这是indexloc提供的服务,不要输入任何密码
Skip to content

android inline hook hook dlopen crash #48

@xiaoyur347

Description

@xiaoyur347

ShadowHook Version

1.0.7

Android OS Version

8.0

Android ABIs

armeabi-v7a

Device Manufacturers and Models

Google Pixel 2 XL

Describe the Bug

需要hook dlopen,此为前提。
static void (old_dlopen)(const char filename, int flags);
void new_dlopen(const char filename, int flags)
{
return old_dlopen(filename, flags);
}
尝试了unique模式,调用shadowhook_hook_sym_addr(dlopen, (void
)new_dlopen, (void**)&old_dlopen);
在android 8上会因为namespace导致失败。
失败的原因有几个:
1、sh_linker.c中static uintptr_t sh_linker_dlopen_addr; // save address of dlopen(==4.x) or do_dlopen(>=5.0)这个变量设计的不太合理,应该再增加一个static uintptr_t sh_linker_dlopen_addr_ro;以避免因为sh_linker_dlopen_addr修改导致无法判断是否用户想要hook dlopen。

__attribute__((constructor)) static void sh_linker_ctor(void) {
  sh_linker_dlopen_addr_ro = (uintptr_t)dlopen;
  sh_linker_dlopen_addr = (uintptr_t)dlopen;
bool sh_linker_need_to_hook_dlopen(uintptr_t target_addr) {
  return SHADOWHOOK_IS_UNIQUE_MODE && !sh_linker_dlopen_hooked && target_addr == sh_linker_dlopen_addr_ro;
}

2、

if (sh_linker_need_to_hook_dlopen(self->target_addr)) {
    SH_LOG_INFO("task: hook dlopen/do_dlopen internal. target-address %" PRIxPTR, self->target_addr);
    if (0 != (r = sh_task_start_monitor(false))) goto end;
    // 这里也有问题,内部已经hook dlopen的情况下,是否应该挂个链式的hook来返回。
  }

疑问,是否我应该切换成shared模式。
但是看起来shared模式也不会默认hook dlopen。要hook dlopen需要设置为未加载库时hook未加载库的方法名才会。

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinginvalidThis doesn't seem right

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions