/*
?============================================================================
?Name????????:?libinject.c
?Author??????:??
?Version?????:
?Copyright???:?
?Description?:?Android?shared?library?inject?helper
?============================================================================
?*/

#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?
#include?



#define?ENABLE_DEBUG?1

#define?PTRACE_PEEKTEXT?1
#define?PTRACE_POKETEXT?4
#define?PTRACE_ATTACH	16
#define?PTRACE_CONT?	7
#define?PTRACE_DETACH???17
#define?PTRACE_SYSCALL	24
#define?CPSR_T_MASK		（?1u?<
#define??MAX_PATH?0x100

#define?REMOTE_ADDR（?addr?local_base?remote_base?）?（?（uint32_t）（addr）?+?（uint32_t）（remote_base）?-?（uint32_t）（local_base）?）

const?char?*libc_path?=?“/system/lib/libc.so“;
const?char?*linker_path?=?“/system/bin/linker“;


#if?ENABLE_DEBUG
	#define?DEBUG_PRINT（formatargs...）?\
		LOGD（format?##args）
#else
	#define?DEBUG_PRINT（formatargs...）
#endif


int?ptrace_readdata（?pid_t?pid??uint8_t?*src?uint8_t?*buf?size_t?size?）
{
	uint32_t?i?j?remain;
	uint8_t?*laddr;

	union?u?{
		long?val;
		char?chars[sizeof（long）];
	}?d;

	j?=?size?/?4;
	remain?=?size?%?4;

	laddr?=?buf;

	for?（?i?=?0;?i?	{
		?d.val?=?ptrace（?PTRACE_PEEKTEXT?pid?src?0?）;
		?memcpy（?laddr?d.chars?4?）;
		?src?+=?4;
		?laddr?+=?4;
	}

	if?（?remain?>?0?）
	{
		d.val?=?ptrace（?PTRACE_PEEKTEXT?pid?src?0?）;
		memcpy（?laddr?d.chars?remain?）;
	}

	return?0;

}

int?ptrace_writedata（?pid_t?pid?uint8_t?*dest?uint8_t?*data?size_t?size?）
{
	uint32_t?i?j?remain;
	uint8_t?*laddr;

	union?u?{
		long?val;
		char?chars[sizeof（long）];
	}?d;

	j?=?size?/?4;
	remain?=?size?%?4;
	
	laddr?=?data;
	
	for?（?i?=?0;?i?	{
		memcpy（?d.chars?laddr?4?）;
		ptrace（?PTRACE_POKETEXT?pid?dest?d.val?）;
	
		dest??+=?4;
		laddr?+=?4;
	}

	if?（?remain?>?0?）
	{
		d.val?=?ptrace（?PTRACE_PEEKTEXT?pid?dest?0?）;
		for?（?i?=?0;?i?		{
			d.chars[i]?=?*laddr?++;
		}

		ptrace（?PTRACE_POKETEXT?pid?dest?d.val?）;
		
	}

	return?0;
}


int?ptrace_writestring（?pid_t?pid?uint8_t?*dest?char?*str??）
{
	return?ptrace_writedata（?pid?dest?str?strlen（str）+1?）;
}

int?ptrace_call（?pid_t?pid?uint32_t?addr?long?*params?uint32_t?num_params?struct?pt_regs*?regs?）
{
	uint32_t?i;

	for?（?i?=?0;?i?	{
		regs->uregs[i]?=?params[i];
	}

	//
	//?push?remained?params?onto?stack
	//
	if?（?i?	{
		regs->ARM_sp?-=?（num_params?-?i）?*?sizeof（long）?;
		ptrace_writedata（?pid?（void?*）regs->ARM_sp?（uint8_t?*）¶ms[i]?（num_params?-?i）?*?sizeof（long）?）;
	}

	regs->ARM_pc?=?addr;
	if?（?regs->ARM_pc?&?1?）
	{
		/*?thumb?*/

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????文件???????10736??2011-10-13?10:43??inject.c
?????文件?????????418??2011-09-21?15:26??inject.h
?????文件????????1243??2011-09-08?15:43??shellcode.s