Add JNI hooks to critical methods

native/jni/inject/hook.cpp

@@ -8,20 +8,61 @@
 
 using namespace std;
 
-// Static vector won't work, use a pointer instead
+static JavaVM *g_jvm;
+
+// For some reason static vector won't work, use a pointer instead
 static vector<tuple<const char *, const char *, void **>> *hook_list;
 
 #define DEF_HOOK_FUNC(ret, func, ...) \
     static ret (*old_##func)(__VA_ARGS__); \
     static ret new_##func(__VA_ARGS__)
 
+#define HOOK_JNI(clazz, method) \
+if (newMethods[i].name == #method##sv) { \
+    JNI::clazz::method##_orig = new JNINativeMethod(); \
+    memcpy(JNI::clazz::method##_orig, &newMethods[i], sizeof(JNINativeMethod)); \
+    for (int j = 0; j < JNI::clazz::method##_methods_num; ++j) { \
+        if (strcmp(newMethods[i].signature, JNI::clazz::method##_methods[j].signature) == 0) { \
+            newMethods[i] = JNI::clazz::method##_methods[j]; \
+            LOGI("hook: replaced " #clazz "#" #method "\n"); \
+            ++hooked; \
+            break; \
+        } \
+    } \
+    continue; \
+}
+
+#define clone_methods() \
+    newMethods = make_unique<JNINativeMethod[]>(numMethods); \
+    memcpy(newMethods.get(), methods, sizeof(JNINativeMethod) * numMethods)
+
 DEF_HOOK_FUNC(int, jniRegisterNativeMethods,
         JNIEnv *env, const char *className, const JNINativeMethod *methods, int numMethods) {
     LOGD("hook: jniRegisterNativeMethods %s", className);
 
-    // TODO: actually do things like replacing JNI native methods
+    unique_ptr<JNINativeMethod[]> newMethods;
+    int hooked = 0;
 
-    return old_jniRegisterNativeMethods(env, className, methods, numMethods);
+    if (g_jvm == nullptr) {
+        // Save for later unhooking
+        env->GetJavaVM(&g_jvm);
+    }
+
+    if (className == "com/android/internal/os/Zygote"sv) {
+        clone_methods();
+        for (int i = 0; i < numMethods && hooked < 3; ++i) {
+            HOOK_JNI(Zygote, nativeForkAndSpecialize);
+            HOOK_JNI(Zygote, nativeSpecializeAppProcess);
+            HOOK_JNI(Zygote, nativeForkSystemServer);
+        }
+    } else if (className == "android/os/SystemProperties"sv) {
+        clone_methods();
+        for (int i = 0; i < numMethods && hooked < 1; ++i) {
+            HOOK_JNI(SystemProperties, native_set);
+        }
+    }
+
+    return old_jniRegisterNativeMethods(env, className, newMethods.get() ?: methods, numMethods);
 }
 
 static bool hook_refresh() {
@@ -58,10 +99,40 @@ void hook_functions() {
     hook_refresh();
 }
 
+#define push_method(clazz, method) \
+if (JNI::clazz::method##_orig) methods.emplace_back(*JNI::clazz::method##_orig)
+
 bool unhook_functions() {
+    JNIEnv* env;
+    if (g_jvm->GetEnv(reinterpret_cast<void**>(&env), JNI_VERSION_1_6) != JNI_OK)
+        return false;
+
+    vector<JNINativeMethod> methods;
+
+    push_method(Zygote, nativeForkAndSpecialize);
+    push_method(Zygote, nativeSpecializeAppProcess);
+    push_method(Zygote, nativeForkSystemServer);
+
+    if (!methods.empty() && old_jniRegisterNativeMethods(env,
+            "com/android/internal/os/Zygote",
+            methods.data(), methods.size()) != 0) {
+        LOGE("hook: Failed to register JNI hook for Zygote\n");
+        return false;
+    }
+
+    methods.clear();
+    push_method(SystemProperties, native_set);
+
+    if (!methods.empty() && old_jniRegisterNativeMethods(env,
+            "android/os/SystemProperties",
+            methods.data(), methods.size()) != 0) {
+        LOGE("hook: Failed to register JNI hook for SystemProperties\n");
+        return false;
+    }
+
     for (auto &[path, sym, old_func] : *hook_list) {
         if (xhook_register(path, sym, *old_func, nullptr) != 0) {
-            LOGE("hook: Failed to register hook \"%s\"\n", sym); \
+            LOGE("hook: Failed to register hook \"%s\"\n", sym);
             return false;
         }
     }