[讨论][原创]看了珍惜大佬的文章去实现注入so 修改svc遇到的一点问题-求助问答-看雪-安全社区|安全招聘|kanxue.com

未解决 [讨论][原创]看了珍惜大佬的文章去实现注入so 修改svc遇到的一点问题 10雪币

发表于: 2024-10-16 14:46 501

未解决 [讨论][原创]看了珍惜大佬的文章去实现注入so 修改svc遇到的一点问题 10雪币

mb_basgiwmq 活跃值

2024-10-16 14:46

501

看来这个珍惜大佬的文章之后
我用ptrace+svc hook的方式
用xposed去注入so 在注入的so文件里面jni_onload里面去用ptrace去attach线程线程是attach上去了但是app界面进不去了一直卡在启动界面
bfp的规则是这样定义的

void installFilterForE() {
    struct sock_filter filter[] =
            {
                    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (offsetof(struct seccomp_data, nr))),
                    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_openat, 0, 1),
                    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRACE),
//                    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_read, 0, 1),
//                    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRACE),
//                    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_close, 0, 1),
//                    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRACE),
                    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
            };
 
    struct sock_fprog prog = {
            .len = (unsigned short) (sizeof(filter) / sizeof(filter[0])),
            .filter = filter,
    };
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
        log("prctl(PR_SET_NO_NEW_PRIVS)");
    }
    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) == -1) {
        log("when setting seccomp filter");
    }
 
}

被注入app没有任何的检测是自写一个简单app
我这样去attach线程的我不知道是我写的有问题还是怎么的也没有大佬帮忙解答一下

void onloadersvc(pid_t mypid){
    pid_t pid = fork();
    if (pid == 0) {
        int ck = ptrace(PTRACE_ATTACH, mypid, 0, 0);
        if (ck < 0) {
            log("attach失败");
            exit(1);
        } else {
            log("ptrace的返回值是：%d", ck);
        }
        log("被调试跟踪的进程是：%d",mypid);
        int st = ptrace(PTRACE_SETOPTIONS,  mypid, 0, default_ptrace_options | PTRACE_O_TRACESECCOMP);
        if (st < 0) {
            log("选项注册失败:%d %s %d",errno, strerror(errno),st);
 
        } else{
            process_signal(mypid);
        }
 
 
    } else {
        installFilterForE();
        int sy=ptrace(PTRACE_TRACEME, 0, 0, 0);
 
    }
}