Add preliminary zygote code injection support

Prototyping the injection setup and a clean "self unloading" mechanism.

native/jni/inject/entry.cpp

@@ -0,0 +1,124 @@
+#include <libgen.h>
+#include <dlfcn.h>
+#include <sys/mount.h>
+#include <sys/sendfile.h>
+#include <android/log.h>
+#include <atomic>
+
+#include <utils.hpp>
+
+#include "inject.hpp"
+
+using namespace std;
+
+static void *self_handle = nullptr;
+static atomic<int> active_threads = -1;
+
+#define alog(prio) [](auto fmt, auto ap){ \
+return __android_log_vprint(ANDROID_LOG_##prio, "Magisk", fmt, ap); }
+static void inject_logging() {
+    log_cb.d = alog(DEBUG);
+    log_cb.i = alog(INFO);
+    log_cb.w = alog(WARN);
+    log_cb.e = alog(ERROR);
+    log_cb.ex = nop_ex;
+}
+
+__attribute__((destructor))
+static void inject_cleanup() {
+    if (active_threads < 0)
+        return;
+
+    // Setup 1ms
+    timespec ts = { .tv_sec = 0, .tv_nsec = 1000000L };
+
+    // Check flag in busy loop
+    while (active_threads)
+        nanosleep(&ts, nullptr);
+
+    // Wait another 1ms to make sure all threads left our code
+    nanosleep(&ts, nullptr);
+}
+
+static inline void self_unload() {
+    new_daemon_thread(reinterpret_cast<void *(*)(void *)>(&dlclose), self_handle);
+    active_threads--;
+}
+
+static void *unload_first_stage(void *) {
+    // Setup 1ms
+    timespec ts = { .tv_sec = 0, .tv_nsec = 1000000L };
+
+    while (getenv(INJECT_ENV_2))
+        nanosleep(&ts, nullptr);
+
+    // Wait another 1ms to make sure all threads left our code
+    nanosleep(&ts, nullptr);
+
+    unmap_all(INJECT_LIB_1);
+    active_threads--;
+    return nullptr;
+}
+
+__attribute__((constructor))
+static void inject_init() {
+    inject_logging();
+    if (char *env = getenv(INJECT_ENV_1)) {
+        LOGD("zygote: inject 1st stage\n");
+
+        if (env[0] == '1')
+            unsetenv("LD_PRELOAD");
+        else
+            setenv("LD_PRELOAD", env, 1);  // Restore original LD_PRELOAD
+        unsetenv(INJECT_ENV_1);
+
+        // Setup second stage
+        setenv(INJECT_ENV_2, "1", 1);
+        cp_afc(INJECT_LIB_1, INJECT_LIB_2);
+        dlopen(INJECT_LIB_2, RTLD_LAZY);
+    } else if (getenv(INJECT_ENV_2)) {
+        LOGD("zygote: inject 2nd stage\n");
+
+        active_threads = 1;
+
+        // Get our own handle
+        self_handle = dlopen(INJECT_LIB_2, RTLD_LAZY);
+        dlclose(self_handle);
+
+        // Cleanup 1st stage maps
+        active_threads++;
+        new_daemon_thread(&unload_first_stage);
+        unsetenv(INJECT_ENV_2);
+
+        // TODO: actually inject stuffs, for now we demonstrate clean self unloading
+        self_unload();
+    }
+}
+
+int app_process_main(int argc, char *argv[]) {
+    inject_logging();
+    char buf[4096];
+    if (realpath("/proc/self/exe", buf) == nullptr)
+        return 1;
+
+    int in = xopen(buf, O_RDONLY);
+    int out = xopen(INJECT_LIB_1, O_CREAT | O_WRONLY | O_TRUNC, 0777);
+    sendfile(out, in, nullptr, INT_MAX);
+    close(in);
+    close(out);
+
+    if (char *ld = getenv("LD_PRELOAD")) {
+        char env[128];
+        sprintf(env, "%s:" INJECT_LIB_1, ld);
+        setenv("LD_PRELOAD", env, 1);
+        setenv(INJECT_ENV_1, ld, 1);  // Backup original LD_PRELOAD
+    } else {
+        setenv("LD_PRELOAD", INJECT_LIB_1, 1);
+        setenv(INJECT_ENV_1, "1", 1);
+    }
+
+    // Execute real app_process
+    xumount2(buf, MNT_DETACH);
+    execve(buf, argv, environ);
+    exit(1);
+}

native/jni/inject/inject.hpp

@@ -0,0 +1,17 @@
+#pragma once
+
+#include <stdint.h>
+
+#define INJECT_LIB_1 "/dev/tmp/magisk.1.so"
+#define INJECT_LIB_2 "/dev/tmp/magisk.2.so"
+#define INJECT_ENV_1 "MAGISK_INJ_1"
+#define INJECT_ENV_2 "MAGISK_INJ_2"
+
+// Unmap all pages matching the name
+void unmap_all(const char *name);
+
+// Get library name and base address that contains the function
+uintptr_t get_function_lib(uintptr_t addr, char *lib);
+
+// Get library base address with name
+uintptr_t get_remote_lib(int pid, const char *lib);

native/jni/inject/ptrace.cpp

@@ -24,6 +24,7 @@
 
 #include <utils.hpp>
 
+#include "inject.hpp"
 #include "ptrace.hpp"
 
 using namespace std;
@@ -43,80 +44,6 @@ using namespace std;
 #define ARM_r0 regs[0]
 #endif
 
-struct map_info {
-    uintptr_t start;
-    uintptr_t end;
-    int perms;
-    char *path;
-
-    map_info() : start(0), end(0), perms(0), path(nullptr) {}
-
-    enum {
-        EXEC = (1 << 0),
-        WRITE = (1 << 1),
-        READ = (1 << 2),
-    };
-};
-
-// Func signature: bool(map_info&)
-template <typename Func>
-static void parse_maps(int pid, Func fn) {
-    char file[32];
-
-    // format: start-end perms offset dev inode path
-    sprintf(file, "/proc/%d/maps", pid);
-    file_readline(true, file, [=](string_view l) -> bool {
-        char *pos = (char *) l.data();
-        map_info info;
-
-        // Parse address hex strings
-        info.start = strtoul(pos, &pos, 16);
-        info.end = strtoul(++pos, &pos, 16);
-
-        // Parse permissions
-        if (*(++pos) != '-')
-            info.perms |= map_info::READ;
-        if (*(++pos) != '-')
-            info.perms |= map_info::WRITE;
-        if (*(++pos) != '-')
-            info.perms |= map_info::EXEC;
-        pos += 3;
-
-        // Skip everything except path
-        int path_off;
-        sscanf(pos, "%*s %*s %*s %n%*s", &path_off);
-        pos += path_off;
-        info.path = pos;
-
-        return fn(info);
-    });
-}
-
-uintptr_t get_function_lib(uintptr_t addr, char *lib) {
-    uintptr_t base = 0;
-    parse_maps(getpid(), [=, &base](map_info &info) -> bool {
-        if (addr >= info.start && addr < info.end) {
-            strcpy(lib, info.path);
-            base = info.start;
-            return false;
-        }
-        return true;
-    });
-    return base;
-}
-
-uintptr_t get_remote_lib(int pid, const char *lib) {
-    uintptr_t base = 0;
-    parse_maps(pid, [=, &base](map_info &info) -> bool {
-        if (strcmp(info.path, lib) == 0 && (info.perms & map_info::EXEC)) {
-            base = info.start;
-            return false;
-        }
-        return true;
-    });
-    return base;
-}
-
 bool _remote_read(int pid, uintptr_t addr, void *buf, size_t len) {
     for (size_t i = 0; i < len; i += sizeof(long)) {
         long data = xptrace(PTRACE_PEEKTEXT, pid, reinterpret_cast<void*>(addr + i));
@@ -165,7 +92,7 @@ static void _remote_setregs(int pid, pt_regs *regs) {
 #endif
 }
 
-static uintptr_t remote_call_abi(int pid, uintptr_t func_addr, int nargs, va_list va) {
+uintptr_t remote_call_abi(int pid, uintptr_t func_addr, int nargs, va_list va) {
     pt_regs regs, regs_bak;
 
     // Get registers and save a backup
@@ -300,7 +227,11 @@ static uintptr_t remote_call_abi(int pid, uintptr_t func_addr, int nargs, va_lis
 uintptr_t remote_call_vararg(int pid, uintptr_t addr, int nargs, ...) {
     char lib_name[4096];
     auto local = get_function_lib(addr, lib_name);
+    if (local == 0)
+        return 0;
     auto remote = get_remote_lib(pid, lib_name);
+    if (remote == 0)
+        return 0;
     addr = addr - local + remote;
     va_list va;
     va_start(va, nargs);

native/jni/inject/ptrace.hpp

@@ -2,12 +2,6 @@
 
 #include <stdint.h>
 
-// Get library name and base address that contains the function
-uintptr_t get_function_lib(uintptr_t addr, char *lib);
-
-// Get library base address with name
-uintptr_t get_remote_lib(int pid, const char *lib);
-
 // Write bytes to the remote process at addr
 bool _remote_write(int pid, uintptr_t addr, const void *buf, size_t len);
 #define remote_write(...) _remote_write(pid, __VA_ARGS__)
@@ -19,6 +13,9 @@ bool _remote_read(int pid, uintptr_t addr, void *buf, size_t len);
 // Call a remote function
 // Arguments are expected to be only integer-like or pointer types
 // as other more complex C ABIs are not implemented.
+uintptr_t remote_call_abi(int pid, uintptr_t func_addr, int nargs, va_list va);
+
+// Find remote offset and invoke function
 uintptr_t remote_call_vararg(int pid, uintptr_t addr, int nargs, ...);
 
 // C++ wrapper for auto argument counting and casting function pointers

native/jni/inject/utils.cpp

@@ -0,0 +1,101 @@
+#include <utils.hpp>
+
+#include "inject.hpp"
+
+using namespace std;
+
+namespace {
+
+struct map_info {
+    uintptr_t start;
+    uintptr_t end;
+    int perms;
+    char *path;
+
+    map_info() : start(0), end(0), perms(0), path(nullptr) {}
+
+    enum {
+        EXEC = (1 << 0),
+        WRITE = (1 << 1),
+        READ = (1 << 2),
+    };
+};
+
+} // namespace
+
+template<typename Func>
+static void parse_maps(int pid, Func fn) {
+    char file[32];
+
+    // format: start-end perms offset dev inode path
+    sprintf(file, "/proc/%d/maps", pid);
+    file_readline(true, file, [=](string_view l) -> bool {
+        char *pos = (char *) l.data();
+        map_info info;
+
+        // Parse address hex strings
+        info.start = strtoul(pos, &pos, 16);
+        info.end = strtoul(++pos, &pos, 16);
+
+        // Parse permissions
+        if (*(++pos) != '-')
+            info.perms |= map_info::READ;
+        if (*(++pos) != '-')
+            info.perms |= map_info::WRITE;
+        if (*(++pos) != '-')
+            info.perms |= map_info::EXEC;
+        pos += 3;
+
+        // Skip everything except path
+        int path_off;
+        sscanf(pos, "%*s %*s %*s %n%*s", &path_off);
+        pos += path_off;
+        info.path = pos;
+
+        return fn(info);
+    });
+}
+
+void unmap_all(const char *name) {
+    vector<map_info> unmaps;
+    parse_maps(getpid(), [=, &unmaps](map_info &info) -> bool {
+        if (strcmp(info.path, name) == 0)
+            unmaps.emplace_back(info);
+        return true;
+    });
+    for (map_info &info : unmaps) {
+        void *addr = reinterpret_cast<void *>(info.start);
+        size_t size = info.end - info.start;
+        munmap(addr, size);
+        if (info.perms & map_info::READ) {
+            // Make sure readable pages are still readable
+            xmmap(addr, size, PROT_READ, MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
+        }
+    }
+}
+
+uintptr_t get_function_lib(uintptr_t addr, char *lib) {
+    uintptr_t base = 0;
+    parse_maps(getpid(), [=, &base](map_info &info) -> bool {
+        if (addr >= info.start && addr < info.end) {
+            if (lib)
+                strcpy(lib, info.path);
+            base = info.start;
+            return false;
+        }
+        return true;
+    });
+    return base;
+}
+
+uintptr_t get_remote_lib(int pid, const char *lib) {
+    uintptr_t base = 0;
+    parse_maps(pid, [=, &base](map_info &info) -> bool {
+        if (strcmp(info.path, lib) == 0 && (info.perms & map_info::EXEC)) {
+            base = info.start;
+            return false;
+        }
+        return true;
+    });
+    return base;
+}