Skip to content

Commit 861950e

Browse files
abcz316abcz316
committed
init64
1 parent 3b6f946 commit 861950e

File tree

3 files changed

+115
-12
lines changed

3 files changed

+115
-12
lines changed

‎testRoot/init64_helper.h‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#ifndef INIT64_HELPER_H_
2+
#define INIT64_HELPER_H_
3+
#include <unistd.h>
4+
#include "process64_inject.h"
5+
6+
//注入init64进程远程执行命令，备注：此命令会自动提权到ROOT、并且关闭SELinux。结束运行后可根据自己的需要决定是否手动重新打开SELinux
7+
ssize_t inject_init64_run_cmd_wrapper(
8+
unsigned int root_key,
9+
const char *cmd,
10+
const char* p_out_result_buf = NULL,
11+
size_t out_result_buf_size = 0) {
12+
return inject_process64_run_cmd_wrapper(root_key, 1, cmd, p_out_result_buf, out_result_buf_size, false, false, false, NULL, false, NULL);
13+
}
14+
15+
//fork安全版本（可用于安卓APP直接调用）
16+
ssize_t safe_inject_init64_run_cmd_wrapper(
17+
unsigned int root_key,
18+
const char *cmd,
19+
const char* p_out_result_buf = NULL,
20+
size_t out_result_buf_size = 0) {
21+
return safe_inject_process64_run_cmd_wrapper(root_key, 1, cmd, p_out_result_buf, out_result_buf_size, false, false, false, NULL, false, NULL);
22+
}
23+
#endif /* INIT64_HELPER_H_ */

‎testRoot/so_symbol_parser.h‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#ifndef SO_SYMBOL_PARSER_H_
2+
#define SO_SYMBOL_PARSER_H_
3+
#include <unistd.h>
4+
#include <stdio.h>
5+
#include <string.h>
6+
#include <stdlib.h>
7+
#include <elf.h>
8+
#include <fcntl.h>
9+
#include <iostream>
10+
#include <sys/mman.h>
11+
#include <map>
12+
#include <vector>
13+
14+
static bool is_elf64_file(int fd) {
15+
Elf64_Ehdr elf;
16+
int r = read(fd, &elf, sizeof(elf));
17+
if (r != sizeof(elf)) {
18+
return false;
19+
}
20+
if (*(uint32_t *)&elf != 0x464c457f) {
21+
//not an ELF file
22+
return false;
23+
}
24+
unsigned char * b = (unsigned char *)&elf;
25+
if (b[EI_CLASS] == ELFCLASS64) {
26+
return true;
27+
}
28+
return false;
29+
}
30+
static int get_so_symbol_addr(const char* so_path, std::map<std::string, uint64_t> & funcSymbolMap) {
31+
int fd;
32+
char *mod;
33+
unsigned int size, i, j, shn, n;
34+
Elf64_Sym *syms, *sym;
35+
Elf64_Shdr *shdrs, *shdr;
36+
Elf64_Ehdr *ehdr;
37+
const char *strtab;
38+
39+
fd = open(so_path, O_RDONLY);
40+
if (fd < 0) {
41+
return -1;
42+
}
43+
lseek(fd, 0L, SEEK_SET);
44+
if (!is_elf64_file(fd)) {
45+
close(fd);
46+
return -2;
47+
}
48+
size = lseek(fd, 0L, SEEK_END);
49+
mod = (char*)mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
50+
51+
ehdr = (Elf64_Ehdr *)mod;
52+
shdrs = (Elf64_Shdr *)(mod + ehdr->e_shoff);
53+
shn = ehdr->e_shnum == 0 ? shdrs[0].sh_size : ehdr->e_shnum;
54+
55+
for (i = 0; i < shn; i++) {
56+
shdr = &shdrs[i];
57+
58+
if (shdr->sh_type == SHT_SYMTAB || shdr->sh_type == SHT_DYNSYM) {
59+
syms = (Elf64_Sym *)(mod + shdr->sh_offset);
60+
strtab = mod + shdrs[shdr->sh_link].sh_offset;
61+
n = shdr->sh_size / shdr->sh_entsize;
62+
for (j = 0; j < n; j++) {
63+
char stype, sbind, sinfo;
64+
65+
sym = &syms[j];
66+
stype = ELF64_ST_TYPE(sym->st_info);
67+
sbind = ELF32_ST_BIND(sym->st_info);
68+
sinfo = ELF32_ST_INFO(sbind, stype);
69+
if (stype == STT_FUNC && sbind == STB_GLOBAL &&
70+
sym->st_other == STV_DEFAULT &&
71+
(uintmax_t)sym->st_size > 0) {
72+
73+
if (funcSymbolMap.find(strtab + sym->st_name) == funcSymbolMap.end()) {
74+
continue;
75+
}
76+
funcSymbolMap[strtab + sym->st_name] = sym->st_value;
77+
}
78+
}
79+
}
80+
}
81+
munmap(mod, size);
82+
close(fd);
83+
return 0;
84+
}
85+
#endif /* SO_SYMBOL_PARSER_H_ */

‎testRoot/testRoot.cpp‎

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
#include <sys/capability.h>
55
#include "process64_inject.h"
66
#include "adb64_helper.h"
7+
#include "init64_helper.h"
78
#include "su_install_helper.h"
89
#define ROOT_KEY 0x7F6766F8
910

@@ -97,7 +98,7 @@ void test_run_normal_cmd(const char * shell) {
9798
void test_run_root_cmd(const char * cmd) {
9899
printf("test_run_root_cmd(%s)\n", cmd);
99100
char result[0x1000] = { 0 };
100-
ssize_t ret = inject_adbd64_run_cmd_wrapper(ROOT_KEY, cmd, result, sizeof(result));
101+
ssize_t ret = inject_init64_run_cmd_wrapper(ROOT_KEY, cmd, result, sizeof(result));
101102
printf("test_run_root_cmd ret val:%zd\n", ret);
102103
printf("test_run_root_cmd result:%s\n", result);
103104
}
@@ -117,7 +118,7 @@ void test_su_env_inject(const char* target_pid_cmdline)
117118

118119
//1.安装su工具套件
119120
std::string su_hidden_path;
120-
int install_su_tools_ret = install_su_tools(ROOT_KEY, myself_path, su_hidden_path, "su");
121+
int install_su_tools_ret = install_su_tools(ROOT_KEY, myself_path, su_hidden_path, "adb_su");
121122
printf("install_su_tools ret val:%d\n", install_su_tools_ret);
122123
if (install_su_tools_ret != 0) {
123124
return;
@@ -126,17 +127,11 @@ void test_su_env_inject(const char* target_pid_cmdline)
126127
//2.杀光所有历史进程
127128
std::vector<pid_t> vOut;
128129
int find_all_cmdline_process_ret = find_all_cmdline_process(ROOT_KEY, target_pid_cmdline, vOut);
129-
printf("find_all_cmdline_process ret val:%d, cnt:%d\n", find_all_cmdline_process_ret, vOut.size());
130+
printf("find_all_cmdline_process ret val:%d, cnt:%zu\n", find_all_cmdline_process_ret, vOut.size());
130131
if (find_all_cmdline_process_ret != 0) {
131132
return;
132133
}
133-
std::string kill_cmd;
134-
for (pid_t t : vOut) {
135-
kill_cmd += "kill -9 ";
136-
kill_cmd += std::to_string(t);
137-
kill_cmd += ";";
138-
}
139-
int kill_ret = run_normal_cmd(ROOT_KEY, kill_cmd.c_str());
134+
int kill_ret = kill_process_ex(ROOT_KEY, vOut);
140135
printf("kill_ret ret val:%d\n", kill_ret);
141136
if (kill_ret != 0) {
142137
return;
@@ -163,7 +158,7 @@ void test_clean_su_env() {
163158

164159
int uninstall_su_tools_ret = uninstall_su_tools(ROOT_KEY, myself_path, "su");
165160
printf("test_clean_su_env ret val:%d\n", uninstall_su_tools_ret);
166-
}
161+
}
167162

168163
int main(int argc, char *argv[])
169164
{
@@ -187,7 +182,7 @@ int main(int argc, char *argv[])
187182

188183
++argv;
189184
--argc;
190-
185+
191186
if (strcmp(argv[0], "show") == 0) { //1.显示自身权限信息
192187
show_capability_info();
193188
}

0 commit comments

Comments
 (0)