Frida-Zymbiote注入机制#

1
// src/linux/linux-host-session.vala:986-995
2
uint64 set_argv0_address = 0;
3
runtime.enumerate_exports (e => {
4
    // JNI 函数的 mangled name
5
    if (e.name == "_Z27android_os_Process_setArgV0P7_JNIEnvP8_jobjectP8_jstring") {
6
        // 计算运行时地址 = 基址 + 偏移
7
        set_argv0_address = runtime_entry.base_address + e.address;
8
        return false;
9
    }
10
    return true;
11
});

1
// src/linux/linux-host-session.vala:1007-1027
2
uint pointer_size = ("/lib64/" in libc_path) ? 8 : 4;
3

4
var original_ptr = new uint8[pointer_size];
5
var replaced_ptr = new uint8[pointer_size];
6

7
// 将地址编码为字节数组
8
(new Buffer (new Bytes.static (original_ptr), ByteOrder.HOST, pointer_size))
9
    .write_pointer (0, set_argv0_address);
10
(new Buffer (new Bytes.static (replaced_ptr), ByteOrder.HOST, pointer_size))
11
    .write_pointer (0, payload_base);
12

13
var fd = open_process_memory (pid);
14

15
uint64 art_method_slot = 0;
16
bool already_patched = false;
17

18
// 遍历堆内存区域
19
foreach (var candidate in heap_candidates) {
20
    var heap = new uint8[candidate.size];
21
    var n = fd.pread (heap, candidate.base_address);
22

23
    // 在堆内存中搜索这个指针值
24
    void * p = memmem (heap, original_ptr);
25
    if (p == null) {
26
        p = memmem (heap, replaced_ptr);
27
        already_patched = p != null;
28
    }
29

30
    if (p != null) {
31
        // 找到了，计算 ArtMethod 的 entry_point 字段地址
32
        art_method_slot = candidate.base_address + ((uint8 *) p - (uint8 *) heap);
33
        break;
34
    }
35
}

1
struct _FridaApi
2
{
3
  char name[64];          // MAGIC
4

5
  void    ** art_method_slot;       // ArtMethod 的 entry_point 地址
6
  void    (* original_set_argv0)(); // 原始 JNI 函数地址
7

8
  // libc 函数指针
9
  int     (* socket) (...);
10
  int     (* connect) (...);
11
  int *   (* __errno) (void);
12
  pid_t   (* getpid) (void);
13
  pid_t   (* getppid) (void);
14
  ssize_t (* sendmsg) (...);
15
  ssize_t (* recv) (...);
16
  int     (* close) (int fd);
17
  int     (* raise) (int sig);
18
};
19

20
static volatile const FridaApi frida = {
21
  .name = "/frida-zymbiote-00000000000000000000000000000000",
22
};

1
__attribute__ ((section (".text.entrypoint")))
2
__attribute__ ((visibility ("default")))
3
int
4
frida_zymbiote_replacement_set_argv0 (JNIEnv * env, jobject clazz, jstring name)
5
{
6
  bool success = false;
7
  int fd = -1;
8
  struct sockaddr_un addr;
9
  socklen_t addrlen;
10
  unsigned int name_len;
11

12
  // 1. 立即恢复原始 entry_point（避免重复触发）
13
  *frida.art_method_slot = frida.original_set_argv0;
14

15
  // 2. 调用原始函数（保证 app 正常运行）
16
  frida.original_set_argv0 (env, clazz, name);
17

18
  // 3. 创建 Unix socket
19
  fd = frida.socket (AF_UNIX, SOCK_STREAM, 0);
20
  if (fd == -1)
21
    goto beach;
22

23
  // 4. 构造 socket 地址（abstract namespace）
24
  addr.sun_family = AF_UNIX;
25
  addr.sun_path[0] = '\0';  // abstract socket 标志
26

27
  name_len = 0;
28
  for (unsigned int i = 0; i != sizeof (frida.name); i++)
29
  {
30
    if (frida.name[i] == '\0')
31
      break;
32
    if (1u + i >= sizeof (addr.sun_path))
33
      break;
34
    addr.sun_path[1u + i] = frida.name[i];
35
    name_len++;
36
  }
37

38
  addrlen = (socklen_t) (offsetof (struct sockaddr_un, sun_path) + 1u + name_len);
39

40
  // 5. 连接 Frida Server
41
  if (frida_connect (fd, (const struct sockaddr *) &addr, addrlen) == -1)
42
    goto beach;
43

44
  // 6. 发送进程信息
45
  {
46
    const char * name_utf8;
47
    struct
48
    {
49
      uint32_t pid;
50
      uint32_t ppid;
51
      uint32_t package_name_len;
52
    } header;
53
    struct iovec iov[2];
54

55
    name_utf8 = (*env)->GetStringUTFChars (env, name, NULL);
56

57
    header.pid = frida.getpid ();
58
    header.ppid = frida.getppid ();
59
    header.package_name_len = 0;
60
    while (name_utf8[header.package_name_len] != '\0')
61
      header.package_name_len++;
62

63
    iov[0].iov_base = &header;
64
    iov[0].iov_len = sizeof (header);
65
    iov[1].iov_base = (void *) name_utf8;
66
    iov[1].iov_len = header.package_name_len;
67

68
    if (!frida_sendmsg_all (fd, iov, 2, MSG_NOSIGNAL))
69
      goto beach;
70

71
    (*env)->ReleaseStringUTFChars (env, name, name_utf8);
72
  }
73

74
  // 7. 等待 Frida Server 确认
75
  {
76
    uint8_t rx;
77
    if (frida_recv (fd, &rx, 1, 0) != 1)
78
      goto beach;
79
  }
80

81
  success = true;
82

83
beach:
84
  if (fd != -1)
85
    frida.close (fd);
86

87
  // 8. 暂停进程
88
  if (success)
89
  {
90
    __attribute__ ((musttail))
91
    return frida_stop_and_return (env, clazz, name);
92
  }
93

94
  return 0;
95
}

1
__attribute__ ((naked, noinline))
2
static int
3
frida_stop_and_return (JNIEnv * env, jobject clazz, jstring name)
4
{
5
#if defined (__aarch64__)
6
  __asm__ __volatile__ (
7
      "mov    w0, #%[sig]\n"           // 参数：SIGSTOP
8
      "adrp   x16, frida\n"            // 获取 frida 地址（位置无关）
9
      "add    x16, x16, :lo12:frida\n"
10
      "ldr    x16, [x16, %[raise_off]]\n" // 读取 raise 函数指针
11
      "br     x16\n"                   // 跳转（不会返回）
12
    :
13
    : [sig] "i" (SIGSTOP),
14
      [raise_off] "i" (offsetof (FridaApi, raise))
15
    : "x16", "memory"
16
  );
17
#elif defined (__arm__)
18
  __asm__ __volatile__ (
19
      "mov    r0, %[sig]\n"
20
      "adr    r12, frida\n"
21
      "ldr    r12, [r12, %[raise_off]]\n"
22
      "bx     r12\n"
23
    :
24
    : [sig] "i" (SIGSTOP),
25
      [raise_off] "i" (offsetof (FridaApi, raise))
26
    : "r12", "memory"
27
  );
28
#elif defined (__x86_64__)
29
  __asm__ __volatile__ (
30
      "mov    $%c[sig], %%edi\n"
31
      "leaq   frida(%%rip), %%r11\n"
32
      "movq   %c[raise_off](%%r11), %%r11\n"
33
      "jmp    *%%r11\n"
34
    :
35
    : [sig] "i" (SIGSTOP),
36
      [raise_off] "i" (offsetof (FridaApi, raise))
37
    : "r11", "rdi", "memory"
38
  );
39
#elif defined (__i386__)
40
  __asm__ __volatile__ (
41
      "movl   $%c[sig], 4(%%esp)\n"
42
      "call   1f\n"
43
      "1: pop %%eax\n"
44
      "addl   $(frida-1b), %%eax\n"
45
      "movl   %c[raise_off](%%eax), %%eax\n"
46
      "jmp    *%%eax\n"
47
    :
48
    : [sig] "i" (SIGSTOP),
49
      [raise_off] "i" (offsetof (FridaApi, raise))
50
    : "eax", "memory"
51
  );
52
#else
53
# error Unsupported architecture
54
#endif
55
}

1
// 通过 /proc/[pid]/mem 将 payload 写入目标位置
2
fd.pwrite (payload.bytes, payload_base);
3

4
// 修改 ArtMethod 的 entry_point，使其指向 payload
5
fd.pwrite (replaced_ptr, art_method_slot);

1
__attribute__ ((section (".text.entrypoint")))

1
SECTIONS {
2
  . = 0;  // 从地址 0 开始
3

4
  .payload : ALIGN(4096)
5
  {
6
    KEEP(*(.text.entrypoint))  // 函数放在最前面
7
    *(.text*)                   // 其他代码
8
    *(.rodata*)                 // 只读数据
9
  }
10

11
  // 其他段（会被 objcopy 去掉）
12
  .dynstr : { *(.dynstr) }
13
  .dynsym : { *(.dynsym) }
14
  // ...
15
}

1
struct uki_tools {
2
  char magic[64];                    // Magic 字符串，用于定位数据区
3

4
  void    ** art_method_slot;        // ArtMethod 的 entry_point 地址
5
  void    (* original_set_argv0)();  // 原始 setArgV0 函数地址
6

7
  uid_t   target_uid;                // 目标 app 的 UID
8
  char    so_path[128];              // 要注入的 SO 路径
9

10
  // 通信相关
11
  int     (* socket) (int domain, int type, int protocol);
12
  int     (* connect) (int sockfd, const struct sockaddr * addr, socklen_t addrlen);
13
  int *   (* __errno) (void);
14
  ssize_t (* write) (int fd, const void * buf, size_t count);
15
  ssize_t (* read) (int fd, void * buf, size_t count);
16
  int     (* close) (int fd);
17

18
  // 进程相关
19
  uid_t   (* getuid) (void);
20
  int     (* raise) (int sig);
21

22
  // 注入相关
23
  void *  (* dlopen) (const char * filename, int flag);
24

25
  // 日志相关
26
  int     (* log_print) (int prio, const char * tag, const char * fmt, ...);
27
};
28

29
static volatile const struct uki_tools tools = {
30
  .magic = "/uki-injector-00000000000000000000000000000000000000000",
31
};

1
__attribute__ ((section (".text.yuuki")))
2
__attribute__ ((visibility ("default")))
3
int
4
uki_replacement_set_argv0 (JNIEnv * env, jobject clazz, jstring name)
5
{
6
  int fd = -1;
7
  struct sockaddr_un addr;
8
  const char * name_utf8;
9
  bool inject_success = false;
10

11
  // T1. 立即恢复 hook（避免重复触发）
12
  *tools.art_method_slot = tools.original_set_argv0;
13

14
  // T2. 调用原始函数（保证 app 正常运行）
15
  tools.original_set_argv0 (env, clazz, name);
16

17
  // T3. 检查 UID，判断是否是目标进程
18
  if (tools.getuid () != tools.target_uid)
19
    return 0;  // 不是目标进程，直接返回
20

21
  name_utf8 = (*env)->GetStringUTFChars (env, name, NULL);
22
  LOGI((&tools), "Target app detected: %s, UID: %d", name_utf8, tools.target_uid);
23

24
  // T4. 创建 Unix socket
25
  fd = tools.socket (AF_UNIX, SOCK_STREAM, 0);
26
  if (fd == -1) {
27
    LOGE((&tools), "Failed to create socket");
28
    goto suicide;
29
  }
30

31
  // 构造 socket 地址（abstract namespace）
32
  addr.sun_family = AF_UNIX;
33
  addr.sun_path[0] = '\0';
34

35
  unsigned int name_len = 0;
36
  for (unsigned int i = 0; i != sizeof (tools.magic); i++)
37
  {
38
    if (tools.magic[i] == '\0')
39
      break;
40
    if (1u + i >= sizeof (addr.sun_path))
41
      break;
42
    addr.sun_path[1u + i] = tools.magic[i];
43
    name_len++;
44
  }
45

46
  socklen_t addrlen = (socklen_t) (offsetof (struct sockaddr_un, sun_path) + 1u + name_len);
47

48
  // 连接 Injector
49
  if (uki_connect (fd, (const struct sockaddr *) &addr, addrlen) == -1) {
50
    LOGE((&tools), "Failed to connect to Injector");
51
    goto suicide;  // T5. 连接失败，进程自杀
52
  }
53

54
  LOGI((&tools), "Connected to Injector, injecting SO: %s", tools.so_path);
55

56
  // T6. dlopen 注入 SO
57
  void * handle = tools.dlopen (tools.so_path, RTLD_NOW);
58

59
  if (handle == NULL) {
60
    // T7. dlopen 失败
61
    LOGE((&tools), "Failed to dlopen SO");
62

63
    // 发送失败消息
64
    uint8_t status = 0x00;  // 0x00 = 失败
65
    uki_write (fd, &status, 1);
66

67
    (*env)->ReleaseStringUTFChars (env, name, name_utf8);
68
    tools.close (fd);
69

70
    // 进程自杀
71
    tools.raise (SIGKILL);
72
    return 0;  // 不会执行到这里
73
  }
74

75
  // T8. dlopen 成功
76
  LOGI((&tools), "Successfully loaded SO at handle: %p", handle);
77
  inject_success = true;
78

79
  // 发送成功消息
80
  uint8_t status = 0x01;  // 0x01 = 成功
81
  if (uki_write (fd, &status, 1) != 1) {
82
    LOGE((&tools), "Failed to send success status");
83
    goto beach;
84
  }
85

86
  // 等待 Injector 确认清理完成
87
  uint8_t ack;
88
  if (uki_read (fd, &ack, 1) != 1) {
89
    LOGE((&tools), "Failed to receive ack");
90
    goto beach;
91
  }
92

93
  LOGI((&tools), "Received ack from Injector, stopping process");
94

95
beach:
96
  (*env)->ReleaseStringUTFChars (env, name, name_utf8);
97

98
  if (fd != -1)
99
    tools.close (fd);
100

101
  // 如果注入成功，暂停进程等待清理
102
  if (inject_success)
103
  {
104
    __attribute__ ((musttail))
105
    return uki_stop_and_return (env, clazz, name);
106
  }
107

108
  return 0;
109

110
suicide:
111
  // T5. 连接失败，进程自杀
112
  (*env)->ReleaseStringUTFChars (env, name, name_utf8);
113
  if (fd != -1)
114
    tools.close (fd);
115

116
  LOGE((&tools), "Connection failed, committing suicide");
117
  tools.raise (SIGKILL);
118
  return 0;  // 不会执行到这里
119
}

1
int main(int argc, char *argv[]) {
2
    if (argc < 3) {
3
        printf("Usage: %s <package_name> <so_path>\n", argv[0]);
4
        return 1;
5
    }
6

7
    const char *package_name = argv[1];
8
    const char *so_path = argv[2];
9

10
    // 查找 zygote 和目标 app 的 UID
11
    pid_t zygote_pid = find_pid_by_name("zygote64");
12
    uid_t target_uid = get_uid_from_package(package_name);
13

14
    printf("[*] Zygote PID: %d, Target UID: %d\n", zygote_pid, target_uid);
15

16
    // 创建 Unix socket 监听器
17
    char socket_name[64];
18
    snprintf(socket_name, sizeof(socket_name), "/uki-injector-%d", getpid());
19

20
    int server_fd = create_unix_socket(socket_name);
21
    if (server_fd < 0) {
22
        printf("[-] Failed to create socket\n");
23
        return 1;
24
    }
25

26
    // 暂停 zygote
27
    kill(zygote_pid, SIGSTOP);
28

29
    // 打开 /proc/[pid]/mem
30
    char mem_path[64];
31
    snprintf(mem_path, sizeof(mem_path), "/proc/%d/mem", zygote_pid);
32
    int mem_fd = open(mem_path, O_RDWR);
33
    if (mem_fd < 0) {
34
        perror("[-] Failed to open /proc/pid/mem");
35
        kill(zygote_pid, SIGCONT);
36
        return 1;
37
    }
38

39
    // 定位注入位置
40
    uintptr_t shellcode_base = find_shellcode_base(zygote_pid);
41
    uintptr_t art_method_slot = find_art_method_slot(zygote_pid, mem_fd);
42

43
    if (!shellcode_base || !art_method_slot) {
44
        printf("[-] Failed to find injection location\n");
45
        close(mem_fd);
46
        kill(zygote_pid, SIGCONT);
47
        return 1;
48
    }
49

50
    // 保存原始数据
51
    uintptr_t original_entry_point;
52
    pread(mem_fd, &original_entry_point, sizeof(uintptr_t), art_method_slot);
53

54
    std::vector<uint8_t> original_shellcode(payload_size);
55
    pread(mem_fd, original_shellcode.data(), payload_size, shellcode_base);
56

57
    // 准备 SO 文件（复制到 app 私有目录）
58
    char target_so_path[256];
59
    snprintf(target_so_path, sizeof(target_so_path),
60
             "/data/data/%s/cache/lib%d.so", package_name, target_uid);
61

62
    char cmd[512];
63
    snprintf(cmd, sizeof(cmd), "cp %s %s", so_path, target_so_path);
64
    system(cmd);
65

66
    snprintf(cmd, sizeof(cmd), "chown %d:%d %s", target_uid, target_uid, target_so_path);
67
    system(cmd);
68

69
    // 准备 payload
70
    prepare_payload(payload, socket_name, target_uid, target_so_path,
71
                   art_method_slot, original_entry_point, zygote_pid);
72

73
    // 注入 payload
74
    pwrite(mem_fd, payload, payload_size, shellcode_base);
75
    pwrite(mem_fd, &shellcode_base, sizeof(uintptr_t), art_method_slot);
76

77
    printf("[+] Payload injected successfully\n");
78

79
    // 恢复 zygote
80
    kill(zygote_pid, SIGCONT);
81

82
    // 启动目标 app
83
    snprintf(cmd, sizeof(cmd), "am force-stop %s", package_name);
84
    system(cmd);
85

86
    snprintf(cmd, sizeof(cmd),
87
             "am start $(cmd package resolve-activity --brief '%s' | tail -n 1)",
88
             package_name);
89
    system(cmd);
90

91
    printf("[*] Waiting for payload notification...\n");
92

93
    // 设置超时
94
    struct timeval timeout;
95
    timeout.tv_sec = 10;
96
    timeout.tv_usec = 0;
97
    setsockopt(server_fd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout));
98

99
    // 等待 payload 连接
100
    int client_fd = accept(server_fd, NULL, NULL);
101
    if (client_fd < 0) {
102
        perror("[-] Failed to accept connection or timeout");
103
        goto cleanup_zygote;
104
    }
105

106
    // 接收状态消息
107
    uint8_t status;
108
    if (read(client_fd, &status, 1) != 1) {
109
        printf("[-] Failed to receive status\n");
110
        close(client_fd);
111
        goto cleanup_zygote;
112
    }
113

114
    if (status == 0x00) {
115
        // dlopen 失败
116
        printf("[-] Payload reported dlopen failure\n");
117
        close(client_fd);
118
        goto cleanup_zygote;
119
    }
120

121
    printf("[+] Received success notification from payload\n");
122

123
    // 查找子进程 PID
124
    sleep(1);  // 等待进程完全启动
125
    pid_t child_pid = find_pid_by_package(package_name);
126
    if (child_pid <= 0) {
127
        printf("[-] Failed to find child process\n");
128
        close(client_fd);
129
        goto cleanup_zygote;
130
    }
131

132
    printf("[*] Child PID: %d\n", child_pid);
133

134
    // T9. 发送确认
135
    uint8_t ack = 0x42;
136
    write(client_fd, &ack, 1);
137
    close(client_fd);
138

139
    // 等待进程进入 STOPPED 状态
140
    if (!wait_until_stopped(child_pid, 5)) {
141
        printf("[-] Process did not stop in time\n");
142
        goto cleanup_zygote;
143
    }
144

145
    // 清理 zygote 的 payload
146
    printf("[*] Cleaning zygote payload...\n");
147
    kill(zygote_pid, SIGSTOP);
148

149
    pwrite(mem_fd, &original_entry_point, sizeof(uintptr_t), art_method_slot);
150
    pwrite(mem_fd, original_shellcode.data(), payload_size, shellcode_base);
151

152
    kill(zygote_pid, SIGCONT);
153
    printf("[+] Zygote payload cleaned\n");
154

155
    // 清理子进程的 payload
156
    printf("[*] Cleaning child process payload...\n");
157
    char child_mem_path[64];
158
    snprintf(child_mem_path, sizeof(child_mem_path), "/proc/%d/mem", child_pid);
159
    int child_mem_fd = open(child_mem_path, O_RDWR);
160
    if (child_mem_fd >= 0) {
161
        pwrite(child_mem_fd, &original_entry_point, sizeof(uintptr_t), art_method_slot);
162
        pwrite(child_mem_fd, original_shellcode.data(), payload_size, shellcode_base);
163
        close(child_mem_fd);
164
        printf("[+] Child process payload cleaned\n");
165
    }
166

167
    // 删除 SO 文件
168
    unlink(target_so_path);
169
    printf("[+] SO file deleted\n");
170

171
    // 恢复子进程
172
    kill(child_pid, SIGCONT);
173
    printf("[+] Child process resumed\n");
174

175
    printf("[+] Injection completed successfully!\n");
176

177
    close(mem_fd);
178
    close(server_fd);
179
    return 0;
180

181
cleanup_zygote:
182
    // 清理 zygote
183
    printf("[*] Cleaning up zygote...\n");
184
    kill(zygote_pid, SIGSTOP);
185
    pwrite(mem_fd, &original_entry_point, sizeof(uintptr_t), art_method_slot);
186
    pwrite(mem_fd, original_shellcode.data(), payload_size, shellcode_base);
187
    kill(zygote_pid, SIGCONT);
188

189
    close(mem_fd);
190
    close(server_fd);
191
    return 1;
192
}