Android so库Hook技术

在有些情况下，可能遇到需要改变目标进程的执行流程的问题，替换原函数转而指向我们自己的函数，而Hook就是指的改变待Hook函数的地址，替换地址而达到更换原函数的功能。本文主要介绍Android上对native层中的so库Hook的方法，核心技术其实是对GOT表的Hook，获取目标函数地址需要对so文件进行解析，而so文件实际上是ELF文件，所以在此之前需要对ELF文件格式有一个很好的了解。

关键

解析so文件，其实主要目的就是获得ELF文件中以下三个表的信息：

• 字符串表：包含以空字符结尾的字符序列，使用这些字符来描绘符号和节名；
• 符号表：保存了一个程序在定位和重定位时需要的定义和引用的信息；
• 重定位表：保存了需要重定位的符号的信息；

准备工作

#include <stdio.h>
#include <stdlib.h>
#include <elf.h>
#include <fcntl.h>
#include <android/log.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <utime.h>
#include <dirent.h>

#ifdef __x86_64
    #define Elf_Eh Elf64_Ehdr
    #define Elf_Shdr Elf64_Shdr
    #define Elf_Sym Elf64_Sym
    #define Elf_Rel Elf64_Rela
    #define ELF_R_SYM ELF64_R_SYM

#else
    #define Elf_Ehdr Elf32_Ehdr
    #define Elf_Shdr Elf32_Shdr
    #define Elf_Sym Elf32_Sym
    #define Elf_Rel Elf32_Rel
    #define ELF_R_SYM ELF32_R_SYM
#endif

#define module_path "/system/lib/libjavacore.so"
#define LOG_TAG    "native_hook_log"
#define LOGD(...)  __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, __VA_ARGS__)

读取ELF文件头（ELF文件头起始于 ELF 文件开始的第一字节），取出：

• 节头表的文件偏移（shdr_base），获取节头表在文件中的位置；
• 节头表的项数（shnum），获取节头表的项数；
• 与节名称字符串表关联的项的节头表索引（shstr_base），并将其缓存起来（shstr）；

int fd;
    fd = open(modulepath,O_RDONLY);
    if (fd == -1){
        LOGD("[-] open the so file fail");
    }
    else{
        LOGD("[+] open the so file success");
    }
    Elf_Ehdr *ehdr = (Elf_Ehdr *)malloc(sizeof(Elf_Ehdr));
    read(fd, ehdr, sizeof(Elf_Ehdr));
    if(fd == -1){
        LOGD("[-] read the elf header fail!!");
    }
    else{
        LOGD("[+] read the elf header success!!!");
    }
    //LOGD("[+] the elf header information:");
    uint32_t shdr_base = ehdr -> e_shoff;
    uint16_t shnum = ehdr -> e_shnum;
    uint32_t shstr_base = shdr_base + ehdr -> e_shstrndx * sizeof(Elf32_Shdr);

    /*LOGD("[+] shstrndx = %d",ehdr -> e_shstrndx);
    LOGD("[+] shoff = %d",shdr_base);
    LOGD("[+] shnum = %d",shnum);
    LOGD("[+] shstr_base = %d",shstr_base);*/

    Elf_Shdr *shstr = (Elf_Shdr *)malloc(sizeof(Elf_Shdr));
    lseek(fd, shstr_base, SEEK_SET);
    read(fd, shstr, sizeof(Elf_Shdr));
    if(fd == -1){
        LOGD("[-] read the shdr section str fail!!");
    }
    else{
        LOGD("[+] read the shdr section str success!!");
    }

读取节头表索引，取出： 节的大小（sh_size）、节的名称（sh_name）；
遍历节名，分别将节名为.dynsym、.dynstr、.got、.rel.plt的节缓存起来（dynsym_shdr、dynstr_shdr、got_shdr、relplt_shdr）；
通过上一步获取的节，分别获得对应的表，并将其缓存；

char *shstrtab = (char *)malloc(shstr -> sh_size);
    lseek(fd, shstr -> sh_offset, SEEK_SET);
    read(fd, shstrtab, shstr -> sh_size);
    if(fd == -1){
        LOGD("[-] read section str fail!!");
    }
    else{
        LOGD("[+] read section str success!!");
    }

    Elf_Shdr *shdr = (Elf_Shdr *)malloc(sizeof(Elf_Shdr));
    lseek(fd, shdr_base, SEEK_SET);

    uint16_t i;
    char *str = NULL;
    Elf_Shdr *relplt_shdr = (Elf_Shdr *) malloc(sizeof(Elf_Shdr));
    Elf_Shdr *dynsym_shdr = (Elf_Shdr *) malloc(sizeof(Elf_Shdr));
    Elf_Shdr *dynstr_shdr = (Elf_Shdr *) malloc(sizeof(Elf_Shdr));
    Elf_Shdr *got_shdr = (Elf_Shdr *) malloc(sizeof(Elf_Shdr));


    for(i = 0; i < shnum; ++i) {
        read(fd, shdr, sizeof(Elf_Shdr));
        if(fd == -1){
            LOGD("[-] read fail!!");
        }
        str = shstrtab + shdr -> sh_name;
        if(strcmp(str, ".dynsym") == 0)
            memcpy(dynsym_shdr, shdr, sizeof(Elf_Shdr));
        else if(strcmp(str, ".dynstr") == 0)
            memcpy(dynstr_shdr, shdr, sizeof(Elf_Shdr));
        else if(strcmp(str, ".got") == 0)
            memcpy(got_shdr, shdr, sizeof(Elf_Shdr));
        else if(strcmp(str, ".rel.plt") == 0)
            memcpy(relplt_shdr, shdr, sizeof(Elf_Shdr));
    }

    char *got = (char *) malloc(sizeof(char) * got_shdr->sh_size);
    lseek(fd, got_shdr->sh_offset,SEEK_SET);
    if(read(fd, got, got_shdr->sh_size) != got_shdr->sh_size)
        LOGD("[-] read the got fail!!");
    else{
        LOGD("[+] read the GOT success!!");
    }

    char *dynstr = (char *) malloc(sizeof(char) * dynstr_shdr->sh_size);
    lseek(fd, dynstr_shdr->sh_offset, SEEK_SET);
    if(read(fd, dynstr, dynstr_shdr->sh_size) != dynstr_shdr->sh_size)
        LOGD("[-] read the dynstr fail!!");
    else{
        LOGD("[+] read the dynstr success!!");
    }


    Elf_Sym *dynsymtab = (Elf_Sym *) malloc(dynsym_shdr->sh_size);
    //LOGD("[+] dynsym_shdr->sh_size\t0x%x\n", dynsym_shdr->sh_size);
    lseek(fd, dynsym_shdr->sh_offset, SEEK_SET);
    if(read(fd, dynsymtab, dynsym_shdr->sh_size) != dynsym_shdr->sh_size)
        LOGD("[-] read the dynsym fail!!");
    else{
        LOGD("[+] read the dynsym success");
    }

    Elf_Rel *rel_ent = (Elf_Rel *) malloc(sizeof(Elf_Rel));
    lseek(fd, relplt_shdr->sh_offset, SEEK_SET);
    if(read(fd, rel_ent, sizeof(Elf_Rel)) != sizeof(Elf_Rel))
        LOGD("[-] read the rel_ent fail!!");
    else{
        LOGD("[+] read the rel_ent success");
    }

获取指定符号在got表的偏移地址：

uint32_t offset = 0;
    for (i = 0; i < relplt_shdr->sh_size / sizeof(Elf_Rel); i++)
    {

        uint16_t ndx = ELF_R_SYM(rel_ent->r_info);
        //LOGD("[+] ndx = %d, str = %s", ndx, dynstr + dynsymtab[ndx].st_name);
        if (strcmp(dynstr + dynsymtab[ndx].st_name, symbolname) == 0)
        {
            LOGD("[+] The offset of %s int the dyn GOT table: 0x%x", symbolname, rel_ent->r_offset);
            offset = rel_ent->r_offset;
            break;
        }
        if(read(fd, rel_ent, sizeof(Elf_Rel)) != sizeof(Elf_Rel))
        {
            LOGD("Fail to get the address of %s", symbolname);
        }
    }


    if(offset == 0)
    {
        LOGD("[-] can't find the address of %s,maybe it's static", symbolname);
        for(i = 0; i < (dynsym_shdr->sh_size) / sizeof(Elf_Sym); ++i)
        {
            if(strcmp(dynstr + dynsymtab[i].st_name, symbolname) == 0)
            {
                LOGD("[+] The address of %s为 int the static GOT table: 0x%x", symbolname, dynsymtab[i].st_value);
                offset = dynsymtab[i].st_value;
                break;
            }
        }
    }

    if(offset == 0)
    {
        LOGD("[-] Fail to get the address of %s", symbolname);
    }
    close(fd);
    return offset;

获取so文件的基地址

static uint32_t get_module_base(pid_t pid,char *modulepath){
    FILE *fp = NULL;
    char *pch = NULL;
    char filename[32];
    char line[512];
    uint32_t addr = 0;
    LOGD("[+] get libc base...");

    if (pid < 0) {
        snprintf(filename, sizeof(filename), "/proc/self/maps");
        LOGD("pid < 0");
    }
    else {
        snprintf(filename, sizeof(filename), "/proc/%d/maps", pid);
        LOGD("pid > 0");
    }

    if ((fp = fopen(filename, "r")) == NULL) {
        LOGD("[-]open %s failed!", filename);
        return 0;
    }
    LOGD("[+]open %s success!", filename);
    while (fgets(line, sizeof(line), fp)) {
        if (strstr(line, modulepath)) {
            pch = strtok(line, "-");
            addr = strtoul(pch, NULL, 16);
            if(addr==0x8000)
                addr = 0;
            break;
        }
    }

    fclose(fp);
    LOGD("[+] libc base:0x%x...\n",addr);

    return addr;
}

最后，基地址加上函数符号在GOT表中的地址就是这个函数在内存中的实际地址。

首先写一个open函数用于替换旧的open函数，之后将这个函数的地址替换到目标so的open函数地址。

int *hook_open(char * path, int flag) {
    //char * retu = "0X00000000";
    LOGD("[+] start hook open()");
    LOGD("[+] hook_open path:%s",path);
    LOGD("[+] hook_open flag:%d",flag);
    LOGD("[+] ++++++++++++++++++++++++++++++++++");
    return open(path,flag);
}

地址替换

void gotHook(char *modulepath,char *symbolname,char *hookfunname){

    uint32_t old_addr = get_fun_addr(modulepath,symbolname);
    mprotect((void *)((uint32_t)old_addr & ~4095), 4096 , PROT_READ | PROT_WRITE);

    uint32_t old_fun_addr = *(uint32_t *)old_addr;
    *(uint32_t *)old_addr = (uint32_t)hookfunname;
}

当运行目标so库中的open函数时，执行流程会跳转到我们上面自定义的hook_open函数。