Attack Android injection 2

Attack Android injection 2
I will continue to describe the basic idea in "1". Next, let's start with the injection.
Injection
Class the code injection that we call at ordinary times, mainly Static and Dynamic Static injection, for executable files, such as the ELF and DEX files we modify at ordinary times, there are also many auxiliary tools, such as IDA, JEB, and ApkTool. Dynamic Injection is used for processes, such as modifying process registers and memory values. The biggest difference between dynamic and static operations is that, the source file does not need to be modified dynamically, but requires high permissions (usually root permissions), and requires a higher technical level.
Essentially, dynamic injection technology is essentially a scheduling technology. What functions can we do when debugging a process? Generally, there are the following items: view the variable value modify the variable value trace process jump view process call stack and so on dynamic injection compared to normal debugging, the biggest difference is that dynamic injection is"Automated debugging and user-defined Dynamic Link Library Loading". The so-called automation is actually implemented through code. in Linux, all the above functions can be completed through Ptrace. Of course, the Ptrace function is relatively primitive, during Normal debugging, many high-level logic encapsulation is required. Before reading the following sections, we strongly recommend that you read the man document.
In general, we need to inject a process to improve the function of the target process, fix the defects of the target process, hijack the function of the target process, and steal the data of the target process; tampered with the data of the target process;

Process as shown in. After process A is injected into process B, process B loads the custom dynamic library a by modifying the register and memory. After process a is loaded, a will try to load other modules, such as loading dex files. The specific injection process is as follows: ATTATCH, specify the target process and start debugging; GETREGS, get the register of the target process, and save the field; SETREGS: modify relevant registers such as PC to point to mmap; POPETEXT: write so path to the address space requested by mmap; SETRESG: modify relevant registers such as PC to point to dlopen; SETREGS, restore the site; DETACH, release debugging, and restore it; The above is a simplified process, the entire injected code, I have uploaded to github, address https://github.com/boyliang/Poison when so is loaded to the target process by dlopen, we need to let the logic in so be executed, the more complex approach is also to use ptrace to modify registers, let the target process call dlsym to find the address of our function. There are two simple methods: Use the gcc precompiled command _ attribute _ (_ constructor _) to load so, the function is automatically executed;

__attribute__ ((__constructor__))void Main() { LOGI(">>>>>>>>>>>>>I am in, I am a bad boy 1!!!!<<<<<<<<<<<<<<"); void* handle = dlopen("libinso.so", RTLD_NOW); void (*setA_func)(int) = (void (*)(int))dlsym(handle, "setA"); if (setA_func) {   setA_func(999); }}

When the c ++ global object is used for initialization, its constructor is automatically executed;

void Main();static void* _main(void*){Main();return NULL;}class EntryClass {public:EntryClass() {pthread_t tid;pthread_create(&tid, NULL, _main, NULL);pthread_detach(tid);}} boy;

The following example shows an example of ptrace injection, which involves two parts: the target Process Code is recorded as the host, and the so code injected by us is recorded as libmyso. so.
The Host Code contains three source files: demo1.c, inso. h, and inso. c.

/** Inso. h ** Created on: June 24, 2014 * Author: boyliang */_ attribute _ (visibility ("default") void setA (int I ); __attribute _ (visibility ("default") int getA ();

/** Inso. c ** Created on: June 24, 2014 * Author: boyliang */# include <stdio. h> # include "inso. h "static int gA = 1; void setA (int I) {gA = I;} int getA () {return gA ;}

/** Demo1.c ** Created on: June 24, 2014 * Author: boyliang */# include <stdio. h> # include <unistd. h> # include "inso. h "# include" log. h "int main () {LOGI (" DEMO1 start. "); while (1) {LOGI (" % d ", getA (); setA (getA () + 1); sleep (2);} return 0 ;}

Libmyso. so code

/** Myso. c ** Created on: June 24, 2014 * Author: boyliang */# include <stdio. h> # include <stddef. h> # include <dlfcn. h> # include <pthread. h> # include <stddef. h> # include "log. h "_ attribute _ (_ constructor _) void Main () {LOGI (">>>>>>>>>>>>>> I am in, I am a bad boy 1 !!!! <"); Void * handle = dlopen (" libinso. so ", RTLD_NOW); void (* setA_func) (int) = (void (*) (int) dlsym (handle," setA "); if (setA_func) {setA_func (999 );}}

Call the injection program and name it "poison". The method is "poison <so_path> <target_pit>. The output of the example is shown as follows:

I/TTT     (  594): DEMO1 start.I/TTT     (  594): 1I/TTT     (  594): 2I/TTT     (  594): 3I/TTT     (  594): 4I/TTT     (  594): 5I/TTT     (  594): 6I/TTT     (  594): 7I/TTT     (  594): >>>>>>>>>>>>>I am in, I am a bad boy 1!!!!<<<<<<<<<<<<<<I/TTT     (  594): 999I/TTT     (  594): 1000I/TTT     (  594): 1001

When. /poison/data/local/tmp/libmyso. after so 594, the output immediately showed a specific string, and the printed data suddenly changed to 999, which proves that the injection was successful. Sample Code the Code involved in the above example, I have released to github, if you want to study the code, you can go to the https://github.com/boyliang/injection_by_ptrace in "three", I will introduce another injection technology unique to Android.