Use Cydia substrate to perform Android native hooks

?

Cydia can not only hook Java code, can also hook native code, below an example to do Android native hook

I found it on the Internet. Supermathhook this project, which was modified on his basis, was intended to be a hasty response to Ali's CTF

This project location:

This project is used to hook JNI code, and I am used to hook dvmdexfileopenpartial This function, so must use

Mshookfunction This function, this function in the libsubstrate.so, go to the official website to download it.

The next step is how to hook.

First of all:

1. Specify the lib to hook:

MSConfig (Msfilterlibrary, "/system/lib/libdvm.so")

1. At the time of initialization, the hook is as follows:

   Msinitialize

   {

   ????

   ???? __android_log_print (Android_log_error, TAG, "substrate initialized.");

   ???? Msimageref image;

   ???? image = Msgetimagebyname ("/system/lib/libdvm.so"), loading Lib

   ???? if (image! = NULL)

   ???? {

   ???????? Note that this is a C + + function that can be obtained by Objdump

   ???????? void * dexload=msfindsymbol (image, "_z21dvmdexfileopenpartialpkvipp6dvmdex");

   ???????? if (dexload==null)

   ???????? {

   ???????????? LOGD ("Error Find _z21dvmdexfileopenpartialpkvipp6dvmdex");

   ????????}

   ???????? else{

   ???????????? mshookfunction (Dexload, (void*) &mydvmdexfileopen, (void * *) &olddexfileopen);

   ????????}

   ????}

   ???? else{

   ???????? LOGD ("ERROR FIND LIBDVM");

   ????}

   }

   ?

   Other functions related to:

   Int (* olddexfileopen) (const void * Addr,int len,void * * dvmdex); Keep the original address

   int Mydvmdexfileopen (const void * Addr,int len,void * * dvmdex) New function

   {

   LOGD ("Call my DVM dex!!:%d", Getpid ());

   {//write to File

   ???? Char buf[200];

   ???? sprintf (buf, "/sdcard/dex.%d", Random ()); Exporting Dex Files

   ???? FILE * F=fopen (BUF, "WB");

   ???? if (!f)

   ???? {

   ???????? LOGD ("Error open SDcard file to write");

   ???? }

   ???? else{

   ???????? Fwrite (ADDR,1,LEN,F);

   ???????? Fclose (f);

   ???? }

   ?

   }

   Return Olddexfileopen (Addr,len,dvmdex); make the original call without affecting the program to run

   }

Use Cydia substrate to perform Android native hooks