// 获取函数地址
void* get_function_address(void* handle, const char* func_name) {
void* func_addr = dlsym(handle, func_name);
if (!func_addr) {
LOGD("[-] Function %s not found in global symbol table", func_name);
} else {
LOGD("[+] Function: %s, addr: 0x%lx", func_name, (uintptr_t)func_addr);
}
return func_addr;
}
// 获取函数偏移
uintptr_t get_function_offset(void* func_addr) {
Dl_info info;
if (dladdr(func_addr, &info) == 0) {
LOGD("[-] Unable to get function info");
return 0;
}
return (uintptr_t)func_addr - (uintptr_t)info.dli_fbase;
}
// 读取库文件中的字节
bool read_bytes_from_libso(const char* libpath, uintptr_t offset, uint8_t* buffer, size_t size) {
int fd = open(libpath, O_RDONLY);
if (fd == -1) {
LOGD("[-] Failed to open %s: %s", libpath, strerror(errno));
return false;
}
if (lseek(fd, offset, SEEK_SET) == -1) {
LOGD("[-] Seek failed at %lx in %s: %s", (unsigned long)offset, libpath, strerror(errno));
close(fd);
return false;
}
ssize_t bytes_read = read(fd, buffer, size);
close(fd);
if (bytes_read != (ssize_t)size) {
LOGD("[-] Read %zd bytes, expected %zu from %s at offset %lx", bytes_read, size, libpath, (unsigned long)offset);
return false;
}
return true;
}
// 字节数组转十六进制字符串
void bytes_to_hex_string(const uint8_t* bytes, size_t size, char* hex_string) {
for (size_t i = 0; i < size; i++) {
sprintf(hex_string + i * 2, "%02x", bytes[i]);
}
hex_string[size * 2] = '\0';
}
// 比较内存中的字节和库文件中的字节
bool compare_function_bytes(void* func_addr, uint8_t* file_bytes, size_t size) {
uint8_t mem_bytes[BYTE_BUFFER_SIZE];
memcpy(mem_bytes, func_addr, size);
char mem_hex_string[BYTE_BUFFER_SIZE * 2 + 1];
char file_hex_string[BYTE_BUFFER_SIZE * 2 + 1];
bytes_to_hex_string(mem_bytes, size, mem_hex_string);
bytes_to_hex_string(file_bytes, size, file_hex_string);
LOGD("[*] Memory: %s | File: %s", mem_hex_string, file_hex_string);
return memcmp(mem_bytes, file_bytes, size) == 0;
}
// Hook 检测函数
bool detect_hook(void* handle, const char* lib_path, const char* func_name) {
void* func_addr = get_function_address(handle, func_name);
if (!func_addr) return false;
uintptr_t offset = get_function_offset(func_addr);
if (offset == 0) {
LOGD("[-] Failed to get offset for %s", func_name);
return false;
}
uint8_t file_bytes[BYTE_BUFFER_SIZE];
if (!read_bytes_from_libso(lib_path, offset, file_bytes, sizeof(file_bytes))) {
LOGD("[-] Failed to read bytes for %s", func_name);
return false;
}
bool is_hooked = !compare_function_bytes(func_addr, file_bytes, sizeof(file_bytes));
LOGD("[+] %s in %s is %s", func_name, lib_path, is_hooked ? "HOOKED" : "NOT HOOKED");
return is_hooked;
}
// 执行 Hook 检测
int do_hook_check() {
const char* libpath = "/system/lib64/libc.so";
void* handle = dlopen(libpath, RTLD_LAZY);
if (!handle) {
LOGD("[-] Failed to load %s", libpath);
return -1;
}
const char* funcs[] = {"sigaction", "signal", "exit", "abort", "_exit"};
bool hooked = false;
for (size_t i = 0; i < sizeof(funcs) / sizeof(funcs[0]); i++) {
if (detect_hook(handle, libpath, funcs[i])) {
hooked = true;
}
}
dlclose(handle);
return hooked;
}
