-
-
[求助]安卓隐私行为监控之访问联系人
-
发表于: 2014-10-21 15:17 3772
-
我最近在hook system_server进程中libbinder.so的函数IOCTL,我想实现哪个app在请求访问通讯录:我的源码如下:
struct binder_write_read* tmp = (struct binder_write_read*) arg;
signed long read_size = tmp->read_size;
signed long write_size = tmp->write_size;
if(read_size > 0)//从binder中读取数据写入到read_buffer
{
int already_got_size = 0;
uint32_t *pret ;
pret=tmp->read_buffer;
uint32_t *end=pret+(read_size/4);
while(pret<end){
uint32_t cmd=*pret++;
switch(cmd){
case BR_TRANSACTION:{
unsigned len;
uint16_t *s;
struct binder_txn *txn=(void *)pret;
struct binder_io msg;
bio_init_from_txn(&msg,txn);
uint32_t strict_policy;
strict_policy = bio_get_uint32(&msg);
s = bio_get_string16(&msg, &len);
if(strstr(str8(s),"IContentProvider"))
{
LOGD("s=%s,len=%d",str8(s),len);
LOGD("hookphone BR_TRANSACTION:target=%p code=%d pid=%d uid=%d,data_size=%d offsets_size=%d\n",
txn->target, txn->code, txn->sender_pid, txn->sender_euid,txn->data_size,txn->offs_size);
}
pret += sizeof(*txn) / sizeof(uint32_t);
break;
}
}
}
我自己写了一个访问联系人的app进行测试时,根本就没有日志文件打印????
struct binder_write_read* tmp = (struct binder_write_read*) arg;
signed long read_size = tmp->read_size;
signed long write_size = tmp->write_size;
if(read_size > 0)//从binder中读取数据写入到read_buffer
{
int already_got_size = 0;
uint32_t *pret ;
pret=tmp->read_buffer;
uint32_t *end=pret+(read_size/4);
while(pret<end){
uint32_t cmd=*pret++;
switch(cmd){
case BR_TRANSACTION:{
unsigned len;
uint16_t *s;
struct binder_txn *txn=(void *)pret;
struct binder_io msg;
bio_init_from_txn(&msg,txn);
uint32_t strict_policy;
strict_policy = bio_get_uint32(&msg);
s = bio_get_string16(&msg, &len);
if(strstr(str8(s),"IContentProvider"))
{
LOGD("s=%s,len=%d",str8(s),len);
LOGD("hookphone BR_TRANSACTION:target=%p code=%d pid=%d uid=%d,data_size=%d offsets_size=%d\n",
txn->target, txn->code, txn->sender_pid, txn->sender_euid,txn->data_size,txn->offs_size);
}
pret += sizeof(*txn) / sizeof(uint32_t);
break;
}
}
}
我自己写了一个访问联系人的app进行测试时,根本就没有日志文件打印????
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
看原图
赞赏
雪币:
留言: