Android so库Hook技术

男娘i 2022-06-08 00:54 334阅读 0赞

在有些情况下，可能遇到需要改变目标进程的执行流程的问题，替换原函数转而指向我们自己的函数，而Hook就是指的改变待Hook函数的地址，替换地址而达到更换原函数的功能。本文主要介绍Android上对native层中的so库Hook的方法，核心技术其实是对GOT表的Hook，获取目标函数地址需要对so文件进行解析，而so文件实际上是ELF文件，所以在此之前需要对ELF文件格式有一个很好的了解。

## 关键 ##

解析so文件，其实主要目的就是获得ELF文件中以下三个表的信息：

*  字符串表：包含以空字符结尾的字符序列，使用这些字符来描绘符号和节名；
 *  符号表：保存了一个程序在定位和重定位时需要的定义和引用的信息；
 *  重定位表：保存了需要重定位的符号的信息；

准备工作

#include <stdio.h>
    #include <stdlib.h>
    #include <elf.h>
    #include <fcntl.h>
    #include <android/log.h>
    #include <sys/mman.h>
    #include <sys/stat.h>
    #include <utime.h>
    #include <dirent.h>
    
    #ifdef __x86_64
        #define Elf_Eh Elf64_Ehdr
        #define Elf_Shdr Elf64_Shdr
        #define Elf_Sym Elf64_Sym
        #define Elf_Rel Elf64_Rela
        #define ELF_R_SYM ELF64_R_SYM
    
    #else
        #define Elf_Ehdr Elf32_Ehdr
        #define Elf_Shdr Elf32_Shdr
        #define Elf_Sym Elf32_Sym
        #define Elf_Rel Elf32_Rel
        #define ELF_R_SYM ELF32_R_SYM
    #endif
    
    #define module_path "/system/lib/libjavacore.so"
    #define LOG_TAG    "native_hook_log"
    #define LOGD(...)  __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, __VA_ARGS__)

读取ELF文件头（ELF文件头起始于 ELF 文件开始的第一字节），取出：

*  节头表的文件偏移（shdr\_base），获取节头表在文件中的位置；
 *  节头表的项数（shnum），获取节头表的项数；
 *  与节名称字符串表关联的项的节头表索引（shstr\_base），并将其缓存起来（shstr）；

int fd;
        fd = open(modulepath,O_RDONLY);
        if (fd == -1){
            LOGD("[-] open the so file fail");
        }
        else{
            LOGD("[+] open the so file success");
        }
        Elf_Ehdr *ehdr = (Elf_Ehdr *)malloc(sizeof(Elf_Ehdr));
        read(fd, ehdr, sizeof(Elf_Ehdr));
        if(fd == -1){
            LOGD("[-] read the elf header fail!!");
        }
        else{
            LOGD("[+] read the elf header success!!!");
        }
        //LOGD("[+] the elf header information:");
        uint32_t shdr_base = ehdr -> e_shoff;
        uint16_t shnum = ehdr -> e_shnum;
        uint32_t shstr_base = shdr_base + ehdr -> e_shstrndx * sizeof(Elf32_Shdr);
    
        /*LOGD("[+] shstrndx = %d",ehdr -> e_shstrndx);
        LOGD("[+] shoff = %d",shdr_base);
        LOGD("[+] shnum = %d",shnum);
        LOGD("[+] shstr_base = %d",shstr_base);*/
    
        Elf_Shdr *shstr = (Elf_Shdr *)malloc(sizeof(Elf_Shdr));
        lseek(fd, shstr_base, SEEK_SET);
        read(fd, shstr, sizeof(Elf_Shdr));
        if(fd == -1){
            LOGD("[-] read the shdr section str fail!!");
        }
        else{
            LOGD("[+] read the shdr section str success!!");
        }

读取节头表索引，取出： 节的大小（sh\_size）、节的名称（sh\_name）；  
遍历节名，分别将节名为.dynsym、.dynstr、.got、.rel.plt的节缓存起来（dynsym\_shdr、dynstr\_shdr、got\_shdr、relplt\_shdr）；  
通过上一步获取的节，分别获得对应的表，并将其缓存；

char *shstrtab = (char *)malloc(shstr -> sh_size);
        lseek(fd, shstr -> sh_offset, SEEK_SET);
        read(fd, shstrtab, shstr -> sh_size);
        if(fd == -1){
            LOGD("[-] read section str fail!!");
        }
        else{
            LOGD("[+] read section str success!!");
        }
    
        Elf_Shdr *shdr = (Elf_Shdr *)malloc(sizeof(Elf_Shdr));
        lseek(fd, shdr_base, SEEK_SET);
    
        uint16_t i;
        char *str = NULL;
        Elf_Shdr *relplt_shdr = (Elf_Shdr *) malloc(sizeof(Elf_Shdr));
        Elf_Shdr *dynsym_shdr = (Elf_Shdr *) malloc(sizeof(Elf_Shdr));
        Elf_Shdr *dynstr_shdr = (Elf_Shdr *) malloc(sizeof(Elf_Shdr));
        Elf_Shdr *got_shdr = (Elf_Shdr *) malloc(sizeof(Elf_Shdr));
    
    
        for(i = 0; i < shnum; ++i) {
            read(fd, shdr, sizeof(Elf_Shdr));
            if(fd == -1){
                LOGD("[-] read fail!!");
            }
            str = shstrtab + shdr -> sh_name;
            if(strcmp(str, ".dynsym") == 0)
                memcpy(dynsym_shdr, shdr, sizeof(Elf_Shdr));
            else if(strcmp(str, ".dynstr") == 0)
                memcpy(dynstr_shdr, shdr, sizeof(Elf_Shdr));
            else if(strcmp(str, ".got") == 0)
                memcpy(got_shdr, shdr, sizeof(Elf_Shdr));
            else if(strcmp(str, ".rel.plt") == 0)
                memcpy(relplt_shdr, shdr, sizeof(Elf_Shdr));
        }
    
        char *got = (char *) malloc(sizeof(char) * got_shdr->sh_size);
        lseek(fd, got_shdr->sh_offset,SEEK_SET);
        if(read(fd, got, got_shdr->sh_size) != got_shdr->sh_size)
            LOGD("[-] read the got fail!!");
        else{
            LOGD("[+] read the GOT success!!");
        }
    
        char *dynstr = (char *) malloc(sizeof(char) * dynstr_shdr->sh_size);
        lseek(fd, dynstr_shdr->sh_offset, SEEK_SET);
        if(read(fd, dynstr, dynstr_shdr->sh_size) != dynstr_shdr->sh_size)
            LOGD("[-] read the dynstr fail!!");
        else{
            LOGD("[+] read the dynstr success!!");
        }
    
    
        Elf_Sym *dynsymtab = (Elf_Sym *) malloc(dynsym_shdr->sh_size);
        //LOGD("[+] dynsym_shdr->sh_size\t0x%x\n", dynsym_shdr->sh_size);
        lseek(fd, dynsym_shdr->sh_offset, SEEK_SET);
        if(read(fd, dynsymtab, dynsym_shdr->sh_size) != dynsym_shdr->sh_size)
            LOGD("[-] read the dynsym fail!!");
        else{
            LOGD("[+] read the dynsym success");
        }
    
        Elf_Rel *rel_ent = (Elf_Rel *) malloc(sizeof(Elf_Rel));
        lseek(fd, relplt_shdr->sh_offset, SEEK_SET);
        if(read(fd, rel_ent, sizeof(Elf_Rel)) != sizeof(Elf_Rel))
            LOGD("[-] read the rel_ent fail!!");
        else{
            LOGD("[+] read the rel_ent success");
        }

获取指定符号在got表的偏移地址：

uint32_t offset = 0;
        for (i = 0; i < relplt_shdr->sh_size / sizeof(Elf_Rel); i++)
        {
    
            uint16_t ndx = ELF_R_SYM(rel_ent->r_info);
            //LOGD("[+] ndx = %d, str = %s", ndx, dynstr + dynsymtab[ndx].st_name);
            if (strcmp(dynstr + dynsymtab[ndx].st_name, symbolname) == 0)
            {
                LOGD("[+] The offset of %s int the dyn GOT table: 0x%x", symbolname, rel_ent->r_offset);
                offset = rel_ent->r_offset;
                break;
            }
            if(read(fd, rel_ent, sizeof(Elf_Rel)) != sizeof(Elf_Rel))
            {
                LOGD("Fail to get the address of %s", symbolname);
            }
        }
    
    
        if(offset == 0)
        {
            LOGD("[-] can't find the address of %s,maybe it's static", symbolname);
            for(i = 0; i < (dynsym_shdr->sh_size) / sizeof(Elf_Sym); ++i)
            {
                if(strcmp(dynstr + dynsymtab[i].st_name, symbolname) == 0)
                {
                    LOGD("[+] The address of %s为 int the static GOT table: 0x%x", symbolname, dynsymtab[i].st_value);
                    offset = dynsymtab[i].st_value;
                    break;
                }
            }
        }
    
        if(offset == 0)
        {
            LOGD("[-] Fail to get the address of %s", symbolname);
        }
        close(fd);
        return offset;

获取so文件的基地址

static uint32_t get_module_base(pid_t pid,char *modulepath){
        FILE *fp = NULL;
        char *pch = NULL;
        char filename[32];
        char line[512];
        uint32_t addr = 0;
        LOGD("[+] get libc base...");
    
        if (pid < 0) {
            snprintf(filename, sizeof(filename), "/proc/self/maps");
            LOGD("pid < 0");
        }
        else {
            snprintf(filename, sizeof(filename), "/proc/%d/maps", pid);
            LOGD("pid > 0");
        }
    
        if ((fp = fopen(filename, "r")) == NULL) {
            LOGD("[-]open %s failed!", filename);
            return 0;
        }
        LOGD("[+]open %s success!", filename);
        while (fgets(line, sizeof(line), fp)) {
            if (strstr(line, modulepath)) {
                pch = strtok(line, "-");
                addr = strtoul(pch, NULL, 16);
                if(addr==0x8000)
                    addr = 0;
                break;
            }
        }
    
        fclose(fp);
        LOGD("[+] libc base:0x%x...\n",addr);
    
        return addr;
    }

最后，基地址加上函数符号在GOT表中的地址就是这个函数在内存中的实际地址。

首先写一个open函数用于替换旧的open函数，之后将这个函数的地址替换到目标so的open函数地址。

int *hook_open(char * path, int flag) {
        //char * retu = "0X00000000";
        LOGD("[+] start hook open()");
        LOGD("[+] hook_open path:%s",path);
        LOGD("[+] hook_open flag:%d",flag);
        LOGD("[+] ++++++++++++++++++++++++++++++++++");
        return open(path,flag);
    }

地址替换

void gotHook(char *modulepath,char *symbolname,char *hookfunname){
    
        uint32_t old_addr = get_fun_addr(modulepath,symbolname);
        mprotect((void *)((uint32_t)old_addr & ~4095), 4096 , PROT_READ | PROT_WRITE);
    
        uint32_t old_fun_addr = *(uint32_t *)old_addr;
        *(uint32_t *)old_addr = (uint32_t)hookfunname;
    }

当运行目标so库中的open函数时，执行流程会跳转到我们上面自定义的hook\_open函数。