-
-
未解决
[求助]请教一下 为什么在riru模块中使用inlinehook会导致crash
100.00雪花
-
发表于:
2019-8-20 16:04
4036
-
未解决 [求助]请教一下 为什么在riru模块中使用inlinehook会导致crash
100.00雪花
我在riru模块的onModuleLoaded中使用inlinehook一些系统的函数都会导致crash
但是用plthook的xhook却可以hook成功
一直也没想明白为什么 麻烦大家指点一下
代码
size_t (*old__system_property_get)(const char *name, char *value);
size_t new__system_property_get(const char *name, char *value) {
return old__system_property_get(name, value);
}
__attribute__((visibility("default")))
void onModuleLoaded() {
ZzReplace((void *)__system_property_get, (void *)new___system_property_get, (void **)&old___system_property_get);
}
错误日志
2019-08-20 19:50:22.157 209-209/? I/Riru: module loaded: zzhook (api 4)
2019-08-20 19:50:22.157 209-209/? V/Riru: zzhook: onModuleLoaded
2019-08-20 19:50:22.168 209-209/? I/zzhook: detect libc.so b368a000
2019-08-20 19:50:22.169 209-209/? I/zzhook: __system_property_get = 0xb36ac53d
2019-08-20 19:50:22.169 209-209/? I/zzzzz: [*] Initialize 'ZzReplace' hook at 0xb36ac53d
2019-08-20 19:50:22.169 209-209/? I/zzzzz: [*] Use Thumb2 Ldr Branch
2019-08-20 19:50:22.169 209-209/? I/zzzzz: [*] Assembler buffer at 0xb07c3000
2019-08-20 19:50:22.169 209-209/? I/zzzzz: [*] relocate thumb1 inst: 0xb510
2019-08-20 19:50:22.169 209-209/? I/zzzzz: [*] relocate thumb1 inst: 0x460c
2019-08-20 19:50:22.169 209-209/? I/zzzzz: [*] relocate thumb2 inst: 0xe9f4f7f3
2019-08-20 19:50:22.170 209-209/? I/zzzzz: [!] Out of memory
2019-08-20 19:50:22.171 209-209/? A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0x0 in tid 209 (app_process), pid 209 (app_process)
2019-08-20 19:50:22.240 428-428/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2019-08-20 19:50:22.241 428-428/? A/DEBUG: Build fingerprint: 'google/hammerhead/hammerhead:6.0.1/M4B30X/3237893:user/release-keys'
2019-08-20 19:50:22.241 428-428/? A/DEBUG: Revision: '0'
2019-08-20 19:50:22.241 428-428/? A/DEBUG: ABI: 'arm'
2019-08-20 19:50:22.241 428-428/? A/DEBUG: pid: 209, tid: 209, name: app_process >>> /system/bin/app_process <<<
2019-08-20 19:50:22.241 428-428/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
2019-08-20 19:50:22.241 428-428/? A/DEBUG: Cause: null pointer dereference
2019-08-20 19:50:22.241 428-428/? A/DEBUG: r0 00000000 r1 b07c3020 r2 00000020 r3 00000000
2019-08-20 19:50:22.241 428-428/? A/DEBUG: r4 00000000 r5 00000000 r6 00001000 r7 bedfd5c0
2019-08-20 19:50:22.241 428-428/? A/DEBUG: r8 b07c3000 r9 00000000 sl 00000020 fp bedfd620
2019-08-20 19:50:22.241 428-428/? A/DEBUG: ip b371a5d4 sp bedfd5a0 lr b0762723 pc b36a2e78 cpsr 600f0030
2019-08-20 19:50:22.256 428-428/? A/DEBUG: backtrace:
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #00 pc 00018e78 /system/lib/libc.so (memcpy+293)
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #01 pc 0000b71f /system/lib/libriru_zzhook.so
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #02 pc 0000b75f /system/lib/libriru_zzhook.so
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #03 pc 0000b777 /system/lib/libriru_zzhook.so
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #04 pc 0000db11 /system/lib/libriru_zzhook.so
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #05 pc 0000cc2f /system/lib/libriru_zzhook.so
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #06 pc 0000a405 /system/lib/libriru_zzhook.so
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #07 pc 0000b95d /system/lib/libriru_zzhook.so
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #08 pc 0000a161 /system/lib/libriru_zzhook.so (ZzReplace+72)
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #09 pc 00008e6d /system/lib/libmemtrack.so
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #10 pc 00013bdd /system/bin/linker (__dl__ZL13call_functionPKcPFviPPcS2_ES0_+68)
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #11 pc 00013939 /system/bin/linker (__dl__ZL10call_arrayIPFviPPcS1_EEvPKcPT_jbS5_+132)
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #12 pc 00013ae1 /system/bin/linker (__dl__ZN6soinfo17call_constructorsEv+380)
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #13 pc 000139d7 /system/bin/linker (__dl__ZN6soinfo17call_constructorsEv+114)
2019-08-20 19:50:22.256 428-428/? A/DEBUG: #14 pc 000139d7 /system/bin/linker (__dl__ZN6soinfo17call_constructorsEv+114)
2019-08-20 19:50:22.257 428-428/? A/DEBUG: #15 pc 000106a1 /system/bin/linker (__dl___linker_init+2436)
2019-08-20 19:50:22.257 428-428/? A/DEBUG: #16 pc 00015590 /system/bin/linker (_start+4)
[课程]Linux pwn 探索篇！
