Add injector

loader/build.gradle.kts

@@ -0,0 +1,17 @@
+plugins {
+    id("com.android.library")
+}
+
+android {
+    buildFeatures {
+        prefab = true
+    }
+
+    externalNativeBuild.ndkBuild {
+        path("src/Android.mk")
+    }
+}
+
+dependencies {
+    implementation("dev.rikka.ndk.thirdparty:cxx:1.2.0")
+}

loader/src/Android.mk

@@ -0,0 +1,33 @@
+LOCAL_PATH := $(call my-dir)
+define walk
+  $(wildcard $(1)) $(foreach e, $(wildcard $(1)/*), $(call walk, $(e)))
+endef
+
+include $(CLEAR_VARS)
+LOCAL_MODULE           := common
+LOCAL_C_INCLUDES       := $(LOCAL_PATH)/include
+FILE_LIST              := $(filter %.cpp, $(call walk, $(LOCAL_PATH)/common))
+LOCAL_SRC_FILES        := $(FILE_LIST:COMMON_FILE_LIST:$(LOCAL_PATH)/%=%)
+LOCAL_STATIC_LIBRARIES := cxx
+LOCAL_LDLIBS           := -llog
+include $(BUILD_STATIC_LIBRARY)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE           := zygiskloader
+LOCAL_C_INCLUDES       := $(LOCAL_PATH)/include
+FILE_LIST              := $(filter %.cpp, $(call walk, $(LOCAL_PATH)/loader))
+LOCAL_SRC_FILES        := $(FILE_LIST:COMMON_FILE_LIST:$(LOCAL_PATH)/%=%)
+LOCAL_STATIC_LIBRARIES := cxx common
+LOCAL_LDLIBS           := -llog
+include $(BUILD_SHARED_LIBRARY)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE           := injector
+LOCAL_C_INCLUDES       := $(LOCAL_PATH)/include
+FILE_LIST              := $(filter %.cpp, $(call walk, $(LOCAL_PATH)/injector))
+LOCAL_SRC_FILES        := $(FILE_LIST:COMMON_FILE_LIST:$(LOCAL_PATH)/%=%)
+LOCAL_STATIC_LIBRARIES := cxx common
+LOCAL_LDLIBS           := -llog
+include $(BUILD_SHARED_LIBRARY)
+
+$(call import-module,prefab/cxx)

loader/src/Application.mk

@@ -0,0 +1,14 @@
+APP_CFLAGS     := -Wall -Wextra
+APP_CFLAGS     += -fno-stack-protector -fomit-frame-pointer
+APP_CFLAGS     += -Wno-builtin-macro-redefined -D__FILE__=__FILE_NAME__
+APP_CPPFLAGS   := -std=c++20
+APP_CONLYFLAGS := -std=c18
+APP_STL        := none
+
+ifneq ($(NDK_DEBUG),1)
+APP_CFLAGS     += -Oz -flto
+APP_CFLAGS     += -Wno-unused -Wno-unused-parameter -Werror
+APP_CFLAGS     += -fvisibility=hidden -fvisibility-inlines-hidden
+APP_CFLAGS     += -fno-unwind-tables -fno-asynchronous-unwind-tables
+APP_LDFLAGS    += -Wl,--exclude-libs,ALL -flto -Wl,--gc-sections -Wl,--strip-all
+endif

loader/src/common/daemon.cpp

@@ -0,0 +1,79 @@
+#include <linux/un.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include "daemon.h"
+#include "dl.h"
+#include "socket_utils.h"
+
+namespace zygiskd {
+
+    UniqueFd Connect(uint8_t retry) {
+        UniqueFd fd = socket(PF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
+        struct sockaddr_un addr{
+                .sun_family = AF_UNIX,
+                .sun_path={0},
+        };
+        strncpy(addr.sun_path + 1, kZygiskSocket.data(), kZygiskSocket.size());
+        socklen_t socklen = sizeof(sa_family_t) + strlen(addr.sun_path + 1) + 1;
+
+        while (retry--) {
+            int r = connect(fd, reinterpret_cast<struct sockaddr*>(&addr), socklen);
+            if (r != -1) return r;
+            LOGW("retrying to connect to zygiskd, sleep 1s");
+            sleep(1);
+        }
+        return -1;
+    }
+
+    bool PingHeartbeat() {
+        auto fd = Connect(5);
+        if (fd == -1) {
+            PLOGE("Connect to zygiskd");
+            return false;
+        }
+        return true;
+    }
+
+    std::string ReadNativeBridge() {
+        auto fd = Connect(1);
+        if (fd == -1) {
+            PLOGE("ReadNativeBridge");
+            return "";
+        }
+        socket_utils::write_u8(fd, (uint8_t) SocketAction::ReadNativeBridge);
+        return socket_utils::read_string(fd);
+    }
+
+    UniqueFd ReadInjector() {
+        auto fd = Connect(1);
+        if (fd == -1) {
+            PLOGE("ReadInjector");
+            return -1;
+        }
+        socket_utils::write_u8(fd, (uint8_t) SocketAction::ReadInjector);
+        return socket_utils::recv_fd(fd);
+    }
+
+    std::vector<Module> ReadModules() {
+        std::vector<Module> modules;
+        auto fd = Connect(1);
+        if (fd == -1) {
+            PLOGE("ReadModules");
+            return modules;
+        }
+        socket_utils::write_u8(fd, (uint8_t) SocketAction::ReadModules);
+        size_t len = socket_utils::read_usize(fd);
+        for (size_t i = 0; i < len; i++) {
+            std::string name = socket_utils::read_string(fd);
+            UniqueFd module_fd = socket_utils::recv_fd(fd);
+            auto handle = DlopenMem(module_fd, RTLD_NOW);
+            if (handle == nullptr) {
+                LOGW("Failed to dlopen module %s: %s", name.data(), dlerror());
+                continue;
+            }
+            modules.emplace_back(name, handle);
+        }
+        return modules;
+    }
+}

loader/src/common/dl.cpp

@@ -0,0 +1,51 @@
+#include <cstdio>
+#include <dlfcn.h>
+#include <libgen.h>
+#include <climits>
+#include <cstring>
+#include <android/dlext.h>
+
+#include "dl.h"
+#include "logging.h"
+
+extern "C" [[gnu::weak]] struct android_namespace_t*
+//NOLINTNEXTLINE
+__loader_android_create_namespace([[maybe_unused]] const char* name,
+                                  [[maybe_unused]] const char* ld_library_path,
+                                  [[maybe_unused]] const char* default_library_path,
+                                  [[maybe_unused]] uint64_t type,
+                                  [[maybe_unused]] const char* permitted_when_isolated_path,
+                                  [[maybe_unused]] android_namespace_t* parent,
+                                  [[maybe_unused]] const void* caller_addr);
+
+void* DlopenExt(const char* path, int flags) {
+    auto info = android_dlextinfo{};
+    auto* dir = dirname(path);
+    auto* ns = &__loader_android_create_namespace == nullptr ? nullptr :
+               __loader_android_create_namespace(path, dir, nullptr,
+                                                 2, /* ANDROID_NAMESPACE_TYPE_SHARED */
+                                                 nullptr, nullptr,
+                                                 reinterpret_cast<void*>(&DlopenExt));
+    if (ns) {
+        info.flags = ANDROID_DLEXT_USE_NAMESPACE;
+        info.library_namespace = ns;
+
+        LOGD("Open %s with namespace %p", path, ns);
+    } else {
+        LOGD("Cannot create namespace for %s", path);
+    }
+
+    auto* handle = android_dlopen_ext(path, flags, &info);
+    if (handle) {
+        LOGD("dlopen %s: %p", path, handle);
+    } else {
+        LOGE("dlopen %s: %s", path, dlerror());
+    }
+    return handle;
+}
+
+void* DlopenMem(int memfd, int flags) {
+    char path[PATH_MAX];
+    sprintf(path, "/proc/self/fd/%d", memfd);
+    return DlopenExt(path, flags);
+}

loader/src/common/socket_utils.cpp

@@ -0,0 +1,114 @@
+#include <cstddef>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include "socket_utils.h"
+
+namespace socket_utils {
+
+    ssize_t xread(int fd, void* buf, size_t count) {
+        size_t read_sz = 0;
+        ssize_t ret;
+        do {
+            ret = read(fd, (std::byte*) buf + read_sz, count - read_sz);
+            if (ret < 0) {
+                if (errno == EINTR) continue;
+                PLOGE("read");
+                return ret;
+            }
+            read_sz += ret;
+        } while (read_sz != count && ret != 0);
+        if (read_sz != count) {
+            PLOGE("read (%d != %d)", count, read_sz);
+        }
+        return read_sz;
+    }
+
+    ssize_t xwrite(int fd, const void* buf, size_t count) {
+        size_t write_sz = 0;
+        ssize_t ret;
+        do {
+            ret = write(fd, (std::byte*) buf + write_sz, count - write_sz);
+            if (ret < 0) {
+                if (errno == EINTR) continue;
+                PLOGE("write");
+                return ret;
+            }
+            write_sz += ret;
+        } while (write_sz != count && ret != 0);
+        if (write_sz != count) {
+            PLOGE("write (%d != %d)", count, write_sz);
+        }
+        return write_sz;
+    }
+
+    ssize_t xrecvmsg(int sockfd, struct msghdr* msg, int flags) {
+        int rec = recvmsg(sockfd, msg, flags);
+        if (rec < 0) PLOGE("recvmsg");
+        return rec;
+    }
+
+    void* recv_fds(int sockfd, char* cmsgbuf, size_t bufsz, int cnt) {
+        iovec iov = {
+                .iov_base = &cnt,
+                .iov_len  = sizeof(cnt),
+        };
+        msghdr msg = {
+                .msg_iov        = &iov,
+                .msg_iovlen     = 1,
+                .msg_control    = cmsgbuf,
+                .msg_controllen = bufsz
+        };
+
+        xrecvmsg(sockfd, &msg, MSG_WAITALL);
+        cmsghdr* cmsg = CMSG_FIRSTHDR(&msg);
+
+        if (msg.msg_controllen != bufsz ||
+            cmsg == nullptr ||
+            cmsg->cmsg_len != CMSG_LEN(sizeof(int) * cnt) ||
+            cmsg->cmsg_level != SOL_SOCKET ||
+            cmsg->cmsg_type != SCM_RIGHTS) {
+            return nullptr;
+        }
+
+        return CMSG_DATA(cmsg);
+    }
+
+    template<typename T>
+    inline T read_exact(int fd) {
+        T res;
+        return sizeof(T) == xread(fd, &res, sizeof(T)) ? res : -1;
+    }
+
+    template<typename T>
+    inline bool write_exact(int fd, T val) {
+        return sizeof(T) == xwrite(fd, &val, sizeof(T));
+    }
+
+    size_t read_usize(int fd) {
+        return read_exact<size_t>(fd);
+    }
+
+    std::string read_string(int fd) {
+        auto len = read_exact<size_t>(fd);
+        char buf[len + 1];
+        buf[len] = '\0';
+        xread(fd, buf, len);
+        return buf;
+    }
+
+    bool write_u8(int fd, uint8_t val) {
+        return write_exact<uint8_t>(fd, val);
+    }
+
+    int recv_fd(int sockfd) {
+        char cmsgbuf[CMSG_SPACE(sizeof(int))];
+
+        void* data = recv_fds(sockfd, cmsgbuf, sizeof(cmsgbuf), 1);
+        if (data == nullptr) return -1;
+
+        int result;
+        memcpy(&result, data, sizeof(int));
+        return result;
+    }
+}

loader/src/include/daemon.h

@@ -0,0 +1,69 @@
+#pragma once
+
+#include <string_view>
+#include <string>
+#include <vector>
+
+#if defined(__LP64__)
+# define LP_SELECT(lp32, lp64) lp64
+#else
+# define LP_SELECT(lp32, lp64) lp32
+#endif
+
+constexpr std::string_view kZygiskSocket = LP_SELECT("zygisk32", "zygisk64") "placeholder123456";
+
+class UniqueFd {
+    using Fd = int;
+public:
+    UniqueFd() = default;
+
+    UniqueFd(Fd fd) : fd_(fd) {}
+
+    ~UniqueFd() { close(fd_); }
+
+    // Disallow copy
+    UniqueFd(const UniqueFd&) = delete;
+
+    UniqueFd& operator=(const UniqueFd&) = delete;
+
+    // Allow move
+    UniqueFd(UniqueFd&& other) { std::swap(fd_, other.fd_); }
+
+    UniqueFd& operator=(UniqueFd&& other) {
+        std::swap(fd_, other.fd_);
+        return *this;
+    }
+
+    // Implict cast to Fd
+    operator const Fd&() const { return fd_; }
+
+private:
+    Fd fd_ = -1;
+};
+
+namespace zygiskd {
+
+    struct Module {
+        std::string name;
+        void* handle;
+
+        inline explicit Module(std::string name, void* handle)
+                : name(name), handle(handle) {}
+    };
+
+    enum class SocketAction {
+        HeartBeat,
+        ReadNativeBridge,
+        ReadInjector,
+        ReadModules,
+        RequestCompanionSocket,
+    };
+
+    bool PingHeartbeat();
+
+    std::string ReadNativeBridge();
+
+    UniqueFd ReadInjector();
+
+    std::vector<Module> ReadModules();
+}

loader/src/include/dl.h

@@ -0,0 +1,7 @@
+#pragma once
+
+#include <dlfcn.h>
+
+void *DlopenExt(const char *path, int flags);
+
+void *DlopenMem(int memfd, int flags);

loader/src/include/logging.h

@@ -0,0 +1,30 @@
+#pragma once
+
+#include <android/log.h>
+#include <errno.h>
+#include <string.h>
+
+#ifndef LOG_TAG
+#define LOG_TAG    "zygisksu"
+#endif
+
+#ifdef LOG_DISABLED
+#define LOGD(...)
+#define LOGV(...)
+#define LOGI(...)
+#define LOGW(...)
+#define LOGE(...)
+#else
+#ifndef NDEBUG
+#define LOGD(...)  __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, __VA_ARGS__)
+#define LOGV(...)  __android_log_print(ANDROID_LOG_VERBOSE, LOG_TAG, __VA_ARGS__)
+#else
+#define LOGD(...)
+#define LOGV(...)
+#endif
+#define LOGI(...)  __android_log_print(ANDROID_LOG_INFO, LOG_TAG, __VA_ARGS__)
+#define LOGW(...)  __android_log_print(ANDROID_LOG_WARN, LOG_TAG, __VA_ARGS__)
+#define LOGE(...)  __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, __VA_ARGS__)
+#define LOGF(...)  __android_log_print(ANDROID_LOG_FATAL, LOG_TAG, __VA_ARGS__)
+#define PLOGE(fmt, args...) LOGE(fmt " failed with %d: %s", ##args, errno, strerror(errno))
+#endif

loader/src/include/native_bridge_callbacks.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include <android/api-level.h>
+#include <cstdint>
+
+template<unsigned>
+struct NativeBridgeCallbacks;
+
+template<>
+struct NativeBridgeCallbacks<__ANDROID_API_Q__> {
+    [[maybe_unused]] uint32_t version;
+    [[maybe_unused]] void *initialize;
+    [[maybe_unused]] void *loadLibrary;
+    [[maybe_unused]] void *getTrampoline;
+    [[maybe_unused]] void *isSupported;
+    [[maybe_unused]] void *getAppEnv;
+    [[maybe_unused]] void *isCompatibleWith;
+    [[maybe_unused]] void *getSignalHandler;
+    [[maybe_unused]] void *unloadLibrary;
+    [[maybe_unused]] void *getError;
+    [[maybe_unused]] void *isPathSupported;
+    [[maybe_unused]] void *initAnonymousNamespace;
+    [[maybe_unused]] void *createNamespace;
+    [[maybe_unused]] void *linkNamespaces;
+    [[maybe_unused]] void *loadLibraryExt;
+    [[maybe_unused]] void *getVendorNamespace;
+    [[maybe_unused]] void *getExportedNamespace;
+};
+
+template<>
+struct NativeBridgeCallbacks<__ANDROID_API_R__> : NativeBridgeCallbacks<__ANDROID_API_Q__> {
+    [[maybe_unused]] void *preZygoteFork;
+};

loader/src/include/socket_utils.h

@@ -0,0 +1,20 @@
+#pragma once
+
+#include <string>
+
+#include "logging.h"
+
+namespace socket_utils {
+
+    ssize_t xread(int fd, void *buf, size_t count);
+
+    ssize_t xwrite(int fd, const void *buf, size_t count);
+
+    size_t read_usize(int fd);
+
+    std::string read_string(int fd);
+
+    bool write_u8(int fd, uint8_t val);
+
+    int recv_fd(int fd);
+}

loader/src/loader/loader.cpp

@@ -0,0 +1,96 @@
+#include <string_view>
+#include <sys/system_properties.h>
+#include <unistd.h>
+#include <array>
+
+#include "daemon.h"
+#include "dl.h"
+#include "logging.h"
+#include "native_bridge_callbacks.h"
+
+extern "C" [[gnu::visibility("default")]]
+uint8_t NativeBridgeItf[sizeof(NativeBridgeCallbacks<__ANDROID_API_R__>) * 2]{0};
+
+namespace {
+    constexpr std::array kZygoteProcesses = {"zygote", "zygote32""zygote64", "usap32", "usap64"};
+
+    void* sOriginalBridge = nullptr;
+}
+
+__used __attribute__((destructor))
+void Destructor() {
+    if (sOriginalBridge) {
+        dlclose(sOriginalBridge);
+    }
+}
+
+__used __attribute__((constructor))
+void Constructor() {
+    if (getuid() != 0) {
+        return;
+    }
+
+    std::string_view cmdline = getprogname();
+    if (std::any_of(
+            kZygoteProcesses.begin(),
+            kZygoteProcesses.end(),
+            [&](const char* p) { return cmdline == p; }
+    )) {
+        LOGW("Not started as zygote (cmdline=%s)", cmdline.data());
+        return;
+    }
+
+    std::string native_bridge;
+    do {
+        LOGD("Ping heartbeat");
+        if (!zygiskd::PingHeartbeat()) break;
+
+        LOGI("Read native bridge");
+        native_bridge = zygiskd::ReadNativeBridge();
+
+        LOGI("Load injector");
+        auto injector = zygiskd::ReadInjector();
+        if (injector != -1) break;
+
+        auto handle = DlopenMem(injector, RTLD_NOW);
+        if (handle == nullptr) {
+            LOGE("Failed to dlopen injector: %s", dlerror());
+            break;
+        }
+        auto entry = dlsym(handle, "entry");
+        if (entry == nullptr) {
+            LOGE("Failed to dlsym injector entry: %s", dlerror());
+            break;
+        }
+        reinterpret_cast<void (*)()>(entry)();
+    } while (false);
+
+    if (native_bridge.empty()) return;
+    LOGI("Load original native bridge: %s", native_bridge.data());
+    sOriginalBridge = dlopen(native_bridge.data(), RTLD_NOW);
+    if (sOriginalBridge == nullptr) {
+        LOGE("dlopen failed: %s", dlerror());
+        return;
+    }
+
+    auto* original_native_bridge_itf = dlsym(sOriginalBridge, "NativeBridgeItf");
+    if (original_native_bridge_itf == nullptr) {
+        LOGE("dlsym failed: %s", dlerror());
+        return;
+    }
+
+    long sdk = 0;
+    char value[PROP_VALUE_MAX + 1];
+    if (__system_property_get("ro.build.version.sdk", value) > 0) {
+        sdk = strtol(value, nullptr, 10);
+    }
+
+    auto callbacks_size = 0;
+    if (sdk >= __ANDROID_API_R__) {
+        callbacks_size = sizeof(NativeBridgeCallbacks<__ANDROID_API_R__>);
+    } else if (sdk == __ANDROID_API_Q__) {
+        callbacks_size = sizeof(NativeBridgeCallbacks<__ANDROID_API_Q__>);
+    }
+
+    memcpy(NativeBridgeItf, original_native_bridge_itf, callbacks_size);
+}