android 5.0.1 libdvm.so,Android Cydia Substrate hook用法

如果是exe

MSConfig(MSFilterExecutable, "/system/bin/app_process")

b. 初始化入口:

MSInitialize

{

//TODO:模块安装后, Cydia会自动调用这里的代码,你可以在这里进行hook,也可以以后手动hook

hook();

}

(3) 进行hook, 以hook libdvm.so里的dvmCallMethodV为例:

void hook()

{

MSImageRef image = MSGetImageByName("/system/lib/libdvm.so");

if (image != NULL)

{

void * symbole = MSFindSymbol(image,

"_Z14dvmCallMethodVP6ThreadPK6MethodP6ObjectbP6JValueSt9__va_list");

if (symbole == NULL)

{

LOGE("error find _Z21dvmDexFileOpenPartialPKviPP6DvmDex ");

}

else

{

MSHookFunction(symbole, (void*) &MydvmCallMethodV,

(void **) &OriDvmCallMethodV);

LOGD("hook dvmCallMethodV ok");

}

}

else {

LOGE("error find libdvm");

}

}

4. JNI hook

与C hook基本类似, 主要区别:

(1) 把C函数hook链接的so改为libsubstrate-dvm.so

(2) 在C代码里进行hook:

MSConfig(MSFilterExecutable, "/system/bin/app_process")

static jint (*_Resources$getColor)(JNIEnv *jni, jobject _this, ...);

static jint $Resources$getColor(JNIEnv *jni, jobject _this, jint rid) {

jint color = _Resources$getColor(jni, _this, rid);

return color & ~0x0000ff00 | 0x00ff0000;

}

static void OnResources(JNIEnv *jni, jclass resources, void *data) {

jmethodID method = jni->GetMethodID(resources, "getColor", "(I)I");

if (method != NULL)

MSJavaHookMethod(jni, resources, method,

&$Resources$getColor, &_Resources$getColor);

}

MSInitialize {

MSJavaHookClassLoad(NULL, "android/content/res/Resources", &OnResources);

}