使用ptrace向已运行进程中注入.so并执行相关函数

1. 简介

    使用ptrace向已运行进程中注入.so并执行相关函数，其中的“注入”二字的真正含义为：此.so被link到已运行进程（以下简称为：目标进程）空间中，从而.so中的函数在目标进程空间中有对应的地址，然后通过此地址便可在目标进程中进行调用。

     到底是如何注入的呢？

     本文实现方案为：在目标进程中，通过dlopen把需要注入的.so加载到目标进程的空间中。

2. 如何让目标进程执行dlopen加载.so?

     显然，目标进程本来是没有实现通过dlopen来加载我们想注入的.so，为了实现此功能，我们需要目标进程执行一段我们实现的代码，此段代码的功能为通过dlopen来加载一个.so。

3. 【加载.so的实现代码】

    加载需要注入的.so的实现代码如下所示：     

.global _dlopen_addr_s       @dlopen函数在目标进程中的地址     注：以下全局变化在C中可读写
.global _dlopen_param1_s     @dlopen参数1<.so>在目标进程中的地址 
.global _dlopen_param2_s     @dlopen参数2在目标进程中的地址

.global _dlsym_addr_s        @dlsym函数在目标进程中的地址
.global _dlsym_param2_s      @dlsym参数2在目标进程中的地址，其实为函数名

.global _dlclose_addr_s      @dlcose在目标进程中的地址

.global _inject_start_s      @汇编代码段的起始地址
.global _inject_end_s        @汇编代码段的结束地址

.global _inject_function_param_s  @hook_init参数在目标进程中的地址

.global _saved_cpsr_s        @保存CPSR，以便执行完hook_init之后恢复环境
.global _saved_r0_pc_s       @保存r0-r15，以便执行完hook_init之后恢复环境


.data

_inject_start_s:
	@ debug loop
3:
	@sub r1, r1, #0
	@B 3b

	@ dlopen
	ldr r1, _dlopen_param2_s        @设置dlopen第二个参数, flag
	ldr r0, _dlopen_param1_s        @设置dlopen第一个参数 .so
	ldr r3, _dlopen_addr_s          @设置dlopen函数
	blx r3                          @执行dlopen函数,返回值位于r0中
	subs r4, r0, #0                 @把dlopen的返回值soinfo保存在r4中，以方便后面dlclose使用
	beq	2f

	@dlsym
	ldr r1, _dlsym_param2_s        @设置dlsym第二个参数，第一个参数已经在r0中了
	ldr r3, _dlsym_addr_s          @设置dlsym函数
	blx r3                         @执行dlsym函数，返回值位于r0中
	subs r3, r0, #0                @把返回值<hook_init在目标进程中的地址>保存在r3中
	beq 1f

	@call our function
	ldr r0, _inject_function_param_s  @设置hook_init第一个参数
        blx r3                            @执行hook_init
	subs r0, r0, #0
	beq 2f

1:
	@dlclose                        
	mov r0, r4                        @把dlopen的返回值设为dlcose的第一个参数
	ldr r3, _dlclose_addr_s           @设置dlclose函数
	blx r3                            @执行dlclose函数

2:
	@restore context
	ldr r1, _saved_cpsr_s             @恢复CPSR
	msr cpsr_cf, r1
	ldr sp, _saved_r0_pc_s            @恢复寄存器r0-r15
	ldmfd sp, {r0-pc}
	

    

_dlopen_addr_s:                           @初始化_dlopen_addr_s
.word 0x11111111

_dlopen_param1_s:
.word 0x11111111

_dlopen_param2_s:
.word 0x2                                 @RTLD_GLOBAL

_dlsym_addr_s:
.word 0x11111111

_dlsym_param2_s:
.word 0x11111111

_dlclose_addr_s:
.word 0x11111111

_inject_function_param_s:
.word 0x11111111

_saved_cpsr_s:
.word 0x11111111

_saved_r0_pc_s:
.word 0x11111111


_inject_end_s:                     @代码结束地址

.space 0x400, 0                    @代码段空间大小

.end

4. 如何把【加载.so的实现代码】写入目标进程并启动执行？

   为了把【加载.so的实现代码】写入目标进程，主要有以下两步操作：

   1) 在目标进程中找到存放【加载.so的实现代码】的空间(通过mmap实现)

   2) 把【加载.so的实现代码】写入目标进程指定的空间

   3) 启动执行

4.1 在目标进程中找到存放【加载.so的实现代码】的空间

    通过mmap来实现，其实现步骤如下：

   1) 获取目标进程中mmap地址
   2) 把mmap参数据放入r0-r3,另外两个写入目标进程sp 
   3) pc设置为mmap地址，lr设置为0
   4) 把准备好的寄存器写入目标进程(PTRACE_SETREGS),并启动目标进程运行(PTRACE_CONT)
   5) 分配的内存首地址位于r0 (PTRACE_GETREGS)

4.2 为【加载.so的实现代码】中的全局变量赋值

   1) 获取目标进程中dlopen地址并赋值给_dlopen_addr_s

   2) 获取目标进程中dlsym地址并赋值给_dlsym_addr_s

   3) 获取目标进程中dlclose地址并赋值给_dlclose_addr_s

   4) 把需要加载的.so的路径放入 汇编代码中，并获取此路径在目标进程中的地址然后赋值给_dlopen_param1_s

   5) 把需要加载的.so中的hook_init放入 汇编代码中，并获取此路径在目标进程中的地址然后赋值给_dlsym_param2_s

   6) 把目标进程中的cpsr保存在_saved_cpsr_s中

   7) 把目标进程中的r0-r15存入汇编代码中，并获取此变量在目标进程中的地址然后赋值给_saved_r0_pc_s

   8) 通过ptrace( PTRACE_POKETEXT,...)把汇编代码写入目标进程中，起始地址由前面的mmap所分配

   9) 把目标进程的pc设置为汇编代码的起始地址，然后调用ptrace(PTRACE_DETACH,...)以启动目标进程执行

5. 把汇编代码写入目标进程并执行的实现代码

5.1 主函数 writecode_to_targetproc

#include <stdio.h>
#include <stdlib.h>
#include <asm/ptrace.h>
#include <asm/user.h>
#include <asm/ptrace.h>
#include <sys/wait.h>
#include <sys/mman.h>
#include <dlfcn.h>
#include <dirent.h>
#include <unistd.h>
#include <string.h>
#include <android/log.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <sys/stat.h>

#define MAX_PATH 0x100
#define REMOTE_ADDR( addr, local_base, remote_base ) ( (uint32_t)(addr) + (uint32_t)(remote_base) - (uint32_t)(local_base) )

/* write the assembler code into target proc,
 * and invoke it to execute
 */
int writecode_to_targetproc( 
    pid_t target_pid, // target process pid
    const char *library_path, // the path of .so that will be 
                              // upload to target process 
    const char *function_name, // .so init fucntion e.g. hook_init
    void *param, // the parameters of init function
    size_t param_size ) // number of parameters 
{
	int ret = -1;
	void *mmap_addr, *dlopen_addr, *dlsym_addr, *dlclose_addr;
	void *local_handle, *remote_handle, *dlhandle;
	uint8_t *map_base;
	uint8_t *dlopen_param1_ptr, *dlsym_param2_ptr, *saved_r0_pc_ptr, *inject_param_ptr, *remote_code_ptr, *local_code_ptr;

	struct pt_regs regs, original_regs;

    // extern global variable in the assembler code 
	extern uint32_t _dlopen_addr_s, _dlopen_param1_s, _dlopen_param2_s, \
	        _dlsym_addr_s, _dlsym_param2_s, _dlclose_addr_s, \
	        _inject_start_s, _inject_end_s, _inject_function_param_s, \
			_saved_cpsr_s, _saved_r0_pc_s;

	uint32_t code_length;

	long parameters[10];

    // make target_pid as its child process and stop
	if ( ptrace_attach( target_pid ) == -1 )
		return -1;

    // get the values of 18 registers from target_pid
	if ( ptrace_getregs( target_pid, ®s ) == -1 )
		goto exit;

	// save original registers 
	memcpy( &original_regs, ®s, sizeof(regs) );

    // get mmap address from target_pid
    // the mmap is the address of mmap in the cur process
	mmap_addr = get_remote_addr( target_pid, "/system/lib/libc.so", (void *)mmap );

	// set mmap parameters
	parameters[0] = 0;	// addr
	parameters[1] = 0x4000; // size
	parameters[2] = PROT_READ | PROT_WRITE | PROT_EXEC;  // prot
	parameters[3] =  MAP_ANONYMOUS | MAP_PRIVATE; // flags
	parameters[4] = 0; //fd
	parameters[5] = 0; //offset

    // execute the mmap in target_pid
	if ( ptrace_call( target_pid, (uint32_t)mmap_addr, parameters, 6, ®s ) == -1 )
		goto exit;

    // get the return values of mmap <in r0>
	if ( ptrace_getregs( target_pid, ®s ) == -1 )
		goto exit;

    // get the start address for assembler code
	map_base = (uint8_t *)regs.ARM_r0;

    // get the address of dlopen, dlsym and dlclose in target process
	dlopen_addr = get_remote_addr( target_pid, "/system/bin/linker", (void *)dlopen );
	dlsym_addr = get_remote_addr( target_pid, "/system/bin/linker", (void *)dlsym );
	dlclose_addr = get_remote_addr( target_pid, "/system/bin/linker", (void *)dlclose );

    // set the start address for assembler code in target process
	remote_code_ptr = map_base + 0x3C00;

    // set the start address for assembler code in cur process
	local_code_ptr = (uint8_t *)&_inject_start_s;

    // set global variable of assembler code
    // and these address is in the target process
	_dlopen_addr_s = (uint32_t)dlopen_addr;
	_dlsym_addr_s = (uint32_t)dlsym_addr;
	_dlclose_addr_s = (uint32_t)dlclose_addr;

	code_length = (uint32_t)&_inject_end_s - (uint32_t)&_inject_start_s;
    
	dlopen_param1_ptr = local_code_ptr + code_length + 0x20;
	dlsym_param2_ptr = dlopen_param1_ptr + MAX_PATH;
	saved_r0_pc_ptr = dlsym_param2_ptr + MAX_PATH;
	inject_param_ptr = saved_r0_pc_ptr + MAX_PATH;


	// save library path to assembler code global variable
	strcpy( dlopen_param1_ptr, library_path );
	_dlopen_param1_s = REMOTE_ADDR( dlopen_param1_ptr, local_code_ptr, remote_code_ptr );
	

	// save function name to assembler code global variable
	strcpy( dlsym_param2_ptr, function_name );
	_dlsym_param2_s = REMOTE_ADDR( dlsym_param2_ptr, local_code_ptr, remote_code_ptr );

	// save cpsr to assembler code global variable
	_saved_cpsr_s = original_regs.ARM_cpsr;

	// save r0-r15 to assembler code global variable
	memcpy( saved_r0_pc_ptr, &(original_regs.ARM_r0), 16 * 4 ); // r0 ~ r15
	_saved_r0_pc_s = REMOTE_ADDR( saved_r0_pc_ptr, local_code_ptr, remote_code_ptr );

	// save function parameters to assembler code global variable
	memcpy( inject_param_ptr, param, param_size );
	_inject_function_param_s = REMOTE_ADDR( inject_param_ptr, local_code_ptr, remote_code_ptr );

    // write the assembler code into target process
    // now the values of global variable is in the target process space
	ptrace_writedata( target_pid, remote_code_ptr, local_code_ptr, 0x400 );

	memcpy( ®s, &original_regs, sizeof(regs) );

    // set sp and pc to the start address of assembler code
	regs.ARM_sp = (long)remote_code_ptr;
	regs.ARM_pc = (long)remote_code_ptr;

    // set registers for target process
	ptrace_setregs( target_pid, ®s );

    // make the target_pid is not a child process of cur process
    // and make target_pid continue to running
	ptrace_detach( target_pid );

    // now finish it successfully
	ret = 0;

exit:
	return ret;
}

5.2 attach目标进程ptrace_attach

int ptrace_attach( pid_t pid )
{
    // after PTRACE_ATTACH, the proc<pid> will stop
    if ( ptrace( PTRACE_ATTACH, pid, NULL, 0  ) < 0 )
    {
    	perror( "ptrace_attach" );
    	return -1;
    }

    // wait proc<pid> stop
    waitpid( pid, NULL, WUNTRACED );

    // after PTRACE_SYSCALL, the proc<pid> will continue,
    // but when exectue sys call function, proc<pid> will stop
    if ( ptrace( PTRACE_SYSCALL, pid, NULL, 0  ) < 0 )
    {
    	perror( "ptrace_syscall" );
    	return -1;
    }

    // wait proc<pid> stop
    waitpid( pid, NULL, WUNTRACED );

    return 0;
}

5.3 获取目标进程寄存器值ptrace_getregs

int ptrace_getregs( pid_t pid, struct pt_regs* regs )
{
    if ( ptrace( PTRACE_GETREGS, pid, NULL, regs ) < 0 )
    {
    	perror( "ptrace_getregs: Can not get register values" );
    	return -1;
    }

    return 0;
}

5.4 获取目标进程中指定模块中指定函数的地址get_remote_addr

 
/* find the start address of module whose name is module_name 
 * in the designated process
 */
void* get_module_base( pid_t pid, const char* module_name )
{
	FILE *fp;
	long addr = 0;
	char *pch;
	char filename[32];
	char line[1024];

	if ( pid < 0 )
	{
		/* self process */
		snprintf( filename, sizeof(filename), "/proc/self/maps", pid );
	}
	else
	{
		snprintf( filename, sizeof(filename), "/proc/%d/maps", pid );
	}

	fp = fopen( filename, "r" );

	if ( fp != NULL )
	{
		while ( fgets( line, sizeof(line), fp ) )
		{
			if ( strstr( line, module_name ) )
			{
				pch = strtok( line, "-" );
				addr = strtoul( pch, NULL, 16 );

				if ( addr == 0x8000 )
					addr = 0;

				break;
			}
		}
		fclose( fp ) ;
	}

	return (void *)addr;
}

void* get_remote_addr( pid_t target_pid, const char* module_name, void* local_addr )
{
	void* local_handle, *remote_handle;

	local_handle = get_module_base( -1, module_name );
	remote_handle = get_module_base( target_pid, module_name );

	return (void *)( (uint32_t)local_addr + (uint32_t)remote_handle - (uint32_t)local_handle );
}

5.5 在目标进程中执行指定函数ptrace_call

int ptrace_call( pid_t pid, uint32_t addr, long *params, uint32_t num_params, struct pt_regs* regs )
{
    uint32_t i;

    // put the first 4 parameters into r0-r3
    for ( i = 0; i < num_params && i < 4; i ++ )
    {
    	regs->uregs[i] = params[i];
    }

    // push remained params into stack
    if ( i < num_params )
    {
    	regs->ARM_sp -= (num_params - i) * sizeof(long) ;
    	ptrace_writedata( pid, (void *)regs->ARM_sp, (uint8_t *)¶ms[i], (num_params - i) * sizeof(long) );
    }
    // set the pc to func <e.g: mmap> that will be executed
    regs->ARM_pc = addr;
    if ( regs->ARM_pc & 1 )
    {
    	/* thumb */
    	regs->ARM_pc &= (~1u);
    	regs->ARM_cpsr |= CPSR_T_MASK;
    }
    else
    {
    	/* arm */
    	regs->ARM_cpsr &= ~CPSR_T_MASK;
    }

    // when finish this func, pid will stop
    regs->ARM_lr = 0;	

    // set the regsister and start to execute
    if ( ptrace_setregs( pid, regs ) == -1 
    	|| ptrace_continue( pid ) == -1 )
    {
    	return -1;
    }

    // wait pid finish work and stop
    waitpid( pid, NULL, WUNTRACED );

    return 0;
}

5.6 把代码写入目标进程指定地址ptrace_writedata

int ptrace_writedata( pid_t pid, uint8_t *dest, uint8_t *data, size_t size )
{
    uint32_t i, j, remain;
    uint8_t *laddr;

    union u {
    	long val;
    	char chars[sizeof(long)];
    } d;

    j = size / 4;
    remain = size % 4;

    laddr = data;

    for ( i = 0; i < j; i ++ )
    {
    	memcpy( d.chars, laddr, 4 );
    	ptrace( PTRACE_POKETEXT, pid, dest, d.val );

    	dest  += 4;
    	laddr += 4;
    }

    if ( remain > 0 )
    {
    	d.val = ptrace( PTRACE_PEEKTEXT, pid, dest, 0 );
    	for ( i = 0; i < remain; i ++ )
    	{
    		d.chars[i] = *laddr ++;
    	}

    	ptrace( PTRACE_POKETEXT, pid, dest, d.val );
    	
    }

    return 0;
}

5.7 设置目标进程寄存器ptrace_setregs

int ptrace_setregs( pid_t pid, struct pt_regs* regs )
{
    if ( ptrace( PTRACE_SETREGS, pid, NULL, regs ) < 0 )
    {
    	perror( "ptrace_setregs: Can not set register values" );
    	return -1;
    }

    return 0;
}

5.8 detach目标进程ptrace_detach

int ptrace_detach( pid_t pid )
{
    if ( ptrace( PTRACE_DETACH, pid, NULL, 0 ) < 0 )
    {
    	perror( "ptrace_detach" );
    	return -1;
    }

    return 0;
}

6.  需要被加载的.so

    需要被加载的.so例子程序如下，其目的是替换目标进程libapp.so中的strlen函数。其主要实现见hook_init。

int g_isInit = 0;    
pthread_t g_hThread;     

__attribute__((visibility("default"))) void hook_init( char *args )
{
   if( g_isInit == 1 )
   {
      printf("i am already in!");
      return;
   }

   void* soHandle = NULL;
   
   // the libapp.so is a .so of target process, and it call strcmp
   soHandle  = dlopen( "libapp.so", RTLD_GLOBAL );
   if( soHandle != NULL )
   {
      g_realstrcmp = NULL;
      replaceFunc( soHandle, "strcmp", my_strcmp, (void**)&g_realstrcmp );
      
      int ret = pthread_create( &g_hThread, NULL, my_thread, NULL );
      if( ret != 0 )
      {
         printf("create thread error:%d", ret );
      }
      
      g_isInit = 1;
   }
   
}

6.1 替换函数replaceFunc

// replace function of libapp.so
// e.g: replace strcmp of libapp.so with my_strcmp
void replaceFunc(void *handle,const char *name, void* pNewFun, void** pOldFun )
{

   if(!handle)
      return;
      
   soinfo *si = (soinfo*)handle;   
   Elf32_Sym *symtab = si->symtab;  
   const char *strtab = si->strtab;  
   Elf32_Rel *rel = si->plt_rel;
   unsigned count = si->plt_rel_count; 
   unsigned idx; 

   // these external functions that are called by libapp.so 
   // is in the plt_rel
   for(idx=0; idx<count; idx++) 
   {  
      unsigned type = ELF32_R_TYPE(rel->r_info);  
      unsigned sym = ELF32_R_SYM(rel->r_info);  
      unsigned reloc = (unsigned)(rel->r_offset + si->base);  
      char *sym_name = (char *)(strtab + symtab[sym].st_name); 
      
      if(strcmp(sym_name, name)==0) 
      { 
         *pOldFun = (void *)*((unsigned*)reloc); 
   		  *((unsigned*)reloc)= pNewFun;
         break;
      } 
      rel++;  
   } 
}

6.2 新函数及其它函数

// global function variable, save the address of strcmp of libapp.so
int (*g_realstrcmp)(const char *s1, const char *s2);

// my strcmp function
int my_strcmp(const char *s1, const char *s2)
{
    if( g_realstrcmp != NULL )
    {
        int nRet = g_realstrcmp( s1, s2 );
        printf("***%s: s1=%s, s2=%s\n",__FUNCTION__, s1, s2 );
        return nRet;
    }

    return -1;
}


// create a thread
void* my_thread( void* pVoid )
{
    int sock;
    sock = socket(AF_INET, SOCK_DGRAM, 0);
    if( sock < -1 )
    {
      printf("create socket failed!\n");
      return 0;
    }

    struct sockaddr_in addr_serv;  
    int len;  
    memset(&addr_serv, 0, sizeof(struct sockaddr_in));  
    addr_serv.sin_family = AF_INET;  
    addr_serv.sin_port = htons(9999);   
    addr_serv.sin_addr.s_addr = inet_addr("127.0.0.1");  
    len = sizeof(addr_serv);  

    int flags = fcntl( sock, F_GETFL, 0); 
    fcntl( sock, F_SETFL, flags | O_NONBLOCK);
    int nPreState = -1;
    unsigned char data=0;
    while( 1 )
    {
        data++;
        sendto( sock, &data,  sizeof( data ), 0, (struct sockaddr *)&addr_serv, sizeof( addr_serv ) );
        usleep( 30000 );
    }
}