();
/**
* Add primitive type abbreviation to maps of abbreviations.
*
* @param primitive Canonical name of primitive type
* @param abbreviation Corresponding abbreviation of primitive type
*/
private static void addAbbreviation(String primitive, String abbreviation) {
abbreviationMap.put(primitive, abbreviation);
reverseAbbreviationMap.put(abbreviation, primitive);
}
/**
* Feed abbreviation maps
*/
static {
addAbbreviation("int", "I");
addAbbreviation("boolean", "Z");
addAbbreviation("float", "F");
addAbbreviation("long", "J");
addAbbreviation("short", "S");
addAbbreviation("byte", "B");
addAbbreviation("double", "D");
addAbbreviation("char", "C");
}
/**
* ClassUtils instances should NOT be constructed in standard programming.
* Instead, the class should be used as
* {@code ClassUtils.getShortClassName(cls)}.
*
* This constructor is public to permit tools that require a JavaBean
* instance to operate.
*/
public ClassUtils() {
super();
}
// Short class name
// ----------------------------------------------------------------------
/**
* Gets the class name minus the package name for an {@code Object}.
*
* @param object the class to get the short name for, may be null
* @param valueIfNull the value to return if null
* @return the class name of the object without the package name, or the null value
*/
public static String getShortClassName(Object object, String valueIfNull) {
if (object == null) {
return valueIfNull;
}
return getShortClassName(object.getClass());
}
/**
* Gets the class name minus the package name from a {@code Class}.
*
* Consider using the Java 5 API {@link Class#getSimpleName()} instead.
* The one known difference is that this code will return {@code "Map.Entry"} while
* the {@code java.lang.Class} variant will simply return {@code "Entry"}.
*
* @param cls the class to get the short name for.
* @return the class name without the package name or an empty string
*/
public static String getShortClassName(Class cls) {
if (cls == null) {
return "";
}
return getShortClassName(cls.getName());
}
/**
* Gets the class name minus the package name from a String.
*
* The string passed in is assumed to be a class name - it is not checked.
* Note that this method differs from Class.getSimpleName() in that this will
* return {@code "Map.Entry"} whilst the {@code java.lang.Class} variant will simply
* return {@code "Entry"}.
*
* @param className the className to get the short name for
* @return the class name of the class without the package name or an empty string
*/
public static String getShortClassName(String className) {
if (className == null) {
return STRING_EMPTY;
}
if (className.length() == 0) {
return STRING_EMPTY;
}
StringBuilder arrayPrefix = new StringBuilder();
// Handle array encoding
if (className.startsWith("[")) {
while (className.charAt(0) == '[') {
className = className.substring(1);
arrayPrefix.append("[]");
}
// Strip Object type encoding
if (className.charAt(0) == 'L' && className.charAt(className.length() - 1) == ';') {
className = className.substring(1, className.length() - 1);
}
}
if (reverseAbbreviationMap.containsKey(className)) {
className = reverseAbbreviationMap.get(className);
}
int lastDotIdx = className.lastIndexOf(PACKAGE_SEPARATOR_CHAR);
int innerIdx = className.indexOf(
INNER_CLASS_SEPARATOR_CHAR, lastDotIdx == -1 ? 0 : lastDotIdx + 1);
String out = className.substring(lastDotIdx + 1);
if (innerIdx != -1) {
out = out.replace(INNER_CLASS_SEPARATOR_CHAR, PACKAGE_SEPARATOR_CHAR);
}
return out + arrayPrefix;
}
/**
* Null-safe version of aClass.getSimpleName()
*
* @param cls the class for which to get the simple name.
* @return the simple class name.
* @since 3.0
* @see Class#getSimpleName()
*/
public static String getSimpleName(Class cls) {
if (cls == null) {
return STRING_EMPTY;
}
return cls.getSimpleName();
}
/**
* Null-safe version of aClass.getSimpleName()
*
* @param object the object for which to get the simple class name.
* @param valueIfNull the value to return if object is null
* @return the simple class name.
* @since 3.0
* @see Class#getSimpleName()
*/
public static String getSimpleName(Object object, String valueIfNull) {
if (object == null) {
return valueIfNull;
}
return getSimpleName(object.getClass());
}
// Package name
// ----------------------------------------------------------------------
/**
* Gets the package name of an {@code Object}.
*
* @param object the class to get the package name for, may be null
* @param valueIfNull the value to return if null
* @return the package name of the object, or the null value
*/
public static String getPackageName(Object object, String valueIfNull) {
if (object == null) {
return valueIfNull;
}
return getPackageName(object.getClass());
}
/**
* Gets the package name of a {@code Class}.
*
* @param cls the class to get the package name for, may be {@code null}.
* @return the package name or an empty string
*/
public static String getPackageName(Class cls) {
if (cls == null) {
return STRING_EMPTY;
}
return getPackageName(cls.getName());
}
/**
* Gets the package name from a {@code String}.
*
* The string passed in is assumed to be a class name - it is not checked.
* If the class is unpackaged, return an empty string.
*
* @param className the className to get the package name for, may be {@code null}
* @return the package name or an empty string
*/
public static String getPackageName(String className) {
if (className == null || className.length() == 0) {
return STRING_EMPTY;
}
// Strip array encoding
while (className.charAt(0) == '[') {
className = className.substring(1);
}
// Strip Object type encoding
if (className.charAt(0) == 'L' && className.charAt(className.length() - 1) == ';') {
className = className.substring(1);
}
int i = className.lastIndexOf(PACKAGE_SEPARATOR_CHAR);
if (i == -1) {
return STRING_EMPTY;
}
return className.substring(0, i);
}
// Superclasses/Superinterfaces
// ----------------------------------------------------------------------
/**
* Gets a {@code List} of superclasses for the given class.
*
* @param cls the class to look up, may be {@code null}
* @return the {@code List} of superclasses in order going up from this one
* {@code null} if null input
*/
public static List> getAllSuperclasses(Class cls) {
if (cls == null) {
return null;
}
List> classes = new ArrayList>();
Class superclass = cls.getSuperclass();
while (superclass != null) {
classes.add(superclass);
superclass = superclass.getSuperclass();
}
return classes;
}
/**
* Gets a {@code List} of all interfaces implemented by the given
* class and its superclasses.
*
* The order is determined by looking through each interface in turn as
* declared in the source file and following its hierarchy up. Then each
* superclass is considered in the same way. Later duplicates are ignored,
* so the order is maintained.
*
* @param cls the class to look up, may be {@code null}
* @return the {@code List} of interfaces in order,
* {@code null} if null input
*/
public static List> getAllInterfaces(Class cls) {
if (cls == null) {
return null;
}
LinkedHashSet> interfacesFound = new LinkedHashSet>();
getAllInterfaces(cls, interfacesFound);
return new ArrayList>(interfacesFound);
}
/**
* Get the interfaces for the specified class.
*
* @param cls the class to look up, may be {@code null}
* @param interfacesFound the {@code Set} of interfaces for the class
*/
private static void getAllInterfaces(Class cls, HashSet> interfacesFound) {
while (cls != null) {
Class[] interfaces = cls.getInterfaces();
for (Class i : interfaces) {
if (interfacesFound.add(i)) {
getAllInterfaces(i, interfacesFound);
}
}
cls = cls.getSuperclass();
}
}
// Convert list
// ----------------------------------------------------------------------
/**
* Given a {@code List} of class names, this method converts them into classes.
*
* A new {@code List} is returned. If the class name cannot be found, {@code null}
* is stored in the {@code List}. If the class name in the {@code List} is
* {@code null}, {@code null} is stored in the output {@code List}.
*
* @param classNames the classNames to change
* @return a {@code List} of Class objects corresponding to the class names,
* {@code null} if null input
* @throws ClassCastException if classNames contains a non String entry
*/
public static List> convertClassNamesToClasses(List classNames) {
if (classNames == null) {
return null;
}
List> classes = new ArrayList>(classNames.size());
for (String className : classNames) {
try {
classes.add(Class.forName(className));
} catch (Exception ex) {
classes.add(null);
}
}
return classes;
}
/**
* Given a {@code List} of {@code Class} objects, this method converts
* them into class names.
*
* A new {@code List} is returned. {@code null} objects will be copied into
* the returned list as {@code null}.
*
* @param classes the classes to change
* @return a {@code List} of class names corresponding to the Class objects,
* {@code null} if null input
* @throws ClassCastException if {@code classes} contains a non-{@code Class} entry
*/
public static List convertClassesToClassNames(List> classes) {
if (classes == null) {
return null;
}
List classNames = new ArrayList(classes.size());
for (Class cls : classes) {
if (cls == null) {
classNames.add(null);
} else {
classNames.add(cls.getName());
}
}
return classNames;
}
// Class loading
// ----------------------------------------------------------------------
/**
* Returns the class represented by {@code className} using the
* {@code classLoader}. This implementation supports the syntaxes
* "{@code java.util.Map.Entry[]}", "{@code java.util.Map$Entry[]}",
* "{@code [Ljava.util.Map.Entry;}", and "{@code [Ljava.util.Map$Entry;}".
*
* @param classLoader the class loader to use to load the class
* @param className the class name
* @param initialize whether the class must be initialized
* @return the class represented by {@code className} using the {@code classLoader}
* @throws ClassNotFoundException if the class is not found
*/
public static Class getClass(
ClassLoader classLoader, String className, boolean initialize) throws ClassNotFoundException {
try {
Class clazz;
if (abbreviationMap.containsKey(className)) {
String clsName = "[" + abbreviationMap.get(className);
clazz = Class.forName(clsName, initialize, classLoader).getComponentType();
} else {
clazz = Class.forName(toCanonicalName(className), initialize, classLoader);
}
return clazz;
} catch (ClassNotFoundException ex) {
// allow path separators (.) as inner class name separators
int lastDotIndex = className.lastIndexOf(PACKAGE_SEPARATOR_CHAR);
if (lastDotIndex != -1) {
try {
return getClass(classLoader, className.substring(0, lastDotIndex) +
INNER_CLASS_SEPARATOR_CHAR + className.substring(lastDotIndex + 1),
initialize);
} catch (ClassNotFoundException ex2) { // NOPMD
// ignore exception
}
}
throw ex;
}
}
/**
* Returns the (initialized) class represented by {@code className}
* using the {@code classLoader}. This implementation supports
* the syntaxes "{@code java.util.Map.Entry[]}",
* "{@code java.util.Map$Entry[]}", "{@code [Ljava.util.Map.Entry;}",
* and "{@code [Ljava.util.Map$Entry;}".
*
* @param classLoader the class loader to use to load the class
* @param className the class name
* @return the class represented by {@code className} using the {@code classLoader}
* @throws ClassNotFoundException if the class is not found
*/
public static Class getClass(ClassLoader classLoader, String className) throws ClassNotFoundException {
return getClass(classLoader, className, true);
}
/**
* Returns the (initialized) class represented by {@code className}
* using the current thread's context class loader. This implementation
* supports the syntaxes "{@code java.util.Map.Entry[]}",
* "{@code java.util.Map$Entry[]}", "{@code [Ljava.util.Map.Entry;}",
* and "{@code [Ljava.util.Map$Entry;}".
*
* @param className the class name
* @return the class represented by {@code className} using the current thread's context class loader
* @throws ClassNotFoundException if the class is not found
*/
public static Class getClass(String className) throws ClassNotFoundException {
return getClass(className, true);
}
/**
* Returns the class represented by {@code className} using the
* current thread's context class loader. This implementation supports the
* syntaxes "{@code java.util.Map.Entry[]}", "{@code java.util.Map$Entry[]}",
* "{@code [Ljava.util.Map.Entry;}", and "{@code [Ljava.util.Map$Entry;}".
*
* @param className the class name
* @param initialize whether the class must be initialized
* @return the class represented by {@code className} using the current thread's context class loader
* @throws ClassNotFoundException if the class is not found
*/
public static Class getClass(String className, boolean initialize) throws ClassNotFoundException {
ClassLoader contextCL = Thread.currentThread().getContextClassLoader();
ClassLoader loader = contextCL == null ? ClassUtils.class.getClassLoader() : contextCL;
return getClass(loader, className, initialize);
}
// ----------------------------------------------------------------------
/**
* Converts a class name to a JLS style class name.
*
* @param className the class name
* @return the converted name
*/
private static String toCanonicalName(String className) {
className = deleteWhitespace(className);
if (className == null) {
throw new NullPointerException("className must not be null.");
} else if (className.endsWith("[]")) {
StringBuilder classNameBuffer = new StringBuilder();
while (className.endsWith("[]")) {
className = className.substring(0, className.length() - 2);
classNameBuffer.append("[");
}
String abbreviation = abbreviationMap.get(className);
if (abbreviation != null) {
classNameBuffer.append(abbreviation);
} else {
classNameBuffer.append("L").append(className).append(";");
}
className = classNameBuffer.toString();
}
return className;
}
/**
* Converts an array of {@code Object} in to an array of {@code Class} objects.
* If any of these objects is null, a null element will be inserted into the array.
*
* This method returns {@code null} for a {@code null} input array.
*
* @param array an {@code Object} array
* @return a {@code Class} array, {@code null} if null array input
* @since 2.4
*/
public static Class[] toClass(Object... array) {
if (array == null) {
return null;
} else if (array.length == 0) {
return new Class[0];
}
Class[] classes = new Class[array.length];
for (int i = 0; i < array.length; i++) {
classes[i] = array[i] == null ? null : array[i].getClass();
}
return classes;
}
// Delete
//-----------------------------------------------------------------------
/**
* Deletes all whitespaces from a String as defined by
* {@link Character#isWhitespace(char)}.
*
*
* StringUtils.deleteWhitespace(null) = null
* StringUtils.deleteWhitespace("") = ""
* StringUtils.deleteWhitespace("abc") = "abc"
* StringUtils.deleteWhitespace(" ab c ") = "abc"
*
*
* @param str the String to delete whitespace from, may be null
* @return the String without whitespaces, {@code null} if null String input
*/
public static String deleteWhitespace(String str) {
if (isEmpty(str)) {
return str;
}
int sz = str.length();
char[] chs = new char[sz];
int count = 0;
for (int i = 0; i < sz; i++) {
if (!Character.isWhitespace(str.charAt(i))) {
chs[count++] = str.charAt(i);
}
}
if (count == sz) {
return str;
}
return new String(chs, 0, count);
}
// Empty checks
//-----------------------------------------------------------------------
/**
* Checks if a CharSequence is empty ("") or null.
*
*
* StringUtils.isEmpty(null) = true
* StringUtils.isEmpty("") = true
* StringUtils.isEmpty(" ") = false
* StringUtils.isEmpty("bob") = false
* StringUtils.isEmpty(" bob ") = false
*
*
* NOTE: This method changed in Lang version 2.0.
* It no longer trims the CharSequence.
* That functionality is available in isBlank().
*
* @param cs the CharSequence to check, may be null
* @return {@code true} if the CharSequence is empty or null
* @since 3.0 Changed signature from isEmpty(String) to isEmpty(CharSequence)
*/
public static boolean isEmpty(CharSequence cs) {
return cs == null || cs.length() == 0;
}
}
================================================
FILE: library/src/main/java/com/taobao/android/dexposed/DeviceCheck.java
================================================
/*
* Original work Copyright (c) 2005-2008, The Android Open Source Project
* Modified work Copyright (c) 2013, rovo89 and Tungstwenty
* Modified work Copyright (c) 2015, Alibaba Mobile Infrastructure (Android) Team
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.taobao.android.dexposed;
import android.annotation.SuppressLint;
import android.content.Context;
import android.util.Log;
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
public class DeviceCheck {
private static final String SELECT_RUNTIME_PROPERTY = "persist.sys.dalvik.vm.lib";
private static final String LIB_DALVIK = "libdvm.so";
private static final String LIB_ART = "libart.so";
private static final String LIB_ART_D = "libartd.so";
private static boolean isCheckedDeviceSupport = false;
private static boolean isDeviceSupportable = false;
private static boolean isDalvikMode() {
String vmMode = getCurrentRuntimeValue();
if("Dalvik".equals(vmMode)){
return true;
}
return false;
}
private static String getCurrentRuntimeValue() {
try {
Class systemProperties = Class
.forName("android.os.SystemProperties");
try {
Method get = systemProperties.getMethod("get", String.class,
String.class);
if (get == null) {
return "WTF?!";
}
try {
final String value = (String) get.invoke(systemProperties,
SELECT_RUNTIME_PROPERTY,
/* Assuming default is */"Dalvik");
if (LIB_DALVIK.equals(value)) {
return "Dalvik";
} else if (LIB_ART.equals(value)) {
return "ART";
} else if (LIB_ART_D.equals(value)) {
return "ART debug build";
}
return value;
} catch (IllegalAccessException e) {
return "IllegalAccessException";
} catch (IllegalArgumentException e) {
return "IllegalArgumentException";
} catch (InvocationTargetException e) {
return "InvocationTargetException";
}
} catch (NoSuchMethodException e) {
return "SystemProperties.get(String key, String def) method is not found";
}
} catch (ClassNotFoundException e) {
return "SystemProperties class is not found";
}
}
private static boolean isSupportSDKVersion() {
if (android.os.Build.VERSION.SDK_INT >= 14 && android.os.Build.VERSION.SDK_INT < 20) {
return true;
} else if(android.os.Build.VERSION.SDK_INT == 10 || android.os.Build.VERSION.SDK_INT == 9){
return true;
}
return false;
}
private static boolean isX86CPU() {
Process process = null;
String abi = null;
InputStreamReader ir = null;
BufferedReader input = null;
try {
process = Runtime.getRuntime().exec("getprop ro.product.cpu.abi");
ir = new InputStreamReader(process.getInputStream());
input = new BufferedReader(ir);
abi = input.readLine();
if (abi.contains("x86")) {
return true;
}
} catch (Exception e) {
} finally {
if (input != null) {
try {
input.close();
} catch (Exception e) {
}
}
if (ir != null) {
try {
ir.close();
} catch (Exception e) {
}
}
if (process != null) {
try {
process.destroy();
} catch (Exception e) {
}
}
}
return false;
}
public static synchronized boolean isDeviceSupport(Context context) {
// return memory checked value.
try {
if (isCheckedDeviceSupport)
return isDeviceSupportable;
if (!isX86CPU() && !isYunOS()) {
isDeviceSupportable = true;
} else {
isDeviceSupportable = false;
}
} finally {
Log.d("hotpatch", "device support is " + isDeviceSupportable + "checked" + isCheckedDeviceSupport);
isCheckedDeviceSupport = true;
}
return isDeviceSupportable;
}
@SuppressLint("DefaultLocale")
public static boolean isYunOS() {
String s1 = null;
String s2 = null;
try {
Method m = Class.forName("android.os.SystemProperties").getMethod(
"get", String.class);
s1 = (String) m.invoke(null, "ro.yunos.version");
s2 = (String) m.invoke(null, "java.vm.name");
} catch (NoSuchMethodException a) {
} catch (ClassNotFoundException b) {
} catch (IllegalAccessException c) {
} catch (InvocationTargetException d) {
}
if ((s2 != null && s2.toLowerCase().contains("lemur")) || (s1 != null && s1.trim().length() > 0)) {
return true;
} else {
return false;
}
}
}
================================================
FILE: library/src/main/java/com/taobao/android/dexposed/utility/Debug.java
================================================
/*
* Original work Copyright (c) 2014-2015, Marvin Wißfeld
* Modified work Copyright (c) 2016, Alibaba Mobile Infrastructure (Android) Team
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.taobao.android.dexposed.utility;
import android.util.Log;
import java.io.BufferedReader;
import java.io.FileReader;
import java.io.IOException;
import java.lang.reflect.Method;
import me.weishu.epic.BuildConfig;
import me.weishu.epic.art.method.ArtMethod;
public final class Debug {
private static final String TAG = "Dexposed";
public static final boolean DEBUG = BuildConfig.DEBUG;
private static final String RELASE_WRAN_STRING = "none in release mode.";
private Debug() {
}
public static String addrHex(long i) {
if (!DEBUG) {
return RELASE_WRAN_STRING;
}
if (Runtime.is64Bit()) {
return longHex(i);
} else {
return intHex((int) i);
}
}
public static String longHex(long i) {
return String.format("0x%016X", i);
}
public static String intHex(int i) {
return String.format("0x%08X", i);
}
public static String byteHex(byte b) {
return String.format("%02X", b);
}
public static String dump(byte[] b, long start) {
StringBuffer sb = new StringBuffer();
for (int i = 0; i < b.length; i++) {
if (i % 8 == 0) {
sb.append(addrHex(start + i)).append(":");
}
sb.append(byteHex(b[i])).append(" ");
if (i % 8 == 7) {
sb.append("\n");
}
}
return sb.toString();
}
public static String hexdump(byte[] bytes, long start) {
if (!DEBUG) {
return RELASE_WRAN_STRING;
}
StringBuffer sb = new StringBuffer();
for (int i = 0; i < bytes.length; i++) {
if (i % 8 == 0) {
sb.append(addrHex(start + i)).append(":");
}
sb.append(byteHex(bytes[i])).append(" ");
if (i % 8 == 7) {
sb.append("\n");
}
}
return sb.toString();
}
public static String methodDescription(Method method) {
return method.getDeclaringClass().getName() + "->" + method.getName() + " @" +
addrHex(ArtMethod.of(method).getEntryPointFromQuickCompiledCode()) +
" +" + addrHex(ArtMethod.of(method).getAddress());
}
public static void dumpMaps() {
BufferedReader br = null;
try {
br = new BufferedReader(new FileReader("/proc/self/maps"));
String line;
while ((line = br.readLine()) != null) {
Log.i(TAG, line);
}
} catch (IOException e) {
Log.e(TAG, "dumpMaps error");
} finally {
if (br != null) {
try {
br.close();
} catch (IOException e) {
// ignore.
}
}
}
}
}
================================================
FILE: library/src/main/java/com/taobao/android/dexposed/utility/Logger.java
================================================
package com.taobao.android.dexposed.utility;
import android.util.Log;
/**
* Created by weishu on 17/11/10.
*/
public class Logger {
private static final boolean DEBUG = Debug.DEBUG;
public static final String preFix = "epic.";
public static void i(String tag, String msg) {
if (DEBUG) {
Log.i(preFix + tag, msg);
}
}
public static void d(String tagSuffix, String msg) {
if (DEBUG) {
Log.d(preFix + tagSuffix, msg);
}
}
public static void w(String tag, String msg) {
Log.w(preFix + tag, msg);
}
public static void e(String tag, String msg) {
if (DEBUG) {
Log.e(preFix + tag, msg);
}
}
public static void e(String tag, String msg, Throwable e) {
if (DEBUG) {
Log.e(preFix + tag, msg, e);
}
}
}
================================================
FILE: library/src/main/java/com/taobao/android/dexposed/utility/NeverCalled.java
================================================
package com.taobao.android.dexposed.utility;
import android.util.Log;
/**
* This Class is used for get the art_quick_to_interpreter_bridge address
* Do not call this forever!!!
*/
public class NeverCalled {
private void fake(int a) {
Log.i(getClass().getSimpleName(), a + "Do not inline me!!");
}
}
================================================
FILE: library/src/main/java/com/taobao/android/dexposed/utility/NougatPolicy.java
================================================
package com.taobao.android.dexposed.utility;
import android.content.Context;
import android.os.SystemClock;
import android.util.Log;
import java.lang.reflect.Method;
public class NougatPolicy {
private static class TraceLogger {
static void i(String tag, String msg) {
Log.i(tag, msg);
}
static void e(String tag, String msg) {
Log.i(tag, msg);
}
static void e(String tag, String msg, Throwable e) {
Log.i(tag, msg, e);
}
}
private static final String TAG = "NougatPolicy";
public static boolean fullCompile(Context context) {
try {
long t1 = SystemClock.elapsedRealtime();
Object pm = getPackageManagerBinderProxy();
if (pm == null) {
TraceLogger.e(TAG, "can not found package service");
return false;
}
/*
@Override
public boolean performDexOptMode(String packageName,
boolean checkProfiles, String targetCompilerFilter, boolean force) {
int dexOptStatus = performDexOptTraced(packageName, checkProfiles,
targetCompilerFilter, force);
return dexOptStatus != PackageDexOptimizer.DEX_OPT_FAILED;
*/
final Method performDexOptMode = pm.getClass().getDeclaredMethod("performDexOptMode",
String.class, boolean.class, String.class, boolean.class);
boolean ret = (boolean) performDexOptMode.invoke(pm, context.getPackageName(), false, "speed", true);
long cost = SystemClock.elapsedRealtime() - t1;
Log.i(TAG, "full Compile cost: " + cost + " result:" + ret);
return ret;
} catch (Throwable e) {
TraceLogger.e(TAG, "fullCompile failed:", e);
return false;
}
}
public static boolean clearCompileData(Context context) {
boolean ret;
try {
Object pm = getPackageManagerBinderProxy();
final Method performDexOpt = pm.getClass().getDeclaredMethod("performDexOpt", String.class,
boolean.class, int.class, boolean.class);
ret = (Boolean) performDexOpt.invoke(pm, context.getPackageName(), false, 2 /*install*/, true);
} catch (Throwable e) {
TraceLogger.e(TAG, "clear compile data failed", e);
ret = false;
}
return ret;
}
private static Object getPackageManagerBinderProxy() throws Exception {
Class activityThread = Class.forName("android.app.ActivityThread");
final Method getPackageManager = activityThread.getDeclaredMethod("getPackageManager");
return getPackageManager.invoke(null);
}
}
================================================
FILE: library/src/main/java/com/taobao/android/dexposed/utility/Platform.java
================================================
/*
* Original work Copyright (c) 2016, Lody
* Modified work Copyright (c) 2016, Alibaba Mobile Infrastructure (Android) Team
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.taobao.android.dexposed.utility;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
public abstract class Platform {
/*package*/ static Platform PLATFORM_INTERNAL;
static {
if (Runtime.is64Bit()) {
PLATFORM_INTERNAL = new Platform64Bit();
}else {
PLATFORM_INTERNAL = new Platform32Bit();
}
}
public static Platform getPlatform() {
return PLATFORM_INTERNAL;
}
/**
* Convert a byte array to int,
* Use this function to get address from memory.
*
* @param data byte array
* @return long
*/
public abstract int orderByteToInt(byte[] data);
/**
* Convert a byte array to long,
* Use this function to get address from memory.
*
* @param data byte array
* @return long
*/
public abstract long orderByteToLong(byte[] data);
public abstract byte[] orderLongToByte(long serial, int length);
public abstract byte[] orderIntToByte(int serial);
public abstract int getIntSize();
static class Platform32Bit extends Platform {
@Override
public int orderByteToInt(byte[] data) {
return ByteBuffer.wrap(data).order(ByteOrder.LITTLE_ENDIAN).getInt();
}
@Override
public long orderByteToLong(byte[] data) {
return ByteBuffer.wrap(data).order(ByteOrder.LITTLE_ENDIAN).getInt() & 0xFFFFFFFFL;
}
@Override
public byte[] orderLongToByte(long serial, int length) {
return ByteBuffer.allocate(length).order(ByteOrder.LITTLE_ENDIAN).putInt((int) serial).array();
}
@Override
public byte[] orderIntToByte(int serial) {
return ByteBuffer.allocate(4).order(ByteOrder.LITTLE_ENDIAN).putInt(serial).array();
}
@Override
public int getIntSize() {
return 4;
}
}
static class Platform64Bit extends Platform {
@Override
public int orderByteToInt(byte[] data) {
return ByteBuffer.wrap(data).order(ByteOrder.LITTLE_ENDIAN).getInt();
}
@Override
public long orderByteToLong(byte[] data) {
return ByteBuffer.wrap(data).order(ByteOrder.LITTLE_ENDIAN).getLong();
}
@Override
public byte[] orderLongToByte(long serial, int length) {
return ByteBuffer.allocate(length).order(ByteOrder.LITTLE_ENDIAN).putLong(serial).array();
}
@Override
public byte[] orderIntToByte(int serial) {
return ByteBuffer.allocate(4).order(ByteOrder.LITTLE_ENDIAN).putInt(serial).array();
}
@Override
public int getIntSize() {
return 8;
}
}
}
================================================
FILE: library/src/main/java/com/taobao/android/dexposed/utility/Runtime.java
================================================
/*
* Original work Copyright (c) 2016, Lody
* Modified work Copyright (c) 2016, Alibaba Mobile Infrastructure (Android) Team
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.taobao.android.dexposed.utility;
import android.util.Log;
import java.lang.reflect.Method;
import me.weishu.epic.art.method.ArtMethod;
public class Runtime {
private static final String TAG = "Runtime";
private volatile static Boolean isThumb = null;
private volatile static boolean g64 = false;
private volatile static boolean isArt = true;
static {
try {
g64 = (boolean) Class.forName("dalvik.system.VMRuntime").getDeclaredMethod("is64Bit").invoke(Class.forName("dalvik.system.VMRuntime").getDeclaredMethod("getRuntime").invoke(null));
} catch (Exception e) {
Log.e(TAG, "get is64Bit failed, default not 64bit!", e);
g64 = false;
}
isArt = System.getProperty("java.vm.version").startsWith("2");
Log.i(TAG, "is64Bit: " + g64 + ", isArt: " + isArt);
}
public static boolean is64Bit() {
return g64;
}
public static boolean isArt() {
return isArt;
}
public static boolean isThumb2() {
if (isThumb != null) {
return isThumb;
}
try {
Method method = String.class.getDeclaredMethod("hashCode");
ArtMethod artMethodStruct = ArtMethod.of(method);
long entryPointFromQuickCompiledCode = artMethodStruct.getEntryPointFromQuickCompiledCode();
Logger.w("Runtime", "isThumb2, entry: " + Long.toHexString(entryPointFromQuickCompiledCode));
isThumb = ((entryPointFromQuickCompiledCode & 1) == 1);
return isThumb;
} catch (Throwable e) {
Logger.w("Runtime", "isThumb2, error: " + e);
return true; // Default Thumb2.
}
}
}
================================================
FILE: library/src/main/java/com/taobao/android/dexposed/utility/Unsafe.java
================================================
/*
* Copyright 2014-2015 Marvin Wißfeld
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.taobao.android.dexposed.utility;
import android.util.Log;
import java.lang.reflect.Field;
public final class Unsafe {
private static final String TAG = "Unsafe";
private static Object unsafe;
private static Class unsafeClass;
static {
try {
unsafeClass = Class.forName("sun.misc.Unsafe");
Field theUnsafe = unsafeClass.getDeclaredField("theUnsafe");
theUnsafe.setAccessible(true);
unsafe = theUnsafe.get(null);
} catch (Exception e) {
try {
final Field theUnsafe = unsafeClass.getDeclaredField("THE_ONE");
theUnsafe.setAccessible(true);
unsafe = theUnsafe.get(null);
} catch (Exception e2) {
Log.w(TAG, "Unsafe not found o.O");
}
}
}
private Unsafe() {
}
@SuppressWarnings("unchecked")
public static int arrayBaseOffset(Class cls) {
try {
return (int) unsafeClass.getDeclaredMethod("arrayBaseOffset", Class.class).invoke(unsafe, cls);
} catch (Exception e) {
Log.w(TAG, e);
return 0;
}
}
@SuppressWarnings("unchecked")
public static int arrayIndexScale(Class cls) {
try {
return (int) unsafeClass.getDeclaredMethod("arrayIndexScale", Class.class).invoke(unsafe, cls);
} catch (Exception e) {
Log.w(TAG, e);
return 0;
}
}
@SuppressWarnings("unchecked")
public static long objectFieldOffset(Field field) {
try {
return (long) unsafeClass.getDeclaredMethod("objectFieldOffset", Field.class).invoke(unsafe, field);
} catch (Exception e) {
Log.w(TAG, e);
return 0;
}
}
@SuppressWarnings("unchecked")
public static int getInt(Object array, long offset) {
try {
return (int) unsafeClass.getDeclaredMethod("getInt", Object.class, long.class).invoke(unsafe, array, offset);
} catch (Exception e) {
Log.w(TAG, e);
return 0;
}
}
@SuppressWarnings("unchecked")
public static long getLong(Object array, long offset) {
try {
return (long) unsafeClass.getDeclaredMethod("getLong", Object.class, long.class).invoke(unsafe, array, offset);
} catch (Exception e) {
Log.w(TAG, e);
return 0;
}
}
@SuppressWarnings("unchecked")
public static void putLong(Object array, long offset, long value) {
try {
unsafeClass.getDeclaredMethod("putLongVolatile", Object.class, long.class, long.class).invoke(unsafe, array, offset, value);
} catch (Exception e) {
try {
unsafeClass.getDeclaredMethod("putLong", Object.class, long.class, long.class).invoke(unsafe, array, offset, value);
} catch (Exception e1) {
Log.w(TAG, e);
}
}
}
@SuppressWarnings("unchecked")
public static void putInt(Object array, long offset, int value) {
try {
unsafeClass.getDeclaredMethod("putIntVolatile", Object.class, long.class, int.class).invoke(unsafe, array, offset, value);
} catch (Exception e) {
try {
unsafeClass.getDeclaredMethod("putIntVolatile", Object.class, long.class, int.class).invoke(unsafe, array, offset, value);
} catch (Exception e1) {
Log.w(TAG, e);
}
}
}
public static long getObjectAddress(Object obj) {
try {
Object[] array = new Object[]{obj};
if (arrayIndexScale(Object[].class) == 8) {
return getLong(array, arrayBaseOffset(Object[].class));
} else {
return 0xffffffffL & getInt(array, arrayBaseOffset(Object[].class));
}
} catch (Exception e) {
Log.w(TAG, e);
return -1;
}
}
/**
* get Object from address, refer: http://mishadoff.com/blog/java-magic-part-4-sun-dot-misc-dot-unsafe/
* @param address the address of a object.
* @return
*/
public static Object getObject(long address) {
Object[] array = new Object[]{null};
long baseOffset = arrayBaseOffset(Object[].class);
if (Runtime.is64Bit()) {
putLong(array, baseOffset, address);
} else {
putInt(array, baseOffset, (int) address);
}
return array[0];
}
}
================================================
FILE: library/src/main/java/de/robv/android/xposed/DexposedBridge.java
================================================
/*
* Original work Copyright (c) 2005-2008, The Android Open Source Project
* Modified work Copyright (c) 2013, rovo89 and Tungstwenty
* Modified work Copyright (c) 2015, Alibaba Mobile Infrastructure (Android) Team
* Modified work Copyright (c) 2017, weishu
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package de.robv.android.xposed;
import android.app.AndroidAppHelper;
import android.os.Build;
import android.util.Log;
import com.taobao.android.dexposed.utility.Logger;
import com.taobao.android.dexposed.utility.Runtime;
import java.lang.reflect.AccessibleObject;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Member;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import me.weishu.epic.art.Epic;
import me.weishu.epic.art.method.ArtMethod;
import me.weishu.reflection.Reflection;
import static de.robv.android.xposed.XposedHelpers.getIntField;
public final class DexposedBridge {
static {
try {
if (android.os.Build.VERSION.SDK_INT > Build.VERSION_CODES.KITKAT) {
System.loadLibrary("epic");
} else if (android.os.Build.VERSION.SDK_INT > Build.VERSION_CODES.ICE_CREAM_SANDWICH){
System.loadLibrary("dexposed");
} else {
throw new RuntimeException("unsupported api level: " + Build.VERSION.SDK_INT);
}
Reflection.unseal(AndroidAppHelper.currentApplication());
} catch (Throwable e) {
log(e);
}
}
private static final String TAG = "DexposedBridge";
private static final Object[] EMPTY_ARRAY = new Object[0];
public static final ClassLoader BOOTCLASSLOADER = ClassLoader.getSystemClassLoader();
// built-in handlers
private static final Map> hookedMethodCallbacks
= new HashMap>();
private static final ArrayList allUnhookCallbacks = new ArrayList();
/**
* Writes a message to BASE_DIR/log/debug.log (needs to have chmod 777)
* @param text log message
*/
public synchronized static void log(String text) {
Log.i(TAG, text);
}
/**
* Log the stack trace
* @param t The Throwable object for the stacktrace
* @see DexposedBridge#log(String)
*/
public synchronized static void log(Throwable t) {
log(Log.getStackTraceString(t));
}
/**
* Hook any method with the specified callback
*
* @param hookMethod The method to be hooked
* @param callback
*/
public static XC_MethodHook.Unhook hookMethod(Member hookMethod, XC_MethodHook callback) {
if (!(hookMethod instanceof Method) && !(hookMethod instanceof Constructor)) {
throw new IllegalArgumentException("only methods and constructors can be hooked");
}
boolean newMethod = false;
CopyOnWriteSortedSet callbacks;
synchronized (hookedMethodCallbacks) {
callbacks = hookedMethodCallbacks.get(hookMethod);
if (callbacks == null) {
callbacks = new CopyOnWriteSortedSet();
hookedMethodCallbacks.put(hookMethod, callbacks);
newMethod = true;
}
}
Logger.w(TAG, "hook: " + hookMethod + ", newMethod ? " + newMethod);
callbacks.add(callback);
if (newMethod) {
if (Runtime.isArt()) {
if (hookMethod instanceof Method) {
Epic.hookMethod(((Method) hookMethod));
} else {
Epic.hookMethod(((Constructor) hookMethod));
}
} else {
Class declaringClass = hookMethod.getDeclaringClass();
int slot = getIntField(hookMethod, "slot");
Class[] parameterTypes;
Class returnType;
if (hookMethod instanceof Method) {
parameterTypes = ((Method) hookMethod).getParameterTypes();
returnType = ((Method) hookMethod).getReturnType();
} else {
parameterTypes = ((Constructor) hookMethod).getParameterTypes();
returnType = null;
}
AdditionalHookInfo additionalInfo = new AdditionalHookInfo(callbacks, parameterTypes, returnType);
hookMethodNative(hookMethod, declaringClass, slot, additionalInfo);
}
}
return callback.new Unhook(hookMethod);
}
/**
* Removes the callback for a hooked method
* @param hookMethod The method for which the callback should be removed
* @param callback The reference to the callback as specified in {@link #hookMethod}
*/
public static void unhookMethod(Member hookMethod, XC_MethodHook callback) {
CopyOnWriteSortedSet callbacks;
synchronized (hookedMethodCallbacks) {
callbacks = hookedMethodCallbacks.get(hookMethod);
if (callbacks == null)
return;
}
callbacks.remove(callback);
}
public static Set hookAllMethods(Class hookClass, String methodName, XC_MethodHook callback) {
Set unhooks = new HashSet();
for (Member method : hookClass.getDeclaredMethods())
if (method.getName().equals(methodName))
unhooks.add(hookMethod(method, callback));
return unhooks;
}
public static XC_MethodHook.Unhook findAndHookMethod(Class clazz, String methodName, Object... parameterTypesAndCallback) {
if (parameterTypesAndCallback.length == 0 || !(parameterTypesAndCallback[parameterTypesAndCallback.length-1] instanceof XC_MethodHook))
throw new IllegalArgumentException("no callback defined");
XC_MethodHook callback = (XC_MethodHook) parameterTypesAndCallback[parameterTypesAndCallback.length-1];
Method m = XposedHelpers.findMethodExact(clazz, methodName, parameterTypesAndCallback);
XC_MethodHook.Unhook unhook = hookMethod(m, callback);
synchronized (allUnhookCallbacks) {
allUnhookCallbacks.add(unhook);
}
return unhook;
}
public static void unhookAllMethods() {
synchronized (allUnhookCallbacks) {
for (int i = 0; i < allUnhookCallbacks.size(); i++) {
((XC_MethodHook.Unhook) allUnhookCallbacks.get(i)).unhook();
}
allUnhookCallbacks.clear();
}
}
public static Set hookAllConstructors(Class hookClass, XC_MethodHook callback) {
Set unhooks = new HashSet();
for (Member constructor : hookClass.getDeclaredConstructors())
unhooks.add(hookMethod(constructor, callback));
return unhooks;
}
public static Object handleHookedArtMethod(Object artMethodObject, Object thisObject, Object[] args) {
CopyOnWriteSortedSet callbacks;
ArtMethod artmethod = (ArtMethod ) artMethodObject;
synchronized (hookedMethodCallbacks) {
callbacks = hookedMethodCallbacks.get(artmethod.getExecutable());
}
Object[] callbacksSnapshot = callbacks.getSnapshot();
final int callbacksLength = callbacksSnapshot.length;
//Logger.d(TAG, "callbacksLength:" + callbacksLength + ", this:" + thisObject + ", args:" + Arrays.toString(args));
if (callbacksLength == 0) {
try {
ArtMethod method = Epic.getBackMethod(artmethod);
return method.invoke(thisObject, args);
} catch (Exception e) {
log(e.getCause());
}
}
XC_MethodHook.MethodHookParam param = new XC_MethodHook.MethodHookParam();
param.method = (Member) (artmethod).getExecutable();
param.thisObject = thisObject;
param.args = args;
// call "before method" callbacks
int beforeIdx = 0;
do {
try {
((XC_MethodHook) callbacksSnapshot[beforeIdx]).beforeHookedMethod(param);
} catch (Throwable t) {
log(t);
// reset result (ignoring what the unexpectedly exiting callback did)
param.setResult(null);
param.returnEarly = false;
continue;
}
if (param.returnEarly) {
// skip remaining "before" callbacks and corresponding "after" callbacks
beforeIdx++;
break;
}
} while (++beforeIdx < callbacksLength);
// call original method if not requested otherwise
if (!param.returnEarly) {
try {
ArtMethod method = Epic.getBackMethod(artmethod);
Object result = method.invoke(thisObject, args);
param.setResult(result);
} catch (Exception e) {
// log(e); origin throw exception is normal.
param.setThrowable(e);
}
}
// call "after method" callbacks
int afterIdx = beforeIdx - 1;
do {
Object lastResult = param.getResult();
Throwable lastThrowable = param.getThrowable();
try {
((XC_MethodHook) callbacksSnapshot[afterIdx]).afterHookedMethod(param);
} catch (Throwable t) {
DexposedBridge.log(t);
// reset to last result (ignoring what the unexpectedly exiting callback did)
if (lastThrowable == null)
param.setResult(lastResult);
else
param.setThrowable(lastThrowable);
}
} while (--afterIdx >= 0);
if (param.hasThrowable()) {
final Throwable throwable = param.getThrowable();
if (throwable instanceof IllegalAccessException || throwable instanceof InvocationTargetException
|| throwable instanceof InstantiationException) {
// reflect exception, get the origin cause
final Throwable cause = throwable.getCause();
// We can not change the exception flow of origin call, rethrow
// Logger.e(TAG, "origin call throw exception (not a real crash, just record for debug):", cause);
DexposedBridge.throwNoCheck(param.getThrowable().getCause(), null);
return null; //never reach.
} else {
// the exception cause by epic self, just log.
Logger.e(TAG, "epic cause exception in call bridge!!", throwable);
}
return null; // never reached.
} else {
final Object result = param.getResult();
//Logger.d(TAG, "return :" + result);
return result;
}
}
/**
* Just for throw an checked exception without check
* @param exception The checked exception.
* @param dummy dummy.
* @param fake type
* @throws T the checked exception.
*/
@SuppressWarnings("unchecked")
private static void throwNoCheck(Throwable exception, Object dummy) throws T {
throw (T) exception;
}
/**
* This method is called as a replacement for hooked methods.
*/
private static Object handleHookedMethod(Member method, int originalMethodId, Object additionalInfoObj,
Object thisObject, Object[] args) throws Throwable {
AdditionalHookInfo additionalInfo = (AdditionalHookInfo) additionalInfoObj;
Object[] callbacksSnapshot = additionalInfo.callbacks.getSnapshot();
final int callbacksLength = callbacksSnapshot.length;
if (callbacksLength == 0) {
try {
return invokeOriginalMethodNative(method, originalMethodId, additionalInfo.parameterTypes,
additionalInfo.returnType, thisObject, args);
} catch (InvocationTargetException e) {
throw e.getCause();
}
}
XC_MethodHook.MethodHookParam param = new XC_MethodHook.MethodHookParam();
param.method = method;
param.thisObject = thisObject;
param.args = args;
// call "before method" callbacks
int beforeIdx = 0;
do {
try {
((XC_MethodHook) callbacksSnapshot[beforeIdx]).beforeHookedMethod(param);
} catch (Throwable t) {
log(t);
// reset result (ignoring what the unexpectedly exiting callback did)
param.setResult(null);
param.returnEarly = false;
continue;
}
if (param.returnEarly) {
// skip remaining "before" callbacks and corresponding "after" callbacks
beforeIdx++;
break;
}
} while (++beforeIdx < callbacksLength);
// call original method if not requested otherwise
if (!param.returnEarly) {
try {
param.setResult(invokeOriginalMethodNative(method, originalMethodId,
additionalInfo.parameterTypes, additionalInfo.returnType, param.thisObject, param.args));
} catch (InvocationTargetException e) {
param.setThrowable(e.getCause());
}
}
// call "after method" callbacks
int afterIdx = beforeIdx - 1;
do {
Object lastResult = param.getResult();
Throwable lastThrowable = param.getThrowable();
try {
((XC_MethodHook) callbacksSnapshot[afterIdx]).afterHookedMethod(param);
} catch (Throwable t) {
DexposedBridge.log(t);
// reset to last result (ignoring what the unexpectedly exiting callback did)
if (lastThrowable == null)
param.setResult(lastResult);
else
param.setThrowable(lastThrowable);
}
} while (--afterIdx >= 0);
// return
if (param.hasThrowable())
throw param.getThrowable();
else
return param.getResult();
}
private native static Object invokeSuperNative(Object obj, Object[] args, Member method, Class declaringClass,
Class[] parameterTypes, Class returnType, int slot)
throws IllegalAccessException, IllegalArgumentException,
InvocationTargetException;
public static Object invokeSuper(Object obj, Member method, Object... args) throws NoSuchFieldException {
try {
int slot = 0;
if(!Runtime.isArt()) {
//get the super method slot
Method m = XposedHelpers.findMethodExact(obj.getClass().getSuperclass(), method.getName(), ((Method) method).getParameterTypes());
slot = (int) getIntField(m, "slot");
}
return invokeSuperNative(obj, args, method, method.getDeclaringClass(), ((Method) method).getParameterTypes(), ((Method) method).getReturnType(), slot);
} catch (IllegalAccessException e) {
throw new IllegalAccessError(e.getMessage());
} catch (IllegalArgumentException e) {
throw e;
} catch (InvocationTargetException e) {
throw new XposedHelpers.InvocationTargetError(e.getCause());
}
}
/**
* Intercept every call to the specified method and call a handler function instead.
* @param method The method to intercept
*/
private native synchronized static void hookMethodNative(Member method, Class declaringClass, int slot, Object additionalInfo);
private native static Object invokeOriginalMethodNative(Member method, int methodId,
Class[] parameterTypes, Class returnType, Object thisObject, Object[] args)
throws IllegalAccessException, IllegalArgumentException, InvocationTargetException;
/**
* Basically the same as {@link Method#invoke}, but calls the original method
* as it was before the interception by Xposed. Also, access permissions are not checked.
*
* @param method Method to be called
* @param thisObject For non-static calls, the "this" pointer
* @param args Arguments for the method call as Object[] array
* @return The result returned from the invoked method
* @throws NullPointerException
* if {@code receiver == null} for a non-static method
* @throws IllegalAccessException
* if this method is not accessible (see {@link AccessibleObject})
* @throws IllegalArgumentException
* if the number of arguments doesn't match the number of parameters, the receiver
* is incompatible with the declaring class, or an argument could not be unboxed
* or converted by a widening conversion to the corresponding parameter type
* @throws InvocationTargetException
* if an exception was thrown by the invoked method
*/
public static Object invokeOriginalMethod(Member method, Object thisObject, Object[] args)
throws NullPointerException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
if (args == null) {
args = EMPTY_ARRAY;
}
Class[] parameterTypes;
Class returnType;
if (method instanceof Method) {
parameterTypes = ((Method) method).getParameterTypes();
returnType = ((Method) method).getReturnType();
} else if (method instanceof Constructor) {
parameterTypes = ((Constructor) method).getParameterTypes();
returnType = null;
} else {
throw new IllegalArgumentException("method must be of type Method or Constructor");
}
if (Runtime.isArt()) {
ArtMethod artMethod;
if (method instanceof Method) {
artMethod = ArtMethod.of((Method) method);
} else {
artMethod = ArtMethod.of((Constructor)method);
}
try {
return Epic.getBackMethod(artMethod).invoke(thisObject, args);
} catch (InstantiationException e) {
DexposedBridge.throwNoCheck(e, null);
}
}
return invokeOriginalMethodNative(method, 0, parameterTypes, returnType, thisObject, args);
}
public static class CopyOnWriteSortedSet {
private transient volatile Object[] elements = EMPTY_ARRAY;
public synchronized boolean add(E e) {
int index = indexOf(e);
if (index >= 0)
return false;
Object[] newElements = new Object[elements.length + 1];
System.arraycopy(elements, 0, newElements, 0, elements.length);
newElements[elements.length] = e;
Arrays.sort(newElements);
elements = newElements;
return true;
}
public synchronized boolean remove(E e) {
int index = indexOf(e);
if (index == -1)
return false;
Object[] newElements = new Object[elements.length - 1];
System.arraycopy(elements, 0, newElements, 0, index);
System.arraycopy(elements, index + 1, newElements, index, elements.length - index - 1);
elements = newElements;
return true;
}
public synchronized void clear(){
elements = EMPTY_ARRAY;
}
private int indexOf(Object o) {
for (int i = 0; i < elements.length; i++) {
if (o.equals(elements[i]))
return i;
}
return -1;
}
public Object[] getSnapshot() {
return elements;
}
}
private static class AdditionalHookInfo {
final CopyOnWriteSortedSet callbacks;
final Class[] parameterTypes;
final Class returnType;
private AdditionalHookInfo(CopyOnWriteSortedSet callbacks, Class[] parameterTypes, Class returnType) {
this.callbacks = callbacks;
this.parameterTypes = parameterTypes;
this.returnType = returnType;
}
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/Epic.java
================================================
/*
* Copyright (c) 2017, weishu
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art;
import android.os.Build;
import com.taobao.android.dexposed.utility.Debug;
import com.taobao.android.dexposed.utility.Logger;
import com.taobao.android.dexposed.utility.Runtime;
import java.lang.reflect.Constructor;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import java.util.HashMap;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import me.weishu.epic.art.arch.Arm64;
import me.weishu.epic.art.arch.ShellCode;
import me.weishu.epic.art.arch.Thumb2;
import me.weishu.epic.art.method.ArtMethod;
/**
* Hook Center.
*/
public final class Epic {
private static final String TAG = "Epic";
private static final Map backupMethodsMapping = new ConcurrentHashMap<>();
private static final Map originSigs = new ConcurrentHashMap<>();
private static final Map scripts = new HashMap<>();
private static ShellCode ShellCode;
static {
boolean isArm = true; // TODO: 17/11/21 TODO
int apiLevel = Build.VERSION.SDK_INT;
boolean thumb2 = true;
if (isArm) {
if (Runtime.is64Bit()) {
ShellCode = new Arm64();
} else if (Runtime.isThumb2()) {
ShellCode = new Thumb2();
} else {
thumb2 = false;
ShellCode = new Thumb2();
Logger.w(TAG, "ARM32, not support now.");
}
}
if (ShellCode == null) {
throw new RuntimeException("Do not support this ARCH now!! API LEVEL:" + apiLevel + " thumb2 ? : " + thumb2);
}
Logger.i(TAG, "Using: " + ShellCode.getName());
}
public static boolean hookMethod(Constructor origin) {
return hookMethod(ArtMethod.of(origin));
}
public static boolean hookMethod(Method origin) {
ArtMethod artOrigin = ArtMethod.of(origin);
return hookMethod(artOrigin);
}
private static boolean hookMethod(ArtMethod artOrigin) {
MethodInfo methodInfo = new MethodInfo();
methodInfo.isStatic = Modifier.isStatic(artOrigin.getModifiers());
final Class[] parameterTypes = artOrigin.getParameterTypes();
if (parameterTypes != null) {
methodInfo.paramNumber = parameterTypes.length;
methodInfo.paramTypes = parameterTypes;
} else {
methodInfo.paramNumber = 0;
methodInfo.paramTypes = new Class[0];
}
methodInfo.returnType = artOrigin.getReturnType();
methodInfo.method = artOrigin;
originSigs.put(artOrigin.getAddress(), methodInfo);
if (!artOrigin.isAccessible()) {
artOrigin.setAccessible(true);
}
artOrigin.ensureResolved();
long originEntry = artOrigin.getEntryPointFromQuickCompiledCode();
if (originEntry == ArtMethod.getQuickToInterpreterBridge()) {
Logger.i(TAG, "this method is not compiled, compile it now. current entry: 0x" + Long.toHexString(originEntry));
boolean ret = artOrigin.compile();
if (ret) {
originEntry = artOrigin.getEntryPointFromQuickCompiledCode();
Logger.i(TAG, "compile method success, new entry: 0x" + Long.toHexString(originEntry));
} else {
Logger.e(TAG, "compile method failed...");
return false;
// return hookInterpreterBridge(artOrigin);
}
}
ArtMethod backupMethod = artOrigin.backup();
Logger.i(TAG, "backup method address:" + Debug.addrHex(backupMethod.getAddress()));
Logger.i(TAG, "backup method entry :" + Debug.addrHex(backupMethod.getEntryPointFromQuickCompiledCode()));
ArtMethod backupList = getBackMethod(artOrigin);
if (backupList == null) {
setBackMethod(artOrigin, backupMethod);
}
final long key = originEntry;
final EntryLock lock = EntryLock.obtain(originEntry);
//noinspection SynchronizationOnLocalVariableOrMethodParameter
synchronized (lock) {
if (!scripts.containsKey(key)) {
scripts.put(key, new Trampoline(ShellCode, originEntry));
}
Trampoline trampoline = scripts.get(key);
boolean ret = trampoline.install(artOrigin);
// Logger.d(TAG, "hook Method result:" + ret);
return ret;
}
}
/*
private static boolean hookInterpreterBridge(ArtMethod artOrigin) {
String identifier = artOrigin.getIdentifier();
ArtMethod backupMethod = artOrigin.backup();
Logger.d(TAG, "backup method address:" + Debug.addrHex(backupMethod.getAddress()));
Logger.d(TAG, "backup method entry :" + Debug.addrHex(backupMethod.getEntryPointFromQuickCompiledCode()));
List backupList = backupMethodsMapping.get(identifier);
if (backupList == null) {
backupList = new LinkedList();
backupMethodsMapping.put(identifier, backupList);
}
backupList.add(backupMethod);
long originalEntryPoint = ShellCode.toMem(artOrigin.getEntryPointFromQuickCompiledCode());
Logger.d(TAG, "originEntry Point(bridge):" + Debug.addrHex(originalEntryPoint));
originalEntryPoint += 16;
Logger.d(TAG, "originEntry Point(offset8):" + Debug.addrHex(originalEntryPoint));
if (!scripts.containsKey(originalEntryPoint)) {
scripts.put(originalEntryPoint, new Trampoline(ShellCode, artOrigin));
}
Trampoline trampoline = scripts.get(originalEntryPoint);
boolean ret = trampoline.install();
Logger.i(TAG, "hook Method result:" + ret);
return ret;
}*/
public synchronized static ArtMethod getBackMethod(ArtMethod origin) {
String identifier = origin.getIdentifier();
return backupMethodsMapping.get(identifier);
}
public static synchronized void setBackMethod(ArtMethod origin, ArtMethod backup) {
String identifier = origin.getIdentifier();
backupMethodsMapping.put(identifier, backup);
}
public static MethodInfo getMethodInfo(long address) {
return originSigs.get(address);
}
public static int getQuickCompiledCodeSize(ArtMethod method) {
long entryPoint = ShellCode.toMem(method.getEntryPointFromQuickCompiledCode());
long sizeInfo1 = entryPoint - 4;
byte[] bytes = EpicNative.get(sizeInfo1, 4);
int size = ByteBuffer.wrap(bytes).order(ByteOrder.LITTLE_ENDIAN).getInt();
Logger.d(TAG, "getQuickCompiledCodeSize: " + size);
return size;
}
public static class MethodInfo {
public boolean isStatic;
public int paramNumber;
public Class[] paramTypes;
public Class returnType;
public ArtMethod method;
@Override
public String toString() {
return method.toGenericString();
}
}
private static class EntryLock {
static Map sLockPool = new HashMap<>();
static synchronized EntryLock obtain(long entry) {
if (sLockPool.containsKey(entry)) {
return sLockPool.get(entry);
} else {
EntryLock entryLock = new EntryLock();
sLockPool.put(entry, entryLock);
return entryLock;
}
}
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/EpicNative.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art;
import android.util.Log;
import com.taobao.android.dexposed.DeviceCheck;
import com.taobao.android.dexposed.utility.Debug;
import com.taobao.android.dexposed.utility.Logger;
import com.taobao.android.dexposed.utility.Unsafe;
import java.lang.reflect.Member;
import de.robv.android.xposed.XposedHelpers;
import static com.taobao.android.dexposed.utility.Debug.addrHex;
public final class EpicNative {
private static final String TAG = "EpicNative";
private static volatile boolean useUnsafe = false;
static {
try {
System.loadLibrary("epic");
useUnsafe = DeviceCheck.isYunOS() || !isGetObjectAvailable();
Log.i(TAG, "use unsafe ? " + useUnsafe);
} catch (Throwable e) {
Log.e(TAG, "init EpicNative error", e);
}
}
public static native long mmap(int length);
public static native boolean munmap(long address, int length);
public static native void memcpy(long src, long dest, int length);
public static native void memput(byte[] bytes, long dest);
public static native byte[] memget(long src, int length);
public static native boolean munprotect(long addr, long len);
public static native long getMethodAddress(Member method);
public static native void MakeInitializedClassVisibilyInitialized(long self);
public static native boolean cacheflush(long addr, long len);
public static native long malloc(int sizeOfPtr);
public static native Object getObjectNative(long self, long address);
private static native boolean isGetObjectAvailable();
public static Object getObject(long self, long address) {
if (useUnsafe) {
return Unsafe.getObject(address);
} else {
return getObjectNative(self, address);
}
}
public static native boolean compileMethod(Member method, long self);
/**
* suspend all running thread momently
* @return a handle to resume all thread, used by {@link #resumeAll(long)}
*/
public static native long suspendAll();
/**
* resume all thread which are suspend by {@link #suspendAll()}
* only work abobe Android N
* @param cookie the cookie return by {@link #suspendAll()}
*/
public static native void resumeAll(long cookie);
/**
* stop jit compiler in runtime.
* Warning: Just for experiment Do not call this now!!!
* @return cookie use by {@link #startJit(long)}
*/
public static native long stopJit();
/**
* start jit compiler stop by {@link #stopJit()}
* Warning: Just for experiment Do not call this now!!!
* @param cookie the cookie return by {@link #stopJit()}
*/
public static native void startJit(long cookie);
// FIXME: 17/12/29 reimplement it with pure native code.
static native boolean activateNative(long jumpToAddress, long pc, long sizeOfTargetJump, long sizeOfBridgeJump, byte[] code);
/**
* Disable the moving gc of runtime.
* Warning: Just for experiment Do not call this now!!!
* @param api the api level
*/
public static native void disableMovingGc(int api);
private EpicNative() {
}
public static boolean compileMethod(Member method) {
final long nativePeer = XposedHelpers.getLongField(Thread.currentThread(), "nativePeer");
return compileMethod(method, nativePeer);
}
public static Object getObject(long address) {
final long nativePeer = XposedHelpers.getLongField(Thread.currentThread(), "nativePeer");
return getObject(nativePeer, address);
}
public static void MakeInitializedClassVisibilyInitialized() {
final long nativePeer = XposedHelpers.getLongField(Thread.currentThread(), "nativePeer");
MakeInitializedClassVisibilyInitialized(nativePeer);
}
public static long map(int length) {
long m = mmap(length);
Logger.i(TAG, "Mapped memory of size " + length + " at " + addrHex(m));
return m;
}
public static boolean unmap(long address, int length) {
Logger.d(TAG, "Removing mapped memory of size " + length + " at " + addrHex(address));
return munmap(address, length);
}
public static void put(byte[] bytes, long dest) {
if (Debug.DEBUG) {
Logger.d(TAG, "Writing memory to: " + addrHex(dest));
Logger.d(TAG, Debug.hexdump(bytes, dest));
}
memput(bytes, dest);
}
public static byte[] get(long src, int length) {
Logger.d(TAG, "Reading " + length + " bytes from: " + addrHex(src));
byte[] bytes = memget(src, length);
Logger.d(TAG, Debug.hexdump(bytes, src));
return bytes;
}
public static boolean unprotect(long addr, long len) {
Logger.d(TAG, "Disabling mprotect from " + addrHex(addr));
return munprotect(addr, len);
}
public static void copy(long src, long dst, int length) {
Logger.d(TAG, "Copy " + length + " bytes form " + addrHex(src) + " to " + addrHex(dst));
memcpy(src, dst, length);
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/Trampoline.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art;
import com.taobao.android.dexposed.utility.Debug;
import com.taobao.android.dexposed.utility.Logger;
import com.taobao.android.dexposed.utility.Runtime;
import java.lang.reflect.Method;
import java.util.HashSet;
import java.util.Set;
import me.weishu.epic.art.arch.ShellCode;
import me.weishu.epic.art.entry.Entry;
import me.weishu.epic.art.entry.Entry64;
import me.weishu.epic.art.method.ArtMethod;
class Trampoline {
private static final String TAG = "Trampoline";
private final ShellCode shellCode;
private final long jumpToAddress;
private final byte[] originalCode;
private int trampolineSize;
private long trampolineAddress;
private boolean active;
// private ArtMethod artOrigin;
private Set segments = new HashSet<>();
Trampoline(ShellCode shellCode, long entryPoint) {
this.shellCode = shellCode;
this.jumpToAddress = shellCode.toMem(entryPoint);
this.originalCode = EpicNative.get(jumpToAddress, shellCode.sizeOfDirectJump());
}
public boolean install(ArtMethod originMethod){
boolean modified = segments.add(originMethod);
if (!modified) {
// Already hooked, ignore
Logger.d(TAG, originMethod + " is already hooked, return.");
return true;
}
byte[] page = create();
EpicNative.put(page, getTrampolineAddress());
int quickCompiledCodeSize = Epic.getQuickCompiledCodeSize(originMethod);
int sizeOfDirectJump = shellCode.sizeOfDirectJump();
if (quickCompiledCodeSize < sizeOfDirectJump) {
Logger.w(TAG, originMethod.toGenericString() + " quickCompiledCodeSize: " + quickCompiledCodeSize);
originMethod.setEntryPointFromQuickCompiledCode(getTrampolinePc());
return true;
}
// 这里是绝对不能改EntryPoint的，碰到GC就挂(GC暂停线程的时候，遍历所有线程堆栈，如果被hook的方法在堆栈上，那就GG)
// source.setEntryPointFromQuickCompiledCode(script.getTrampolinePc());
return activate();
}
private long getTrampolineAddress() {
if (getSize() != trampolineSize) {
alloc();
}
return trampolineAddress;
}
private long getTrampolinePc() {
return shellCode.toPC(getTrampolineAddress());
}
private void alloc() {
if (trampolineAddress != 0) {
free();
}
trampolineSize = getSize();
trampolineAddress = EpicNative.map(trampolineSize);
Logger.d(TAG, "Trampoline alloc:" + trampolineSize + ", addr: 0x" + Long.toHexString(trampolineAddress));
}
private void free() {
if (trampolineAddress != 0) {
EpicNative.unmap(trampolineAddress, trampolineSize);
trampolineAddress = 0;
trampolineSize = 0;
}
if (active) {
EpicNative.put(originalCode, jumpToAddress);
}
}
private int getSize() {
int count = 0;
count += shellCode.sizeOfBridgeJump() * segments.size();
count += shellCode.sizeOfCallOrigin();
return count;
}
private byte[] create() {
Logger.d(TAG, "create trampoline." + segments);
byte[] mainPage = new byte[getSize()];
int offset = 0;
for (ArtMethod method : segments) {
byte[] bridgeJump = createTrampoline(method);
int length = bridgeJump.length;
System.arraycopy(bridgeJump, 0, mainPage, offset, length);
offset += length;
}
byte[] callOriginal = shellCode.createCallOrigin(jumpToAddress, originalCode);
System.arraycopy(callOriginal, 0, mainPage, offset, callOriginal.length);
return mainPage;
}
private boolean activate() {
long pc = getTrampolinePc();
Logger.d(TAG, "Writing direct jump entry " + Debug.addrHex(pc) + " to origin entry: 0x" + Debug.addrHex(jumpToAddress));
synchronized (Trampoline.class) {
return EpicNative.activateNative(jumpToAddress, pc, shellCode.sizeOfDirectJump(),
shellCode.sizeOfBridgeJump(), shellCode.createDirectJump(pc));
}
}
@Override
protected void finalize() throws Throwable {
free();
super.finalize();
}
private byte[] createTrampoline(ArtMethod source){
final Epic.MethodInfo methodInfo = Epic.getMethodInfo(source.getAddress());
final Class returnType = methodInfo.returnType;
// Method bridgeMethod = Runtime.is64Bit() ? (Build.VERSION.SDK_INT == 23 ? Entry64_2.getBridgeMethod(methodInfo) : Entry64.getBridgeMethod(returnType))
// : Entry.getBridgeMethod(returnType);
Method bridgeMethod = Runtime.is64Bit() ? Entry64.getBridgeMethod(returnType)
: Entry.getBridgeMethod(returnType);
final ArtMethod target = ArtMethod.of(bridgeMethod);
long targetAddress = target.getAddress();
long targetEntry = target.getEntryPointFromQuickCompiledCode();
long sourceAddress = source.getAddress();
long structAddress = EpicNative.malloc(4);
Logger.d(TAG, "targetAddress:"+ Debug.longHex(targetAddress));
Logger.d(TAG, "sourceAddress:"+ Debug.longHex(sourceAddress));
Logger.d(TAG, "targetEntry:"+ Debug.longHex(targetEntry));
Logger.d(TAG, "structAddress:"+ Debug.longHex(structAddress));
return shellCode.createBridgeJump(targetAddress, targetEntry, sourceAddress, structAddress);
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/arch/Arm64.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art.arch;
import java.nio.ByteOrder;
public class Arm64 extends ShellCode {
@Override
public int sizeOfDirectJump() {
return 4 * 4;
}
@Override
public byte[] createDirectJump(long targetAddress) {
byte[] instructions = new byte[]{
0x50, 0x00, 0x00, 0x58, // ldr x9, _targetAddress
0x00, 0x02, 0x1F, (byte) 0xD6, // br x9
0x00, 0x00, 0x00, 0x00, // targetAddress
0x00, 0x00, 0x00, 0x00 // targetAddress
};
writeLong(targetAddress, ByteOrder.LITTLE_ENDIAN, instructions, instructions.length - 8);
return instructions;
}
@Override
public byte[] createBridgeJump(long targetAddress, long targetEntry, long srcAddress, long structAddress) {
byte[] instructions = new byte[]{
0x1f, 0x20, 0x03, (byte) 0xd5, // nop
0x69, 0x02, 0x00, 0x58, // ldr x9, source_method
0x1f, 0x00, 0x09, (byte) 0xeb, // cmp x0, x9
(byte) 0xa1, 0x02, 0x00, 0x54, // bne 5f
(byte) 0x80, 0x01, 0x00, 0x58, // ldr x0, target_method
0x29, 0x02, 0x00, 0x58, // ldr x9, struct
(byte) 0xea, 0x03, 0x00, (byte) 0x91, // mov x10, sp
0x2a, 0x01, 0x00, (byte) 0xf9, // str x10, [x9, #0]
0x22, 0x05, 0x00, (byte) 0xf9, // str x2, [x9, #8]
0x23, 0x09, 0x00, (byte) 0xf9, // str x3, [x9, #16]
(byte) 0xe3, 0x03, 0x09, (byte) 0xaa, // mov x3, x9
0x22, 0x01, 0x00, 0x58, // ldr x2, source_method
0x22, 0x0d, 0x00, (byte) 0xf9, // str x2, [x9, #24]
(byte) 0xe2, 0x03, 0x13, (byte) 0xaa, // mov x2, x19
(byte) 0x89, 0x00, 0x00, 0x58, // ldr x9, target_method_entry
0x20, 0x01, 0x1f, (byte) 0xd6, // br x9
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // target_method_address
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // target_method_entry
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // source_method
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 // struct
};
writeLong(targetAddress, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 32);
writeLong(targetEntry, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 24);
writeLong(srcAddress,
ByteOrder.LITTLE_ENDIAN, instructions, instructions.length - 16);
writeLong(structAddress, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 8);
return instructions;
}
@Override
public int sizeOfBridgeJump() {
return 24 * 4;
}
@Override
public long toPC(long code) {
return code;
}
@Override
public long toMem(long pc) {
return pc;
}
@Override
public String getName() {
return "64-bit ARM";
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/arch/Arm64_2.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art.arch;
import java.nio.ByteOrder;
public class Arm64_2 extends ShellCode {
@Override
public int sizeOfDirectJump() {
return 4 * 4;
}
@Override
public byte[] createDirectJump(long targetAddress) {
byte[] instructions = new byte[]{
0x50, 0x00, 0x00, 0x58, // ldr x16, _targetAddress
0x00, 0x02, 0x1F, (byte) 0xD6, // br x16
0x00, 0x00, 0x00, 0x00, // targetAddress
0x00, 0x00, 0x00, 0x00 // targetAddress
};
writeLong(targetAddress, ByteOrder.LITTLE_ENDIAN, instructions, instructions.length - 8);
return instructions;
}
@Override
public byte[] createBridgeJump(long targetAddress, long targetEntry, long srcAddress, long structAddress) {
byte[] instructions = new byte[] {
/*
ldr x17, 3f
cmp x0, x17
bne 5f
ldr x0, 1f
ldr x17, 4f
mov x16, sp
str x16, [x17, #0]
str x2, [x17, #8]
ldr x16, 3f
str x16, [x17, #16]
mov x2, x17
ldr x17, 2f
br x17
1:
.quad 0x0
2:
.quad 0x0
3:
.quad 0x0
4:
.quad 0x0
5:
mov x0, x17
*/
0x1f, 0x20, 0x03, (byte) 0xd5, // nop
0x31, 0x02, 0x00, 0x58,
0x1f, 0x00, 0x11, (byte)0xeb,
(byte)0x61, 0x02, 0x00, 0x54,
(byte)0x40, 0x01, 0x00, 0x58,
(byte)0xf1, 0x01, 0x00, 0x58,
(byte)0xf0, 0x03, 0x00, (byte)0x91,
(byte)0x30, 0x02, 0x00, (byte)0xf9,
0x22, 0x06, 0x00, (byte)0xf9,
0x30, 0x01, 0x00, (byte)0x58,
(byte)0x30, 0x0a, 0x00, (byte)0xf9,
(byte)0xe2, 0x03, 0x11, (byte)0xaa,
(byte)0x91, 0x00, 0x00, 0x58,
(byte)0x20, 0x02, 0x1f, (byte)0xd6,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // target_method_address
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // target_method_entry
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // source_method
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 // struct
};
writeLong(targetAddress, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 32);
writeLong(targetEntry, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 24);
writeLong(srcAddress,
ByteOrder.LITTLE_ENDIAN, instructions, instructions.length - 16);
writeLong(structAddress, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 8);
return instructions;
}
@Override
public int sizeOfBridgeJump() {
return 22 * 4;
}
@Override
public long toPC(long code) {
return code;
}
@Override
public long toMem(long pc) {
return pc;
}
@Override
public String getName() {
return "64-bit ARM(Android M)";
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/arch/ShellCode.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art.arch;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
public abstract class ShellCode {
public abstract byte[] createDirectJump(long targetAddress);
public abstract int sizeOfDirectJump();
public abstract long toPC(long code);
public abstract long toMem(long pc);
public byte[] createCallOrigin(long originalAddress, byte[] originalPrologue) {
byte[] callOriginal = new byte[sizeOfCallOrigin()];
System.arraycopy(originalPrologue, 0, callOriginal, 0, sizeOfDirectJump());
byte[] directJump = createDirectJump(toPC(originalAddress + sizeOfDirectJump()));
System.arraycopy(directJump, 0, callOriginal, sizeOfDirectJump(), directJump.length);
return callOriginal;
}
public int sizeOfCallOrigin() {
return sizeOfDirectJump() * 2;
}
public abstract int sizeOfBridgeJump();
public byte[] createBridgeJump(long targetAddress, long targetEntry, long srcAddress, long structAddress) {
throw new RuntimeException("not impled");
}
static void writeInt(int i, ByteOrder order, byte[] target, int pos) {
System.arraycopy(ByteBuffer.allocate(4).order(order).putInt(i).array(), 0, target, pos, 4);
}
static void writeLong(long i, ByteOrder order, byte[] target, int pos) {
System.arraycopy(ByteBuffer.allocate(8).order(order).putLong(i).array(), 0, target, pos, 8);
}
public abstract String getName();
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/arch/Thumb2.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art.arch;
import java.nio.ByteOrder;
public class Thumb2 extends ShellCode {
@Override
public int sizeOfDirectJump() {
return 12;
}
@Override
public byte[] createDirectJump(long targetAddress) {
byte[] instructions = new byte[] {
(byte) 0xdf, (byte) 0xf8, 0x00, (byte) 0xf0, // ldr pc, [pc]
0, 0, 0, 0
};
writeInt((int) targetAddress, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 4);
return instructions;
}
@Override
public byte[] createBridgeJump(long targetAddress, long targetEntry, long srcAddress, long structAddress) {
// 有问题，参数丢失。
// byte[] instructions = new byte[] {
// (byte) 0xdf, (byte) 0xf8, 0x18, (byte) 0xc0, // ldr ip, [pc, #24], ip = source_method_address
//
// (byte) 0x01, (byte) 0x91, // str r1, [sp, #4]
// (byte) 0x02, (byte) 0x92, // str r2, [sp, #8]
//
// (byte) 0x03, (byte) 0x93, // str r3, [sp, #12]
// (byte) 0x62, (byte) 0x46, // mov r2, ip
//
// 0x01, 0x48, // ldr r0, [pc, #4]
// 0x6b, 0x46, // mov r3, sp
//
// (byte) 0xdf, (byte) 0xf8, 0x04, (byte) 0xf0, // ldr pc, [pc, #4]
//
// 0x0, 0x0, 0x0, 0x0, // target_method_pos_x
// 0x0, 0x0, 0x0, 0x0, // target_method_entry_point
// 0x0, 0x0, 0x0, 0x0, // src_method_pos_x
// };
// writeInt((int) targetAddress, ByteOrder.LITTLE_ENDIAN, instructions,
// instructions.length - 12);
// writeInt((int) targetEntry,
// ByteOrder.LITTLE_ENDIAN, instructions, instructions.length - 8);
// writeInt((int) srcAddress, ByteOrder.LITTLE_ENDIAN, instructions,
// instructions.length - 4);
byte[] instructions = new byte[]{
(byte) 0xdf, (byte) 0xf8, (byte) 0x30, (byte) 0xc0, // ldr ip, [pc, #48] ip = source method address
(byte) 0x60, (byte) 0x45, // cmp r0, ip if r0 != ip
(byte) 0x40, (byte) 0xf0, (byte) 0x19, (byte) 0x80, // bne.w 1f jump label 1:
(byte) 0x08, (byte) 0x48, // ldr r0, [pc, #28] r0 = target_method_address
(byte) 0xdf, (byte) 0xf8, (byte) 0x28, (byte) 0xc0, // ldr ip, [pc, #38] ip = struct address
(byte) 0xcc, (byte) 0xf8, (byte) 0x00, (byte) 0xd0, // str sp, [ip, #0]
(byte) 0xcc, (byte) 0xf8, (byte) 0x04, (byte) 0x20, // str r2, [ip, #4]
(byte) 0xcc, (byte) 0xf8, (byte) 0x08, (byte) 0x30, // str r3, [ip, #8]
(byte) 0x63, (byte) 0x46, // mov r3, ip
(byte) 0x05, (byte) 0x4a, // ldr r2, [pc, #16] r2 = source_method_address
(byte) 0xcc, (byte) 0xf8, (byte) 0x0c, (byte) 0x20, // str r2, [ip, #12]
(byte) 0x4a, (byte) 0x46, // move r2, r9
(byte) 0x4a, (byte) 0x46, // move r2, r9
(byte) 0xdf, (byte) 0xf8, (byte) 0x04, (byte) 0xf0, // ldr pc, [pc, #4]
0x0, 0x0, 0x0, 0x0, // target_method_pos_x
0x0, 0x0, 0x0, 0x0, // target_method_entry_point
0x0, 0x0, 0x0, 0x0, // src_method_address
0x0, 0x0, 0x0, 0x0, // struct address (sp, r1, r2)
// 1:
};
writeInt((int) targetAddress, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 16);
writeInt((int) targetEntry, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 12);
writeInt((int) srcAddress,
ByteOrder.LITTLE_ENDIAN, instructions, instructions.length - 8);
writeInt((int) structAddress, ByteOrder.LITTLE_ENDIAN, instructions,
instructions.length - 4);
return instructions;
}
@Override
public int sizeOfBridgeJump() {
return 15 * 4;
}
@Override
public long toPC(long code) {
return toMem(code) + 1;
}
@Override
public long toMem(long pc) {
return pc & ~0x1;
}
@Override
public String getName() {
return "Thumb2";
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/entry/Entry.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art.entry;
import android.os.Build;
import android.util.Pair;
import de.robv.android.xposed.DexposedBridge;
import com.taobao.android.dexposed.utility.Debug;
import com.taobao.android.dexposed.utility.Logger;
import java.lang.reflect.Method;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import me.weishu.epic.art.Epic;
import me.weishu.epic.art.EpicNative;
@SuppressWarnings({"unused", "ConstantConditions"})
public class Entry {
private final static String TAG = "Entry";
private static final Object[] EMPTY_OBJECT_ARRAY = new Object[0];
//region ---------------callback---------------
private static int onHookInt(Object artmethod, Object receiver, Object[] args) {
return (Integer) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static long onHookLong(Object artmethod, Object receiver, Object[] args) {
return (Long) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static double onHookDouble(Object artmethod, Object receiver, Object[] args) {
return (Double) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static char onHookChar(Object artmethod, Object receiver, Object[] args) {
return (Character) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static short onHookShort(Object artmethod, Object receiver, Object[] args) {
return (Short) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static float onHookFloat(Object artmethod, Object receiver, Object[] args) {
return (Float) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static Object onHookObject(Object artmethod, Object receiver, Object[] args) {
return DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static void onHookVoid(Object artmethod, Object receiver, Object[] args) {
DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static boolean onHookBoolean(Object artmethod, Object receiver, Object[] args) {
return (Boolean) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static byte onHookByte(Object artmethod, Object receiver, Object[] args) {
return (Byte) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
//endregion
//region ---------------bridge---------------
private static void voidBridge(int r1, int self, int struct) {
referenceBridge(r1, self, struct);
}
private static boolean booleanBridge(int r1, int self, int struct) {
return (Boolean) referenceBridge(r1, self, struct);
}
private static byte byteBridge(int r1, int self, int struct) {
return (Byte) referenceBridge(r1, self, struct);
}
private static short shortBridge(int r1, int self, int struct) {
return (Short) referenceBridge(r1, self, struct);
}
private static char charBridge(int r1, int self, int struct) {
return (Character) referenceBridge(r1, self, struct);
}
private static int intBridge(int r1, int self, int struct) {
return (Integer) referenceBridge(r1, self, struct);
}
private static long longBridge(int r1, int self, int struct) {
return (Long) referenceBridge(r1, self, struct);
}
private static float floatBridge(int r1, int self, int struct) {
return (Float) referenceBridge(r1, self, struct);
}
private static double doubleBridge(int r1, int self, int struct) {
return (Double) referenceBridge(r1, self, struct);
}
//endregion
private static Object referenceBridge(int r1, int self, int struct) {
Logger.i(TAG, "enter bridge function.");
// struct {
// void* sp;
// void* r2;
// void* r3;
// void* sourceMethod
// }
// sp + 16 = r4
Logger.i(TAG, "struct:" + Long.toHexString(struct));
final int sp = ByteBuffer.wrap(EpicNative.get(struct, 4)).order(ByteOrder.LITTLE_ENDIAN).getInt();
// Logger.i(TAG, "stack:" + Debug.hexdump(EpicNative.get(sp, 96), 0));
final byte[] rr1 = ByteBuffer.allocate(4).order(ByteOrder.LITTLE_ENDIAN).putInt(r1).array();
final byte[] r2 = EpicNative.get(struct + 4, 4);
final byte[] r3 = EpicNative.get(struct + 8, 4);
Logger.d(TAG, "r1:" + Debug.hexdump(rr1, 0));
Logger.d(TAG, "r2:" + Debug.hexdump(r2, 0));
Logger.d(TAG, "r3:" + Debug.hexdump(r3, 0));
final byte[] sourceAddr = EpicNative.get(struct + 12, 4);
ByteBuffer byteBuffer = ByteBuffer.wrap(new byte[8]);
byteBuffer.put(sourceAddr);
byteBuffer.put(new byte[] {0, 0, 0, 0});
byteBuffer.flip();
final long sourceMethod = byteBuffer.order(ByteOrder.LITTLE_ENDIAN).getLong();
Logger.i(TAG, "sourceMethod:" + Long.toHexString(sourceMethod));
Epic.MethodInfo originMethodInfo = Epic.getMethodInfo(sourceMethod);
Logger.i(TAG, "originMethodInfo :" + originMethodInfo);
final Pair constructArguments = constructArguments(originMethodInfo, self, rr1, r2, r3, sp);
Object receiver = constructArguments.first;
Object[] arguments = constructArguments.second;
Logger.i(TAG, "arguments:" + Arrays.toString(arguments));
Class returnType = originMethodInfo.returnType;
Object artMethod = originMethodInfo.method;
Logger.i(TAG, "leave bridge function");
if (returnType == void.class) {
onHookVoid(artMethod, receiver, arguments);
return 0;
} else if (returnType == char.class) {
return onHookChar(artMethod, receiver, arguments);
} else if (returnType == byte.class) {
return onHookByte(artMethod, receiver, arguments);
} else if (returnType == short.class) {
return onHookShort(artMethod, receiver, arguments);
} else if (returnType == int.class) {
return onHookInt(artMethod, receiver, arguments);
} else if (returnType == long.class) {
return onHookLong(artMethod, receiver, arguments);
} else if (returnType == float.class) {
return onHookFloat(artMethod, receiver, arguments);
} else if (returnType == double.class) {
return onHookDouble(artMethod, receiver, arguments);
} else if (returnType == boolean.class) {
return onHookBoolean(artMethod, receiver, arguments);
} else {
return onHookObject(artMethod, receiver, arguments);
}
}
/**
* construct the method arguments from register r1, r2, r3 and stack
* @param r1 register r1 value
* @param r2 register r2 value
* @param r3 register r3 value
* @param sp stack pointer
* @return arguments passed to the callee method
*/
private static Pair constructArguments(Epic.MethodInfo originMethodInfo, int self,
byte[] r1, byte[] r2, byte[] r3, int sp) {
boolean isStatic = originMethodInfo.isStatic;
int numberOfArgs;
Class[] typeOfArgs;
if (isStatic) {
// static argument, r1, r2, r3, sp + 16
// sp + 0 = ArtMethod (ourself)
// sp + 4 = r1 (may be earased)
// sp + 8 = r2 (may be earased)
// sp + 12 = r3 (may be earased)
// sp + 16 = r4, remain
numberOfArgs = originMethodInfo.paramNumber;
typeOfArgs = originMethodInfo.paramTypes;
} else {
// non-static, r1 = receiver; r2, r3, sp + 16 is arguments.
// sp + 0 = ArtMethod (ourself)
// sp + 4 = r1 = this (may be earased)
// sp + 8 = r2 = first argument (may be earased)
// sp + 12 = r3 = second argument (may be earased)
// sp + 16 = third argument, remain
numberOfArgs = 1 + originMethodInfo.paramNumber;
typeOfArgs = new Class[numberOfArgs];
typeOfArgs[0] = Object.class; // this
System.arraycopy(originMethodInfo.paramTypes, 0, typeOfArgs, 1, originMethodInfo.paramTypes.length);
}
Object[] arguments = new Object[numberOfArgs];
int currentStackPosition = 4; // sp + 0 = ArtMethod, sp + 4... start store arguments.
final int argumentStackBegin = 16; // sp + 4 = r1, sp + 8 = r2, sp + 12 = r3, sp + 16 start in stack.
int[] argStartPos = new int[numberOfArgs];
for (int i = 0; i < numberOfArgs; i++) {
Class typeOfArg = typeOfArgs[i];
int typeLength = getTypeLength(typeOfArg);
argStartPos[i] = currentStackPosition;
currentStackPosition += typeLength;
}
int argTotalLength = currentStackPosition;
byte[] argBytes = new byte[argTotalLength];
do {
if (argTotalLength <= 4) break;
boolean align = Build.VERSION.SDK_INT >= 23 && numberOfArgs > 0 && getTypeLength(typeOfArgs[0]) == 8;
if (align) {
System.arraycopy(r2, 0, argBytes, 4, 4);
System.arraycopy(r3, 0, argBytes, 8, 4);
if (argTotalLength <= 12) break;
System.arraycopy(EpicNative.get(sp + 12, 4), 0, argBytes, 12, 4);
} else {
System.arraycopy(r1, 0, argBytes, 4, 4);
if (argTotalLength <= 8) break;
System.arraycopy(r2, 0, argBytes, 8, 4);
if (argTotalLength <= 12) break;
System.arraycopy(r3, 0, argBytes, 12, 4);
}
if (argTotalLength <= 16) break;
byte[] argInStack = EpicNative.get(sp + 16, argTotalLength - 16);
System.arraycopy(argInStack, 0, argBytes, 16, argTotalLength - 16);
} while (false);
//region ---------------Process Arguments passing in Android M---------------
if (Build.VERSION.SDK_INT == 23) {
// Android M, fix sp + 12
if (argTotalLength <= 12) {
// Nothing
} else {
if (argTotalLength <= 16) {
if (getTypeLength(typeOfArgs[0]) == 8) {
// first is 8byte
System.arraycopy(EpicNative.get(sp + 44, 4), 0, argBytes, 12, 4);
} else {
// 48, 444: normal.
}
} else {
boolean isR3Grabbed = true;
if (numberOfArgs >= 2) {
int arg1TypeLength = getTypeLength(typeOfArgs[0]);
int arg2TypeLength = getTypeLength(typeOfArgs[1]);
if (arg1TypeLength == 4 && arg2TypeLength == 8) {
isR3Grabbed = false;
}
if (numberOfArgs == 2 && arg1TypeLength == 8 && arg2TypeLength == 8) {
// in this case, we have no reference register to local r3, just hard code now :(
System.arraycopy(EpicNative.get(sp + 44, 4), 0, argBytes, 12, 4);
isR3Grabbed = false;
}
}
if (numberOfArgs >= 3) {
int arg1TypeLength = getTypeLength(typeOfArgs[0]);
int arg2TypeLength = getTypeLength(typeOfArgs[1]);
int arg3TypeLength = getTypeLength(typeOfArgs[2]);
if (arg1TypeLength == 4 && arg2TypeLength == 4 && arg3TypeLength == 4) {
// in this case: r1 = arg1; r2 = arg2; r3 = arg3, normal.
isR3Grabbed = false;
}
if (numberOfArgs == 3 && arg1TypeLength == 8 && arg2TypeLength == 4 && arg3TypeLength == 8) {
// strange case :)
System.arraycopy(EpicNative.get(sp + 52, 4), 0, argBytes, 12, 4);
isR3Grabbed = false;
}
}
if (isR3Grabbed) {
byte[] otherStoreInStack = Arrays.copyOfRange(argBytes, argumentStackBegin, argBytes.length);
int otherStoreInStackLength = otherStoreInStack.length;
int searchRegion = 0;
for (int i = argumentStackBegin + otherStoreInStackLength; ; i = i + 4) {
final byte[] bytes = EpicNative.get(sp + i, otherStoreInStackLength);
searchRegion += otherStoreInStackLength;
if (Arrays.equals(bytes, otherStoreInStack)) {
int originR3Index = sp + i - 4;
final byte[] originR3 = EpicNative.get(originR3Index, 4);
Logger.d(TAG, "found other arguments in stack, index:" + i + ", origin r3:" + Arrays.toString(originR3));
System.arraycopy(originR3, 0, argBytes, 12, 4);
break;
}
if (searchRegion > (1 << 10)) {
throw new RuntimeException("can not found the modify r3 register!!!");
}
}
}
}
}
}
//endregion
Logger.d(TAG, "argBytes: " + Debug.hexdump(argBytes, 0));
for (int i = 0; i < numberOfArgs; i++) {
final Class typeOfArg = typeOfArgs[i];
final int startPos = argStartPos[i];
final int typeLength = getTypeLength(typeOfArg);
byte[] argWithBytes = Arrays.copyOfRange(argBytes, startPos, startPos + typeLength);
arguments[i] = wrapArgument(typeOfArg, self, argWithBytes);
// Logger.d(TAG, "argument[" + i + "], startPos:" + startPos + ", typeOfLength:" + typeLength);
// Logger.d(TAG, "argWithBytes:" + Debug.hexdump(argWithBytes, 0) + ", value:" + arguments[i]);
}
Object thiz = null;
Object[] parameters = EMPTY_OBJECT_ARRAY;
if (isStatic) {
parameters = arguments;
} else {
thiz = arguments[0];
int argumentLength = arguments.length;
if (argumentLength > 1) {
parameters = Arrays.copyOfRange(arguments, 1, argumentLength);
}
}
return Pair.create(thiz, parameters);
}
private static Object wrapArgument(Class type, int self, byte[] value) {
final ByteBuffer byteBuffer = ByteBuffer.wrap(value).order(ByteOrder.LITTLE_ENDIAN);
Logger.d(TAG, "wrapArgument: type:" + type);
if (type.isPrimitive()) {
if (type == int.class) {
return byteBuffer.getInt();
} else if (type == long.class) {
return byteBuffer.getLong();
} else if (type == float.class) {
return byteBuffer.getFloat();
} else if (type == short.class) {
return byteBuffer.getShort();
} else if (type == byte.class) {
return byteBuffer.get();
} else if (type == char.class) {
return byteBuffer.getChar();
} else if (type == double.class) {
return byteBuffer.getDouble();
} else if (type == boolean.class) {
return byteBuffer.getInt() != 0;
} else {
throw new RuntimeException("unknown type:" + type);
}
} else {
int address = byteBuffer.getInt();
Object object = EpicNative.getObject(self, address);
// Logger.i(TAG, "wrapArgument, address: 0x" + Long.toHexString(address) + ", value:" + object);
return object;
}
}
private static Map, String> bridgeMethodMap = new HashMap<>();
static {
Class[] primitiveTypes = new Class[]{boolean.class, byte.class, char.class, short.class,
int.class, long.class, float.class, double.class};
for (Class primitiveType : primitiveTypes) {
bridgeMethodMap.put(primitiveType, primitiveType.getName() + "Bridge");
}
bridgeMethodMap.put(Object.class, "referenceBridge");
bridgeMethodMap.put(void.class, "voidBridge");
}
public static Method getBridgeMethod(Class returnType) {
try {
final String bridgeMethod = bridgeMethodMap.get(returnType.isPrimitive() ? returnType : Object.class);
Logger.i(TAG, "bridge method:" + bridgeMethod + ", map:" + bridgeMethodMap);
Method method = Entry.class.getDeclaredMethod(bridgeMethod, int.class, int.class, int.class);
method.setAccessible(true);
return method;
} catch (Throwable e) {
throw new RuntimeException("error", e);
}
}
private static int getTypeLength(Class clazz) {
if (clazz == long.class || clazz == double.class) {
return 8; // double & long are 8 bytes.
} else {
return 4;
}
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/entry/Entry64.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art.entry;
import com.taobao.android.dexposed.utility.Logger;
import java.lang.reflect.Method;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import de.robv.android.xposed.DexposedBridge;
import de.robv.android.xposed.XposedHelpers;
import me.weishu.epic.art.Epic;
import me.weishu.epic.art.EpicNative;
@SuppressWarnings({"unused", "ConstantConditions"})
public class Entry64 {
private final static String TAG = "Entry64";
//region ---------------callback---------------
private static int onHookInt(Object artmethod, Object receiver, Object[] args) {
return (Integer) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static long onHookLong(Object artmethod, Object receiver, Object[] args) {
return (Long) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static double onHookDouble(Object artmethod, Object receiver, Object[] args) {
return (Double) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static char onHookChar(Object artmethod, Object receiver, Object[] args) {
return (Character) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static short onHookShort(Object artmethod, Object receiver, Object[] args) {
return (Short) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static float onHookFloat(Object artmethod, Object receiver, Object[] args) {
return (Float) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static Object onHookObject(Object artmethod, Object receiver, Object[] args) {
return DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static void onHookVoid(Object artmethod, Object receiver, Object[] args) {
DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static boolean onHookBoolean(Object artmethod, Object receiver, Object[] args) {
return (Boolean) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static byte onHookByte(Object artmethod, Object receiver, Object[] args) {
return (Byte) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
//endregion
//region ---------------bridge---------------
private static void voidBridge(long r1, long self, long struct, long x4, long x5, long x6, long x7) {
referenceBridge(r1, self, struct, x4, x5, x6, x7);
}
private static boolean booleanBridge(long r1, long self, long struct, long x4, long x5, long x6, long x7) {
return (Boolean) referenceBridge(r1, self, struct, x4, x5, x6, x7);
}
private static byte byteBridge(long r1, long self, long struct, long x4, long x5, long x6, long x7) {
return (Byte) referenceBridge(r1, self, struct, x4, x5, x6, x7);
}
private static short shortBridge(long r1, long self, long struct, long x4, long x5, long x6, long x7) {
return (Short) referenceBridge(r1, self, struct, x4, x5, x6, x7);
}
private static char charBridge(long r1, long self, long struct, long x4, long x5, long x6, long x7) {
return (Character) referenceBridge(r1, self, struct, x4, x5, x6, x7);
}
private static int intBridge(long r1, long self, long struct, long x4, long x5, long x6, long x7) {
return (Integer) referenceBridge(r1, self, struct, x4, x5, x6, x7);
}
private static long longBridge(long r1, long self, long struct, long x4, long x5, long x6, long x7) {
return (Long) referenceBridge(r1, self, struct, x4, x5, x6, x7);
}
private static float floatBridge(long r1, long self, long struct, long x4, long x5, long x6, long x7) {
return (Float) referenceBridge(r1, self, struct, x4, x5, x6, x7);
}
private static double doubleBridge(long r1, long self, long struct, long x4, long x5, long x6, long x7) {
return (Double) referenceBridge(r1, self, struct, x4, x5, x6, x7);
}
//endregion
private static Object referenceBridge(long x1, long self, long struct, long x4, long x5, long x6, long x7) {
Logger.i(TAG, "enter bridge function.");
// struct {
// void* sp;
// void* r2;
// void* r3;
// void* sourceMethod
// }
// sp + 16 = r4
Logger.d(TAG, "self:" + Long.toHexString(self));
final long nativePeer = XposedHelpers.getLongField(Thread.currentThread(), "nativePeer");
Logger.d(TAG, "java thread native peer:" + Long.toHexString(nativePeer));
Logger.d(TAG, "struct:" + Long.toHexString(struct));
final long sp = ByteBuffer.wrap(EpicNative.get(struct, 8)).order(ByteOrder.LITTLE_ENDIAN).getLong();
Logger.d(TAG, "stack:" + sp);
final byte[] rr1 = ByteBuffer.allocate(8).order(ByteOrder.LITTLE_ENDIAN).putLong(x1).array();
final byte[] r2 = EpicNative.get(struct + 8, 8);
final byte[] r3 = EpicNative.get(struct + 16, 8);
final long sourceMethod = ByteBuffer.wrap(EpicNative.get(struct + 24, 8)).order(ByteOrder.LITTLE_ENDIAN).getLong();
Logger.d(TAG, "sourceMethod:" + Long.toHexString(sourceMethod));
Epic.MethodInfo originMethodInfo = Epic.getMethodInfo(sourceMethod);
Logger.d(TAG, "originMethodInfo :" + originMethodInfo);
boolean isStatic = originMethodInfo.isStatic;
int numberOfArgs = originMethodInfo.paramNumber;
Class[] typeOfArgs = originMethodInfo.paramTypes;
Object[] arguments = new Object[numberOfArgs];
Object receiver;
self = nativePeer;
if (isStatic) {
receiver = null;
do {
if (numberOfArgs == 0) break;
arguments[0] = wrapArgument(typeOfArgs[0], self, rr1);
if (numberOfArgs == 1) break;
arguments[1] = wrapArgument(typeOfArgs[1], self, r2);
if (numberOfArgs == 2) break;
arguments[2] = wrapArgument(typeOfArgs[2], self, r3);
if (numberOfArgs == 3) break;
arguments[3] = wrapArgument(typeOfArgs[3], self, x4);
if (numberOfArgs == 4) break;
arguments[4] = wrapArgument(typeOfArgs[4], self, x5);
if (numberOfArgs == 5) break;
arguments[5] = wrapArgument(typeOfArgs[5], self, x6);
if (numberOfArgs == 6) break;
arguments[6] = wrapArgument(typeOfArgs[6], self, x7);
if (numberOfArgs == 7) break;
for (int i = 7; i < numberOfArgs; i++) {
byte[] argsInStack = EpicNative.get(sp + i * 8 + 8, 8);
arguments[i] = wrapArgument(typeOfArgs[i], self, argsInStack);
}
} while (false);
} else {
receiver = EpicNative.getObject(self, x1);
//Logger.i(TAG, "this :" + receiver);
do {
if (numberOfArgs == 0) break;
arguments[0] = wrapArgument(typeOfArgs[0], self, r2);
if (numberOfArgs == 1) break;
arguments[1] = wrapArgument(typeOfArgs[1], self, r3);
if (numberOfArgs == 2) break;
arguments[2] = wrapArgument(typeOfArgs[2], self, x4);
if (numberOfArgs == 3) break;
arguments[3] = wrapArgument(typeOfArgs[3], self, x5);
if (numberOfArgs == 4) break;
arguments[4] = wrapArgument(typeOfArgs[4], self, x6);
if (numberOfArgs == 5) break;
arguments[5] = wrapArgument(typeOfArgs[5], self, x7);
if (numberOfArgs == 6) break;
for (int i = 6; i < numberOfArgs; i++) {
byte[] argsInStack = EpicNative.get(sp + i * 8 + 16, 8);
arguments[i] = wrapArgument(typeOfArgs[i], self, argsInStack);
}
} while (false);
}
Logger.i(TAG, "arguments:" + Arrays.toString(arguments));
Class returnType = originMethodInfo.returnType;
Object artMethod = originMethodInfo.method;
Logger.d(TAG, "leave bridge function");
if (returnType == void.class) {
onHookVoid(artMethod, receiver, arguments);
return 0;
} else if (returnType == char.class) {
return onHookChar(artMethod, receiver, arguments);
} else if (returnType == byte.class) {
return onHookByte(artMethod, receiver, arguments);
} else if (returnType == short.class) {
return onHookShort(artMethod, receiver, arguments);
} else if (returnType == int.class) {
return onHookInt(artMethod, receiver, arguments);
} else if (returnType == long.class) {
return onHookLong(artMethod, receiver, arguments);
} else if (returnType == float.class) {
return onHookFloat(artMethod, receiver, arguments);
} else if (returnType == double.class) {
return onHookDouble(artMethod, receiver, arguments);
} else if (returnType == boolean.class) {
return onHookBoolean(artMethod, receiver, arguments);
} else {
return onHookObject(artMethod, receiver, arguments);
}
}
private static Object wrapArgument(Class type, long self, long value) {
return wrapArgument(type, self, ByteBuffer.allocate(8).order(ByteOrder.LITTLE_ENDIAN).putLong(value).array());
}
private static Object wrapArgument(Class type, long self, byte[] value) {
final ByteBuffer byteBuffer = ByteBuffer.wrap(value).order(ByteOrder.LITTLE_ENDIAN);
if (type.isPrimitive()) {
if (type == int.class) {
return byteBuffer.getInt();
} else if (type == long.class) {
return byteBuffer.getLong();
} else if (type == float.class) {
return byteBuffer.getFloat();
} else if (type == short.class) {
return byteBuffer.getShort();
} else if (type == byte.class) {
return byteBuffer.get();
} else if (type == char.class) {
return byteBuffer.getChar();
} else if (type == double.class) {
return byteBuffer.getDouble();
} else if (type == boolean.class) {
return byteBuffer.getInt() == 0;
} else {
throw new RuntimeException("unknown type:" + type);
}
} else {
long address = byteBuffer.getLong();
Object object = EpicNative.getObject(self, address);
//Logger.i(TAG, "wrapArgument, address: 0x" + Long.toHexString(address) + ", value:" + object);
return object;
}
}
private static Map, String> bridgeMethodMap = new HashMap<>();
static {
Class[] primitiveTypes = new Class[]{boolean.class, byte.class, char.class, short.class,
int.class, long.class, float.class, double.class};
for (Class primitiveType : primitiveTypes) {
bridgeMethodMap.put(primitiveType, primitiveType.getName() + "Bridge");
}
bridgeMethodMap.put(void.class, "voidBridge");
bridgeMethodMap.put(Object.class, "referenceBridge");
}
public static Method getBridgeMethod(Class returnType) {
try {
final String bridgeMethod = bridgeMethodMap.get(returnType.isPrimitive() ? returnType : Object.class);
Logger.d(TAG, "bridge method:" + bridgeMethod + ", map:" + bridgeMethodMap);
Method method = Entry64.class.getDeclaredMethod(bridgeMethod, long.class, long.class,
long.class, long.class, long.class, long.class, long.class);
method.setAccessible(true);
return method;
} catch (Throwable e) {
throw new RuntimeException("error", e);
}
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/entry/Entry64_2.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art.entry;
import com.taobao.android.dexposed.utility.Debug;
import com.taobao.android.dexposed.utility.Logger;
import java.lang.reflect.Method;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import de.robv.android.xposed.DexposedBridge;
import de.robv.android.xposed.XposedHelpers;
import me.weishu.epic.art.Epic;
import me.weishu.epic.art.EpicNative;
@SuppressWarnings({"unused", "ConstantConditions"})
public class Entry64_2 {
private final static String TAG = "Entry64";
//region ---------------callback---------------
private static int onHookInt(Object artmethod, Object receiver, Object[] args) {
return (Integer) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static long onHookLong(Object artmethod, Object receiver, Object[] args) {
return (Long) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static double onHookDouble(Object artmethod, Object receiver, Object[] args) {
return (Double) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static char onHookChar(Object artmethod, Object receiver, Object[] args) {
return (Character) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static short onHookShort(Object artmethod, Object receiver, Object[] args) {
return (Short) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static float onHookFloat(Object artmethod, Object receiver, Object[] args) {
return (Float) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static Object onHookObject(Object artmethod, Object receiver, Object[] args) {
return DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static void onHookVoid(Object artmethod, Object receiver, Object[] args) {
DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static boolean onHookBoolean(Object artmethod, Object receiver, Object[] args) {
return (Boolean) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
private static byte onHookByte(Object artmethod, Object receiver, Object[] args) {
return (Byte) DexposedBridge.handleHookedArtMethod(artmethod, receiver, args);
}
//endregion
//region ---------------voidBridge---------------
private static void voidBridge(long x1, long struct) {
referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static void voidBridge(long x1, long struct, long x3) {
referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static void voidBridge(long x1, long struct, long x3, long x4) {
referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static void voidBridge(long r1, long struct, long x3, long x4, long x5) {
referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static void voidBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
private static void voidBridge(long r1, long struct, long x3, long x4, long x5, long x6, long x7) {
referenceBridge(r1, struct, x3, x4, x5, x6, x7);
}
//endregion
//region ---------------booleanBridge---------------
private static boolean booleanBridge(long x1, long struct) {
return (Boolean) referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static boolean booleanBridge(long x1, long struct, long x3) {
return (Boolean) referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static boolean booleanBridge(long x1, long struct, long x3, long x4) {
return (Boolean) referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static boolean booleanBridge(long r1, long struct, long x3, long x4, long x5) {
return (Boolean) referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static boolean booleanBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
return (Boolean) referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
private static boolean booleanBridge(long r1, long struct, long x3, long x4, long x5, long x6, long x7) {
return (Boolean) referenceBridge(r1, struct, x3, x4, x5, x6, x7);
}
//endregion
//region ---------------byteBridge---------------
private static byte byteBridge(long x1, long struct) {
return (Byte) referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static byte byteBridge(long x1, long struct, long x3) {
return (Byte) referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static byte byteBridge(long x1, long struct, long x3, long x4) {
return (Byte) referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static byte byteBridge(long r1, long struct, long x3, long x4, long x5) {
return (Byte) referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static byte byteBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
return (Byte) referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
private static byte byteBridge(long r1, long struct, long x3, long x4, long x5, long x6, long x7) {
return (Byte) referenceBridge(r1, struct, x3, x4, x5, x6, x7);
}
//endregion
//region ---------------shortBridge---------------
private static short shortBridge(long x1, long struct) {
return (Short) referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static short shortBridge(long x1, long struct, long x3) {
return (Short) referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static short shortBridge(long x1, long struct, long x3, long x4) {
return (Short) referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static short shortBridge(long r1, long struct, long x3, long x4, long x5) {
return (Short) referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static short shortBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
return (Short) referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
private static short shortBridge(long r1, long struct, long x3, long x4, long x5, long x6, long x7) {
return (Short) referenceBridge(r1, struct, x3, x4, x5, x6, x7);
}
//endregion
//region ---------------charBridge---------------
private static char charBridge(long x1, long struct) {
return (Character) referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static char charBridge(long x1, long struct, long x3) {
return (Character) referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static char charBridge(long x1, long struct, long x3, long x4) {
return (Character) referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static char charBridge(long r1, long struct, long x3, long x4, long x5) {
return (Character) referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static char charBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
return (Character) referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
private static char charBridge(long r1, long struct, long x3, long x4, long x5, long x6, long x7) {
return (Character) referenceBridge(r1, struct, x3, x4, x5, x6, x7);
}
//endregion
//region ---------------intBridge---------------
private static int intBridge(long x1, long struct) {
return (Integer) referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static int intBridge(long x1, long struct, long x3) {
return (Integer) referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static int intBridge(long x1, long struct, long x3, long x4) {
return (Integer) referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static int intBridge(long r1, long struct, long x3, long x4, long x5) {
return (Integer) referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static int intBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
return (Integer) referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
private static int intBridge(long r1, long struct, long x3, long x4, long x5, long x6, long x7) {
return (Integer) referenceBridge(r1, struct, x3, x4, x5, x6, x7);
}
//endregion
//region ---------------longBridge---------------
private static long longBridge(long x1, long struct) {
return (Long) referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static long longBridge(long x1, long struct, long x3) {
return (Long) referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static long longBridge(long x1, long struct, long x3, long x4) {
return (Long) referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static long longBridge(long r1, long struct, long x3, long x4, long x5) {
return (Long) referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static long longBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
return (Long) referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
private static long longBridge(long r1, long struct, long x3, long x4, long x5, long x6, long x7) {
return (Long) referenceBridge(r1, struct, x3, x4, x5, x6, x7);
}
//endregion
//region ---------------floatBridge---------------
private static float floatBridge(long x1, long struct) {
return (Float) referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static float floatBridge(long x1, long struct, long x3) {
return (Float) referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static float floatBridge(long x1, long struct, long x3, long x4) {
return (Float) referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static float floatBridge(long r1, long struct, long x3, long x4, long x5) {
return (Float) referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static float floatBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
return (Float) referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
private static float floatBridge(long r1, long struct, long x3, long x4, long x5, long x6, long x7) {
return (Float) referenceBridge(r1, struct, x3, x4, x5, x6, x7);
}
//endregion
//region ---------------doubleBridge---------------
private static double doubleBridge(long x1, long struct) {
return (Double) referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static double doubleBridge(long x1, long struct, long x3) {
return (Double) referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static double doubleBridge(long x1, long struct, long x3, long x4) {
return (Double) referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static double doubleBridge(long r1, long struct, long x3, long x4, long x5) {
return (Double) referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static double doubleBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
return (Double) referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
private static double doubleBridge(long r1, long struct, long x3, long x4, long x5, long x6, long x7) {
return (Double) referenceBridge(r1, struct, x3, x4, x5, x6, x7);
}
//endregion
//region ---------------referenceBridge---------------
private static Object referenceBridge(long x1, long struct) {
return referenceBridge(x1, struct, 0, 0, 0, 0, 0);
}
private static Object referenceBridge(long x1, long struct, long x3) {
return referenceBridge(x1, struct, x3, 0, 0, 0, 0);
}
private static Object referenceBridge(long x1, long struct, long x3, long x4) {
return referenceBridge(x1, struct, x3, x4, 0, 0, 0);
}
private static Object referenceBridge(long r1, long struct, long x3, long x4, long x5) {
return referenceBridge(r1, struct, x3, x4, x5, 0, 0);
}
private static Object referenceBridge(long r1, long struct, long x3, long x4, long x5, long x6) {
return referenceBridge(r1, struct, x3, x4, x5, x6, 0);
}
//endregion
private static Object referenceBridge(long x1, long struct, long x3, long x4, long x5, long x6, long x7) {
Logger.i(TAG, "enter bridge function.");
// struct {
// void* sp;
// void* x2;
// void* sourceMethod
// }
final long self = XposedHelpers.getLongField(Thread.currentThread(), "nativePeer");
Logger.d(TAG, "java thread native peer:" + Long.toHexString(self));
Logger.d(TAG, "struct:" + Long.toHexString(struct));
Logger.d(TAG, "struct:" + Debug.hexdump(EpicNative.get(struct, 24), struct));
final long sp = ByteBuffer.wrap(EpicNative.get(struct, 8)).order(ByteOrder.LITTLE_ENDIAN).getLong();
Logger.d(TAG, "stack:" + sp);
final byte[] rr1 = ByteBuffer.allocate(8).order(ByteOrder.LITTLE_ENDIAN).putLong(x1).array();
final byte[] r2 = EpicNative.get(struct + 8, 8);
final long sourceMethod = ByteBuffer.wrap(EpicNative.get(struct + 16, 8)).order(ByteOrder.LITTLE_ENDIAN).getLong();
Logger.d(TAG, "sourceMethod:" + Long.toHexString(sourceMethod));
Epic.MethodInfo originMethodInfo = Epic.getMethodInfo(sourceMethod);
Logger.d(TAG, "originMethodInfo :" + originMethodInfo);
boolean isStatic = originMethodInfo.isStatic;
int numberOfArgs = originMethodInfo.paramNumber;
Class[] typeOfArgs = originMethodInfo.paramTypes;
Object[] arguments = new Object[numberOfArgs];
Object receiver;
if (isStatic) {
receiver = null;
do {
if (numberOfArgs == 0) break;
arguments[0] = wrapArgument(typeOfArgs[0], self, rr1);
if (numberOfArgs == 1) break;
arguments[1] = wrapArgument(typeOfArgs[1], self, r2);
if (numberOfArgs == 2) break;
arguments[2] = wrapArgument(typeOfArgs[2], self, x3);
if (numberOfArgs == 3) break;
arguments[3] = wrapArgument(typeOfArgs[3], self, x4);
if (numberOfArgs == 4) break;
arguments[4] = wrapArgument(typeOfArgs[4], self, x5);
if (numberOfArgs == 5) break;
arguments[5] = wrapArgument(typeOfArgs[5], self, x6);
if (numberOfArgs == 6) break;
arguments[6] = wrapArgument(typeOfArgs[6], self, x7);
if (numberOfArgs == 7) break;
for (int i = 7; i < numberOfArgs; i++) {
byte[] argsInStack = EpicNative.get(sp + i * 8 + 8, 8);
arguments[i] = wrapArgument(typeOfArgs[i], self, argsInStack);
}
} while (false);
} else {
receiver = EpicNative.getObject(self, x1);
Logger.i(TAG, "this :" + receiver);
do {
if (numberOfArgs == 0) break;
arguments[0] = wrapArgument(typeOfArgs[0], self, r2);
if (numberOfArgs == 1) break;
arguments[1] = wrapArgument(typeOfArgs[1], self, x3);
if (numberOfArgs == 2) break;
arguments[2] = wrapArgument(typeOfArgs[2], self, x4);
if (numberOfArgs == 3) break;
arguments[3] = wrapArgument(typeOfArgs[3], self, x5);
if (numberOfArgs == 4) break;
arguments[4] = wrapArgument(typeOfArgs[4], self, x6);
if (numberOfArgs == 5) break;
arguments[5] = wrapArgument(typeOfArgs[5], self, x7);
if (numberOfArgs == 6) break;
for (int i = 6; i < numberOfArgs; i++) {
byte[] argsInStack = EpicNative.get(sp + i * 8 + 16, 8);
arguments[i] = wrapArgument(typeOfArgs[i], self, argsInStack);
}
} while (false);
}
Logger.i(TAG, "arguments:" + Arrays.toString(arguments));
Class returnType = originMethodInfo.returnType;
Object artMethod = originMethodInfo.method;
Logger.d(TAG, "leave bridge function");
if (returnType == void.class) {
onHookVoid(artMethod, receiver, arguments);
return 0;
} else if (returnType == char.class) {
return onHookChar(artMethod, receiver, arguments);
} else if (returnType == byte.class) {
return onHookByte(artMethod, receiver, arguments);
} else if (returnType == short.class) {
return onHookShort(artMethod, receiver, arguments);
} else if (returnType == int.class) {
return onHookInt(artMethod, receiver, arguments);
} else if (returnType == long.class) {
return onHookLong(artMethod, receiver, arguments);
} else if (returnType == float.class) {
return onHookFloat(artMethod, receiver, arguments);
} else if (returnType == double.class) {
return onHookDouble(artMethod, receiver, arguments);
} else if (returnType == boolean.class) {
return onHookBoolean(artMethod, receiver, arguments);
} else {
return onHookObject(artMethod, receiver, arguments);
}
}
private static Object wrapArgument(Class type, long self, long value) {
return wrapArgument(type, self, ByteBuffer.allocate(8).order(ByteOrder.LITTLE_ENDIAN).putLong(value).array());
}
private static Object wrapArgument(Class type, long self, byte[] value) {
final ByteBuffer byteBuffer = ByteBuffer.wrap(value).order(ByteOrder.LITTLE_ENDIAN);
if (type.isPrimitive()) {
if (type == int.class) {
return byteBuffer.getInt();
} else if (type == long.class) {
return byteBuffer.getLong();
} else if (type == float.class) {
return byteBuffer.getFloat();
} else if (type == short.class) {
return byteBuffer.getShort();
} else if (type == byte.class) {
return byteBuffer.get();
} else if (type == char.class) {
return byteBuffer.getChar();
} else if (type == double.class) {
return byteBuffer.getDouble();
} else if (type == boolean.class) {
return byteBuffer.getInt() == 0;
} else {
throw new RuntimeException("unknown type:" + type);
}
} else {
long address = byteBuffer.getLong();
Object object = EpicNative.getObject(self, address);
// Logger.d(TAG, "wrapArgument, address: 0x" + Long.toHexString(address) + ", value:" + object);
return object;
}
}
private static Map, String> bridgeMethodMap = new HashMap<>();
static {
Class[] primitiveTypes = new Class[]{boolean.class, byte.class, char.class, short.class,
int.class, long.class, float.class, double.class};
for (Class primitiveType : primitiveTypes) {
bridgeMethodMap.put(primitiveType, primitiveType.getName() + "Bridge");
}
bridgeMethodMap.put(void.class, "voidBridge");
bridgeMethodMap.put(Object.class, "referenceBridge");
}
public static Method getBridgeMethod(Epic.MethodInfo methodInfo) {
try {
Class returnType = methodInfo.returnType;
int paramNumber = methodInfo.isStatic ? methodInfo.paramNumber : methodInfo.paramNumber + 1;
Class[] bridgeParamTypes;
if (paramNumber <= 2) {
paramNumber = 2;
}
bridgeParamTypes = new Class[paramNumber];
for (int i = 0; i < paramNumber; i++) {
bridgeParamTypes[i] = long.class;
}
final String bridgeMethod = bridgeMethodMap.get(returnType.isPrimitive() ? returnType : Object.class);
Logger.d(TAG, "bridge method:" + bridgeMethod + ", map:" + bridgeMethodMap);
Method method = Entry64_2.class.getDeclaredMethod(bridgeMethod, bridgeParamTypes);
method.setAccessible(true);
return method;
} catch (Throwable e) {
throw new RuntimeException("can not found bridge." , e);
}
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/method/ArtMethod.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art.method;
import android.os.Build;
import android.util.Log;
import com.taobao.android.dexposed.utility.Debug;
import com.taobao.android.dexposed.utility.Logger;
import com.taobao.android.dexposed.utility.NeverCalled;
import java.lang.reflect.AccessibleObject;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.nio.ByteBuffer;
import java.util.Arrays;
import de.robv.android.xposed.XposedHelpers;
import me.weishu.epic.art.EpicNative;
/**
* Object stands for a Java Method, may be a constructor or a method.
*/
public class ArtMethod {
private static final String TAG = "ArtMethod";
/**
* The address of the Art method. this is not the real memory address of the java.lang.reflect.Method
* But the address used by VM which stand for the Java method.
* generally, it was the address of art::mirror::ArtMethod. @{link #objectAddress}
*/
private long address;
/**
* the origin object if this is a constructor
*/
private Constructor constructor;
/**
* the origin object if this is a method;
*/
private Method method;
/**
* the origin ArtMethod if this method is a backup of someone, null when this is not backup
*/
private ArtMethod origin;
/**
* The size of ArtMethod, usually the java part of ArtMethod may not stand for the whole one
* may be some native field is placed in the end of header.
*/
private static int artMethodSize = -1;
private ArtMethod(Constructor constructor) {
if (constructor == null) {
throw new IllegalArgumentException("constructor can not be null");
}
this.constructor = constructor;
init();
}
private ArtMethod(Method method, long address) {
if (method == null) {
throw new IllegalArgumentException("method can not be null");
}
this.method = method;
if (address != -1) {
this.address = address;
} else {
init();
}
}
private void init() {
if (constructor != null) {
address = EpicNative.getMethodAddress(constructor);
} else {
address = EpicNative.getMethodAddress(method);
}
}
public static ArtMethod of(Method method) {
return new ArtMethod(method, -1);
}
public static ArtMethod of(Method method, long address) {
return new ArtMethod(method, address);
}
public static ArtMethod of(Constructor constructor) {
return new ArtMethod(constructor);
}
public ArtMethod backup() {
try {
// Before Oreo, it is: java.lang.reflect.AbstractMethod
// After Oreo, it is: java.lang.reflect.Executable
Class abstractMethodClass = Method.class.getSuperclass();
Object executable = this.getExecutable();
ArtMethod artMethod;
if (Build.VERSION.SDK_INT < 23) {
Class artMethodClass = Class.forName("java.lang.reflect.ArtMethod");
//Get the original artMethod field
Field artMethodField = abstractMethodClass.getDeclaredField("artMethod");
if (!artMethodField.isAccessible()) {
artMethodField.setAccessible(true);
}
Object srcArtMethod = artMethodField.get(executable);
Constructor constructor = artMethodClass.getDeclaredConstructor();
constructor.setAccessible(true);
Object destArtMethod = constructor.newInstance();
//Fill the fields to the new method we created
for (Field field : artMethodClass.getDeclaredFields()) {
if (!field.isAccessible()) {
field.setAccessible(true);
}
field.set(destArtMethod, field.get(srcArtMethod));
}
Method newMethod = Method.class.getConstructor(artMethodClass).newInstance(destArtMethod);
newMethod.setAccessible(true);
artMethod = ArtMethod.of(newMethod);
artMethod.setEntryPointFromQuickCompiledCode(getEntryPointFromQuickCompiledCode());
artMethod.setEntryPointFromJni(getEntryPointFromJni());
} else {
Constructor constructor = Method.class.getDeclaredConstructor();
// we can't use constructor.setAccessible(true); because Google does not like it
// AccessibleObject.setAccessible(new AccessibleObject[]{constructor}, true);
Field override = AccessibleObject.class.getDeclaredField(
Build.VERSION.SDK_INT == Build.VERSION_CODES.M ? "flag" : "override");
override.setAccessible(true);
override.set(constructor, true);
Method m = constructor.newInstance();
m.setAccessible(true);
for (Field field : abstractMethodClass.getDeclaredFields()) {
field.setAccessible(true);
field.set(m, field.get(executable));
}
Field artMethodField = abstractMethodClass.getDeclaredField("artMethod");
artMethodField.setAccessible(true);
int artMethodSize = getArtMethodSize();
long memoryAddress = EpicNative.map(artMethodSize);
byte[] data = EpicNative.get(address, artMethodSize);
EpicNative.put(data, memoryAddress);
artMethodField.set(m, memoryAddress);
// From Android R, getting method address may involve the jni_id_manager which uses
// ids mapping instead of directly returning the method address. During resolving the
// id->address mapping, it will assume the art method to be from the "methods_" array
// in class. However this address may be out of the range of the methods array. Thus
// it will cause a crash during using the method offset to resolve method array.
artMethod = ArtMethod.of(m, memoryAddress);
}
artMethod.makePrivate();
artMethod.setAccessible(true);
artMethod.origin = this; // save origin method.
return artMethod;
} catch (Throwable e) {
Log.e(TAG, "backup method error:", e);
throw new IllegalStateException("Cannot create backup method from :: " + getExecutable(), e);
}
}
/**
* @return is method/constructor accessible
*/
public boolean isAccessible() {
if (constructor != null) {
return constructor.isAccessible();
} else {
return method.isAccessible();
}
}
/**
* make the constructor or method accessible
* @param accessible accessible
*/
public void setAccessible(boolean accessible) {
if (constructor != null) {
constructor.setAccessible(accessible);
} else {
method.setAccessible(accessible);
}
}
/**
* get the origin method's name
* @return constructor name of method name
*/
public String getName() {
if (constructor != null) {
return constructor.getName();
} else {
return method.getName();
}
}
public Class getDeclaringClass() {
if (constructor != null) {
return constructor.getDeclaringClass();
} else {
return method.getDeclaringClass();
}
}
/**
* Force compile the method to avoid interpreter mode.
* This is only used above Android N
* @return if compile success return true, otherwise false.
*/
public boolean compile() {
if (constructor != null) {
return EpicNative.compileMethod(constructor);
} else {
return EpicNative.compileMethod(method);
}
}
/**
* invoke the origin method
* @param receiver the receiver
* @param args origin method/constructor's parameters
* @return origin method's return value.
* @throws IllegalAccessException throw if no access, impossible.
* @throws InvocationTargetException invoke target error.
* @throws InstantiationException throw when the constructor can not create instance.
*/
public Object invoke(Object receiver, Object... args) throws IllegalAccessException, InvocationTargetException, InstantiationException {
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
if (origin != null) {
byte[] currentAddress = EpicNative.get(origin.address, 4);
byte[] backupAddress = EpicNative.get(address, 4);
if (!Arrays.equals(currentAddress, backupAddress)) {
if (Debug.DEBUG) {
Logger.i(TAG, "the address of java method was moved by gc, backup it now! origin address: 0x"
+ Arrays.toString(currentAddress) + " , currentAddress: 0x" + Arrays.toString(backupAddress));
}
EpicNative.put(currentAddress, address);
return invokeInternal(receiver, args);
} else {
Logger.i(TAG, "the address is same with last invoke, not moved by gc");
}
}
}
return invokeInternal(receiver, args);
}
private Object invokeInternal(Object receiver, Object... args) throws IllegalAccessException, InvocationTargetException, InstantiationException {
if (constructor != null) {
return constructor.newInstance(args);
} else {
return method.invoke(receiver, args);
}
}
/**
* get the modifiers of origin method/constructor
* @return the modifiers
*/
public int getModifiers() {
if (constructor != null) {
return constructor.getModifiers();
} else {
return method.getModifiers();
}
}
/**
* get the parameter type of origin method/constructor
* @return the parameter types.
*/
public Class[] getParameterTypes() {
if (constructor != null) {
return constructor.getParameterTypes();
} else {
return method.getParameterTypes();
}
}
/**
* get the return type of origin method/constructor
* @return the return type, if it is a constructor, return Object.class
*/
public Class getReturnType() {
if (constructor != null) {
return Object.class;
} else {
return method.getReturnType();
}
}
/**
* get the exception declared by the method/constructor
* @return the array of declared exception.
*/
public Class[] getExceptionTypes() {
if (constructor != null) {
return constructor.getExceptionTypes();
} else {
return method.getExceptionTypes();
}
}
public String toGenericString() {
if (constructor != null) {
return constructor.toGenericString();
} else {
return method.toGenericString();
}
}
/**
* @return the origin method/constructor
*/
public Object getExecutable() {
if (constructor != null) {
return constructor;
} else {
return method;
}
}
/**
* get the memory address of the inner constructor/method
* @return the method address, in general, it was the pointer of art::mirror::ArtMethod
*/
public long getAddress() {
return address;
}
/**
* get the unique identifier of the constructor/method
* @return the method identifier
*/
public String getIdentifier() {
// Can we use address, may gc move it??
return String.valueOf(getAddress());
}
/**
* force set the private flag of the method.
*/
public void makePrivate() {
int accessFlags = getAccessFlags();
accessFlags &= ~Modifier.PUBLIC;
accessFlags |= Modifier.PRIVATE;
setAccessFlags(accessFlags);
}
/**
* the static method is lazy resolved, when not resolved, the entry point is a trampoline of
* a bridge, we can not hook these entry. this method force the static method to be resolved.
*/
public void ensureResolved() {
if (!Modifier.isStatic(getModifiers())) {
Logger.d(TAG, "not static, ignore.");
return;
}
try {
invoke(null);
Logger.d(TAG, "ensure resolved");
} catch (Exception ignored) {
// we should never make a successful call.
} finally {
EpicNative.MakeInitializedClassVisibilyInitialized();
}
}
/**
* The entry point of the quick compiled code.
* @return the entry point.
*/
public long getEntryPointFromQuickCompiledCode() {
return Offset.read(address, Offset.ART_QUICK_CODE_OFFSET);
}
/**
* @param pointer_entry_point_from_quick_compiled_code the entry point.
*/
public void setEntryPointFromQuickCompiledCode(long pointer_entry_point_from_quick_compiled_code) {
Offset.write(address, Offset.ART_QUICK_CODE_OFFSET, pointer_entry_point_from_quick_compiled_code);
}
/**
* @return the access flags of the method/constructor, not only stand for the modifiers.
*/
public int getAccessFlags() {
return (int) Offset.read(address, Offset.ART_ACCESS_FLAG_OFFSET);
}
public void setAccessFlags(int newFlags) {
Offset.write(address, Offset.ART_ACCESS_FLAG_OFFSET, newFlags);
}
public void setEntryPointFromJni(long entryPointFromJni) {
Offset.write(address, Offset.ART_JNI_ENTRY_OFFSET, entryPointFromJni);
}
public long getEntryPointFromJni() {
return Offset.read(address, Offset.ART_JNI_ENTRY_OFFSET);
}
/**
* The size of an art::mirror::ArtMethod, we use two rule method to measure the size
* @return the size
*/
public static int getArtMethodSize() {
if (artMethodSize > 0) {
return artMethodSize;
}
final Method rule1 = XposedHelpers.findMethodExact(ArtMethod.class, "rule1");
final Method rule2 = XposedHelpers.findMethodExact(ArtMethod.class, "rule2");
final long rule2Address = EpicNative.getMethodAddress(rule2);
final long rule1Address = EpicNative.getMethodAddress(rule1);
final long size = Math.abs(rule2Address - rule1Address);
artMethodSize = (int) size;
Logger.d(TAG, "art Method size: " + size);
return artMethodSize;
}
private void rule1() {
Log.i(TAG, "do not inline me!!");
}
private void rule2() {
Log.i(TAG, "do not inline me!!");
}
public static long getQuickToInterpreterBridge() {
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N) {
return -1L;
}
final Method fake = XposedHelpers.findMethodExact(NeverCalled.class, "fake", int.class);
return ArtMethod.of(fake).getEntryPointFromQuickCompiledCode();
}
public long getFieldOffset() {
// searchOffset(address, )
return 0L;
}
/**
* search Offset in memory
* @param base base address
* @param range search range
* @param value search value
* @return the first address of value if found
*/
public static long searchOffset(long base, long range, int value) {
final int align = 4;
final long step = range / align;
for (long i = 0; i < step; i++) {
long offset = i * align;
final byte[] bytes = EpicNative.memget(base + i * align, align);
final int valueInOffset = ByteBuffer.allocate(4).put(bytes).getInt();
if (valueInOffset == value) {
return offset;
}
}
return -1;
}
public static long searchOffset(long base, long range, long value) {
final int align = 4;
final long step = range / align;
for (long i = 0; i < step; i++) {
long offset = i * align;
final byte[] bytes = EpicNative.memget(base + i * align, align);
final long valueInOffset = ByteBuffer.allocate(8).put(bytes).getLong();
if (valueInOffset == value) {
return offset;
}
}
return -1;
}
}
================================================
FILE: library/src/main/java/me/weishu/epic/art/method/Offset.java
================================================
/*
* Copyright (c) 2017, weishu twsxtd@gmail.com
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package me.weishu.epic.art.method;
import android.os.Build;
import com.taobao.android.dexposed.utility.Debug;
import com.taobao.android.dexposed.utility.Logger;
import com.taobao.android.dexposed.utility.Runtime;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import me.weishu.epic.art.EpicNative;
/**
* The Offset of field in an ArtMethod
*/
class Offset {
private static final String TAG = "Offset";
/**
* the offset of the entry point
*/
static Offset ART_QUICK_CODE_OFFSET;
/**
* the offset of the access flag
*/
static Offset ART_ACCESS_FLAG_OFFSET;
/**
* the offset of a jni entry point
*/
static Offset ART_JNI_ENTRY_OFFSET;
static {
initFields();
}
private enum BitWidth {
DWORD(4),
QWORD(8);
BitWidth(int width) {
this.width = width;
}
int width;
}
private long offset;
private BitWidth length;
public long getOffset() {
return offset;
}
public void setOffset(long offset) {
this.offset = offset;
}
public BitWidth getLength() {
return length;
}
public void setLength(BitWidth length) {
this.length = length;
}
public static long read(long base, Offset offset) {
long address = base + offset.offset;
byte[] bytes = EpicNative.get(address, offset.length.width);
if (offset.length == BitWidth.DWORD) {
return ByteBuffer.wrap(bytes).order(ByteOrder.LITTLE_ENDIAN).getInt() & 0xFFFFFFFFL;
} else {
return ByteBuffer.wrap(bytes).order(ByteOrder.LITTLE_ENDIAN).getLong();
}
}
public static void write(long base, Offset offset, long value) {
long address = base + offset.offset;
byte[] bytes;
if (offset.length == BitWidth.DWORD) {
if (value > 0xFFFFFFFFL) {
throw new IllegalStateException("overflow may occur");
} else {
bytes = ByteBuffer.allocate(4).order(ByteOrder.LITTLE_ENDIAN).putInt((int) value).array();
}
} else {
bytes = ByteBuffer.allocate(8).order(ByteOrder.LITTLE_ENDIAN).putLong(value).array();
}
EpicNative.put(bytes, address);
}
private static void initFields() {
ART_QUICK_CODE_OFFSET = new Offset();
ART_ACCESS_FLAG_OFFSET = new Offset();
ART_JNI_ENTRY_OFFSET = new Offset();
ART_ACCESS_FLAG_OFFSET.setLength(Offset.BitWidth.DWORD);
final int apiLevel = Build.VERSION.SDK_INT;
if (Runtime.is64Bit()) {
ART_QUICK_CODE_OFFSET.setLength(Offset.BitWidth.QWORD);
ART_JNI_ENTRY_OFFSET.setLength(BitWidth.QWORD);
switch (apiLevel) {
case Build.VERSION_CODES.S:
// source: https://android.googlesource.com/platform/art/+/refs/heads/android12-release/runtime/art_method.h
ART_QUICK_CODE_OFFSET.setOffset(24);
ART_JNI_ENTRY_OFFSET.setOffset(16);
ART_ACCESS_FLAG_OFFSET.setOffset(4);
break;
case Build.VERSION_CODES.R:
case Build.VERSION_CODES.Q:
case Build.VERSION_CODES.P:
ART_QUICK_CODE_OFFSET.setOffset(32);
ART_JNI_ENTRY_OFFSET.setOffset(24);
ART_ACCESS_FLAG_OFFSET.setOffset(4);
break;
case Build.VERSION_CODES.O_MR1:
case Build.VERSION_CODES.O:
ART_QUICK_CODE_OFFSET.setOffset(40);
ART_JNI_ENTRY_OFFSET.setOffset(32);
ART_ACCESS_FLAG_OFFSET.setOffset(4);
break;
case Build.VERSION_CODES.N_MR1:
case Build.VERSION_CODES.N:
ART_QUICK_CODE_OFFSET.setOffset(48);
ART_JNI_ENTRY_OFFSET.setOffset(40);
ART_ACCESS_FLAG_OFFSET.setOffset(4);
break;
case Build.VERSION_CODES.M:
ART_QUICK_CODE_OFFSET.setOffset(48);
ART_JNI_ENTRY_OFFSET.setOffset(40);
ART_ACCESS_FLAG_OFFSET.setOffset(12);
break;
case Build.VERSION_CODES.LOLLIPOP_MR1:
ART_QUICK_CODE_OFFSET.setOffset(56);
ART_JNI_ENTRY_OFFSET.setOffset(44);
ART_ACCESS_FLAG_OFFSET.setOffset(20);
break;
case Build.VERSION_CODES.LOLLIPOP:
ART_QUICK_CODE_OFFSET.setOffset(40);
ART_QUICK_CODE_OFFSET.setLength(BitWidth.QWORD);
ART_JNI_ENTRY_OFFSET.setOffset(32);
ART_JNI_ENTRY_OFFSET.setLength(BitWidth.QWORD);
ART_ACCESS_FLAG_OFFSET.setOffset(56);
break;
case Build.VERSION_CODES.KITKAT:
ART_QUICK_CODE_OFFSET.setOffset(32);
ART_ACCESS_FLAG_OFFSET.setOffset(28);
break;
default:
throw new RuntimeException("API LEVEL: " + apiLevel + " is not supported now : (");
}
} else {
ART_QUICK_CODE_OFFSET.setLength(Offset.BitWidth.DWORD);
ART_JNI_ENTRY_OFFSET.setLength(BitWidth.DWORD);
switch (apiLevel) {
case Build.VERSION_CODES.S:
ART_QUICK_CODE_OFFSET.setOffset(20);
ART_JNI_ENTRY_OFFSET.setOffset(16);
ART_ACCESS_FLAG_OFFSET.setOffset(4);
break;
case Build.VERSION_CODES.R:
case Build.VERSION_CODES.Q:
case Build.VERSION_CODES.P:
ART_QUICK_CODE_OFFSET.setOffset(24);
ART_JNI_ENTRY_OFFSET.setOffset(20);
ART_ACCESS_FLAG_OFFSET.setOffset(4);
break;
case Build.VERSION_CODES.O_MR1:
case Build.VERSION_CODES.O:
ART_QUICK_CODE_OFFSET.setOffset(28);
ART_JNI_ENTRY_OFFSET.setOffset(24);
ART_ACCESS_FLAG_OFFSET.setOffset(4);
break;
case Build.VERSION_CODES.N_MR1:
case Build.VERSION_CODES.N:
ART_QUICK_CODE_OFFSET.setOffset(32);
ART_JNI_ENTRY_OFFSET.setOffset(28);
ART_ACCESS_FLAG_OFFSET.setOffset(4);
break;
case Build.VERSION_CODES.M:
ART_QUICK_CODE_OFFSET.setOffset(36);
ART_JNI_ENTRY_OFFSET.setOffset(32);
ART_ACCESS_FLAG_OFFSET.setOffset(12);
break;
case Build.VERSION_CODES.LOLLIPOP_MR1:
ART_QUICK_CODE_OFFSET.setOffset(44);
ART_JNI_ENTRY_OFFSET.setOffset(40);
ART_ACCESS_FLAG_OFFSET.setOffset(20);
break;
case Build.VERSION_CODES.LOLLIPOP:
ART_QUICK_CODE_OFFSET.setOffset(40);
ART_QUICK_CODE_OFFSET.setLength(BitWidth.QWORD);
ART_JNI_ENTRY_OFFSET.setOffset(32);
ART_JNI_ENTRY_OFFSET.setLength(BitWidth.QWORD);
ART_ACCESS_FLAG_OFFSET.setOffset(56);
break;
case Build.VERSION_CODES.KITKAT:
ART_QUICK_CODE_OFFSET.setOffset(32);
ART_ACCESS_FLAG_OFFSET.setOffset(28);
break;
default:
throw new RuntimeException("API LEVEL: " + apiLevel + " is not supported now : (");
}
}
if (Debug.DEBUG) {
Logger.i(TAG, "quick code offset: " + ART_QUICK_CODE_OFFSET.getOffset());
Logger.i(TAG, "access flag offset: " + ART_ACCESS_FLAG_OFFSET.getOffset());
Logger.i(TAG, "jni code offset: " + ART_JNI_ENTRY_OFFSET.getOffset());
}
}
}
================================================
FILE: library/src/main/res/values/strings.xml
================================================
epic
================================================
FILE: settings.gradle
================================================
include ':app', ':library'
2. 监控 dex 文件的加载：
```java
DexposedBridge.findAndHookMethod(DexFile.class, "loadDex", String.class, String.class, int.class, new XC_MethodHook() {
@Override
protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
super.beforeHookedMethod(param);
String dex = (String) param.args[0];
String odex = (String) param.args[1];
Log.i(TAG, "load dex, input:" + dex + ", output:" + odex);
}
});
```
## 支持情况
目前 Epic 支持 Android 5.0 ~ 11 的 Thumb-2/ARM64 指令集，arm32/x86/x86_64/mips/mips64 不支持。本项目被 [VirtualXposed](https://github.com/android-hacker/VirtualXposed) 和 [太极](http://taichi.cool) 以及大量企业级用户使用，经过了数千万用户的验证，已经被证明非常稳定。目前，手机 QQ 已经在产品中使用 Epic。
## 已知问题
1. 受限于 inline hook 本身，短方法 (Thumb-2 下指令小于 8 个字节，ARM64 小于 16 字节) 无法支持。
2. 被完全内联的方法不支持。
## 致谢
1. [Dexposed](https://github.com/alibaba/dexposed)
2. [Xposed](http://repo.xposed.info/module/de.robv.android.xposed.installer)
3. [mar-v-in/ArtHook](https://github.com/mar-v-in/ArtHook)
4. [Nougat_dlfunctions](https://github.com/avs333/Nougat_dlfunctions.git)
## 联系我
twsxtd@gmail.com
================================================
FILE: app/.gitignore
================================================
/build
================================================
FILE: app/build.gradle
================================================
apply plugin: 'com.android.application'
android {
compileSdkVersion 30
defaultConfig {
applicationId "me.weishu.epic.samples"
minSdkVersion 21
targetSdkVersion 30
versionCode 1
versionName "1.0"
testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
externalNativeBuild {
ndkBuild {
abiFilters "armeabi-v7a", "x86"
}
}
}
buildTypes {
release {
minifyEnabled false
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
}
}
sourceSets {
main {
jniLibs.srcDirs = ['libs']
}
}
lintOptions {
abortOnError false
}
}
dependencies {
implementation fileTree(dir: 'libs', include: ['*.jar'])
implementation project(":library")
implementation 'com.qmuiteam:qmui:1.0.4'
}
================================================
FILE: app/proguard-rules.pro
================================================
# Add project specific ProGuard rules here.
# By default, the flags in this file are appended to flags specified
# in /Users/weishu/Library/Android/sdk/tools/proguard/proguard-android.txt
# You can edit the include path and order by changing the proguardFiles
# directive in build.gradle.
#
# For more details, see
# http://developer.android.com/guide/developing/tools/proguard.html
# Add any project specific keep options here:
# If your project uses WebView with JS, uncomment the following
# and specify the fully qualified class name to the JavaScript interface
# class:
#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
# public *;
#}
# Uncomment this to preserve the line number information for
# debugging stack traces.
#-keepattributes SourceFile,LineNumberTable
# If you keep the line number information, uncomment this to
# hide the original source file name.
#-renamesourcefileattribute SourceFile
================================================
FILE: app/src/androidTest/java/me/weishu/epic/ExampleInstrumentedTest.java
================================================
//package me.weishu.epic;
//
//import android.content.Context;
//import android.support.test.InstrumentationRegistry;
//import android.support.test.runner.AndroidJUnit4;
//
//import org.junit.Test;
//import org.junit.runner.RunWith;
//
//import static junit.framework.Assert.assertEquals;
//import static org.junit.Assert.*;
//
///**
// * Instrumentation test, which will execute on an Android device.
// *
// * @see Testing documentation
// */
//@RunWith(AndroidJUnit4.class)
//public class ExampleInstrumentedTest {
// @Test
// public void useAppContext() throws Exception {
// // Context of the app under test.
// Context appContext = InstrumentationRegistry.getTargetContext();
//
// assertEquals("me.weishu.epic", appContext.getPackageName());
// }
//}
================================================
FILE: app/src/main/AndroidManifest.xml
================================================