Android平台的进程注入和linux平台的注入技术类似，采用ptrace机制来实现
ptrace
在执行系统调用之前，内核会先检查当前进程是否处于被“跟踪”(traced)的状态。如果是的话，内核暂停当前进程并将控制权交给跟踪进程，使跟踪进程得以察看或者修改被跟踪进程的寄存器。
ptrace()是一个系统调用,它允许一个进程控制另外一个进程的执行.不仅如此,我们还可以借助于ptrace修改某个进程的空间(内存或寄存器),任何传递给一个进程(即被跟踪进程)的信号(除了会直接杀死进程的SIGKILL信号)都会使得这个进程进入暂停状态,这时系统通过wait()通 知跟踪进程,这样,跟踪进程就可以修改被跟踪进程的行为了.
如果跟踪进程在被跟踪进程的内存中设置了相关的事件标志位,那么运行中被跟踪进程也可能因为特殊的事件而暂停.跟踪结束后,跟踪进程甚至可以通过设置被跟踪进程的退出码(exit code)来杀死它,当然也可以让它继续运行.
ptrace
#include <sys/types.h>
#include <sys/ptrace.h>
int ptrace(int request, pid_t pid, caddr_t addr, int data);
我们可以看到,ptrace有4个参数,其中,request决定ptrace做什么,pid是被跟踪进程的ID,data存储从进程空间偏移量为addr的地方开始将被读取/写入的数据.
request:
PT_ATTACH: attach 进程
PT_DETACH： detach 进程
PTRACE_SINGLESTEP: 单步
PTRACE_SYSCALL, PTRACE_CONT: 继续
PTRACE_POKETEXT, PTRACE_POKEDATA, PTRACE_POKEUSER: 读数据
PTRACE_PEEKTEXT, PTRACE_PEEKDATA, PTRACE_PEEKUSER:写数据
PTRACE_GETREGS： 得到寄存器
注入流程
0.保存现场
1.查找目标进程的mmap函数
2.在目标进程中调用mmap分配内存
3.查找目标进程dlopen、dlsym函数地址
4.往目标进程中写入shellcode，填充data
5.执行shellcode，调用hook入口
6.恢复现场，Deattach进程，完成注入
代码片段
int main(int argc, char** argv) {
pid_t target_pid;
if(argc < 2){
printf("Input target pid\n");
return -1;
}
target_pid = atoi(argv[1]);
inject_remote_process( target_pid, "/data/local/tmp/libcode.so", "hook_entry", "I'm parameter!", strlen("I'm parameter!") );
return 0;
}然后inject_remote_process如下
int inject_remote_process( pid_t target_pid, const char *library_path, const char *function_name, void *param, size_t param_size )
{
int ret = -1;
void *mmap_addr, *dlopen_addr, *dlsym_addr, *dlclose_addr;
void *local_handle, *remote_handle, *dlhandle;
uint8_t *map_base;
uint8_t *dlopen_param1_ptr, *dlsym_param2_ptr, *saved_r0_pc_ptr, *inject_param_ptr, *remote_code_ptr, *local_code_ptr;
struct pt_regs regs, original_regs;
extern uint32_t _dlopen_addr_s, _dlopen_param1_s, _dlopen_param2_s, _dlsym_addr_s, \
_dlsym_param2_s, _dlclose_addr_s, _inject_start_s, _inject_end_s, _inject_function_param_s, \
_saved_cpsr_s, _saved_r0_pc_s;
uint32_t code_length;
long parameters[10];
DEBUG_PRINT( "[+] Injecting process: %d\n", target_pid );
if ( ptrace_attach( target_pid ) == -1 )//先attach进程，对ptrace的封装，代码在下段
return EXIT_SUCCESS;
if ( ptrace_getregs( target_pid, ®s ) == -1 )//保存当前状态，寄存器之类的
goto exit;
/* save original registers */
memcpy( &original_regs, ®s, sizeof(regs) );
mmap_addr = get_remote_addr( target_pid, "/system/lib/libc.so", (void *)mmap );//函数在下面，作用是找到目标进程那些dlopen之类的函数地址，可以拿到自己dlopen地址，与自己进程lib.c的base差值和在目标进程一样，所以vaddr就得到，然后加上目标进程lib.c的base，因为自己进程是root可读对方。
DEBUG_PRINT( "[+] Remote mmap address: %x\n", mmap_addr );
//下面是控制目标进程给我们做事，比如分配空间，调用mmp函数
/* call mmap */
parameters[0] = 0; // addr
parameters[1] = 0x4000; // size，按页对齐
parameters[2] = PROT_READ | PROT_WRITE | PROT_EXEC; // prot
parameters[3] = MAP_ANONYMOUS | MAP_PRIVATE; // flags，匿名，下面参数忽略
parameters[4] = 0; //fd
parameters[5] = 0; //offset
DEBUG_PRINT( "[+] Calling mmap in target process.\n" );
//这个函数在下面，
if ( ptrace_call( target_pid, (uint32_t)mmap_addr, parameters, 6, ®s ) == -1 )
goto exit;//目标进程异常，挂起
if ( ptrace_getregs( target_pid, ®s ) == -1 )//读出这个值。
goto exit;
DEBUG_PRINT( "[+] Target process returned from mmap, return value=%x, pc=%x \n", regs.ARM_r0, regs.ARM_pc );
map_base = (uint8_t *)regs.ARM_r0;//r0就是分配在目标进程shellcode
dlopen_addr = get_remote_addr( target_pid, linker_path, (void *)dlopen );
dlsym_addr = get_remote_addr( target_pid, linker_path, (void *)dlsym );
dlclose_addr = get_remote_addr( target_pid, linker_path, (void *)dlclose );
DEBUG_PRINT( "[+] Get imports: dlopen: %x, dlsym: %x, dlclose: %x\n", dlopen_addr, dlsym_addr, dlclose_addr );
//除了在目标进程放shellcode还要控制stack，code使用的是pc，栈式sp，所以在内存一个点，pc向上，sp向下。
remote_code_ptr = map_base + 0x3C00;
local_code_ptr = (uint8_t *)&_inject_start_s;
_dlopen_addr_s = (uint32_t)dlopen_addr;
_dlsym_addr_s = (uint32_t)dlsym_addr;
_dlclose_addr_s = (uint32_t)dlclose_addr;
DEBUG_PRINT( "[+] Inject code start: %x, end: %x\n", local_code_ptr, &_inject_end_s );
//shell拷贝到目标进程。shellcode在下面片段，恢复寄存器在shellcode里
code_length = (uint32_t)&_inject_end_s - (uint32_t)&_inject_start_s;
dlopen_param1_ptr = local_code_ptr + code_length + 0x20;
dlsym_param2_ptr = dlopen_param1_ptr + MAX_PATH;
saved_r0_pc_ptr = dlsym_param2_ptr + MAX_PATH;
inject_param_ptr = saved_r0_pc_ptr + MAX_PATH;
/* dlopen parameter 1: library name *///填写shellcode里用到的参数
strcpy( dlopen_param1_ptr, library_path );
_dlopen_param1_s = REMOTE_ADDR( dlopen_param1_ptr, local_code_ptr, remote_code_ptr );
DEBUG_PRINT( "[+] _dlopen_param1_s: %x\n", _dlopen_param1_s );
/* dlsym parameter 2: function name */
strcpy( dlsym_param2_ptr, function_name );
_dlsym_param2_s = REMOTE_ADDR( dlsym_param2_ptr, local_code_ptr, remote_code_ptr );
DEBUG_PRINT( "[+] _dlsym_param2_s: %x\n", _dlsym_param2_s );
/* saved cpsr */
_saved_cpsr_s = original_regs.ARM_cpsr;
/* saved r0-pc */
memcpy( saved_r0_pc_ptr, &(original_regs.ARM_r0), 16 * 4 ); // r0 ~ r15
_saved_r0_pc_s = REMOTE_ADDR( saved_r0_pc_ptr, local_code_ptr, remote_code_ptr );
DEBUG_PRINT( "[+] _saved_r0_pc_s: %x\n", _saved_r0_pc_s );
/* Inject function parameter */
memcpy( inject_param_ptr, param, param_size );
_inject_function_param_s = REMOTE_ADDR( inject_param_ptr, local_code_ptr, remote_code_ptr );
DEBUG_PRINT( "[+] _inject_function_param_s: %x\n", _inject_function_param_s );
DEBUG_PRINT( "[+] Remote shellcode address: %x\n", remote_code_ptr );
ptrace_writedata( target_pid, remote_code_ptr, local_code_ptr, 0x400 );//把参数shellcode一次性写到目标进程。
memcpy( ®s, &original_regs, sizeof(regs) );
regs.ARM_sp = (long)remote_code_ptr;
regs.ARM_pc = (long)remote_code_ptr;
ptrace_setregs( target_pid, ®s );
ptrace_detach( target_pid );
// inject succeeded
ret = 0;
exit:
return ret;
}ptrace_attach
int ptrace_attach( pid_t pid )
{
if ( ptrace( PTRACE_ATTACH, pid, NULL, 0 ) < 0 )
{
perror( "ptrace_attach" );
return -1;
}
waitpid( pid, NULL, WUNTRACED );//让内核等一下目标进程
//DEBUG_PRINT("attached\n");
if ( ptrace( PTRACE_SYSCALL, pid, NULL, 0 ) < 0 )//让他执行完当前sysycall
{
perror( "ptrace_syscall" );
return -1;
}
waitpid( pid, NULL, WUNTRACED );
return 0;
}
int ptrace_detach( pid_t pid )
{
if ( ptrace( PTRACE_DETACH, pid, NULL, 0 ) < 0 )
{
perror( "ptrace_detach" );
return -1;
}
return 0;
}get_remote_addr
void* get_remote_addr( pid_t target_pid, const char* module_name, void* local_addr )
{
void* local_handle, *remote_handle;
local_handle = get_module_base( -1, module_name );//拿到自己的base
remote_handle = get_module_base( target_pid, module_name );//拿到远程的base
DEBUG_PRINT( "[+] get_remote_addr: local[%x], remote[%x]\n", local_handle, remote_handle );
return (void *)( (uint32_t)local_addr + (uint32_t)remote_handle - (uint32_t)local_handle );//自己函数地址-自己base+远程base
}get_module_base
void* get_module_base( pid_t pid, const char* module_name )
{
FILE *fp;
long addr = 0;
char *pch;
char filename[32];
char line[1024];
if ( pid < 0 )
{
/* self process */
snprintf( filename, sizeof(filename), "/proc/self/maps");
}
else
{
snprintf( filename, sizeof(filename), "/proc/%d/maps", pid );
}
fp = fopen( filename, "r" );
if ( fp != NULL )
{
while ( fgets( line, sizeof(line), fp ) )
{
if ( strstr( line, module_name ) )
{
pch = strtok( line, "-" );
addr = strtoul( pch, NULL, 16 );
if ( addr == 0x8000 )
addr = 0;
break;
}
}
fclose( fp ) ;
}
return (void *)addr;
}ptrace_call
int ptrace_call( pid_t pid, uint32_t addr, long *params, uint32_t num_params, struct pt_regs* regs )
{
uint32_t i;
//r0-r3
for ( i = 0; i < num_params && i < 4; i ++ )
{
regs->uregs[i] = params[i];
}
//
// push remained params onto stack
//
if ( i < num_params )
{
regs->ARM_sp -= (num_params - i) * sizeof(long) ;
ptrace_writedata( pid, (void *)regs->ARM_sp, (uint8_t *)¶ms[i], (num_params - i) * sizeof(long) );
}
//上面就是把另外两个参数通过栈，想做的是先把这两参数push到栈上，然后操作栈顶
regs->ARM_pc = addr;
if ( regs->ARM_pc & 1 )//thumb
{
/* thumb */
regs->ARM_pc &= (~1u);
regs->ARM_cpsr |= CPSR_T_MASK;
}
else
{
/* arm */
regs->ARM_cpsr &= ~CPSR_T_MASK;//如果前面是thumb把1清掉
}
//那么如何notify进程我们mmp执行完了。就是通过下面这句话。原因是当函数调用时候，当我们使用bl或者bx，链接寄存器指向的是下一条返回地址，如果把下条返回地址赋值成0，返回时候pc=0，就会产生异常。相当于一个notify，然后用下面那个waitpid得到异常模式，确定mmp执行完。所以其实下面不一定是0，只要是无效即可。
regs->ARM_lr = 0;//把链接寄存器的值赋值0
if ( ptrace_setregs( pid, regs ) == -1
|| ptrace_continue( pid ) == -1 )//调用continue让进程继续执行
{
return -1;
}
waitpid( pid, NULL, WUNTRACED );
return 0;
}shellcode
.global _dlopen_addr_s
.global _dlopen_param1_s
.global _dlopen_param2_s
.global _dlsym_addr_s
.global _dlsym_param2_s
.global _dlclose_addr_s
.global _inject_start_s
.global _inject_end_s
.global _inject_function_param_s
.global _saved_cpsr_s
.global _saved_r0_pc_s
.data
_inject_start_s:
@ debug loop
3:
@sub r1, r1, #0
@B 3b
@ dlopen
ldr r1, _dlopen_param2_s
ldr r0, _dlopen_param1_s
ldr r3, _dlopen_addr_s@dopen地址
blx r3
subs r4, r0, #0
beq 2f
@dlsym@要去找hook——entry
ldr r1, _dlsym_param2_s
ldr r3, _dlsym_addr_s
blx r3
subs r3, r0, #0
beq 1f
@call our function
ldr r0, _inject_function_param_s
blx r3
subs r0, r0, #0
beq 2f
1:
@dlclose
mov r0, r4
ldr r3, _dlclose_addr_s
blx r3
2:
@restore context
ldr r1, _saved_cpsr_s
msr cpsr_cf, r1@把寄存器都回复了
ldr sp, _saved_r0_pc_s
ldmfd sp, {r0-pc}
_dlopen_addr_s:
.word 0x11111111
_dlopen_param1_s:
.word 0x11111111
_dlopen_param2_s:
.word 0x2
_dlsym_addr_s:
.word 0x11111111
_dlsym_param2_s:
.word 0x11111111
_dlclose_addr_s:
.word 0x11111111
_inject_function_param_s:
.word 0x11111111
_saved_cpsr_s:
.word 0x11111111
_saved_r0_pc_s:
.word 0x11111111
_inject_end_s:
.space 0x400, 0
.end也可以用SO的init(init_array)实现注入，不一定要用hook_entry,或者找到目标进程dlopen控制栈区调用？
2266
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
