native_hook

对于 Native Hook 技术,我们比较熟悉的有 GOT/PLT Hook、Trap Hook 以及 Inline Hook,下面我来逐个讲解这些 Hook 技术的实现原理和优劣比较。

GOT/PLT Hook

xHook

https://github.com/iqiyi/xHook

https://github.com/iqiyi/xHook/blob/master/docs/overview/android_plt_hook_overview.zh-CN.md

PLT/GOT hook局限性

xhook只支持PLT/GOT方式的hook,就是hook“调用方so中的对外调用点”。android_getaddrinfofornet函数的实现在libc.so中,需要hook android_getaddrinfofornet的调用方,可以:
xhook_register(".*/libwebviewchromium\\.so$", "android_getaddrinfofornet", new_android_getaddrinfofornet, NULL);

不能做 ELF 内部函数之间调用的 hook。

inline hook 可以做到

demo执行步骤

1:下载Android NDK r16b,配置环境变量(每次重启PC都要配置一次)
2:./build_libs.sh通过cmd中单个执行编译完成
3:./install_libs.sh通过在cmd中执行:
C:\Users\zhenghuan\git\demo\xHook>install_libs.sh
完成

如何引用系统so

https://developer.android.com/ndk/guides/stable_apis.html?hl=zh-CN

https://stackoverflow.com/questions/13115827/how-to-link-to-the-libmedia-so-system-library-in-an-android-ndk-app-using-androi

InlineHook

Android inline hook 浅析

什么是 inline hook

Inline hooking is a method of intercepting calls to target functions. The general idea is to redirect a function to our own, so that we can perform processing before and/or after the function does its; this could include: checking parameters, shimming, logging, spoofing returned data, and filtering calls.

The hooks are placed by directly modifying code within the target function (inline modification), usually by overwriting the first few bytes with a jump; this allows execution to be redirected before the function does any processing

Inline hook 的原理

inline hook 由3部分组成:

  • Hook - 为了 hook 目标函数(旧函数),会向其代码中写入一个5个字节的跳转指令(实际跳转指令以及指令大小跟平台相关)
  • Proxy - 用于指定被 hook 的目标函数将要跳转到的函数(新函数)
  • Trampoline - 用于调用旧函数

参考

Android Native Hook技术路线概述

android native hook技术你知道多少?

frida

https://www.frida.re/

https://github.com/frida/frida

旧项目

https://github.com/crmulliner/adbi