Skip to content

Commit 5d86deb

Browse files
committed
Improvements
Added support for LDPreload Injection and Improved architecture text.
1 parent 14662c0 commit 5d86deb

File tree

7 files changed

+139
-94
lines changed

7 files changed

+139
-94
lines changed

app/src/main/AndroidManifest.xml

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,10 @@
33
xmlns:tools="http://schemas.android.com/tools"
44
package="com.reveny.injector">
55

6-
<uses-permission
7-
android:name="android.permission.QUERY_ALL_PACKAGES"
8-
tools:ignore="QueryAllPackagesPermission" />
6+
<uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" tools:ignore="QueryAllPackagesPermission" />
97
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
108
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
11-
<uses-permission
12-
android:name="android.permission.MANAGE_EXTERNAL_STORAGE"
13-
tools:ignore="ScopedStorage" />
9+
<uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" tools:ignore="ScopedStorage" />
1410

1511
<application
1612
android:allowBackup="true"

app/src/main/cpp/Android.mk

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@ LOCAL_C_INCLUDES += $(MAIN_LOCAL_PATH)
66

77
LOCAL_SRC_FILES := Inject.cpp \
88

9-
LOCAL_LDLIBS := -llog -landroid -lGLESv2
9+
LOCAL_LDLIBS := -llog -landroid
1010

1111
include $(BUILD_SHARED_LIBRARY)

app/src/main/cpp/Inject.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,10 @@ extern "C" {
99
Java_com_reveny_injector_Native_Inject(JNIEnv *env, jclass clazz, jstring package_name, jstring library_path, jstring launcherAct, jboolean auto_launch) {
1010
pkgName = env->GetStringUTFChars(package_name, nullptr);
1111
libraryPath = env->GetStringUTFChars(library_path, nullptr);
12+
appLaunchActivity = env->GetStringUTFChars(launcherAct, nullptr);
1213
shouldAutoLaunch = auto_launch;
13-
appLaunchActivity = env->GetStringUTFChars(launcherAct, nullptr);;
1414

15-
return initInject();
15+
int result = initInject();
16+
return result;
1617
}
1718
}

app/src/main/cpp/Injector/PtraceUtils.h

Lines changed: 46 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -295,52 +295,51 @@ int ptrace_call(pid_t pid, uintptr_t ExecuteAddr, long *parameters, long num_par
295295
if (ptrace_getregs(pid, regs) == -1) {
296296
return -1;
297297
}
298-
299298
#elif defined(__x86_64__)
300-
LOGE("Ptrace call x86_64");
301-
int num_param_registers = 6;
302-
if (num_params > 0)
303-
regs->rdi = parameters[0];
304-
if (num_params > 1)
305-
regs->rsi = parameters[1];
306-
if (num_params > 2)
307-
regs->rdx = parameters[2];
308-
if (num_params > 3)
309-
regs->rcx = parameters[3];
310-
if (num_params > 4)
311-
regs->r8 = parameters[4];
312-
if (num_params > 5)
313-
regs->r9 = parameters[5];
314-
315-
if (num_param_registers < num_params){
316-
regs->esp -= (num_params - num_param_registers) * sizeof(long); //Allocate stack space, the direction of the stack is from high address to low address
317-
if (0 != ptrace_writedata(pid, (uint8_t *)regs->esp, (uint8_t *)&parameters[num_param_registers], (num_params - num_param_registers) * sizeof(long))){
318-
return -1;
319-
}
320-
}
321-
322-
long tmp_addr = 0x0;
323-
regs->esp -= sizeof(long);
324-
if (0 != ptrace_writedata(pid, (uint8_t *)regs->esp, (uint8_t *)&tmp_addr, sizeof(tmp_addr))) {
325-
return -1;
326-
}
327-
328-
regs->eip = ExecuteAddr;
329-
330-
if (ptrace_setregs(pid, regs) == -1 || ptrace_continue(pid) == -1) {
331-
return -1;
332-
}
333-
334-
int stat = 0;
335-
waitpid(pid, &stat, WUNTRACED);
336-
337-
while (stat != 0xb7f){
338-
if (ptrace_continue(pid) == -1){
339-
//printf("[-] ptrace call error");
340-
return -1;
341-
}
342-
waitpid(pid, &stat, WUNTRACED);
343-
}
299+
LOGE("Ptrace call x86_64");
300+
int num_param_registers = 6;
301+
if (num_params > 0)
302+
regs->rdi = parameters[0];
303+
if (num_params > 1)
304+
regs->rsi = parameters[1];
305+
if (num_params > 2)
306+
regs->rdx = parameters[2];
307+
if (num_params > 3)
308+
regs->rcx = parameters[3];
309+
if (num_params > 4)
310+
regs->r8 = parameters[4];
311+
if (num_params > 5)
312+
regs->r9 = parameters[5];
313+
314+
if (num_param_registers < num_params){
315+
regs->esp -= (num_params - num_param_registers) * sizeof(long); //Allocate stack space, the direction of the stack is from high address to low address
316+
if (0 != ptrace_writedata(pid, (uint8_t *)regs->esp, (uint8_t *)&parameters[num_param_registers], (num_params - num_param_registers) * sizeof(long))){
317+
return -1;
318+
}
319+
}
320+
321+
long tmp_addr = 0x0;
322+
regs->esp -= sizeof(long);
323+
if (0 != ptrace_writedata(pid, (uint8_t *)regs->esp, (uint8_t *)&tmp_addr, sizeof(tmp_addr))) {
324+
return -1;
325+
}
326+
327+
regs->eip = ExecuteAddr;
328+
329+
if (ptrace_setregs(pid, regs) == -1 || ptrace_continue(pid) == -1) {
330+
return -1;
331+
}
332+
333+
int stat = 0;
334+
waitpid(pid, &stat, WUNTRACED);
335+
336+
while (stat != 0xb7f){
337+
if (ptrace_continue(pid) == -1){
338+
//printf("[-] ptrace call error");
339+
return -1;
340+
}
341+
waitpid(pid, &stat, WUNTRACED);
342+
}
344343

345344
#elif defined(__arm__) || defined(__aarch64__)
346345
#if defined(__arm__)
@@ -382,6 +381,7 @@ int ptrace_call(pid_t pid, uintptr_t ExecuteAddr, long *parameters, long num_par
382381
}
383382
lr_val = start_ptr;
384383
}
384+
LOGE("lr_val: %ld", lr_val);
385385
regs->ARM_lr = lr_val;
386386

387387
if (ptrace_setregs(pid, regs) == -1 || ptraceContinue(pid) == -1){
@@ -401,9 +401,8 @@ int ptrace_call(pid_t pid, uintptr_t ExecuteAddr, long *parameters, long num_par
401401
if (ptrace_getregs(pid, regs) == -1){
402402
return -1;
403403
}
404-
405404
#else
406-
LOGE("Unsupported device")
405+
LOGE("Unsupported device");
407406
#endif
408407
return 0;
409408
}

app/src/main/java/com/reveny/injector/MainActivity.java

Lines changed: 62 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -45,16 +45,18 @@ public class MainActivity extends AppCompatActivity implements Handler.Callback
4545
AutoCompleteTextView autoCompleteTextView;
4646
EditText libPath;
4747
CheckBox autoLaunchBox;
48+
CheckBox ptraceBox;
49+
CheckBox ldpreloadBox;
50+
TextView archText;
4851
TextView console;
4952
Button githubButton;
50-
Button tutorialButton;
53+
Button uninjectButton;
5154
Button injectButton;
52-
TextView archText;
5355

5456
ArrayAdapter<String> adapterItems;
5557

56-
public String packageName;
57-
public String finalLibPath;
58+
public String packageName = "";
59+
public String finalLibPath = "";
5860
public String launchActivity;
5961
public boolean shouldAutoLaunch = true;
6062

@@ -84,11 +86,13 @@ protected void onCreate(Bundle savedInstanceState) {
8486
autoCompleteTextView = findViewById(R.id.auto_complete_txt);
8587
libPath = findViewById(R.id.path_to_lib);
8688
githubButton = findViewById(R.id.github_button);
87-
tutorialButton = findViewById(R.id.tutorial_button);
89+
uninjectButton = findViewById(R.id.tutorial_button);
8890
injectButton = findViewById(R.id.inject_button);
8991
autoLaunchBox = findViewById(R.id.auto_launch_toggle);
92+
ptraceBox = findViewById(R.id.mode_ptrace);
93+
ldpreloadBox = findViewById(R.id.mode_ldpreload);
94+
archText = findViewById(R.id.architecture);
9095
console = findViewById(R.id.console);
91-
archText = findViewById(R.id.arch);
9296

9397
//Set installed packages
9498
adapterItems = new ArrayAdapter<String>(this, R.layout.list_item, getInstalledApps());
@@ -99,47 +103,77 @@ public void onItemClick(AdapterView<?> parent, View view, int position, long id)
99103
String item = parent.getItemAtPosition(position).toString();
100104
packageName = item;
101105
console.append("Package Name: " + item + "\n");
106+
String arch = "Unknown";
107+
108+
try {
109+
String libraryDir = getPackageManager().getApplicationInfo(packageName, 0).nativeLibraryDir;
110+
arch = libraryDir.substring(libraryDir.lastIndexOf("/") + 1);
111+
} catch (PackageManager.NameNotFoundException exception) {
112+
exception.printStackTrace();
113+
}
114+
115+
archText.setText("Architecture: " + arch);
102116
}
103117
});
104118

105119
libPath.setText("/data/local/tmp/libnative.so"); //Set default path
106-
archText.setText(Build.CPU_ABI.toString());
120+
console.append("Device Architecture: " + Build.CPU_ABI.toString() + " \n");
107121

108122
injectButton.setOnClickListener(new View.OnClickListener() {
109123
@Override
110124
public void onClick(View v) {
125+
checkLibPath();
111126
if (hasRootAccess) {
112-
MSGConnection mSGConnection = messageConnection;
113-
if (mSGConnection == null) {
114-
console.append("Binding root services\n");
115-
116-
shouldAutoLaunch = autoLaunchBox.isChecked();
117-
launchActivity = getLaunchActivity(packageName);
118-
checkLibPath();
119-
120-
console.append("---------------------------------------\n");
121-
console.append("Trying to Inject with following settings: \n");
122-
console.append("shouldAutoLaunch: " + shouldAutoLaunch + "\n");
123-
console.append("packageName: " + packageName + "\n");
124-
console.append("launchActivity: " + launchActivity + "\n");
125-
console.append("finalLibPath: " + finalLibPath + "\n");
126-
console.append("---------------------------------------\n");
127-
RootService.bind(new Intent(thisInstance, RootService.class), new MSGConnection());
127+
if (packageName.equals("") || finalLibPath.equals("")) {
128+
console.append("Please fill out all the fields\n");
128129
} else {
129-
RootService.unbind(mSGConnection);
130+
if (ptraceBox.isChecked()) {
131+
MSGConnection mSGConnection = messageConnection;
132+
if (mSGConnection == null) {
133+
console.append("Binding root services\n");
134+
135+
shouldAutoLaunch = autoLaunchBox.isChecked();
136+
launchActivity = getLaunchActivity(packageName);
137+
138+
console.append("---------------------------------------\n");
139+
console.append("Trying to Inject with following settings: \n");
140+
console.append("shouldAutoLaunch: " + shouldAutoLaunch + "\n");
141+
console.append("packageName: " + packageName + "\n");
142+
console.append("launchActivity: " + launchActivity + "\n");
143+
console.append("finalLibPath: " + finalLibPath + "\n");
144+
console.append("---------------------------------------\n");
145+
RootService.bind(new Intent(thisInstance, RootService.class), new MSGConnection());
146+
} else {
147+
RootService.unbind(mSGConnection);
148+
}
149+
} else if (ldpreloadBox.isChecked()) {
150+
if (packageName.equals("") || finalLibPath.equals("")) {
151+
console.append("Please fill out all the fields\n");
152+
} else {
153+
String command = "setprop wrap." + packageName + " LD_PRELOAD=" + finalLibPath;
154+
Shell.cmd(command).exec();
155+
Toast.makeText(thisInstance, "Injected! The game might take longer to load", Toast.LENGTH_LONG).show();
156+
}
157+
} else {
158+
console.append("You need to select an Injection mode \n");
159+
}
130160
}
131161
} else {
132162
console.append("Bind root service failed: root access not granted\n");
133163
}
134164
}
135165
});
136166

137-
tutorialButton.setOnClickListener(new View.OnClickListener() {
167+
uninjectButton.setOnClickListener(new View.OnClickListener() {
138168
@Override
139169
public void onClick(View v) {
140-
Toast.makeText(thisInstance, "No tutorial yet :(", Toast.LENGTH_LONG).show();
141-
//Intent browserIntent = new Intent(Intent.ACTION_VIEW, Uri.parse("http://github.com/reveny"));
142-
//startActivity(browserIntent);
170+
if (packageName.isEmpty()) {
171+
console.append("Cannot uninject without a package name\n");
172+
} else {
173+
String command = "resetprop --delete wrap." + packageName;
174+
Shell.cmd(command).exec();
175+
Toast.makeText(thisInstance, "Uninjected!", Toast.LENGTH_LONG).show();
176+
}
143177
}
144178
});
145179

app/src/main/res/layout/activity_main.xml

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,12 @@
2424
android:inputType="none"
2525
tools:ignore="LabelFor" />
2626

27+
<TextView
28+
android:layout_width="wrap_content"
29+
android:layout_height="wrap_content"
30+
android:id="@+id/architecture"
31+
android:text="Architecture: " />
32+
2733
<CheckBox
2834
android:id="@+id/auto_launch_toggle"
2935
android:layout_width="wrap_content"
@@ -36,17 +42,23 @@
3642
<TextView
3743
android:layout_width="wrap_content"
3844
android:layout_height="wrap_content"
39-
android:id="@+id/arch_txt"
40-
android:text="@string/architecture" >
45+
android:id="@+id/mode_text"
46+
android:text="Mode:" >
4147
</TextView>
4248

43-
<TextView
44-
android:id="@+id/arch"
49+
<CheckBox
50+
android:id="@+id/mode_ptrace"
51+
android:layout_width="96dp"
52+
android:layout_height="27dp"
53+
android:text="@string/ptrace"
54+
tools:ignore="MissingConstraints" />
55+
56+
<CheckBox
57+
android:id="@+id/mode_ldpreload"
4558
android:layout_width="wrap_content"
46-
android:layout_height="wrap_content"
47-
android:layout_weight="1"
48-
android:text=""
49-
/>
59+
android:layout_height="30dp"
60+
android:text="@string/ldpreload"
61+
tools:ignore="MissingConstraints" />
5062
</com.google.android.material.textfield.TextInputLayout>
5163

5264
<TextView
@@ -94,7 +106,7 @@
94106
<ScrollView
95107
android:id="@+id/consoleLog"
96108
android:layout_width="match_parent"
97-
android:layout_height="298dp"
109+
android:layout_height="241dp"
98110
android:layout_marginBottom="180dp"
99111
android:layout_weight="1"
100112
android:background="@color/grey"
@@ -135,7 +147,7 @@
135147
android:id="@+id/tutorial_button"
136148
android:layout_width="match_parent"
137149
android:layout_height="52dp"
138-
android:text="@string/tutorial"
150+
android:text="@string/uninject_only_for_ldpreload"
139151
android:backgroundTint="@color/blue"
140152
app:layout_constraintBottom_toTopOf="@+id/github_button"
141153
app:layout_constraintEnd_toEndOf="parent"

app/src/main/res/values/strings.xml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,7 @@
1010
<string name="github">Github</string>
1111
<string name="tutorial">Tutorial</string>
1212
<string name="architecture">Architecture:</string>
13+
<string name="ldpreload">LDPreload</string>
14+
<string name="ptrace">PTrace</string>
15+
<string name="uninject_only_for_ldpreload">Uninject (only for LDPreload)</string>
1316
</resources>

0 commit comments

Comments
 (0)