示例#1
0
int CAirLogEx::GetPointsPenaltyBlock(LPPOINTSPENALTY lpPointsPenalty)	// 获取PointsPenalty区块
{
	BOOL bRet = FALSE;
	int cellIdx = 0;
	for (int i = 0, size = m_airMemoryArr.size(); i < size; ++ i)
	{
		for (int cidx = 0, csize = lstrlenA(m_airMemoryArr[i].lpMmeory)
			; cidx < csize
			; ++ cidx)
		{
			if ( memicmp(m_airMemoryArr[i].lpMmeory + cidx, BLOCK_POINTSPENALTY, lstrlenA(BLOCK_POINTSPENALTY)) == 0 )
			{
				cellIdx = i;
				bRet = TRUE;
				break;
			}
		}

	}
	if ( ! bRet )
	{	//如果没找到该区块,说明不是人机,消除 lpPointsPenalty 无用的多余部分
		for (int i = 0, size = m_airMemoryArr.size(); i < size; ++ i)
		{
			for (int cidx = 0, csize = lstrlenA(m_airMemoryArr[i].lpMmeory)
				; cidx < csize
				; ++ cidx)
			{
				if ( memicmp(m_airMemoryArr[i].lpMmeory + cidx, BLOCK_POINTSPENALTY_2, lstrlenA(BLOCK_POINTSPENALTY_2)) == 0 )
				{
					cellIdx = i;
					std::vector<AIRMEMORY>::iterator itr = m_airMemoryArr.begin();
					itr += cellIdx;	// itr 赋好值
					// 消除 lpPointsPenalty 无用的多余部分
					int tmpIdx = getTypeIdx(itr, SWF_DOUBLE, 0+1);
					cellIdx = getStrIdx(itr, "\n\r", tmpIdx+1);
					if (SWF_ERR_INT != cellIdx)
						FreeAirMemory(itr+tmpIdx+1, cellIdx-tmpIdx);

					cellIdx = getTypeIdx(itr, SWF_STR, 0+1);
					if ( SWF_ERR_INT == cellIdx )
						return SWF_ERR_INT;
					else
						return itr[cellIdx].idx;	// 返回 OtherTeam 开始地址索引
				}
			}

		}
		return SWF_ERR_INT;
	}
	else
		cellIdx += 1;	// +1 跳过标记
	std::vector<AIRMEMORY>::iterator itr;
	itr = m_airMemoryArr.begin();
	itr += cellIdx;

	int idx = 0;

	idx = getTypeIdx(itr, SWF_STR, 0);
	if (SWF_ERR_INT == idx)		return SWF_ERR_INT;
	else	strcpy_s(lpPointsPenalty->type, sizeof(lpPointsPenalty->type), getSWF_str(itr[idx].lpMmeory));

	idx = getTypeIdx(itr, SWF_DOUBLE, idx+1);
	if (SWF_ERR_INT == idx)		return SWF_ERR_INT;
	else	lpPointsPenalty->penalty = getSWF_double(itr[idx].lpMmeory);

	idx = getTypeIdx(itr, SWF_INT, idx+1);
	if (SWF_ERR_INT == idx)		return SWF_ERR_INT;
	else	lpPointsPenalty->unKnowAddr = getSWF_int(itr[idx].lpMmeory);

	if ( SWF_SEG == itr[idx+1].lpMmeory[0] )
		idx += 1;
	++idx;
	
	FreeAirMemory(itr, idx);
	itr = m_airMemoryArr.begin(), itr += cellIdx;
	return itr->idx;
}
示例#2
0
JNIEXPORT jint JNICALL Java_com_example_selfmodify_MainActivity_selfmodify(JNIEnv *env, jobject thisObj) {
   jint result = 1;

   char	*s;
   void	 *start;
   void	 *end;

   FILE *fp;    
   fp = fopen("/proc/self/maps", "r");    
   if(fp!=NULL)
      {
   	char line [ 2048 ];
   	while ( fgets ( line, sizeof line, fp ) != NULL ) /* read a line */
    	       {
                  if (strstr(line, "/data/dalvik-cache/data@[email protected]") != NULL)
                      {
                         if (strstr(line, "classes.dex") != NULL) 
                             {

               			s = strchr(line, '-');
                                if (s == NULL) 
                                    LOGD(" Error: string NULL");
                                *s++ = '\0';

		                start = (void *)strtoul(line, NULL, 16);
		                end = (void *)strtoul(s, NULL, 16);
            
           
          
                   		LOGD(" startAddress = %x", (unsigned int)start);
             			LOGD(" endAddress = %x", (unsigned int)end);

                             }
                       }
                 }
        fclose ( fp);
      }

  long page_size = sysconf(39);
  unsigned int start_address = (unsigned int)start;
  unsigned int end_address = (unsigned int)end;

  int search_start_page;
  unsigned int dex_search_start = end_address;  
  int search_start_position;

  search_start_page = dex_search_start - dex_search_start % page_size;

  do{

  search_start_page -= page_size;
  search_start_position = search_start_page + 40;
   
  }while(!findmagic( (void *)(search_start_page + 40) ) );


  LOGD(" search_start_page = %x", search_start_page);
  LOGD(" search_start_position = %x", search_start_position);
  LOGD("string = %s", (char *)search_start_position);
 
  int class_strIdx=0;

  class_strIdx = getStrIdx(search_start_position,"Lcom/example/selfmodify/TestAdd;",strlen("Lcom/example/selfmodify/TestAdd;"));
  LOGD("class_strIdx = %x", class_strIdx);

  int method_strIdx=0;

  method_strIdx = getStrIdx(search_start_position,"add",3);
  LOGD("method_strIdx = %x", method_strIdx);


 int class_typeIdx=0;

 class_typeIdx = getTypeIdx(search_start_position,class_strIdx);
 LOGD("class_typeIdx = %x", class_typeIdx);

 int class_def_item_address = 0;

 class_def_item_address = getClassItem(search_start_position,class_typeIdx);
 LOGD("class_def_item_address = %x", class_def_item_address);

 
 int methodIdx = 0;
 
 methodIdx = getMethodIdx(search_start_position,method_strIdx,class_typeIdx);
 LOGD("methodIdx = %x", methodIdx);
 
 int codeItem_address = 0;

 codeItem_address = getCodeItem(search_start_position,class_def_item_address,methodIdx);
 LOGD("codeItem_address = %x", codeItem_address);


 void *code_insns_address;
 code_insns_address = (void *)(codeItem_address+16);
 LOGD("code_insns_address = %x", code_insns_address);

 void *codeinsns_page_address = (void *)(codeItem_address + 16 - (codeItem_address + 16) % (unsigned int)page_size );
  LOGD("codeinsns_page_address = %x",codeinsns_page_address);


 mprotect(codeinsns_page_address,page_size,3);


 char inject[]={0x90,0x00,0x02,0x03,0x0f,0x00};

 memcpy(code_insns_address,&inject,6);








  
   return result;
}