layout: post
title: 动态注入并执行Android代码到进程
categories: Android
description: 动态注入并执行Android代码到进程
keywords: Inject
url: https://lichao890427.github.io/ https://github.com/lichao890427/

动态注入并执行Android代码到进程

背景

  网上可以见到很多帖子是如何注入进程并钩取c层api的例子，而动态的让目标进程加载一个dex并执行这个dex却没看到，c层的注入很简单，可以参考adbi，ptrace进去修改当前指令指针寄存器，构造一个dlopen的指令并调用，类似于win上getcontext修改eip， java层稍复杂一些，加载dex->解析dex->查找目标类->调用函数,下面是测试用例,我们的目标是打log

代码

import android.util.Log;
public class injectjava {
    static void initialize(){
        Log.i("INJECTJAVA","injectava called");
    }
}

#define LOGI(...)  __android_log_print(ANDROID_LOG_ERROR, "INJECTJAVA", __VA_ARGS__)
#define DEXNAME "/data/local/tmp/inject.dex"

typedef void Object;
typedef void ClassObject;
typedef void Thread;
typedef uint8_t u1;
typedef uint32_t u4;
struct JNIEnvExt
{
    const struct JNINativeInterface* funcTable;
    const struct JNINativeInterface* baseFuncTable;
    u4      envThreadId;
    Thread* self;
};

typedef void DexOptHeader;
typedef void DexStringId;
typedef void DexTypeId;
typedef void DexFieldId;
typedef void DexMethodId;
typedef void DexProtoId;
typedef void DexLink;
typedef void DexClassLookup;

struct DexHeader
{
    u1  magic[8];           /* includes version number */
    u4  checksum;           /* adler32 checksum */
    u1  signature[20];       /* SHA-1 hash */
    u4  fileSize;           /* length of entire file */
    u4  headerSize;         /* offset to start of next section */
    u4  endianTag;
    u4  linkSize;
    u4  linkOff;
    u4  mapOff;
    u4  stringIdsSize;
    u4  stringIdsOff;
    u4  typeIdsSize;
    u4  typeIdsOff;
    u4  protoIdsSize;
    u4  protoIdsOff;
    u4  fieldIdsSize;
    u4  fieldIdsOff;
    u4  methodIdsSize;
    u4  methodIdsOff;
    u4  classDefsSize;
    u4  classDefsOff;
    u4  dataSize;
    u4  dataOff;
};

struct DexClassDef
{
    u4  classIdx;           /* index into typeIds for this class */
    u4  accessFlags;
    u4  superclassIdx;      /* index into typeIds for superclass */
    u4  interfacesOff;      /* file offset to DexTypeList */
    u4  sourceFileIdx;      /* index into stringIds for source file name */
    u4  annotationsOff;     /* file offset to annotations_directory_item */
    u4  classDataOff;       /* file offset to class_data_item */
    u4  staticValuesOff;    /* file offset to DexEncodedArray */
};

struct DexFile
{
    DexOptHeader *pOptHeader;
    DexHeader *pHeader;
    DexStringId *pStringIds;
    DexTypeId *pTypeIds;
    DexFieldId *pFieldIds;
    DexMethodId *pMethodIds;
    DexProtoId *pProtoIds;
    DexClassDef *pClassDefs;
    DexLink *pLinkData;
    DexClassLookup *pClassLookup;
};

struct DvmDex
{
    DexFile*            pDexFile;
};

int (*dvmDexFileOpenPartial)(const void* addr, int len, DvmDex** ppDvmDex)=0;
int (*dexSwapAndVerify)(void* addr, int len)=0;
JNIEnv* (*dvmGetJNIEnvForThread)()=0;
Object* (*dvmDecodeIndirectRef)(JNIEnv* env, jobject jobj)=0;
Object* (*dvmDecodeIndirectRef_)(Thread* self, jobject jobj)=0;
ClassObject* (*dvmDefineClass)(DvmDex* pDvmDex, const char* descriptor, Object* classLoader)=0;
DexClassLookup* (*dexCreateClassLookup)(DexFile* pDexFile)=0;

void inject()
{
    /*
     * C层hook
     */
    /*
     * JAVA层hook
     */
    //获取关键函数指针
    do
    {
        void* hdvm = dlopen("libdvm.so", RTLD_LAZY | RTLD_GLOBAL);
        if(!hdvm)
        {
            LOGI("libdvm not exist!");
            break;
        }
        dvmDexFileOpenPartial = (typeof(dvmDexFileOpenPartial))dlsym(hdvm, "dvmDexFileOpenPartial");
        if(!dvmDexFileOpenPartial)
        {
            dvmDexFileOpenPartial = (typeof(dvmDexFileOpenPartial))dlsym(hdvm, "_Z21dvmDexFileOpenPartialPKviPP6DvmDex");
            if(!dvmDexFileOpenPartial)
                LOGI("dvmDexFileOpenPartial not exist!");
        }
        dexSwapAndVerify = (typeof(dexSwapAndVerify))dlsym(hdvm, "dexSwapAndVerify");
        if(!dexSwapAndVerify)
        {
            dexSwapAndVerify = (typeof(dexSwapAndVerify))dlsym(hdvm, "_Z16dexSwapAndVerifyPhi");
            if(!dexSwapAndVerify)
                LOGI("dexSwapAndVerify not exist!");
        }
        dvmGetJNIEnvForThread = (typeof(dvmGetJNIEnvForThread))dlsym(hdvm, "dvmGetJNIEnvForThread");
        if(!dvmGetJNIEnvForThread)
        {
            dvmGetJNIEnvForThread = (typeof(dvmGetJNIEnvForThread))dlsym(hdvm, "_Z21dvmGetJNIEnvForThreadv");
            if(!dvmGetJNIEnvForThread)
                LOGI("dvmGetJNIEnvForThread not exist!");
        }
        dvmDecodeIndirectRef = (typeof(dvmDecodeIndirectRef))dlsym(hdvm, "dvmDecodeIndirectRef");
        if(!dvmDecodeIndirectRef)
        {
            dvmDecodeIndirectRef = (typeof(dvmDecodeIndirectRef))dlsym(hdvm, "_Z20dvmDecodeIndirectRefP7_JNIEnvP8_jobject");
            if(!dvmDecodeIndirectRef)
            {
                dvmDecodeIndirectRef_ = (typeof(dvmDecodeIndirectRef_))dlsym(hdvm, "_Z20dvmDecodeIndirectRefP6ThreadP8_jobject");
                if(!dvmDecodeIndirectRef_)
                    LOGI("dvmDecodeIndirectRef_ not exist!");
            }
        }
        dvmDefineClass = (typeof(dvmDefineClass))dlsym(hdvm, "dvmDefineClass");
        if(!dvmDefineClass)
        {
            dvmDefineClass = (typeof(dvmDefineClass))dlsym(hdvm, "_Z14dvmDefineClassP6DvmDexPKcP6Object");
            if(!dvmDefineClass)
                LOGI("dvmDefineClass not exist!");
        }
        dexCreateClassLookup = (typeof(dexCreateClassLookup))dlsym(hdvm, "dexCreateClassLookup");
        if(!dexCreateClassLookup)
        {
            dexCreateClassLookup = (typeof(dexCreateClassLookup))dlsym(hdvm, "_Z20dexCreateClassLookupP7DexFile");
            if(!dexCreateClassLookup)
                LOGI("dexCreateClassLookup not exist!");
        }
        if(!dvmDexFileOpenPartial || !dexSwapAndVerify || !dvmGetJNIEnvForThread || !dvmDefineClass || !dexCreateClassLookup || (!dvmDecodeIndirectRef && !dvmDecodeIndirectRef_))
            break;
        LOGI("InitOk");
        //读取dex以便动态加载
        char* dexdata = 0;
        int dexlen;
        int dexfd = open(DEXNAME, O_RDONLY);
        if(dexfd == -1)
        {
            LOGI("can't open inject.dex!");
            break;
        }
        struct stat st = {0};
        fstat(dexfd , &st);
        if(st.st_size)
        {
            dexlen = st.st_size;
            dexdata = (char*)malloc(st.st_size);
            if(dexdata)
                read(dexfd, dexdata, st.st_size);
        }
        close(dexfd);
        if(!dexdata)
        {
            LOGI("read inject.dex fail!");
            break;
        }
        int result;
        DvmDex* dvmDex = 0;
        JNIEnv* env =0;
        jclass java_lang_Class =0;
        jmethodID java_lang_Class_forName =0;
        jclass java_lang_ClassLoader =0;
        jmethodID java_lang_ClassLoader_getSystemClassLoader =0;
        jobject jSystemClassLoader =0;
        Object* SystemClassLoader =0;
        jstring com_injectjava_str =0;
        jclass com_injectjava =0;
        jmethodID com_injectjava_initialize =0;
        DexFile* pDexFile = 0;
        int csize,i;
        dexSwapAndVerify(dexdata, dexlen);
        result = dvmDexFileOpenPartial(dexdata, dexlen, &dvmDex);
        if(result != 0)
        {
            LOGI("dvmDexFileOpenPartial fail!");
            goto END1;
        }
        env = dvmGetJNIEnvForThread();
        if(!env)
        {
            LOGI("dvmGetJNIEnvForThread fail!");
            goto END1;
        }
        java_lang_Class = env->FindClass("java/lang/Class");
        if(!java_lang_Class)
        {
            LOGI("java_lang_Class null!");
            goto END1;
        }
        java_lang_Class_forName = env->GetStaticMethodID(java_lang_Class, "forName", "(Ljava/lang/String;ZLjava/lang/ClassLoader;)Ljava/lang/Class;");
        if(!java_lang_Class_forName)
        {
            LOGI("java_lang_Class_forName null!");
            goto END1;
        }
        java_lang_ClassLoader = env->FindClass("java/lang/ClassLoader");
        if(!java_lang_ClassLoader)
        {
            LOGI("java_lang_ClassLoader null!");
            goto END1;
        }
        java_lang_ClassLoader_getSystemClassLoader = env->GetStaticMethodID(java_lang_ClassLoader, "getSystemClassLoader", "()Ljava/lang/ClassLoader;");
        if(!java_lang_ClassLoader_getSystemClassLoader)
        {
            LOGI("java_lang_ClassLoader_getSystemClassLoader null!");
            goto END1;
        }
        jSystemClassLoader = env->CallStaticObjectMethod(java_lang_ClassLoader, java_lang_ClassLoader_getSystemClassLoader, "()Ljava/lang/ClassLoader;");
        if(!jSystemClassLoader)
        {
            LOGI("jSystemClassLoader null!");
            goto END1;
        }
        LOGI("InitOk1");
        if(dvmDecodeIndirectRef)
            SystemClassLoader = dvmDecodeIndirectRef(env, jSystemClassLoader);
        else
            SystemClassLoader = dvmDecodeIndirectRef_(((JNIEnvExt*)env)->self, jSystemClassLoader);
        if(!SystemClassLoader)
        {
            LOGI("SystemClassLoader null!");
            goto END1;
        }
        pDexFile = dvmDex->pDexFile;
        pDexFile->pClassLookup = dexCreateClassLookup(dvmDex->pDexFile);
        csize = pDexFile->pHeader->classDefsSize;
        for(i=0;i<csize;i++)
        {
            pDexFile->pClassDefs[i].accessFlags | 0x10000;
        }
        dvmDefineClass(dvmDex, "Lcom/injectjava;", SystemClassLoader);
        com_injectjava_str = env->NewStringUTF("com.injectjava");
        if(!com_injectjava_str)
        {
            LOGI("com_injectjava null!");
            goto END1;
        }
        com_injectjava = (jclass)env->CallStaticObjectMethod(java_lang_Class, java_lang_Class_forName, com_injectjava_str, true, jSystemClassLoader);
        if(!com_injectjava)
        {
            LOGI("com_injectjava null!");
            goto END1;
        }
        com_injectjava_initialize = env->GetStaticMethodID(com_injectjava, "initialize", "()V");
        if(!com_injectjava_initialize)
        {
            LOGI("com_injectjava_initialize null!");
            goto END1;
        }
        env->CallStaticVoidMethod(com_injectjava, com_injectjava_initialize);
        LOGI("InitOk2");
        END1:
        free(dexdata);
    }
    while(false);
}

结论

  将要执行的dex放到/data/local/tmp/inject.dex即可

06-03 15:47:34.984 16197-16197/com.example.hellojni E/INJECTJAVA: InitOk
06-03 15:47:35.074 16197-16197/com.example.hellojni E/INJECTJAVA: InitOk1
06-03 15:54:08.304 16197-16197/com.example.hellojni I/INJECTJAVA: injectava called

  这里只是做实验验证Java代码的注入原理分析，Frida注入框架是这类动态注入的最佳实践框架