-
-
[原创] NDK加载 LLVM Pass方案
-
2023-5-23 21:29
-
NDK加载 LLVM Pass方案
本文基于 ndk r25c （25.2.9519653）
仅测试 Linux 和 macOS
获取ndk r25c
直接下载
点只因下载：https://dl.google.com/android/repository/android-ndk-r25c-linux.zip
使用sdkmanager安装
1 | $ANDROID_HOME/tools/bin/sdkmanager --install "ndk;25.2.9519653" |
坑：archlinux 需要
sudo archlinux-java set java-8-openjdk
查看clang信息
1 | cat $ANDROID_HOME/ndk/25.2.9519653/toolchains/llvm/prebuilt/linux-x86_64/AndroidVersion.txt |
内容：
1 2 3 | 14.0.7based on r450784d1for additional information on LLVM revision and cherry-picks, see clang_source_info.md |
下载未精简的clang
然后去Google的 prebuilt clang仓库找到 r450784d1 相关的分支并打开：
点开最新的一个commit，进入
然后点击tgz下载这一份clang
然后基于这一份clang直接编译llvm动态库插件就可以直接用ndk加载了
解压
1 2 | mkdir clangtar xzvf clang-r450784d1.tar.gz -C clang |
编译使用pass实例
- 下载代码
1 | git clone https://github.com/LeadroyaL/llvm-pass-tutorial |
- 修改 CMakeLists.txt，在
project()后加上
1 2 3 | set(CMAKE_C_COMPILER /home/ylarod/ndk-r25c/clang/bin/clang)set(CMAKE_CXX_COMPILER /home/ylarod/ndk-r25c/clang/bin/clang)set(ENV{LLVM_HOME} /home/ylarod/ndk-r25c/clang) |
这个时候cmake ..会报错
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 | CMake Error at /home/ylarod/ndk-r25c/clang/lib64/cmake/llvm/LLVMExports.cmake:1036 (message): The imported target "LLVMDemangle" references the file "/home/ylarod/ndk-r25c/clang/lib64/libLLVMDemangle.a" but this file does not exist. Possible reasons include: * The file was deleted, renamed, or moved to another location. * An install or uninstall procedure did not complete successfully. * The installation package was faulty and contained "/home/ylarod/ndk-r25c/clang/lib64/cmake/llvm/LLVMExports.cmake" but not all the files it references.Call Stack (most recent call first): /home/ylarod/ndk-r25c/clang/lib64/cmake/llvm/LLVMConfig.cmake:251 (include) CMakeLists.txt:14 (find_package) |
这个时候去注释掉clang/lib64/cmake/llvm/LLVMExports.cmake 下面这一段代码
然后
1 2 3 | mkdir build && cd buildcmake .. -DCMAKE_BUILD_TYPE=Release -G Ninjaninja |
测试代码来自 https://github.com/bluesadi/Pluto-Obfuscator/tree/main/test/aes
build.sh:
1 2 3 4 | export CC=/home/ylarod/Android/Sdk/ndk/25.2.9519653/toolchains/llvm/prebuilt/linux-x86_64/bin/clang++$CC aes.cpp test.cpp -o no_obf$CC -fpass-plugin=/home/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so -Xclang -load -Xclang /home/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so -mllvm -split_num=3 -mllvm -fw_prob=100 -mllvm -fw_times=4 -mllvm -bcf_prob=100 -mllvm -bcf_loop=3 aes.cpp test.cpp -o obf |
编译后：
差不多鸟～
当我们来到macOS上
由于Google编译macOS工具链的系统版本太低，加载so的时候会报错
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | In file included from aes.cpp:1:./aes.h:6:10: fatal error: 'cstring' file not found#include <cstring> ^~~~~~~~~1 error generated.test.cpp:1:10: fatal error: 'cstdio' file not found#include <cstdio> ^~~~~~~~1 error generated.error: unable to load plugin '/Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so': 'dlopen(/Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so, 0x0009): symbol not found in flat namespace '__ZN4llvm10CallbackVH6anchorEv''clang (LLVM option parsing): Unknown command line argument '-split_num=3'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--print-bfi=3'?clang (LLVM option parsing): Unknown command line argument '-fw_prob=100'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--color=100'?clang (LLVM option parsing): Unknown command line argument '-fw_times=4'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--fast-isel=4'?clang (LLVM option parsing): Unknown command line argument '-bcf_prob=100'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--icp-lto=100'?clang (LLVM option parsing): Unknown command line argument '-bcf_loop=3'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--icp-lto=3'?error: unable to load plugin '/Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so': 'dlopen(/Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so, 0x0009): symbol not found in flat namespace '__ZN4llvm10CallbackVH6anchorEv''clang (LLVM option parsing): Unknown command line argument '-split_num=3'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--print-bfi=3'?clang (LLVM option parsing): Unknown command line argument '-fw_prob=100'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--color=100'?clang (LLVM option parsing): Unknown command line argument '-fw_times=4'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--fast-isel=4'?clang (LLVM option parsing): Unknown command line argument '-bcf_prob=100'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--icp-lto=100'?clang (LLVM option parsing): Unknown command line argument '-bcf_loop=3'. Try: 'clang (LLVM option parsing) --help'clang (LLVM option parsing): Did you mean '--icp-lto=3'? |
解决办法：
使用下载的clang替换掉ndk里面的clang
1 2 | mv clang-14 clang-14.bakcp ~/ndk-r25c/clang/bin/clang-14 clang-14 |
找不到头文件是macOS的问题，修改 build.sh 为
1 2 3 4 | export CC=/Users/ylarod/Library/Android/sdk/ndk/25.2.9519653/toolchains/llvm/prebuilt/darwin-x86_64/bin/aarch64-linux-android33-clang++$CC aes.cpp test.cpp -o no_obf$CC -fpass-plugin=/Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so -Xclang -load -Xclang /Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so -mllvm -split_num=3 -mllvm -fw_prob=100 -mllvm -fw_times=4 -mllvm -bcf_prob=100 -mllvm -bcf_loop=3 aes.cpp test.cpp -o obf |
后重新编译，成功混淆
参考
https://www.leadroyal.cn/p/1008/
在我的博客中查看：
https://xtuly.cn/article/ndk-load-llvm-pass-plugin
[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界
最后于 2023-5-23 21:29
被Ylarod编辑
，原因：
|
|
|---|---|
|
|
|
|
|
|
|
|
实在要用Windows的话可以WSL用linux版本的NDK |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
