/
/
extern
"C"
JNIEXPORT jstring JNICALL
Java_com_cs_inline_MainActivity_stringFromJNI(
JNIEnv
*
env,
jobject
/
*
thisobj
*
/
,
jstring jstr) {
std::string hello
=
"Hello from C++: "
;
hello.append(env
-
>GetStringUTFChars(jstr, nullptr));
return
env
-
>NewStringUTF(hello.c_str());
}
/
/
extern
"C"
JNIEXPORT void JNICALL
Java_com_cs_inline_MainActivity_inlineHook1(JNIEnv
*
env,
jobject
/
*
thisobj
*
/
)
{
/
/
u_long func_addr
=
(u_long)Java_com_cs_inline_MainActivity_stringFromJNI;
extern u_long _shellcode_start_, _the_func_addr_, _end_func_addr_, _ori_ins_set1_, _retback_addr_, _shellcode_end_, _trampoline_, _jmp_addr_, _shellcode_part2_;
/
/
u_long total_len
=
(u_long)&_shellcode_end_
-
(u_long)&_shellcode_start_;
LOGD(ANDROID_LOG_DEBUG,
"[+] ShellCode len: %d, target func: %p"
, total_len, func_addr);
/
/
u_long page_size
=
getpagesize();
u_long shellcode_mem_start
=
(u_long)mmap(
0
, page_size, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS | MAP_PRIVATE,
0
,
0
);
memset((void
*
)shellcode_mem_start,
0
, page_size);
memcpy((void
*
)shellcode_mem_start, (void
*
)&_shellcode_start_, total_len);
LOGD(ANDROID_LOG_DEBUG,
"[+] shellcode_mem_start: %p"
, shellcode_mem_start);
/
/
*
(u_long
*
)&_jmp_addr_
=
shellcode_mem_start;
u_long mem_the_func_addr_
=
(u_long)&_the_func_addr_
-
(u_long)&_shellcode_start_
+
shellcode_mem_start;
u_long mem_end_func_addr_
=
(u_long)&_end_func_addr_
-
(u_long)&_shellcode_start_
+
shellcode_mem_start;
u_long mem_ori_ins_set1_
=
(u_long)&_ori_ins_set1_
-
(u_long)&_shellcode_start_
+
shellcode_mem_start;
u_long mem_retback_addr_
=
(u_long)&_retback_addr_
-
(u_long)&_shellcode_start_
+
shellcode_mem_start;
if
(!off_shellcode_part2_)
off_shellcode_part2_
=
(u_long)&_shellcode_part2_
-
(u_long)&_shellcode_start_;
/
/
*
(u_long
*
)mem_the_func_addr_
=
(u_long)on_enter_1;
*
(u_long
*
)mem_end_func_addr_
=
(u_long)on_leave_1;
/
/
*
(u_long
*
)mem_retback_addr_
=
(u_long)func_addr
+
0x10
;
/
/
*
(u_long
*
)mem_ori_ins_set1_
=
*
(u_long
*
)func_addr;
*
(u_long
*
)(mem_ori_ins_set1_
+
8
)
=
*
(u_long
*
)(func_addr
+
8
);
/
/
u_long entry_page_start
=
(u_long)(func_addr) & (~(page_size
-
1
));
mprotect((u_long
*
)entry_page_start, page_size, PROT_READ | PROT_WRITE | PROT_EXEC);
*
(u_long
*
)func_addr
=
*
(u_long
*
)&_trampoline_;
*
(u_long
*
)(func_addr
+
8
)
=
*
(u_long
*
)(((u_long)&_trampoline_)
+
8
);
}