Question

使用插入值为5个字节的跳转的基本x86方法写一个函数的钩子。我的代码生锈了，但我认为我有逻辑。当我针对LD_PRELOAD env var运行时出现分段错误错误。我基本上使用了替换函数，hook func，trampoline函数来修改并返回原始地址。以下是代码链接。

foo.h中

#ifndef foo_h__
#define foo_h__

extern void foo(const char*);

#endif  // foo_h_

foo.c的

#include <stdio.h>


void foo(const char*str)
{
    puts(str);
}

的main.c

#include <stdio.h>
#include "foo.h"

int main(void)
{const char*str="I am a shared lib!\n";
        int count=1;
    puts("This is a shared library test...");
    while(count!=200){
        printf("%d time!\n",count);    
    foo(str);
    count++;
}
    return 0;
}

hook.c

# include <stdio.h>
# include <unistd.h>
# define __USE_GNU
# include <dlfcn.h>
# include <stdint.h>
# include <sys/mman.h>

const char*str = "Hooked! ma fucker!\n";
struct hookdata
{
    int64_t*origFunc;
    int64_t*newFunc;
    const char*s;
    void (*foo_trampoline)(const char*str);
}*hkd;

void fooHooked(const char*str)
{
    puts(str);
    hkd->foo_trampoline(hkd->s);

}

void hook(void)
{
//Get pointers to the original and new functions and calculate the jump offset
    hkd->origFunc = dlsym(RTLD_NOW, "foo");
    hkd->newFunc = (int64_t*) &fooHooked;
    int64_t offset = hkd->newFunc - (hkd->origFunc + 5);
//Make the memory containing the original funcion writable
//Code from http://stackoverflow.com/questions/20381812/mprotect-always-returns-invalid-arguments
    size_t pageSize = sysconf(_SC_PAGESIZE);
    uintptr_t start = (uintptr_t) hkd->origFunc;
    uintptr_t end = start + 1;
    uintptr_t pageStart = start & -pageSize;
    mprotect((void *) pageStart, end - pageStart,
            PROT_READ | PROT_WRITE | PROT_EXEC);
//Insert the jump instruction at the beginning of the original function
    int32_t instruction = 0xe9 | offset << 8;
    *hkd->origFunc = instruction;
}
void foo(const char*str)
{
    if (*hkd->origFunc == 0xe9)
    {
        printf("hook detected!");
    }
    else
        hook();
}

Answer 1

页面访问标志PROT_READ | PROT_WRITE | PROT_EXEC的组合违反了W ^ X保护，因此这可能是手头的第一个问题。在第一步中，首先设置PROT_READ | PROT_WRITE以替换函数前导码然后将其恢复为PROT_READ | PROT_EXEC可能会解决该问题。

Answer 2

你在4字节类型中存储了5个字节的指令，你需要这样的东西：

unsigned char instr[5];
instr[0] = 0xe9;
*(int32_t*)(&instr[1]) = offset;
memcpy(hkd->origFunc, instr, 5);

Linux写入跳转以使用mprotect保护内存

2 个答案: