python scripts/mk_make.py -x

/**
 * lookup the start address of a specific module
 * return 0 if FAILED
 */
 
//函数功能：在指定pid的内存文件中查找包含module_path字符串的so，并返回其在内存中的起始地址
//成功返回so起始地址，失败返回0
uint32_t get_module_base(pid_t pid, const char *module_path)
{
    FILE *fp = NULL;
    char *pch = NULL;
    char filename[32];
    char line[512];
    uint32_t addr = 0;

	//若pid为负值，proc/self/maps是查找本进程的内存映射信息
	//snprintf()对filename字串赋值
    if ( pid < 0 )
        snprintf(filename, sizeof(filename), "/proc/self/maps");
	//若pid为非负值，proc/pid/maps查找指定pid进程的内存映射信息
    else
        snprintf(filename, sizeof(filename), "/proc/%d/maps", pid);
    
	//处理打开内存文件失败
    if ( (fp = fopen(filename, "r")) == NULL )
    {
        LOGE("open %s failed!", filename);
        return 0;
    }
    
	//逐行读取内存文件maps
    while ( fgets(line, sizeof(line), fp) )
    {
        //如果在maps文件中搜索在module_path字符串（模块名称？）
        if ( strstr(line, module_path) )
        {
            LOGE("[+]:2");
			//strtok()把字串line按"-"分割，返回被分割出字符串的指针
            pch = strtok(line, "-");
			//strtoul()把字串pch转换成16进制
			//此处addr为模块所处内存空间的起始地址（XXX-YYY中的XXX）
            addr = strtoul(pch, NULL, 16);
            break;
        }
    }

    fclose(fp);

    return addr;
}

 typedef struct link_map_t {
  uintptr_t l_addr;
  char*  l_name;
  uintptr_t l_ld;
  struct link_map_t* l_next;
  struct link_map_t* l_prev;
} link_map_t;

typedef void (*linker_function_t)();

#define SOINFO_NAME_LEN 128
typedef struct soinfo {
    char name[SOINFO_NAME_LEN];
    const Elf32_Phdr* phdr;
    size_t phnum;
    Elf32_Addr entry;
    Elf32_Addr base;
    unsigned size;

    uint32_t unused1;  // DO NOT USE, maintained for compatibility.

    Elf32_Dyn* dynamic;

    uint32_t unused2; // DO NOT USE, maintained for compatibility
    uint32_t unused3; // DO NOT USE, maintained for compatibility

    struct soinfo* next;

    unsigned flags;

    const char* strtab;
    Elf32_Sym* symtab;
    size_t nbucket;
    size_t nchain;
    unsigned* bucket;
    unsigned* chain;

    //------------------

  // This is only used by 32-bit MIPS, but needs to be here for
  // all 32-bit architectures to preserve binary compatibility.
  unsigned* plt_got;

  Elf32_Rel* plt_rel;
  size_t plt_rel_count;

  Elf32_Rel* rel;
  size_t rel_count;

  linker_function_t* preinit_array;
  size_t preinit_array_count;

  linker_function_t* init_array;
  size_t init_array_count;
  linker_function_t* fini_array;
  size_t fini_array_count;

  linker_function_t init_func;
  linker_function_t fini_func;

  // ARM EABI section used for stack unwinding.
  unsigned* ARM_exidx;
  size_t ARM_exidx_count;

  size_t ref_count;
  link_map_t link_map;

  int constructors_called;

  // When you read a virtual address from the ELF file, add this
  // value to get the corresponding address in the process' address space.
  Elf32_Addr load_bias;

} soinfo;

uint32_t load_bias_addr;

uint32_t get_module_base(pid_t pid, const char *module_path)
{
    FILE *fp = NULL;
    char *pch = NULL;
    char filename[32];
    char line[512];
    uint32_t addr = 0;

    void *handle =  dlopen( LIBSF_PATH, RTLD_GLOBAL);
    soinfo *si = (soinfo*)handle; 
    addr = si->base;
    load_bias_addr = si->load_bias;

	//若pid为负值，proc/self/maps是查找本进程的内存映射信息
	//snprintf()对filename字串赋值
    if ( pid < 0 )
        snprintf(filename, sizeof(filename), "/proc/self/maps");
	//若pid为非负值，proc/pid/maps查找指定pid进程的内存映射信息
    else
        snprintf(filename, sizeof(filename), "/proc/%d/maps", pid);
    
	//处理打开内存文件失败
    if ( (fp = fopen(filename, "r")) == NULL )
    {
        LOGE("open %s failed!", filename);
        return 0;
    }
    
	//逐行读取内存文件maps
    while ( fgets(line, sizeof(line), fp) )
    {
        //如果在maps文件中搜索在module_path字符串（模块名称？）
        if ( strstr(line, module_path) )
        {
            LOGE("[+]:2");
			//strtok()把字串line按"-"分割，返回被分割出字符串的指针
            pch = strtok(line, "-");
			//strtoul()把字串pch转换成16进制
			//此处addr为模块所处内存空间的起始地址（XXX-YYY中的XXX）
            addr = strtoul(pch, NULL, 16);
            break;
        }
    }

    fclose(fp);

    return addr;
}

int find_name(pid_t pid, char *name, char *libn, unsigned long *addr)

{
	struct mm mm[1000];
	unsigned long libcaddr;
	int nmm;
	char libc[1024];
	symtab_t s;

	if (0 > load_memmap(pid, mm, &nmm)) {
		log("[-] cannot read memory map\n")
		return -1;
	} else 
		log("[+] success load memory map")

	if (0 > find_libname(libn, libc, sizeof(libc), &libcaddr, mm, nmm)) {
		log("[-] cannot find lib: %s\n", libn)
		return -1;
	} else 
		log("[+] success find lib name: 0x%X", libcaddr)

	log("[+] lib: >%s<\n", libc)
	s = load_symtab(libc);
	if (!s) {
	 	log("[-] cannot read symbol table\n")
		return -1;
	}else log("[+] success read symbol table")

	if (0 > lookup_func_sym(s, name, addr)) {
		log("[-] cannot find function: %s\n", name)
		return -1;
	}else log("[+] success find function: %s: addr - 0x%X, *addr - 0x%X", name, addr, *addr)

	 *addr += libcaddr;

	return 0;
}

int find_name(pid_t pid, char *name, char *libn, unsigned long *addr, int syslib)
{
	struct mm mm[1000];
	unsigned long libcaddr;
	int nmm;
	char libc[1024];
	symtab_t s;

	if (0 > load_memmap(pid, mm, &nmm)) {
		log("[-] cannot read memory map\n")
		return -1;
	} else 
		log("[+] success load memory map")

	if (0 > find_libname(libn, libc, sizeof(libc), &libcaddr, mm, nmm)) {
		log("[-] cannot find lib: %s\n", libn)
		return -1;
	} else 
		log("[+] success find lib name: 0x%X", libcaddr)

	log("[+] lib: >%s<\n", libc)
	s = load_symtab(libc);
	if (!s) {
	 	log("[-] cannot read symbol table\n")
		return -1;
	 }else log("[+] success read symbol table")

	if (0 > lookup_func_sym(s, name, addr)) {
		log("[-] cannot find function: %s\n", name)
		return -1;
	}else log("[+] success find function: %s: addr - 0x%X, *addr - 0x%X", name, addr, *addr)

	log("[+] libcaddr is 0x%X\n", libcaddr)

	void *handle =  dlopen( LIBSF_PATH, RTLD_GLOBAL);
    soinfo *si = (soinfo*)handle; 
    load_bias_addr = si->load_bias;
	log("[+] load_bias_addr is 0x%X\n", load_bias_addr)

	if(syslib == 0){
		*addr += libcaddr;
	}else if(syslib == 1){
		*addr += load_bias_addr;
	}else{
		log("[-] parameter syslib is wrong !\n")
	}

	return 0;
}

void new_hookData(JNIEnv* env, jobject thiz, jbyte *a) {

        jbyte *arrayBody = (*env)->GetByteArrayElements(env,a,NULL); 
        jsize len = (*env)->GetArrayLength(env,a); 
        byte *dDate = (byte *)arrayBody;
        int fd = open("/sdcard/data.txt", O_APPEND|O_RDWR|O_CREAT,S_IRWXU);

        if(fd < 0)
        {
            LOGI("[+] open failed");
            LOGW("[+] error (errno=%d)", errno);
        }
        else
        {
            LOGI("[+] success open");
        }
            
        int write_len = write(fd, dDate, len);

        (*env)->ReleaseByteArrayElements(env,a,arrayBody,NULL);
        close(fd);

    old_hookData(env, thiz, a);
}

findAndHookMethod("className",lp.classLoader,"methodName",byte[].class, new hookData());

class  hookData extends XC_MethodHook{
    protected void beforeHookedMethod(MethodHookParam param) throws Throwable {

        byte[] buf = (byte[])param.args[0];
        FileHelper filehelper = new FileHelper();
        try {
            //将byte数组写入文件
            createFile("/sdcard/data.txt", buf);
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }

    //将byte数组写入文件
    public void createFile(String path, byte[] content) throws IOException {
        FileOutputStream fos = new FileOutputStream(path);
        fos.write(content);
        fos.close();
    }
}

$ hexo new "My New Post"

$ hexo server

$ hexo generate

$ hexo deploy