Attack Android injection "2", attack android "2"

Attack Android injection "2", attack android "2"
I will continue to describe the basic idea in "1". Next, let's start with the injection.
Injection
Classification of the code injection we usually call, mainly static and dynamic

• Static injection is intended for executable files. For example, we usually modify ELF and DEX files. There are also many auxiliary tools, such as IDA, JEB, and ApkTool;
• Dynamic Injection for processes, such as modifying process registers and memory values;

The biggest difference between dynamic and static is that the source file does not need to be modified dynamically, but requires high permissions (usually root permissions), and requires a higher technical level.
Essentially, dynamic injection technology is essentially a scheduling technology. What functions can we do when debugging a process? Generally, there are the following items:

• View variable values
• Modify variable value
• Tracing process jump
• View the process call stack
• And so on.

The biggest difference between dynamic injection and normal debugging is that dynamic injection is "Automated debugging and user-defined Dynamic Link Library Loading". The so-called automation is actually implemented through code. in Linux, all the above functions can be completed through Ptrace. Of course, the Ptrace function is relatively primitive, during Normal debugging, many high-level logic encapsulation is required. Before reading the following sections, we strongly recommend that you read the man document.
The purpose is to inject a process in the following aspects:

• Enhance the functions of the target process;
• Fix the defects of the target process;
• Hijack the target process function;
• Stealing data from target processes;
• Tampered with the data of the target process;

Process as shown in. After process A is injected into process B, process B loads the custom dynamic library a by modifying the register and memory. After process a is loaded, a will try to load other modules, such as loading dex files. The specific injection process is as follows:

• ATTATCH: Specifies the target process and starts debugging;
• GETREGS: Get the register of the target process and save it to the site;
• SETREGS: Modify related registers such as PC to point to mmap;
• POPETEXT: writes the so path to the address space requested by mmap;
• SETRESG, modify the relevant registers such as PC to point to dlopen;
• SETREGS: restore the site;
• DETACH, release debugging, and restore it;

The above is a simplified process. The whole injected code has been uploaded to github. There are two simple methods:

• Use the gcc precompiled command _ attribute _ (_ constructor _) to automatically execute the function after so is loaded;

__attribute__ ((__constructor__))void Main() { LOGI(">>>>>>>>>>>>>I am in, I am a bad boy 1!!!!<<<<<<<<<<<<<<"); void* handle = dlopen("libinso.so", RTLD_NOW); void (*setA_func)(int) = (void (*)(int))dlsym(handle, "setA"); if (setA_func) {   setA_func(999); }}

• When the c ++ global object is used for initialization, its constructor is automatically executed;

void Main();static void* _main(void*){Main();return NULL;}class EntryClass {public:EntryClass() {pthread_t tid;pthread_create(&tid, NULL, _main, NULL);pthread_detach(tid);}} boy;

The following example shows an example of ptrace injection, which involves two parts: the target Process Code is recorded as the host, and the so code injected by us is recorded as libmyso. so.
The Host Code contains three source files: demo1.c, inso. h, and inso. c.

/** Inso. h ** Created on: June 24, 2014 * Author: boyliang */_ attribute _ (visibility ("default") void setA (int I ); __attribute _ (visibility ("default") int getA ();

/** Inso. c ** Created on: June 24, 2014 * Author: boyliang */# include <stdio. h> # include "inso. h "static int gA = 1; void setA (int I) {gA = I;} int getA () {return gA ;}

/** Demo1.c ** Created on: June 24, 2014 * Author: boyliang */# include <stdio. h> # include <unistd. h> # include "inso. h "# include" log. h "int main () {LOGI (" DEMO1 start. "); while (1) {LOGI (" % d ", getA (); setA (getA () + 1); sleep (2);} return 0 ;}

Libmyso. so code

/** Myso. c ** Created on: June 24, 2014 * Author: boyliang */# include <stdio. h> # include <stddef. h> # include <dlfcn. h> # include <pthread. h> # include <stddef. h> # include "log. h "_ attribute _ (_ constructor _) void Main () {LOGI (">>>>>>>>>>>>>> I am in, I am a bad boy 1 !!!! <"); Void * handle = dlopen (" libinso. so ", RTLD_NOW); void (* setA_func) (int) = (void (*) (int) dlsym (handle," setA "); if (setA_func) {setA_func (999 );}}

Call the injection program and name it "poison". The method is "poison <so_path> <target_pit>. The output of the example is shown as follows:

I/TTT     (  594): DEMO1 start.I/TTT     (  594): 1I/TTT     (  594): 2I/TTT     (  594): 3I/TTT     (  594): 4I/TTT     (  594): 5I/TTT     (  594): 6I/TTT     (  594): 7I/TTT     (  594): >>>>>>>>>>>>>I am in, I am a bad boy 1!!!!<<<<<<<<<<<<<<I/TTT     (  594): 999I/TTT     (  594): 1000I/TTT     (  594): 1001

When. /poison/data/local/tmp/libmyso. after so 594, the output immediately showed a specific string, and the printed data suddenly changed to 999, which proves that the injection was successful. The Code involved in the sample code above is published on github. If you want to study the code, you can go to the release.

I know about the attacking giants.

Mountain O group or fellow group:
The chance of death from the armor of Arni is almost nonexistent.

You Neil rushed into the giant group to save Hoover and Reena. The three were missing outside the wall.
The purpose of kidnapping Allen is to say that you need the power of Alan! I did not explain it.
Why can it become a giant?
There are two types of giant chemicals. The first one is typical of Allen and is injected with giant chemicals.
The second is a typical example of unil. After being transformed into a giant, it is restored to humans.
According to the speculation of the Investigation Corps, brainless giants are likely to be humans. It was transformed into a giant by a beast giant!
Where did Alan's father go?
Whereabouts unknown! Dad is a giant researcher. If he doesn't die, he must be preparing for the Giants and thinking personally.
Why are there giants in the walls?
In the case of the mountain Olympics group, the Investigation Corps said that when Maria fell into the army, she entered.
The brainless giant appeared after he climbed into the wall,
So I guess the villagers in your home village have been turned into giants.
Conway's testimony shows that a giant's face looks like she's mom.

The cartoon is not decrypted yet! Still in encryption mode,
Only reveal the story of hyrista. Recently, comics may reveal related secrets.




What did the attacking giants talk about?

Homosexuality was created on a voluntary basis, not true.