最近研究论坛两位大神的全局注入的方法
https://bbs.pediy.com/thread-217587.htm
https://bbs.pediy.com/thread-224191.htm

但是遇到一个问题 在zygote进程中使用inlinehook系统函数就会崩溃

系统android 7.1.2
两种方案我都尝试了
还测试了magisk的riru模块
在zygote进程加载so都没问题
但是只要在在so中使用inlinehook 系统函数就会出现崩溃
android-inline-hook hookzz 一样的崩溃问题
但是同样的位置使用xhook的plthook就可以成功
或者在应用进程附加上so去inlinehook也会成功

搞了好久没想明白原因 想请教一下大家

崩溃日志 hookzz的

I/Riru: module loaded: zzhook (api 4)
V/Riru: zzhook: onModuleLoaded
I/zzhook: detect libc.so b368a000
I/zzhook: __system_property_get = 0xb36ac53d
I/zzzzz: [*] Initialize 'ZzReplace' hook at 0xb36ac53d
I/zzzzz: [*] Use Thumb2 Ldr Branch
I/zzzzz: [*] Assembler buffer at 0xb07c3000
I/zzzzz: [*] relocate thumb1 inst: 0xb510
I/zzzzz: [*] relocate thumb1 inst: 0x460c
I/zzzzz: [*] relocate thumb2 inst: 0xe9f4f7f3
I/zzzzz: [!] Out of memory

A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0x0 in tid 209 (app_process), pid 209 (app_process)

A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
A/DEBUG: Build fingerprint: 'google/hammerhead/hammerhead:6.0.1/M4B30X/3237893:user/release-keys'
A/DEBUG: Revision: '0'
A/DEBUG: ABI: 'arm'
A/DEBUG: pid: 209, tid: 209, name: app_process  >>> /system/bin/app_process <<<
A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
A/DEBUG: Cause: null pointer dereference
A/DEBUG:     r0 00000000  r1 b07c3020  r2 00000020  r3 00000000
A/DEBUG:     r4 00000000  r5 00000000  r6 00001000  r7 bedfd5c0
A/DEBUG:     r8 b07c3000  r9 00000000  sl 00000020  fp bedfd620
A/DEBUG:     ip b371a5d4  sp bedfd5a0  lr b0762723  pc b36a2e78  cpsr 600f0030

A/DEBUG: backtrace:
A/DEBUG:     #00 pc 00018e78  /system/lib/libc.so (memcpy+293)
A/DEBUG:     #01 pc 0000b71f  /system/lib/libriru_zzhook.so
A/DEBUG:     #02 pc 0000b75f  /system/lib/libriru_zzhook.so
A/DEBUG:     #03 pc 0000b777  /system/lib/libriru_zzhook.so
A/DEBUG:     #04 pc 0000db11  /system/lib/libriru_zzhook.so
A/DEBUG:     #05 pc 0000cc2f  /system/lib/libriru_zzhook.so
A/DEBUG:     #06 pc 0000a405  /system/lib/libriru_zzhook.so
A/DEBUG:     #07 pc 0000b95d  /system/lib/libriru_zzhook.so
A/DEBUG:     #08 pc 0000a161  /system/lib/libriru_zzhook.so (ZzReplace+72)
A/DEBUG:     #09 pc 00008e6d  /system/lib/libmemtrack.so
A/DEBUG:     #10 pc 00013bdd  /system/bin/linker (__dl__ZL13call_functionPKcPFviPPcS2_ES0_+68)
A/DEBUG:     #11 pc 00013939  /system/bin/linker (__dl__ZL10call_arrayIPFviPPcS1_EEvPKcPT_jbS5_+132)
A/DEBUG:     #12 pc 00013ae1  /system/bin/linker (__dl__ZN6soinfo17call_constructorsEv+380)
A/DEBUG:     #13 pc 000139d7  /system/bin/linker (__dl__ZN6soinfo17call_constructorsEv+114)
A/DEBUG:     #14 pc 000139d7  /system/bin/linker (__dl__ZN6soinfo17call_constructorsEv+114)
A/DEBUG:     #15 pc 000106a1  /system/bin/linker (__dl___linker_init+2436)
A/DEBUG:     #16 pc 00015590  /system/bin/linker (_start+4)

android-inline-hook的

A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0xffffffff in tid 550 (ip6tables)
A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
A/DEBUG: LineageOS Version: '14.1-20190714-UNOFFICIAL-hammerhead'
A/DEBUG: Build fingerprint: 'google/hammerhead/hammerhead:6.0.1/M4B30Z/3437181:user/release-keys'
A/DEBUG: Revision: '0'
A/DEBUG: ABI: 'arm'
A/DEBUG: pid: 288, tid: 288, name: app_process  >>> /system/bin/app_process <<<
A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xffffffff
A/DEBUG:     r0 0000f000  r1 ffffffff  r2 0000b100  r3 b43e0258
A/DEBUG:     r4 0000b000  r5 00000000  r6 00000000  r7 0000b510
A/DEBUG:     r8 b6f7768c  r9 b6f86600  sl b6f7767b  fp b6f1c010
A/DEBUG:     ip b41e1fac  sp beaf543c  lr b41dcac1  pc b41dd6c2  cpsr 200f0030
A/DEBUG: backtrace:
A/DEBUG:     #00 pc 000076c2  /system/lib/libho.so (_Z19relocateInstructionjPviS_PiS0_S0_+1469)
A/DEBUG:     #01 pc 00006abd  /system/lib/libho.so (_Z18registerInlineHookjjPPj+244)
A/DEBUG:     #02 pc 000025f9  /system/lib/libho.so (_Z4Hookv+36)
A/DEBUG:     #03 pc 0000297b  /system/lib/libho.so (_Z7initv+38)
A/DEBUG:     #04 pc 00006505  /system/bin/linker (__dl__ZN6soinfo13call_functionEPKcPFvvE+84)
A/DEBUG:     #05 pc 00006425  /system/bin/linker (__dl__ZN6soinfo10call_arrayEPKcPPFvvEjb+184)
A/DEBUG:     #06 pc 0000510f  /system/bin/linker (__dl__ZN6soinfo17call_constructorsEv+218)
A/DEBUG:     #07 pc 00004e5b  /system/bin/linker (__dl__Z9do_dlopenPKciPK17android_dlextinfoPv+1326)
A/DEBUG:     #08 pc 00002c4d  /system/bin/linker (__dl__ZL10dlopen_extPKciPK17android_dlextinfoPv+28)
A/DEBUG:     #09 pc 000802e0  /system/lib/libc.so

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)