玩转Hook——Android权限管理功能揭秘（一）

  1 /*
  2   ptrace3.c
  3   author: pengyiming
  4   description:
  5   1, child process need be traced by father process
  6   2, father process reserve the result of "ls" command which executed by child process
  7 */
  8 
  9 #include <stdio.h>
 10 #include <stdlib.h>
 11 #include <string.h>
 12 #include <sys/ptrace.h>
 13 #include <sys/types.h>
 14 #include <sys/wait.h>
 15 #include <sys/reg.h>
 16 #include <sys/user.h>
 17 #include <sys/syscall.h>
 18 #include <unistd.h>
 19 
 20 #ifdef __x86_64__
 21 
 22   #define OFFSET_UNIT 8
 23 
 24 #else
 25 
 26   #define OFFSET_UNIT 4
 27 
 28 #endif
 29 
 30 // converter long to char[]
 31 union
 32 {
 33   long rawData;
 34   char strData[sizeof(long)];
 35 } converter;
 36 
 37 void getData(pid_t child, unsigned long long dataAddr, unsigned long long dataLen, char * const p_data)
 38 {
 39   // PEEKDATA counter
 40   int counter = 0;
 41   // PEEKDATA max count
 42   int maxCount = dataLen / sizeof(long);
 43   if (dataLen % sizeof(long) != 0)
 44   {
 45     maxCount++;
 46   }
 47   // moving pointer
 48   void * p_moving = p_data;
 49 
 50   while (counter < maxCount)
 51   {
 52     memset(&converter, 0, sizeof(long));
 53     converter.rawData = ptrace(PTRACE_PEEKDATA, child, dataAddr + counter * sizeof(long), NULL);
 54     if (converter.rawData < 0)
 55     {
 56       perror("ptrace peek data error : ");
 57     }
 58 
 59     memcpy(p_moving, converter.strData, sizeof(long));
 60     p_moving += sizeof(long);
 61     counter++;
 62   }
 63   p_data[dataLen] = ‘\0‘;
 64 }
 65 
 66 void setData(pid_t child, unsigned long long dataAddr, unsigned long long dataLen, char * const p_data)
 67 {
 68   // POKEDATA counter
 69   int counter = 0;
 70   // POKEDATA max count
 71   int maxCount = dataLen / sizeof(long);
 72   // data left length (prevent out of range in memory when written)
 73   int dataLeftLen = dataLen % sizeof(long);
 74   // moving pointer
 75   void * p_moving = p_data;
 76 
 77   // write part of data which align to sizeof(long)
 78   int ret;
 79   while (counter < maxCount)
 80   {
 81     memset(&converter, 0, sizeof(long));
 82     memcpy(converter.strData, p_moving, sizeof(long));
 83     ret = ptrace(PTRACE_POKEDATA, child, dataAddr + counter * sizeof(long), converter.rawData);
 84     if (ret < 0)
 85     {
 86       perror("ptrace poke data error : ");
 87     }
 88 
 89     p_moving += sizeof(long);
 90     counter++;
 91   }
 92 
 93   // write data left
 94   if (dataLeftLen != 0)
 95   {
 96     memset(&converter, 0, sizeof(long));
 97     memcpy(converter.strData, p_moving, dataLeftLen);
 98     ret = ptrace(PTRACE_POKEDATA, child, dataAddr + counter * sizeof(long), converter.rawData);
 99     if (ret < 0)
100     {
101       perror("ptrace poke data error : ");
102     }
103   }
104 }
105 
106 void reverseStr(char * p_str)
107 {
108   int strLen = strlen(p_str);
109   char * p_head = p_str;
110   char * p_tail = p_str + strLen - 1;
111   char tempCh;
112 
113   // skip ‘\n‘
114   if (*p_tail == ‘\n‘)
115   {
116     p_tail--;
117   }
118 
119   //exchange char
120   while (p_head < p_tail)
121   {
122     tempCh = *p_head;
123     *p_head = *p_tail;
124     *p_tail = tempCh;
125 
126     p_head++;
127     p_tail--;
128   }
129 }
130 
131 void debugRegs(struct user_regs_struct * p_regs ) 
132 {
133   printf("syscall param DS = %llu\n", p_regs->ds);
134   printf("syscall param RSI = %llu\n", p_regs->rsi);
135   printf("syscall param ES = %llu\n", p_regs->es);
136   printf("syscall param RDI = %llu\n", p_regs->rdi);
137 
138   printf("syscall return RAX = %llu\n", p_regs->rax);
139   printf("syscall param RBX = %llu\n", p_regs->rbx);
140   printf("syscall param RCX = %llu\n", p_regs->rcx);
141   printf("syscall param RDX = %llu\n", p_regs->rdx);
142 }
143 
144 int main()
145 {
146   pid_t child = fork();
147   if(child == 0)
148   {
149     ptrace(PTRACE_TRACEME, 0, NULL, NULL);
150 
151     // make a syscall(SYS_write)
152     execl("/bin/ls", "ls", NULL);
153   }
154   else
155   {
156     int status;
157     // SYS_write will be called twice, one is entry, another is exit, so we mark it
158     unsigned int calledCount = 0;
159 
160     while (1)
161     {
162       wait(&status);
163       if (WIFEXITED(status))
164       {
165         break;
166       }
167 
168       // PEEK regs to find the syscall(SYS_execve)
169       struct user_regs_struct regs;
170       ptrace(PTRACE_GETREGS, child, NULL, &regs);
171 
172       // catch it!
173       if (regs.orig_rax == SYS_write)
174       {
175           if (calledCount == 0)
176           {
177             calledCount = 1;
178 
179             // debugRegs(&regs);
180 
181             char * p_dataStr = (char *) malloc((regs.rdx + 1) * sizeof(char));
182             if (p_dataStr == NULL)
183         {
184               return;
185         }
186             
187             getData(child, regs.ds * OFFSET_UNIT + regs.rsi, regs.rdx, p_dataStr);
188             reverseStr(p_dataStr);
189             setData(child, regs.ds * OFFSET_UNIT + regs.rsi, regs.rdx, p_dataStr);
190           }
191           else if (calledCount == 1)
192           {
193             // debugRegs(&regs);
194           }
195       }
196 
197       ptrace(PTRACE_SYSCALL, child, NULL, NULL);
198     }
199   }
200 
201   return 0;
202 }