#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?


#define?ENABLE_DEBUG?1

#define?PTRACE_PEEKTEXT?1
#define?PTRACE_POKETEXT?4
#define?PTRACE_ATTACH????16
#define?PTRACE_CONT????7
#define?PTRACE_DETACH???17
#define?PTRACE_SYSCALL????24
#define?CPSR_T_MASK????????（?1u?<
#define??MAX_PATH?0x100

#define?REMOTE_ADDR（addr?local_base?remote_base）?（?（uint32_t）（addr）?+?（uint32_t）（remote_base）?-?（uint32_t）（local_base）?）

const?char?*libc_path?=?“/system/lib/libc.so“;
const?char?*linker_path?=?“/system/bin/linker“;


#define??LOG_TAG?“DEBUG“

#define?LOGD（fmt?args...）?__android_log_print（ANDROID_LOG_DEBUG?LOG_TAG?fmt?##args）


#if?ENABLE_DEBUG
#define?DEBUG_PRINT（format?args...）?\
????????printf（format?##args）
#else
#define?DEBUG_PRINT（formatargs...）
#endif


int?ptrace_readdata（pid_t?pid?uint8_t?*src?uint8_t?*buf?size_t?size）?{
????uint32_t?i?j?remain;
????uint8_t?*laddr;

????union?u?{
????????long?val;
????????char?chars[sizeof（long）];
????}?d;

????j?=?size?/?4;
????remain?=?size?%?4;

????laddr?=?buf;

????for?（i?=?0;?i?????????d.val?=?ptrace（PTRACE_PEEKTEXT?pid?src?0）;
????????memcpy（laddr?d.chars?4）;
????????src?+=?4;
????????laddr?+=?4;
????}

????if?（remain?>?0）?{
????????d.val?=?ptrace（PTRACE_PEEKTEXT?pid?src?0）;
????????memcpy（laddr?d.chars?remain）;
????}

????return?0;

}

int?ptrace_writedata（pid_t?pid?uint8_t?*dest?uint8_t?*data?size_t?size）?{
????uint32_t?i?j?remain;
????uint8_t?*laddr;

????union?u?{
????????long?val;
????????char?chars[sizeof（long）];
????}?d;

????j?=?size?/?4;
????remain?=?size?%?4;

????laddr?=?data;

????for?（i?=?0;?i?????????memcpy（d.chars?laddr?4）;
????????ptrace（PTRACE_POKETEXT?pid?dest?d.val）;

????????dest?+=?4;
????????laddr?+=?4;
????}

????if?（remain?>?0）?{
????????d.val?=?ptrace（PTRACE_PEEKTEXT?pid?dest?0）;
????????for?（i?=?0;?i?????????????d.chars[i]?=?*laddr++;
????????}

????????ptrace（PTRACE_POKETEXT?pid?dest?d.val）;

????}

????return?0;
}


int?ptrace_writestring（pid_t?pid?uint8_t?*dest?char?*str）?{
????return?ptrace_writedata（pid?dest?str?strlen（str）?+?1）;
}

int?ptrace_call（pid_t?pid?uint32_t?addr?long?*params?uint32_t?num_params?struct?pt_regs?*regs）?{
????uint32_t?i;

????for?（i?=?0;?i?????????regs->uregs[i]?=?params[i];
????}

????//
????//?push?remained?params?onto?stack
????//
????if?（i?????????regs->ARM_sp?-=?（num_params?-?i）?*?sizeof（long）;
????????ptrace_writedata（pid?（void?*）?regs->ARM_sp?（uint8_t?*）?¶ms[i]
?????????????????????????（num_params?-?i）?*?sizeof（long））;
????}

????regs->ARM_pc?=

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件????????407??2018-09-18?09:27??demo\將so文件注入的代碼\jni\Android.mk

?????文件?????????68??2018-09-17?17:53??demo\將so文件注入的代碼\jni\Application.mk

?????文件??????11937??2018-10-13?09:42??demo\將so文件注入的代碼\jni\inject.c

?????文件????????468??2018-09-19?10:12??demo\將so文件注入的代碼\jni\inject.h

?????文件???????1243??2011-09-08?15:43??demo\將so文件注入的代碼\jni\shellcode.s

?????文件????????399??2018-09-18?10:10??demo\注入的so的代碼\jni\Android.mk

?????文件?????????68??2018-09-17?17:53??demo\注入的so的代碼\jni\Application.mk

?????文件????????451??2018-09-19?16:14??demo\注入的so的代碼\jni\payload.c

?????目錄??????????0??2018-09-19?17:11??demo\將so文件注入的代碼\jni

?????目錄??????????0??2018-09-19?17:12??demo\注入的so的代碼\jni

?????目錄??????????0??2018-09-19?17:11??demo\將so文件注入的代碼

?????目錄??????????0??2018-09-19?17:12??demo\注入的so的代碼

?????目錄??????????0??2018-10-13?09:41??demo

-----------?---------??----------?-----??----

????????????????15041????????????????????13