From e050f771982d6f28c5913b8f717790950dd9c009 Mon Sep 17 00:00:00 2001 From: topjohnwu Date: Sat, 9 Jan 2021 20:39:59 -0800 Subject: [PATCH] Don't hook SystemProperties#set Doesn't seem necessary --- native/jni/inject/hook.cpp | 115 ++++++++++++-------------------- native/jni/inject/jni_hooks.hpp | 87 ++++++++---------------- 2 files changed, 70 insertions(+), 132 deletions(-) diff --git a/native/jni/inject/hook.cpp b/native/jni/inject/hook.cpp index dccdf7161..93272565b 100644 --- a/native/jni/inject/hook.cpp +++ b/native/jni/inject/hook.cpp @@ -8,57 +8,42 @@ using namespace std; -static JavaVM *g_jvm; +#define DCL_HOOK_FUNC(ret, func, ...) \ + static ret (*old_##func)(__VA_ARGS__); \ + static ret new_##func(__VA_ARGS__) + +#define DCL_JNI_FUNC(name) \ + static const JNINativeMethod *name##_orig = nullptr; \ + extern const JNINativeMethod name##_methods[]; \ + extern const int name##_methods_num; // For some reason static vector won't work, use a pointer instead static vector> *hook_list; +static JavaVM *g_jvm; + namespace { struct HookContext { int pid; }; -} - // JNI method declarations +DCL_JNI_FUNC(nativeForkAndSpecialize) +DCL_JNI_FUNC(nativeSpecializeAppProcess) +DCL_JNI_FUNC(nativeForkSystemServer) -namespace JNI { - namespace Zygote { - const JNINativeMethod *nativeForkAndSpecialize_orig = nullptr; - const JNINativeMethod *nativeSpecializeAppProcess_orig = nullptr; - const JNINativeMethod *nativeForkSystemServer_orig = nullptr; - - extern const JNINativeMethod nativeForkAndSpecialize_methods[]; - extern const int nativeForkAndSpecialize_methods_num; - - extern const JNINativeMethod nativeSpecializeAppProcess_methods[]; - extern const int nativeSpecializeAppProcess_methods_num; - - extern const JNINativeMethod nativeForkSystemServer_methods[]; - extern const int nativeForkSystemServer_methods_num; - } - namespace SystemProperties { - const JNINativeMethod *native_set_orig = nullptr; - - extern const JNINativeMethod native_set_methods[]; - constexpr int native_set_methods_num = 1; - } } -#define DEF_HOOK_FUNC(ret, func, ...) \ - static ret (*old_##func)(__VA_ARGS__); \ - static ret new_##func(__VA_ARGS__) - -#define HOOK_JNI(clazz, method) \ +#define HOOK_JNI(method) \ if (newMethods[i].name == #method##sv) { \ auto orig = new JNINativeMethod(); \ memcpy(orig, &newMethods[i], sizeof(JNINativeMethod)); \ - JNI::clazz::method##_orig = orig; \ - for (int j = 0; j < JNI::clazz::method##_methods_num; ++j) { \ - if (strcmp(newMethods[i].signature, JNI::clazz::method##_methods[j].signature) == 0) { \ - newMethods[i] = JNI::clazz::method##_methods[j]; \ - LOGI("hook: replaced " #clazz "#" #method "\n"); \ + method##_orig = orig; \ + for (int j = 0; j < method##_methods_num; ++j) { \ + if (strcmp(newMethods[i].signature, method##_methods[j].signature) == 0) { \ + newMethods[i] = method##_methods[j]; \ + LOGI("hook: replaced #" #method "\n"); \ ++hooked; \ break; \ } \ @@ -66,11 +51,7 @@ if (newMethods[i].name == #method##sv) { \ continue; \ } -#define clone_methods() \ - newMethods = make_unique(numMethods); \ - memcpy(newMethods.get(), methods, sizeof(JNINativeMethod) * numMethods) - -DEF_HOOK_FUNC(int, jniRegisterNativeMethods, +DCL_HOOK_FUNC(int, jniRegisterNativeMethods, JNIEnv *env, const char *className, const JNINativeMethod *methods, int numMethods) { LOGD("hook: jniRegisterNativeMethods %s", className); @@ -83,16 +64,12 @@ DEF_HOOK_FUNC(int, jniRegisterNativeMethods, } if (className == "com/android/internal/os/Zygote"sv) { - clone_methods(); + newMethods = make_unique(numMethods); + memcpy(newMethods.get(), methods, sizeof(JNINativeMethod) * numMethods); for (int i = 0; i < numMethods && hooked < 3; ++i) { - HOOK_JNI(Zygote, nativeForkAndSpecialize); - HOOK_JNI(Zygote, nativeSpecializeAppProcess); - HOOK_JNI(Zygote, nativeForkSystemServer); - } - } else if (className == "android/os/SystemProperties"sv) { - clone_methods(); - for (int i = 0; i < numMethods && hooked < 1; ++i) { - HOOK_JNI(SystemProperties, native_set); + HOOK_JNI(nativeForkAndSpecialize); + HOOK_JNI(nativeSpecializeAppProcess); + HOOK_JNI(nativeForkSystemServer); } } @@ -102,9 +79,11 @@ DEF_HOOK_FUNC(int, jniRegisterNativeMethods, static void nativeForkAndSpecialize_pre(HookContext *ctx, JNIEnv *env, jclass clazz, jint &uid, jint &gid, jintArray &gids, jint &runtime_flags, jobjectArray &rlimits, jint &mount_external, jstring &se_info, jstring &nice_name, - jintArray &fds_to_close, jintArray &fds_to_ignore, jboolean &is_child_zygote, - jstring &instruction_set, jstring &app_data_dir, jboolean &is_top_app, jobjectArray &pkg_data_info_list, - jobjectArray &whitelisted_data_info_list, jboolean &mount_data_dirs, jboolean &mount_storage_dirs) { + jintArray &fds_to_close, jintArray &fds_to_ignore, /* These 2 arguments are unique to fork */ + jboolean &is_child_zygote, jstring &instruction_set, jstring &app_data_dir, + jboolean &is_top_app, jobjectArray &pkg_data_info_list, + jobjectArray &whitelisted_data_info_list, jboolean &mount_data_dirs, + jboolean &mount_storage_dirs) { LOGD("hook: %s\n", __FUNCTION__); } @@ -118,11 +97,12 @@ static void nativeForkAndSpecialize_post(HookContext *ctx, JNIEnv *env, jclass c // ----------------------------------------------------------------- static void nativeSpecializeAppProcess_pre(HookContext *ctx, - JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, - jobjectArray rlimits, jint mount_external, jstring se_info, jstring nice_name, - jboolean is_child_zygote, jstring instruction_set, jstring app_data_dir, - jboolean &is_top_app, jobjectArray &pkg_data_info_list, jobjectArray &whitelisted_data_info_list, - jboolean &mount_data_dirs, jboolean &mount_storage_dirs) { + JNIEnv *env, jclass clazz, jint &uid, jint &gid, jintArray &gids, jint &runtime_flags, + jobjectArray &rlimits, jint &mount_external, jstring &se_info, jstring &nice_name, + jboolean &is_child_zygote, jstring &instruction_set, jstring &app_data_dir, + jboolean &is_top_app, jobjectArray &pkg_data_info_list, + jobjectArray &whitelisted_data_info_list, jboolean &mount_data_dirs, + jboolean &mount_storage_dirs) { LOGD("hook: %s\n", __FUNCTION__); } @@ -142,6 +122,8 @@ static void nativeForkSystemServer_post(HookContext *ctx, JNIEnv *env, jclass cl LOGD("hook: %s\n", __FUNCTION__); } +// ----------------------------------------------------------------- + static bool hook_refresh() { if (xhook_refresh(0) == 0) { xhook_clear(); @@ -176,8 +158,8 @@ void hook_functions() { hook_refresh(); } -#define push_method(clazz, method) \ -if (JNI::clazz::method##_orig) methods.emplace_back(*JNI::clazz::method##_orig) +#define push_method(method) \ +if (method##_orig) methods.emplace_back(*method##_orig) bool unhook_functions() { JNIEnv* env; @@ -186,10 +168,9 @@ bool unhook_functions() { // Unhook JNI methods vector methods; - - push_method(Zygote, nativeForkAndSpecialize); - push_method(Zygote, nativeSpecializeAppProcess); - push_method(Zygote, nativeForkSystemServer); + push_method(nativeForkAndSpecialize); + push_method(nativeSpecializeAppProcess); + push_method(nativeForkSystemServer); if (!methods.empty() && old_jniRegisterNativeMethods(env, "com/android/internal/os/Zygote", @@ -198,16 +179,6 @@ bool unhook_functions() { return false; } - methods.clear(); - push_method(SystemProperties, native_set); - - if (!methods.empty() && old_jniRegisterNativeMethods(env, - "android/os/SystemProperties", - methods.data(), methods.size()) != 0) { - LOGE("hook: Failed to register JNI hook for SystemProperties\n"); - return false; - } - // Unhook xhook for (auto &[path, sym, old_func] : *hook_list) { if (xhook_register(path, sym, *old_func, nullptr) != 0) { diff --git a/native/jni/inject/jni_hooks.hpp b/native/jni/inject/jni_hooks.hpp index ae6cada6e..4019230cd 100644 --- a/native/jni/inject/jni_hooks.hpp +++ b/native/jni/inject/jni_hooks.hpp @@ -6,7 +6,7 @@ * Copyright (c) 2021, John 'topjohnwu' Wu */ -#define ENABLE_LEGACY_DP 1 // Nobody should use outdated developer preview... +#define ENABLE_LEGACY_DP 0 // Nobody should use outdated developer preview... // All possible missing arguments static union { @@ -38,7 +38,7 @@ static ret name(__VA_ARGS__) #define orig_fork(ver, ...) \ ctx.pid = reinterpret_cast \ - (JNI::Zygote::nativeForkAndSpecialize_orig->fnPtr)(__VA_ARGS__) + (nativeForkAndSpecialize_orig->fnPtr)(__VA_ARGS__) #define post_fork() \ nativeForkAndSpecialize_post(&ctx, env, clazz); \ @@ -184,7 +184,7 @@ DCL_FORK_AND_SPECIALIZE(samsung_p, post_fork(); } -#define DCL_FORK(ver) { \ +#define DEF_FORK(ver) { \ "nativeForkAndSpecialize", \ nativeForkAndSpecialize_##ver##_sig, \ (void *) &nativeForkAndSpecialize_##ver \ @@ -202,7 +202,7 @@ DCL_FORK_AND_SPECIALIZE(samsung_p, #define orig_spec(ver, ...) \ reinterpret_cast \ - (JNI::Zygote::nativeSpecializeAppProcess_orig->fnPtr)(__VA_ARGS__) + (nativeSpecializeAppProcess_orig->fnPtr)(__VA_ARGS__) #define post_spec() \ nativeSpecializeAppProcess_post(&ctx, env, clazz) @@ -285,7 +285,7 @@ DCL_SPECIALIZE_APP(samsung_q, post_spec(); } -#define DCL_SPEC(ver) { \ +#define DEF_SPEC(ver) { \ "nativeSpecializeAppProcess", \ nativeSpecializeAppProcess_##ver##_sig, \ (void *) &nativeSpecializeAppProcess_##ver \ @@ -301,7 +301,7 @@ DCL_SPECIALIZE_APP(samsung_q, #define orig_server(ver, ...) \ ctx.pid = reinterpret_cast \ - (JNI::Zygote::nativeForkSystemServer_orig->fnPtr)(__VA_ARGS__) + (nativeForkSystemServer_orig->fnPtr)(__VA_ARGS__) #define post_server() \ nativeForkSystemServer_post(&ctx, env, clazz); \ @@ -329,71 +329,38 @@ DCL_FORK_SERVER(samsung_q, "(II[IIII[[IJJ)I", post_server(); } -#define DCL_SERVER(ver) { \ +#define DEF_SERVER(ver) { \ "nativeForkSystemServer", \ nativeForkSystemServer_##ver##_sig, \ (void *) &nativeForkSystemServer_##ver \ } -/* - * On Android 9+, in very rare cases, SystemProperties.set("sys.user." + userId + ".ce_available", "true") - * will throw an exception (no idea if this is caused by hooking) and user data will be wiped. - * Hook it and clear the exception to prevent this problem from happening. - * - * https://cs.android.com/android/platform/superproject/+/android-9.0.0_r34:frameworks/base/services/core/java/com/android/server/pm/UserDataPreparer.java;l=107;bpv=0;bpt=0 - */ -static void SystemProperties_set(JNIEnv *env, jobject clazz, jstring keyJ, jstring valJ) { - const char *key = env->GetStringUTFChars(keyJ, JNI_FALSE); - char user[16]; - bool no_throw = sscanf(key, "sys.user.%[^.].ce_available", user) == 1; - env->ReleaseStringUTFChars(keyJ, key); +namespace { - reinterpret_cast - (JNI::SystemProperties::native_set_orig->fnPtr)(env, clazz, keyJ, valJ); - - jthrowable exception = env->ExceptionOccurred(); - if (exception && no_throw) { - LOGW("prevented data destroy"); - - env->ExceptionDescribe(); - env->ExceptionClear(); - } -} - -namespace JNI { - - namespace Zygote { - const JNINativeMethod nativeForkAndSpecialize_methods[] = { - DCL_FORK(m), DCL_FORK(o), DCL_FORK(p), - DCL_FORK(q_alt), DCL_FORK(r), - DCL_FORK(samsung_m), DCL_FORK(samsung_n), - DCL_FORK(samsung_o), DCL_FORK(samsung_p), +const JNINativeMethod nativeForkAndSpecialize_methods[] = { + DEF_FORK(m), DEF_FORK(o), DEF_FORK(p), + DEF_FORK(q_alt), DEF_FORK(r), + DEF_FORK(samsung_m), DEF_FORK(samsung_n), + DEF_FORK(samsung_o), DEF_FORK(samsung_p), #if ENABLE_LEGACY_DP - DCL_FORK(r_dp2), DCL_FORK(r_dp3) + DEF_FORK(r_dp2), DEF_FORK(r_dp3) #endif - }; - const int nativeForkAndSpecialize_methods_num = std::size(nativeForkAndSpecialize_methods); +}; +const int nativeForkAndSpecialize_methods_num = std::size(nativeForkAndSpecialize_methods); - const JNINativeMethod nativeSpecializeAppProcess_methods[] = { - DCL_SPEC(q), DCL_SPEC(q_alt), - DCL_SPEC(r), DCL_SPEC(samsung_q), +const JNINativeMethod nativeSpecializeAppProcess_methods[] = { + DEF_SPEC(q), DEF_SPEC(q_alt), + DEF_SPEC(r), DEF_SPEC(samsung_q), #if ENABLE_LEGACY_DP - DCL_SPEC(r_dp2), DCL_SPEC(r_dp3) + DEF_SPEC(r_dp2), DEF_SPEC(r_dp3) #endif - }; - const int nativeSpecializeAppProcess_methods_num = std::size(nativeSpecializeAppProcess_methods); +}; +const int nativeSpecializeAppProcess_methods_num = std::size( + nativeSpecializeAppProcess_methods); - const JNINativeMethod nativeForkSystemServer_methods[] = { - DCL_SERVER(m), DCL_SERVER(samsung_q) - }; - const int nativeForkSystemServer_methods_num = std::size(nativeForkSystemServer_methods); - } +const JNINativeMethod nativeForkSystemServer_methods[] = { + DEF_SERVER(m), DEF_SERVER(samsung_q) +}; +const int nativeForkSystemServer_methods_num = std::size(nativeForkSystemServer_methods); - namespace SystemProperties { - const JNINativeMethod native_set_methods[] = {{ - "native_set", - "(Ljava/lang/String;Ljava/lang/String;)V", - (void *) &SystemProperties_set - }}; - } }