Android aosp10,AOSP Android10 hook dlsym

1 最近的堆栈

#0 pc 0001332c /data/app/com.xx.xx.xx-Y3Pcp5VnIrzHXx1MbVmxwg==/lib/arm/libinjectCamera.so (CodeBuffer::Emit32(int)+28) (BuildId: 4e2ef33d7d3943a9215af15ff3194064fdab415f)

#1 pc 00012967 /data/app/com.xx.xx.xx-Y3Pcp5VnIrzHXx1MbVmxwg==/lib/arm/libinjectCamera.so (generate_thumb_trampoline(unsigned int, unsigned int)+70) (BuildId: 4e2ef33d7d3943a9215af15ff3194064fdab415f)

我从IDA里面把响应代码抠出来了，你看下是不是想要这个东西

2 请搜索如下关键字

CodeBuffer::Emit32(int)+28 搜索 "crash_28"

generate_thumb_trampoline(unsigned int, unsigned int)+70 搜索 "crash_70"

.text:00012920 ; _DWORD __fastcall generate_thumb_trampoline(void *, unsigned int)

.text:00012920 EXPORT _Z25generate_thumb_trampolinejj

.text:00012920 _Z25generate_thumb_trampolinejj ; CODE XREF: generate_thumb_trampoline(uint,uint)+8↑j

.text:00012920 ; DATA XREF: LOAD:00000F40↑o ...

.text:00012920

.text:00012920 var_44 = -0x44

.text:00012920 var_3C = -0x3C

.text:00012920 var_38 = -0x38

.text:00012920 var_34 = -0x34

.text:00012920 var_28 = -0x28

.text:00012920 var_24 = -0x24

.text:00012920 var_20 = -0x20

.text:00012920 var_1C = -0x1C

.text:00012920 var_18 = -0x18

.text:00012920 var_C = -0xC

.text:00012920

.text:00012920 ; __unwind { // j___gxx_personality_v0

.text:00012920 B0 B5 PUSH {R4,R5,R7,LR}

.text:00012922 02 AF ADD R7, SP, #8

.text:00012924 90 B0 SUB SP, SP, #0x40

.text:00012926 0C 46 MOV R4, R1

.text:00012928 01 46 MOV R1, R0 ; void *

.text:0001292A 1D 48 LDR R0, =(__stack_chk_guard_ptr - 0x12930)

.text:0001292C 78 44 ADD R0, PC ; __stack_chk_guard_ptr

.text:0001292E 05 68 LDR R5, [R0] ; __stack_chk_guard

.text:00012930 28 68 LDR R0, [R5]

.text:00012932 0F 90 STR R0, [SP,#0x48+var_C]

.text:00012934 0B A8 ADD R0, SP, #0x48+var_1C ; this

.text:00012936 F9 F7 66 E9 BLX j__ZN2zz3arm19ThumbTurboAssemblerC2EPv ; zz::arm::ThumbTurboAssembler::ThumbTurboAssembler(void *)

.text:0001293A 1A 49 LDR R1, =(_ZTVN2zz3arm8RegisterE_ptr - 0x12946)

.text:0001293C 00 23 MOVS R3, #0

.text:0001293E 0F 22 MOVS R2, #0xF

.text:00012940 04 93 STR R3, [SP,#0x48+var_38]

.text:00012942 79 44 ADD R1, PC ; _ZTVN2zz3arm8RegisterE_ptr

.text:00012944 09 68 LDR R1, [R1] ; `vtable for'zz::arm::Register

.text:00012946 08 31 ADDS R1, #8

.text:00012948 09 91 STR R1, [SP,#0x48+var_24]

.text:0001294A 0A 92 STR R2, [SP,#0x48+var_20]

.text:0001294C CD E9 01 12 STRD.W R1, R2, [SP,#4]

.text:00012950 4F F0 C0 72 MOV.W R2, #0x1800000

.text:00012954 08 92 STR R2, [SP,#0x48+var_28]

.text:00012956 05 93 STR R3, [SP,#0x48+var_34]

.text:00012958 03 91 STR R1, [SP,#0x48+var_3C]

.text:0001295A 09 A9 ADD R1, SP, #0x48+var_24

.text:0001295C 01 AA ADD R2, SP, #0x48+var_44

.text:0001295E F9 F7 58 E9 BLX j__ZN2zz3arm14ThumbAssembler6t2_ldrENS0_8RegisterERKNS0_10MemOperandE ; zz::arm::ThumbAssembler::t2_ldr(zz::arm::Register,zz::arm::MemOperand const&)

.text:00012962 0C 98 LDR R0, [SP,#0x48+var_18] ; this

.text:00012964 21 46 MOV R1, R4 ; int

.text:00012966 F9 F7 5A E9 BLX j__ZN10CodeBuffer6Emit32Ei ; CodeBuffer::Emit32(int) ---> (crash_70)

.text:0001296A 0B A8 ADD R0, SP, #0x48+var_1C ; this

.text:00013310 EXPORT _ZN10CodeBuffer6Emit32Ei

.text:00013310 _ZN10CodeBuffer6Emit32Ei ; CODE XREF: CodeBuffer::Emit32(int)+8↑j

.text:00013310 ; DATA XREF: LOAD:00000F60↑o ...

.text:00013310 ; __unwind {

.text:00013310 B0 B5 PUSH {R4,R5,R7,LR}

.text:00013312 02 AF ADD R7, SP, #8

.text:00013314 05 46 MOV R5, R0

.text:00013316 00 68 LDR R0, [R0]

.text:00013318 0C 46 MOV R4, R1

.text:0001331A C1 69 LDR R1, [R0,#0x1C]

.text:0001331C 28 46 MOV R0, R5

.text:0001331E 88 47 BLX R1

.text:00013320 01 1D ADDS R1, R0, #4

.text:00013322 28 68 LDR R0, [R5]

.text:00013324 42 69 LDR R2, [R0,#0x14]

.text:00013326 28 46 MOV R0, R5

.text:00013328 90 47 BLX R2

.text:0001332A A8 68 LDR R0, [R5,#8]

.text:0001332C 10 C0 STMIA R0!, {R4} -----> (crash_28)

.text:0001332E A8 60 STR R0, [R5,#8]

.text:00013330 B0 BD POP {R4,R5,R7,PC}