-
-
[原创]Android JNI Inject servicemanager Hook ioctl 成功 分享
-
发表于: 2016-10-13 15:52
-
|
|
|---|---|
|
|
|
|
|
|
|
|
 也不是想保留啥，只是觉得没人关注的话，有点自说自话的样子 核心替换函数贴一下，大家指点
int new_ioctl(int __fd, unsigned long int __request, void* arg) {
if (__request == BINDER_WRITE_READ) {
struct binder_write_read bwr;
__copy_from_user(&bwr, (void __user *) arg, sizeof(bwr));
if(bwr.read_size){
char *file_l = "/data/zh_br.log";
FILE *fp1 = fopen(file_l, "ab+");
if(fp1 == NULL)
return;
fwrite(&bwr,sizeof(bwr),1,fp1);
fwrite(bwr.read_buffer,bwr.read_size,1,fp1);
fclose(fp1);
uint32_t *ptr = bwr.read_buffer;
uint32_t end = ptr + bwr.read_size;
while (ptr < end) {
if(*ptr++ == BR_TRANSACTION) {
catch_btd((const struct binder_transaction_data*) ptr);
}
}
}
if(bwr.write_size){
char *file_l = "/data/zh_bw.log";
FILE *fp1 = fopen(file_l, "ab+");
if(fp1 == NULL)
return;
fwrite(&bwr,sizeof(bwr),1,fp1);
fwrite(bwr.write_buffer,bwr.write_size,1,fp1);
fclose(fp1);
}
}
return ioctl(__fd, __request, arg);
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
刚分析了你那个so文件，，根本不是来自ioctl这个函数的参数数据 |
