[原创]记录一下YAHFA相关-Android安全-看雪论坛-安全社区|安全招聘|bbs.pediy.com

[原创]记录一下YAHFA相关

2021-5-14 21:18 7538

[原创]记录一下YAHFA相关

唱过阡陌

2021-5-14 21:18

7538

这里使用的手机是google Pixel XL 8.1
本文的目的是记录一下使用frida对YAHFA的原理的简单分析

首先写一个安卓demo如下

findViewById(R.id.sample_text).setOnClickListener(v -> {
        try {
            Method doWork1 = MainActivity.class.getDeclaredMethod("doWork1");
            Method doWork2 = MainActivity.class.getDeclaredMethod("doWork2");
            Method doWork3 = MainActivity.class.getDeclaredMethod("doWork3");
 
            calledBefore(doWork1,doWork2,doWork3);
            HookMain.backupAndHook(doWork1,doWork2,doWork3);
            calledAfter(doWork1,doWork2,doWork3);
        } catch (NoSuchMethodException e) {
            e.printStackTrace();
        }
    });
}
 
private static void doWork1() {
    Log.i(TAG, "doWork1");
}
private static void doWork2() {
    Log.i(TAG, "doWork2");
}
private static void doWork3() {
    Log.i(TAG, "doWork3");
}
 
public native void calledBefore(Method doWork1, Method doWork2, Method doWork3);
public native void calledAfter(Method doWork1, Method doWork2, Method doWork3);

两个native方法(calledBefore/calledAfter)在native层啥也不用做只是拿到一个反射方法

顺带附上hook代码,主要是用frida展示artmethod指针内存的变化

var getArtMethod = new NativeFunction(Module.findExportByName('libnative-lib.so','getArtMethod'),'pointer',['pointer','pointer'])
 
Interceptor.attach(Module.findExportByName('libnative-lib.so','Java_com_lzy_yahfa_MainActivity_calledBefore'),{
    onEnter:function(args){
        LOG("\n----------------------- Before -----------------------\n",LogColor.RED)
        showLog(args[0],args[2],args[3],args[4])
    },
    onLeave:function(ret){
 
    }
})
 
Interceptor.attach(Module.findExportByName('libnative-lib.so','Java_com_lzy_yahfa_MainActivity_calledAfter'),{
    onEnter:function(args){
        LOG("\n----------------------- After -----------------------\n",LogColor.RED)
        showLog(args[0],args[2],args[3],args[4])
    },
    onLeave:function(ret){
 
    }
})
 
function showLog(a0,a1,a2,a3){
 
    LOG(" ----- ORG  ----- ",LogColor.YELLOW)
    var method = getArtMethod(a0,a1)
    seeHexA(method,p_size*8)
    LOG("entry_point_from_quick_compiled_code -> "+method.add(p_size*7).readPointer()+" ---> "+method.add(p_size*7).readPointer().readPointer())
    LOG("\n")
 
    LOG(" ----- Hook  ----- ",LogColor.YELLOW)
    var method = getArtMethod(a0,a2)
    seeHexA(method,p_size*8)    
    LOG("entry_point_from_quick_compiled_code -> "+method.add(p_size*7).readPointer()+" ---> "+method.add(p_size*7).readPointer().readPointer())
    LOG("\n")
 
    LOG(" ----- Back  ----- ",LogColor.YELLOW)
    var method = getArtMethod(a0,a3)
    seeHexA(method,p_size*8)
    LOG("entry_point_from_quick_compiled_code -> "+method.add(p_size*7).readPointer()+" ---> "+method.add(p_size*7).readPointer().readPointer())
}

这里我用的是google原生系统 8.1
直接去参考源码得到 artMethod 结构体长这样:

4        GcRoot<mirror::Class> declaring_class_;
 
4        std::atomic<std::uint32_t> access_flags_;    
 
4        uint32_t dex_code_item_offset_;
 
4        uint32_t dex_method_index_;
 
2        uint16_t method_index_;
 
2        uint16_t hotness_count_;
 
12        struct PtrSizedFields {
4            ArtMethod** dex_cache_resolved_methods_;
 
4            void* data_;
 
4            void* entry_point_from_quick_compiled_code_;
        } ptr_sized_fields_;