | 	if ((instruction & 0xF800D000) == 0xF000D000) {
110 | 		return BL_THUMB32;
111 | 	}
112 | 	if ((instruction & 0xF800D000) == 0xF0008000) {
113 | 		return B1_THUMB32;
114 | 	}
115 | 	if ((instruction & 0xF800D000) == 0xF0009000) {
116 | 		return B2_THUMB32;
117 | 	}
118 | 	if ((instruction & 0xFBFF8000) == 0xF2AF0000) {
119 | 		return ADR1_THUMB32;
120 | 	}
121 | 	if ((instruction & 0xFBFF8000) == 0xF20F0000) {
122 | 		return ADR2_THUMB32;		
123 | 	}
124 | 	if ((instruction & 0xFF7F0000) == 0xF85F0000) {
125 | 		return LDR_THUMB32;
126 | 	}
127 | 	if ((instruction & 0xFFFF00F0) == 0xE8DF0000) {
128 | 		return TBB_THUMB32;
129 | 	}
130 | 	if ((instruction & 0xFFFF00F0) == 0xE8DF0010) {
131 | 		return TBH_THUMB32;
132 | 	}
133 | 	return UNDEFINE;
134 | }
135 | 
136 | int getTypeInArm(uint32_t instruction)
137 | {
138 | 	if ((instruction & 0xFE000000) == 0xFA000000) {
139 | 		return BLX_ARM;
140 | 	}
141 | 	if ((instruction & 0xF000000) == 0xB000000) {
142 | 		return BL_ARM;
143 | 	}
144 | 	if ((instruction & 0xF000000) == 0xA000000) {
145 | 		return B_ARM;
146 | 	}
147 | 	if ((instruction & 0xFF000FF) == 0x120001F) {
148 | 		return BX_ARM;
149 | 	}
150 | 	if ((instruction & 0xFEF0010) == 0x8F0000) {
151 | 		return ADD_ARM;
152 | 	}
153 | 	if ((instruction & 0xFFF0000) == 0x28F0000) {
154 | 		return ADR1_ARM;
155 | 	}
156 | 	if ((instruction & 0xFFF0000) == 0x24F0000) {
157 | 		return ADR2_ARM;		
158 | 	}
159 | 	if ((instruction & 0xE5F0000) == 0x41F0000) {
160 | 		return LDR_ARM;
161 | 	}
162 | 	if ((instruction & 0xFE00FFF) == 0x1A0000F) {
163 | 		return MOV_ARM;
164 | 	}
165 | 	return UNDEFINE;
166 | }
167 | 
168 | int relocateInstructionInThumb16(uint32_t pc, uint16_t instruction, uint16_t *trampoline_instructions)
169 | {
170 | 	int type;
171 | 	int offset;
172 | 	
173 | 	type = getTypeInThumb16(instruction);
174 | 	if (type == B1_THUMB16 || type == B2_THUMB16 || type == BX_THUMB16) {
175 | 		uint32_t x;
176 | 		int top_bit;
177 | 		uint32_t imm32;
178 | 		uint32_t value;
179 | 		int idx;
180 | 		
181 | 		idx = 0;
182 | 		if (type == B1_THUMB16) {
183 | 			x = (instruction & 0xFF) << 1;
184 | 			top_bit = x >> 8;
185 | 			imm32 = top_bit ? (x | (0xFFFFFFFF << 8)) : x;
186 | 			value = pc + imm32;
187 | 			trampoline_instructions[idx++] = instruction & 0xFF00;
188 | 			trampoline_instructions[idx++] = 0xE003;	// B PC, #6
189 | 		}
190 | 		else if (type == B2_THUMB16) {
191 | 			x = (instruction & 0x7FF) << 1;
192 | 			top_bit = x >> 11;
193 | 			imm32 = top_bit ? (x | (0xFFFFFFFF << 11)) : x;
194 | 			value = pc + imm32;
195 | 		}
196 | 		else if (type == BX_THUMB16) {
197 | 			value = pc;
198 | 		}
199 | 		
200 | 		trampoline_instructions[idx++] = 0xF8DF;
201 | 		trampoline_instructions[idx++] = 0xF000;	// LDR.W PC, [PC]
202 | 		trampoline_instructions[idx++] = value & 0xFFFF;
203 | 		trampoline_instructions[idx++] = value >> 16;
204 | 		offset = idx;
205 | 	}
206 | 	else if (type == ADD_THUMB16) {
207 | 		int rdn;
208 | 		int rm;
209 | 		int r;
210 | 		
211 | 		rdn = ((instruction & 0x80) >> 4) | (instruction & 0x7);
212 | 		
213 | 		for (r = 7; ; --r) {
214 | 			if (r != rdn) {
215 | 				break;
216 | 			}
217 | 		}
218 | 		
219 | 		trampoline_instructions[0] = 0xB400 | (1 << r);	// PUSH {Rr}
220 | 		trampoline_instructions[1] = 0x4802 | (r << 8);	// LDR Rr, [PC, #8]
221 | 		trampoline_instructions[2] = (instruction & 0xFF87) | (r << 3);
222 | 		trampoline_instructions[3] = 0xBC00 | (1 << r);	// POP {Rr}
223 | 		trampoline_instructions[4] = 0xE002;	// B PC, #4
224 | 		trampoline_instructions[5] = 0xBF00;
225 | 		trampoline_instructions[6] = pc & 0xFFFF;
226 | 		trampoline_instructions[7] = pc >> 16;
227 | 		offset = 8;
228 | 	}
229 | 	else if (type == MOV_THUMB16 || type == ADR_THUMB16 || type == LDR_THUMB16) {
230 | 		int r;
231 | 		uint32_t value;
232 | 		
233 | 		if (type == MOV_THUMB16) {
234 | 			r = instruction & 0x7;
235 | 			value = pc;
236 | 		}
237 | 		else if (type == ADR_THUMB16) {
238 | 			r = (instruction & 0x700) >> 8;
239 | 			value = ALIGN_PC(pc) + (instruction & 0xFF) << 2;
240 | 		}
241 | 		else {
242 | 			r = (instruction & 0x700) >> 8;
243 | 			value = ((uint32_t *) (ALIGN_PC(pc) + ((instruction & 0xFF) << 2)))[0];
244 | 		}
245 | 
246 | 		trampoline_instructions[0] = 0x4800 | (r << 8);	// LDR Rd, [PC]
247 | 		trampoline_instructions[1] = 0xE001;	// B PC, #2
248 | 		trampoline_instructions[2] = value & 0xFFFF;
249 | 		trampoline_instructions[3] = value >> 16;
250 | 		offset = 4;
251 | 	}
252 | 	else if (type == CB_THUMB16) {
253 | 		int nonzero;
254 | 		uint32_t imm32;
255 | 		uint32_t value;
256 | 
257 | 		nonzero = (instruction & 0x800) >> 11;
258 | 		imm32 = ((instruction & 0x200) >> 3) | ((instruction & 0xF8) >> 2);
259 | 		value = pc + imm32 + 1;
260 | 
261 | 		trampoline_instructions[0] = instruction & 0xFD07;
262 | 		trampoline_instructions[1] = 0xE003;	// B PC, #6
263 | 		trampoline_instructions[2] = 0xF8DF;
264 | 		trampoline_instructions[3] = 0xF000;	// LDR.W PC, [PC]
265 | 		trampoline_instructions[4] = value & 0xFFFF;
266 | 		trampoline_instructions[5] = value >> 16;
267 | 		offset = 6;
268 | 	}
269 | 	else {
270 | 		trampoline_instructions[0] = instruction;
271 | 		trampoline_instructions[1] = 0xBF00;  // NOP
272 | 		offset = 2;
273 | 	}
274 | 	
275 | 	return offset;
276 | }
277 | 
278 | int relocateInstructionInThumb32(uint32_t pc, uint16_t high_instruction, uint16_t low_instruction, uint16_t *trampoline_instructions)
279 | {
280 | 	uint32_t instruction;
281 | 	int type;
282 | 	int idx;
283 | 	int offset;
284 | 	
285 | 	instruction = (high_instruction << 16) | low_instruction;
286 | 	type = getTypeInThumb32(instruction);
287 | 	idx = 0;
288 | 	if (type == BLX_THUMB32 || type == BL_THUMB32 || type == B1_THUMB32 || type == B2_THUMB32) {
289 | 		uint32_t j1;
290 | 		uint32_t j2;
291 | 		uint32_t s;
292 | 		uint32_t i1;
293 | 		uint32_t i2;
294 | 		uint32_t x;
295 | 		uint32_t imm32;
296 | 		uint32_t value;
297 | 
298 | 		j1 = (low_instruction & 0x2000) >> 13;
299 | 		j2 = (low_instruction & 0x800) >> 11;
300 | 		s = (high_instruction & 0x400) >> 10;
301 | 		i1 = !(j1 ^ s);
302 | 		i2 = !(j2 ^ s);
303 | 
304 | 		if (type == BLX_THUMB32 || type == BL_THUMB32) {
305 | 			trampoline_instructions[idx++] = 0xF20F;
306 | 			trampoline_instructions[idx++] = 0x0E09;	// ADD.W LR, PC, #9
307 | 		}
308 | 		else if (type == B1_THUMB32) {
309 | 			trampoline_instructions[idx++] = 0xD000 | ((high_instruction & 0x3C0) << 2);
310 | 			trampoline_instructions[idx++] = 0xE003;	// B PC, #6
311 | 		}
312 | 		trampoline_instructions[idx++] = 0xF8DF;
313 | 		trampoline_instructions[idx++] = 0xF000;	// LDR.W PC, [PC]
314 | 		if (type == BLX_THUMB32) {
315 | 			x = (s << 24) | (i1 << 23) | (i2 << 22) | ((high_instruction & 0x3FF) << 12) | ((low_instruction & 0x7FE) << 1);
316 | 			imm32 = s ? (x | (0xFFFFFFFF << 25)) : x;
317 | 			value = pc + imm32;
318 | 		}
319 | 		else if (type == BL_THUMB32) {
320 | 			x = (s << 24) | (i1 << 23) | (i2 << 22) | ((high_instruction & 0x3FF) << 12) | ((low_instruction & 0x7FF) << 1);
321 | 			imm32 = s ? (x | (0xFFFFFFFF << 25)) : x;
322 | 			value = pc + imm32 + 1;
323 | 		}
324 | 		else if (type == B1_THUMB32) {
325 | 			x = (s << 20) | (j2 << 19) | (j1 << 18) | ((high_instruction & 0x3F) << 12) | ((low_instruction & 0x7FF) << 1);
326 | 			imm32 = s ? (x | (0xFFFFFFFF << 21)) : x;
327 | 			value = pc + imm32 + 1;
328 | 		}
329 | 		else if (type == B2_THUMB32) {
330 | 			x = (s << 24) | (i1 << 23) | (i2 << 22) | ((high_instruction & 0x3FF) << 12) | ((low_instruction & 0x7FF) << 1);
331 | 			imm32 = s ? (x | (0xFFFFFFFF << 25)) : x;
332 | 			value = pc + imm32 + 1;
333 | 		}
334 | 		trampoline_instructions[idx++] = value & 0xFFFF;
335 | 		trampoline_instructions[idx++] = value >> 16;
336 | 		offset = idx;
337 | 	}
338 | 	else if (type == ADR1_THUMB32 || type == ADR2_THUMB32 || type == LDR_THUMB32) {
339 | 		int r;
340 | 		uint32_t imm32;
341 | 		uint32_t value;
342 | 		
343 | 		if (type == ADR1_THUMB32 || type == ADR2_THUMB32) {
344 | 			uint32_t i;
345 | 			uint32_t imm3;
346 | 			uint32_t imm8;
347 | 		
348 | 			r = (low_instruction & 0xF00) >> 8;
349 | 			i = (high_instruction & 0x400) >> 10;
350 | 			imm3 = (low_instruction & 0x7000) >> 12;
351 | 			imm8 = instruction & 0xFF;
352 | 			
353 | 			imm32 = (i << 31) | (imm3 << 30) | (imm8 << 27);
354 | 			
355 | 			if (type == ADR1_THUMB32) {
356 | 				value = ALIGN_PC(pc) + imm32;
357 | 			}
358 | 			else {
359 | 				value = ALIGN_PC(pc) - imm32;
360 | 			}
361 | 		}
362 | 		else {
363 | 			int is_add;
364 | 			uint32_t *addr;
365 | 			
366 | 			is_add = (high_instruction & 0x80) >> 7;
367 | 			r = low_instruction >> 12;
368 | 			imm32 = low_instruction & 0xFFF;
369 | 			
370 | 			if (is_add) {
371 | 				addr = (uint32_t *) (ALIGN_PC(pc) + imm32);
372 | 			}
373 | 			else {
374 | 				addr = (uint32_t *) (ALIGN_PC(pc) - imm32);
375 | 			}
376 | 			
377 | 			value = addr[0];
378 | 		}
379 | 		
380 | 		trampoline_instructions[0] = 0x4800 | (r << 8);	// LDR Rr, [PC]
381 | 		trampoline_instructions[1] = 0xE001;	// B PC, #2
382 | 		trampoline_instructions[2] = value & 0xFFFF;
383 | 		trampoline_instructions[3] = value >> 16;
384 | 		offset = 4;
385 | 	}
386 | 
387 | 	else if (type == TBB_THUMB32 || type == TBH_THUMB32) {
388 | 		int rm;
389 | 		int r;
390 | 		int rx;
391 | 		
392 | 		rm = low_instruction & 0xF;
393 | 		
394 | 		for (r = 7;; --r) {
395 | 			if (r != rm) {
396 | 				break;
397 | 			}
398 | 		}
399 | 		
400 | 		for (rx = 7; ; --rx) {
401 | 			if (rx != rm && rx != r) {
402 | 				break;
403 | 			}
404 | 		}
405 | 		
406 | 		trampoline_instructions[0] = 0xB400 | (1 << rx);	// PUSH {Rx}
407 | 		trampoline_instructions[1] = 0x4805 | (r << 8);	// LDR Rr, [PC, #20]
408 | 		trampoline_instructions[2] = 0x4600 | (rm << 3) | rx;	// MOV Rx, Rm
409 | 		if (type == TBB_THUMB32) {
410 | 			trampoline_instructions[3] = 0xEB00 | r;
411 | 			trampoline_instructions[4] = 0x0000 | (rx << 8) | rx;	// ADD.W Rx, Rr, Rx
412 | 			trampoline_instructions[5] = 0x7800 | (rx << 3) | rx; 	// LDRB Rx, [Rx]
413 | 		}
414 | 		else if (type == TBH_THUMB32) {
415 | 			trampoline_instructions[3] = 0xEB00 | r;
416 | 			trampoline_instructions[4] = 0x0040 | (rx << 8) | rx;	// ADD.W Rx, Rr, Rx, LSL #1
417 | 			trampoline_instructions[5] = 0x8800 | (rx << 3) | rx; 	// LDRH Rx, [Rx]
418 | 		}
419 | 		trampoline_instructions[6] = 0xEB00 | r;
420 | 		trampoline_instructions[7] = 0x0040 | (r << 8) | rx;	// ADD Rr, Rr, Rx, LSL #1
421 | 		trampoline_instructions[8] = 0x3001 | (r << 8);	// ADD Rr, #1
422 | 		trampoline_instructions[9] = 0xBC00 | (1 << rx);	// POP {Rx}
423 | 		trampoline_instructions[10] = 0x4700 | (r << 3);	// BX Rr
424 | 		trampoline_instructions[11] = 0xBF00;
425 | 		trampoline_instructions[12] = pc & 0xFFFF;
426 | 		trampoline_instructions[13] = pc >> 16;
427 | 		offset = 14;
428 | 	}
429 | 	else {
430 | 		trampoline_instructions[0] = high_instruction;
431 | 		trampoline_instructions[1] = low_instruction;
432 | 		offset = 2;
433 | 	}
434 | 
435 | 	return offset;
436 | }
437 | 
438 | void relocateInstructionInThumb(uint32_t target_addr, uint16_t *orig_instructions, int length, uint16_t *trampoline_instructions, int *orig_boundaries, int *trampoline_boundaries, int *count)
439 | {
440 | 	int orig_pos;
441 | 	int trampoline_pos;
442 | 	uint32_t pc;
443 | 	uint32_t lr;
444 | 
445 | 	orig_pos = 0;
446 | 	trampoline_pos = 0;
447 | 	pc = target_addr + 4;
448 | 	while (1) {
449 | 		int offset;
450 | 
451 | 		orig_boundaries[*count] = orig_pos * sizeof(uint16_t);
452 | 		trampoline_boundaries[*count] = trampoline_pos * sizeof(uint16_t);
453 | 		++(*count);
454 | 		
455 | 		if ((orig_instructions[orig_pos] >> 11) >= 0x1D && (orig_instructions[orig_pos] >> 11) <= 0x1F) {
456 | 			if (orig_pos + 2 > length / sizeof(uint16_t)) {
457 | 				break;
458 | 			}
459 | 			offset = relocateInstructionInThumb32(pc, orig_instructions[orig_pos], orig_instructions[orig_pos + 1], &trampoline_instructions[trampoline_pos]);
460 | 			pc += sizeof(uint32_t);
461 | 			trampoline_pos += offset;
462 | 			orig_pos += 2;
463 | 		}
464 | 		else {
465 | 			offset = relocateInstructionInThumb16(pc, orig_instructions[orig_pos], &trampoline_instructions[trampoline_pos]);
466 | 			pc += sizeof(uint16_t);
467 | 			trampoline_pos += offset;
468 | 			++orig_pos;
469 | 		}
470 | 		
471 | 		if (orig_pos >= length / sizeof(uint16_t)) {
472 | 			break;
473 | 		}
474 | 	}
475 | 
476 | 
477 | 	
478 | 	lr = target_addr + orig_pos * sizeof(uint16_t) + 1;
479 | 	trampoline_instructions[trampoline_pos] = 0xF8DF;
480 | 	trampoline_instructions[trampoline_pos + 1] = 0xF000;	// LDR.W PC, [PC]
481 | 	trampoline_instructions[trampoline_pos + 2] = lr & 0xFFFF;
482 | 	trampoline_instructions[trampoline_pos + 3] = lr >> 16;
483 | }
484 | 
485 | void relocateInstructionInArm(uint32_t target_addr, uint32_t *orig_instructions, int length, uint32_t *trampoline_instructions, int *orig_boundaries, int *trampoline_boundaries, int *count)
486 | {
487 | 	uint32_t pc;
488 | 	uint32_t lr;
489 | 	int orig_pos;
490 | 	int trampoline_pos;
491 | 
492 | 	pc = target_addr + 8;
493 | 	lr = target_addr + length;
494 | 
495 | 	trampoline_pos = 0;
496 | 	for (orig_pos = 0; orig_pos < length / sizeof(uint32_t); ++orig_pos) {
497 | 		uint32_t instruction;
498 | 		int type;
499 | 
500 | 		orig_boundaries[*count] = orig_pos * sizeof(uint32_t);
501 | 		trampoline_boundaries[*count] = trampoline_pos * sizeof(uint32_t);
502 | 		++(*count);
503 | 
504 | 		instruction = orig_instructions[orig_pos];
505 | 		type = getTypeInArm(instruction);
506 | 		if (type == BLX_ARM || type == BL_ARM || type == B_ARM || type == BX_ARM) {
507 | 			uint32_t x;
508 | 			int top_bit;
509 | 			uint32_t imm32;
510 | 			uint32_t value;
511 | 
512 | 			if (type == BLX_ARM || type == BL_ARM) {
513 | 				trampoline_instructions[trampoline_pos++] = 0xE28FE004;	// ADD LR, PC, #4
514 | 			}
515 | 			trampoline_instructions[trampoline_pos++] = 0xE51FF004;  	// LDR PC, [PC, #-4]
516 | 			if (type == BLX_ARM) {
517 | 				x = ((instruction & 0xFFFFFF) << 2) | ((instruction & 0x1000000) >> 23);
518 | 			}
519 | 			else if (type == BL_ARM || type == B_ARM) {
520 | 				x = (instruction & 0xFFFFFF) << 2;
521 | 			}
522 | 			else {
523 | 				x = 0;
524 | 			}
525 | 			
526 | 			top_bit = x >> 25;
527 | 			imm32 = top_bit ? (x | (0xFFFFFFFF << 26)) : x;
528 | 			if (type == BLX_ARM) {
529 | 				value = pc + imm32 + 1;
530 | 			}
531 | 			else {
532 | 				value = pc + imm32;
533 | 			}
534 | 			trampoline_instructions[trampoline_pos++] = value;
535 | 			
536 | 		}
537 | 		else if (type == ADD_ARM) {
538 | 			int rd;
539 | 			int rm;
540 | 			int r;
541 | 			
542 | 			rd = (instruction & 0xF000) >> 12;
543 | 			rm = instruction & 0xF;
544 | 			
545 | 			for (r = 12; ; --r) {
546 | 				if (r != rd && r != rm) {
547 | 					break;
548 | 				}
549 | 			}
550 | 			
551 | 			trampoline_instructions[trampoline_pos++] = 0xE52D0004 | (r << 12);	// PUSH {Rr}
552 | 			trampoline_instructions[trampoline_pos++] = 0xE59F0008 | (r << 12);	// LDR Rr, [PC, #8]
553 | 			trampoline_instructions[trampoline_pos++] = (instruction & 0xFFF0FFFF) | (r << 16);
554 | 			trampoline_instructions[trampoline_pos++] = 0xE49D0004 | (r << 12);	// POP {Rr}
555 | 			trampoline_instructions[trampoline_pos++] = 0xE28FF000;	// ADD PC, PC
556 | 			trampoline_instructions[trampoline_pos++] = pc;
557 | 		}
558 | 		else if (type == ADR1_ARM || type == ADR2_ARM || type == LDR_ARM || type == MOV_ARM) {
559 | 			int r;
560 | 			uint32_t value;
561 | 			
562 | 			r = (instruction & 0xF000) >> 12;
563 | 			
564 | 			if (type == ADR1_ARM || type == ADR2_ARM || type == LDR_ARM) {
565 | 				uint32_t imm32;
566 | 				
567 | 				imm32 = instruction & 0xFFF;
568 | 				if (type == ADR1_ARM) {
569 | 					value = pc + imm32;
570 | 				}
571 | 				else if (type == ADR2_ARM) {
572 | 					value = pc - imm32;
573 | 				}
574 | 				else if (type == LDR_ARM) {
575 | 					int is_add;
576 | 					
577 | 					is_add = (instruction & 0x800000) >> 23;
578 | 					if (is_add) {
579 | 						value = ((uint32_t *) (pc + imm32))[0];
580 | 					}
581 | 					else {
582 | 						value = ((uint32_t *) (pc - imm32))[0];
583 | 					}
584 | 				}
585 | 			}
586 | 			else {
587 | 				value = pc;
588 | 			}
589 | 				
590 | 			trampoline_instructions[trampoline_pos++] = 0xE51F0000 | (r << 12);	// LDR Rr, [PC]
591 | 			trampoline_instructions[trampoline_pos++] = 0xE28FF000;	// ADD PC, PC
592 | 			trampoline_instructions[trampoline_pos++] = value;
593 | 		}
594 | 		else {
595 | 			trampoline_instructions[trampoline_pos++] = instruction;
596 | 		}
597 | 		pc += sizeof(uint32_t);
598 | 	}
599 | 	
600 | 	trampoline_instructions[trampoline_pos++] = 0xe51ff004;	// LDR PC, [PC, #-4]
601 | 	trampoline_instructions[trampoline_pos++] = lr;
602 | }
603 | 
604 | void relocateInstruction(uint32_t target_addr, void *orig_instructions, int length, void *trampoline_instructions, int *orig_boundaries, int *trampoline_boundaries, int *count)
605 | {
606 | 	if (target_addr & 1 == 1) {
607 | 		relocateInstructionInThumb(target_addr - 1, (uint16_t *) orig_instructions, length, (uint16_t *) trampoline_instructions, orig_boundaries, trampoline_boundaries, count);
608 | 	}
609 | 	else {
610 | 		relocateInstructionInArm(target_addr, (uint32_t *) orig_instructions, length, (uint32_t *) trampoline_instructions, orig_boundaries, trampoline_boundaries, count);
611 | 	}
612 | }
613 | 


--------------------------------------------------------------------------------