Skip to content

Commit

Permalink
Sync with YAHFA
Browse files Browse the repository at this point in the history
  • Loading branch information
solohsu committed Jul 31, 2020
1 parent e4f24e4 commit 8d7a662
Show file tree
Hide file tree
Showing 12 changed files with 40 additions and 84 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ public class Yahfa {
// JNI.ToReflectedMethod() could return either Method or Constructor
public static native Object findMethodNative(Class targetClass, String methodName, String methodSig);

public static native void init(int SDK_version);
public static native void init(int sdkVersion);

public static native void setMethodNonCompilable(Member member);

Expand Down
41 changes: 20 additions & 21 deletions edxp-core/src/main/cpp/external/yahfa/src/HookMain.c
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@
#include <stdbool.h>

#include "common.h"
#include "env.h"
#include "trampoline.h"
#include "HookMain.h"

Expand All @@ -22,10 +21,6 @@ static int kAccNative = 0x0100;
static int kAccCompileDontBother = 0x01000000;
static int kAccFastInterpreterToInterpreterInvoke = 0x40000000;

static inline uint16_t read16(void *addr) {
return *((uint16_t *) addr);
}

static inline uint32_t read32(void *addr) {
return *((uint32_t *) addr);
}
Expand All @@ -34,13 +29,17 @@ static inline void write32(void *addr, uint32_t value) {
*((uint32_t *) addr) = value;
}

static inline void* readAddr(void *addr) {
return *((void**) addr);
}

void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVersion) {
int i;
SDKVersion = sdkVersion;
LOGI("init to SDK %d", sdkVersion);
switch (sdkVersion) {
case ANDROID_Q:
case ANDROID_P:
case __ANDROID_API_Q__:
case __ANDROID_API_P__:
kAccCompileDontBother = 0x02000000;
OFFSET_ArtMehod_in_Object = 0;
OFFSET_access_flags_in_ArtMethod = 4;
Expand All @@ -50,9 +49,9 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size;
ArtMethodSize = roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size * 2;
break;
case ANDROID_O2:
case __ANDROID_API_O_MR1__:
kAccCompileDontBother = 0x02000000;
case ANDROID_O:
case __ANDROID_API_O__:
OFFSET_ArtMehod_in_Object = 0;
OFFSET_access_flags_in_ArtMethod = 4;
OFFSET_dex_method_index_in_ArtMethod = 4 * 3;
Expand All @@ -62,8 +61,8 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size * 2;
ArtMethodSize = roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size * 3;
break;
case ANDROID_N2:
case ANDROID_N:
case __ANDROID_API_N_MR1__:
case __ANDROID_API_N__:
OFFSET_ArtMehod_in_Object = 0;
OFFSET_access_flags_in_ArtMethod = 4; // sizeof(GcRoot<mirror::Class>) = 4
OFFSET_dex_method_index_in_ArtMethod = 4 * 3;
Expand All @@ -76,7 +75,7 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers

ArtMethodSize = roundUpToPtrSize(4 * 4 + 2 * 2) + pointer_size * 4;
break;
case ANDROID_M:
case __ANDROID_API_M__:
OFFSET_ArtMehod_in_Object = 0;
OFFSET_entry_point_from_interpreter_in_ArtMethod = roundUpToPtrSize(4 * 7);
OFFSET_entry_point_from_quick_compiled_code_in_ArtMethod =
Expand All @@ -86,7 +85,7 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
OFFSET_array_in_PointerArray = 4 * 3;
ArtMethodSize = roundUpToPtrSize(4 * 7) + pointer_size * 3;
break;
case ANDROID_L2:
case __ANDROID_API_L_MR1__:
OFFSET_ArtMehod_in_Object = 4 * 2;
OFFSET_entry_point_from_interpreter_in_ArtMethod = roundUpToPtrSize(
OFFSET_ArtMehod_in_Object + 4 * 7);
Expand All @@ -97,7 +96,7 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
OFFSET_array_in_PointerArray = 12;
ArtMethodSize = OFFSET_entry_point_from_interpreter_in_ArtMethod + pointer_size * 3;
break;
case ANDROID_L:
case __ANDROID_API_L__:
OFFSET_ArtMehod_in_Object = 4 * 2;
OFFSET_entry_point_from_interpreter_in_ArtMethod = OFFSET_ArtMehod_in_Object + 4 * 4;
OFFSET_entry_point_from_quick_compiled_code_in_ArtMethod =
Expand All @@ -117,7 +116,7 @@ void Java_lab_galaxy_yahfa_HookMain_init(JNIEnv *env, jclass clazz, jint sdkVers
}

void setNonCompilable(void *method) {
if (SDKVersion < ANDROID_N) {
if (SDKVersion < __ANDROID_API_N__) {
return;
}
int access_flags = read32((char *) method + OFFSET_access_flags_in_ArtMethod);
Expand All @@ -132,7 +131,7 @@ bool setNativeFlag(void *method, bool isNative) {
int old_access_flags = access_flags;
if (isNative) {
access_flags |= kAccNative;
if (SDKVersion >= ANDROID_Q) {
if (SDKVersion >= __ANDROID_API_Q__) {
// On API 29 whether to use the fast path or not is cached in the ART method structure
access_flags &= ~kAccFastInterpreterToInterpreterInvoke;
}
Expand Down Expand Up @@ -162,7 +161,7 @@ static int doBackupAndHook(JNIEnv *env, void *targetMethod, void *hookMethod, vo

// set kAccCompileDontBother for a method we do not want the compiler to compile
// so that we don't need to worry about hotness_count_
if (SDKVersion >= ANDROID_N) {
if (SDKVersion >= __ANDROID_API_N__) {
setNonCompilable(targetMethod);
setNonCompilable(hookMethod);
}
Expand Down Expand Up @@ -199,7 +198,7 @@ static int doBackupAndHook(JNIEnv *env, void *targetMethod, void *hookMethod, vo
}

// set the target method to native so that Android O wouldn't invoke it with interpreter
if (SDKVersion >= ANDROID_O) {
if (SDKVersion >= __ANDROID_API_O__) {
setNativeFlag(targetMethod, true);
LOGI("access flags is 0x%x", access_flags);
}
Expand Down Expand Up @@ -231,7 +230,7 @@ static void ensureMethodCached(void *hookMethod, void *backupMethod,
}

// finally the addr of backup method is put at the corresponding location in cached methods array
if (SDKVersion >= ANDROID_O2) {
if (SDKVersion >= __ANDROID_API_O_MR1__) {
// array of MethodDexCacheType is used as dexCacheResolvedMethods in Android 8.1
// struct:
// struct NativeDexCachePair<T> = { T*, size_t idx }
Expand Down Expand Up @@ -319,11 +318,11 @@ static void *getResolvedMethodsAddr(JNIEnv *env, jobject hook) {
jobject dexCacheObj = (*env)->GetObjectField(env, backupClass, dexCacheFid);
// get resolvedMethods address
jclass dexCacheClass = (*env)->GetObjectClass(env, dexCacheObj);
if (SDKVersion >= ANDROID_N) {
if (SDKVersion >= __ANDROID_API_N__) {
jfieldID resolvedMethodsFid = (*env)->GetFieldID(env, dexCacheClass, "resolvedMethods",
"J");
return (void *) (*env)->GetLongField(env, dexCacheObj, resolvedMethodsFid);
} else if (SDKVersion >= ANDROID_L) {
} else if (SDKVersion >= __ANDROID_API_L__) {
LOGE("this should has been done in java world: %d", SDKVersion);
return 0;
} else {
Expand Down
3 changes: 3 additions & 0 deletions edxp-core/src/main/cpp/external/yahfa/src/common.h
Original file line number Diff line number Diff line change
Expand Up @@ -26,4 +26,7 @@
#endif // DEBUG
#endif // LOG_DISABLED

#define pointer_size sizeof(void*)
#define roundUpToPtrSize(v) (v + pointer_size - 1 - ((v + pointer_size - 1) & (pointer_size - 1)))

#endif //YAHFA_COMMON_H
33 changes: 0 additions & 33 deletions edxp-core/src/main/cpp/external/yahfa/src/env.h

This file was deleted.

6 changes: 5 additions & 1 deletion edxp-core/src/main/cpp/external/yahfa/src/trampoline.c
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@
#include <sys/syscall.h>

#include "common.h"
#include "env.h"
#include "trampoline.h"

static unsigned char *trampolineCode; // place where trampolines are saved
Expand Down Expand Up @@ -89,6 +88,9 @@ void *genTrampoline(void *hookMethod) {

#elif defined(__aarch64__)
memcpy(targetAddr + 12, &hookMethod, pointer_size);

#else
#error Unsupported architecture
#endif

return targetAddr;
Expand All @@ -106,6 +108,8 @@ void setupTrampoline() {
((unsigned char) OFFSET_entry_point_from_quick_compiled_code_in_ArtMethod) << 4;
trampoline[6] |=
((unsigned char) OFFSET_entry_point_from_quick_compiled_code_in_ArtMethod) >> 4;
#else
#error Unsupported architecture
#endif
}

Expand Down
17 changes: 0 additions & 17 deletions edxp-core/src/main/cpp/main/include/android_build.h
Original file line number Diff line number Diff line change
Expand Up @@ -5,23 +5,6 @@
#include <cstdlib>
#include <sys/system_properties.h>

#define ANDROID_ICE_CREAM_SANDWICH 14
#define ANDROID_ICE_CREAM_SANDWICH_MR1 15
#define ANDROID_JELLY_BEAN 16
#define ANDROID_JELLY_BEAN_MR1 17
#define ANDROID_JELLY_BEAN_MR2 18
#define ANDROID_KITKAT 19
#define ANDROID_KITKAT_WATCH 20
#define ANDROID_LOLLIPOP 21
#define ANDROID_LOLLIPOP_MR1 22
#define ANDROID_M 23
#define ANDROID_N 24
#define ANDROID_N_MR1 25
#define ANDROID_O 26
#define ANDROID_O_MR1 27
#define ANDROID_P 28
#define ANDROID_Q 29

static inline int32_t GetAndroidApiLevel() {
char prop_value[PROP_VALUE_MAX];
__system_property_get("ro.build.version.sdk", prop_value);
Expand Down
4 changes: 2 additions & 2 deletions edxp-core/src/main/cpp/main/include/art/runtime/hidden_api.h
Original file line number Diff line number Diff line change
Expand Up @@ -32,10 +32,10 @@ namespace art {

static void DisableHiddenApi(void *handle, HookFunType hook_func) {
const int api_level = GetAndroidApiLevel();
if (api_level < ANDROID_P) {
if (api_level < __ANDROID_API_P__) {
return;
}
if (api_level == ANDROID_P) {
if (api_level == __ANDROID_API_P__) {
HOOK_FUNC(GetMethodActionImpl,
"_ZN3art9hiddenapi6detail19GetMemberActionImplINS_9ArtMethodEEENS0_"
"6ActionEPT_NS_20HiddenApiAccessFlags7ApiListES4_NS0_12AccessMethodE");
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,11 @@ namespace art {
// http://androidxref.com/9.0.0_r3/xref/art/runtime/oat_file_manager.cc#637
static void DisableOnlyUseSystemOatFiles(void *handle, HookFunType hook_func) {
const int api_level = GetAndroidApiLevel();
if (api_level == ANDROID_P) {
if (api_level == __ANDROID_API_P__) {
HOOK_FUNC(SetOnlyUseSystemOatFiles,
"_ZN3art14OatFileManager24SetOnlyUseSystemOatFilesEv");
}
if (api_level == ANDROID_Q) {
if (api_level == __ANDROID_API_Q__) {
HOOK_FUNC(SetOnlyUseSystemOatFiles,
"_ZN3art14OatFileManager24SetOnlyUseSystemOatFilesEbb");
}
Expand Down
2 changes: 1 addition & 1 deletion edxp-core/src/main/cpp/main/include/config.h
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ namespace edxp {
LP_SELECT("/apex/com.android.runtime/lib/", "/apex/com.android.runtime/lib64/"));

static const auto kLibArtPath =
(GetAndroidApiLevel() >= ANDROID_Q ? kLibRuntimeBasePath : kLibBasePath) + kLibArtName;
(GetAndroidApiLevel() >= __ANDROID_API_Q__ ? kLibRuntimeBasePath : kLibBasePath) + kLibArtName;

static const auto kLibWhalePath = kLibBasePath + kLibWhaleName;
static const auto kLibSandHookPath = kLibBasePath + kLibSandHookName;
Expand Down
2 changes: 1 addition & 1 deletion edxp-core/src/main/cpp/main/src/config_manager.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@ namespace edxp {
};

ConfigManager::ConfigManager() {
use_prot_storage_ = GetAndroidApiLevel() >= ANDROID_N;
use_prot_storage_ = GetAndroidApiLevel() >= __ANDROID_API_N__;
last_user_ = 0;
UpdateConfigPath(last_user_);
}
Expand Down
4 changes: 2 additions & 2 deletions edxp-core/src/main/cpp/main/src/native_hook.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ namespace edxp {
}
LOGI("Start to install inline hooks");
int api_level = GetAndroidApiLevel();
if (UNLIKELY(api_level < ANDROID_LOLLIPOP)) {
if (UNLIKELY(api_level < __ANDROID_API_L__)) {
LOGE("API level not supported: %d, skip inline hooks", api_level);
return;
}
Expand All @@ -66,7 +66,7 @@ namespace edxp {
}
hook_func = reinterpret_cast<HookFunType>(hook_func_symbol);

if (api_level > ANDROID_P) {
if (api_level > __ANDROID_API_P__) {
ScopedDlHandle dl_handle(kLibDlPath.c_str());
void *handle = dl_handle.Get();
HOOK_FUNC(mydlopen, "__loader_dlopen");
Expand Down
6 changes: 3 additions & 3 deletions edxp-core/src/main/cpp/main/src/riru_hook.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ namespace edxp {



if (api_level == ANDROID_O_MR1) {
if (api_level == __ANDROID_API_O_MR1__) {
// https://android.googlesource.com/platform/art/+/f5516d38736fb97bfd0435ad03bbab17ddabbe4e
// Android 8.1 add a fatal check for debugging (removed in Android 9.0),
// which will be triggered by EdXposed in cases where target method is hooked
Expand Down Expand Up @@ -106,7 +106,7 @@ namespace edxp {
}


if (api_level == ANDROID_O_MR1) {
if (api_level == __ANDROID_API_O_MR1__) {
// see __system_property_get hook above for explanations
if (strcmp(kPropKeyUseJitProfiles, key.c_str()) == 0) {
res = "false";
Expand All @@ -126,7 +126,7 @@ namespace edxp {

XHOOK_REGISTER(__system_property_get);

if (GetAndroidApiLevel() >= ANDROID_P) {
if (GetAndroidApiLevel() >= __ANDROID_API_P__) {
XHOOK_REGISTER(
_ZN7android4base11GetPropertyERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEES9_);
}
Expand Down

0 comments on commit 8d7a662

Please sign in to comment.