Code Monkey home page Code Monkey logo

droidsoject's Introduction

droidsoject

android应用安全测试时用到的so注入工具.
binary for android process injection testing.

示例

avatar

How to use it

./inject com.x51.demo
然后重开一个cmd窗口:logcat -s "INJECT"
注入成功样例日志:

D/INJECT  ( 3738): [+] Target process returned from dlclose, return value=0, pc=b6f590bc
E/WakeLock( 1893): GCM_HB_ALARM release without a matched acquire!
D/INJECT  ( 3933): [+] Injecting process: 3719
D/INJECT  ( 3933): [+] get_remote_addr: local[b6f2a000], remote[b6f58000]
D/INJECT  ( 3933): [+] Remote mmap address: b6f6ab25
D/INJECT  ( 3933): [+] Calling mmap in target process.
D/INJECT  ( 3933): [+] Target process returned from mmap, return value=8cd4c000, pc=0
D/INJECT  ( 3933): [+] get_remote_addr: local[b6f8d000], remote[b6fc6000]
D/INJECT  ( 3933): [+] get_remote_addr: local[b6f8d000], remote[b6fc6000]
D/INJECT  ( 3933): [+] get_remote_addr: local[b6f8d000], remote[b6fc6000]
D/INJECT  ( 3933): [+] get_remote_addr: local[b6f8d000], remote[b6fc6000]
D/INJECT  ( 3933): [+] Get imports: dlopen: b6fc6f11, dlsym: b6fc6e61, dlclose: b6fc6ddd, dlerror: b6fc6d8d
D/INJECT  ( 3933): [+] Calling dlopen in target process.
D/INJECT  ( 3933): [+] Target process returned from dlopen, return value=90c805b8, pc=0
D/INJECT  ( 3933): [+] Calling dlsym in target process.
D/INJECT  ( 3933): [+] Target process returned from dlsym, return value=8d665c5d, pc=0
D/INJECT  ( 3933): hook_entry_addr = 0x8d665c5d
D/INJECT  ( 3933): [+] Calling hook_entry in target process.
D/DEBUG   ( 3719): Hook Success, getpid = 3719
D/DEBUG   ( 3719): Hello x51
D/DEBUG   ( 3719): You can inject some evil code here.
D/INJECT  ( 3933): [+] Target process returned from hook_entry, return value=0, pc=0

查看目标进程mmap分布 avatar

Quick Start(Windows)

quickstart.bat

adb push inject /data/local/tmp
adb push libhello.so /data/local/tmp
adb shell chmod 777 /data/local/tmp/inject
adb shell chmod 777 /data/local/tmp/libhello.so
adb shell su -c /data/local/tmp/inject com.x51.demoapp
pause

Notice

1、乙方Android测试工具之一
2、libhello.so的路径在inject中写死了,/data/local/tmp/libhello.so,可以改但没必要.

参考

https://blog.csdn.net/jinzhuojun/article/details/9900105
https://bbs.pediy.com/thread-141355.htm

droidsoject's People

Contributors

xfiftyone avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.