Randomize tmp path

This commit is contained in:
5ec1cff
2023-11-27 10:18:23 +08:00
parent c205893dd2
commit 9e48f18247
9 changed files with 43 additions and 40 deletions

View File

@@ -7,6 +7,10 @@
#include "socket_utils.h"
namespace zygiskd {
static std::string zygisk_path;
void Init(const char *path) {
zygisk_path = path;
}
int Connect(uint8_t retry) {
int fd = socket(PF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
@@ -14,13 +18,14 @@ namespace zygiskd {
.sun_family = AF_UNIX,
.sun_path={0},
};
strcpy(addr.sun_path, kCPSocketPath);
auto socket_path = zygisk_path + kCPSocketName;
strcpy(addr.sun_path, socket_path.c_str());
socklen_t socklen = sizeof(addr);
while (retry--) {
int r = connect(fd, reinterpret_cast<struct sockaddr*>(&addr), socklen);
if (r == 0) return fd;
LOGW("Retrying to connect to zygiskd, sleep 1s");
PLOGE("Retrying to connect to zygiskd, sleep 1s");
sleep(1);
}

View File

@@ -11,7 +11,7 @@
# define LP_SELECT(lp32, lp64) lp32
#endif
constexpr auto kCPSocketPath = "/dev/zygisk/" LP_SELECT("cp32", "cp64") ".sock";
constexpr auto kCPSocketName = "/" LP_SELECT("cp32", "cp64") ".sock";
class UniqueFd {
using Fd = int;
@@ -61,6 +61,8 @@ namespace zygiskd {
ZygoteRestart,
};
void Init(const char *path);
bool PingHeartbeat();
int RequestLogcatFd();

View File

@@ -8,10 +8,11 @@ using namespace std;
void *self_handle = nullptr;
extern "C" [[gnu::visibility("default")]]
void entry(void* handle) {
LOGI("Zygisk library injected");
void entry(void* handle, const char* path) {
LOGI("Zygisk library injected, magic %s", path);
self_handle = handle;
zygiskd::Init(path);
if (!zygiskd::PingHeartbeat()) {
LOGE("Zygisk daemon is not running");
return;

View File

@@ -16,7 +16,8 @@
#include <string>
#include "utils.hpp"
bool inject_on_main(int pid, const char *lib_path) {
bool inject_on_main(int pid, const char *lib_path, const char* magic_path) {
LOGI("injecting %s to zygote %d", lib_path, pid);
// parsing KernelArgumentBlock
// https://cs.android.com/android/platform/superproject/main/+/main:bionic/libc/private/KernelArgumentBlock.h;l=30;drc=6d1ee77ee32220e4202c3066f7e1f69572967ad8
struct user_regs_struct regs{}, backup{};
@@ -141,9 +142,11 @@ bool inject_on_main(int pid, const char *lib_path) {
return false;
}
// call injector entry(handle)
// call injector entry(handle, magic)
args.clear();
args.push_back(remote_handle);
str = push_string(pid, regs, magic_path);
args.push_back((long) str);
remote_call(pid, regs, injector_entry, (uintptr_t) libc_return_addr, args);
// reset pc to entry
@@ -177,7 +180,9 @@ bool trace_zygote(int pid) {
}
WAIT_OR_DIE
if (STOPPED_WITH(SIGSTOP, PTRACE_EVENT_STOP)) {
if (!inject_on_main(pid, "/dev/zygisk/lib" LP_SELECT("", "64") "/libzygisk.so")) {
std::string magic_path = getenv("MAGIC_PATH");
std::string lib_path = magic_path + "/lib" LP_SELECT("", "64") "/libzygisk.so";
if (!inject_on_main(pid, lib_path.c_str(), magic_path.c_str())) {
LOGE("failed to inject");
return false;
}