bhook 的dlopen未监控到加载的so
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- android, c
- Domain
- mobile-dev
Research direction
Reproduce the report on Android 6 with armeabi-v7a using the bytehook_add_dlopen_callback registration and inspect bh_hook_manager_verify_got_value. Compare the logged GOT resolution for dlopen in /system/lib/libsechook.so with the callback behavior. Done means the reported loaded shared object is observed by the dlopen callbacks without incorrectly removing the hook.
Written by the indexing model from the issue text.
Description
bytehook Version
1.0.5
Android OS Version
6
Android ABIs
armeabi-v7a
Device Manufacturers and Models
xiaomi 4
Describe the Bug
我通过注册回调函数:
bytehook_add_dlopen_callback(dlopen_pre_callback, dlopen_callback, NULL);
发现加载so后未被监控到。
于是我修改bh_hook_manager_verify_got_value输出了一下日志
rs = dladdr(*((void **)got_addr), &info);
BH_LOG_INFO("dladdr: %s got_addr=%p callee: %s %s", got_addr, info.dli_fname, info.dli_sname);
...
if (NULL == info.dli_sname) {
ElfW(Sym) *sym = bh_elf_find_export_func_symbol_by_symbol_name(callee_elf, task->sym_name);
BH_LOG_INFO("callee: %s(%s), sym:%p", callee_elf->pathname, task->sym_name, sym);
if (NULL != sym && STT_GNU_IFUNC == ELF_ST_TYPE(sym->st_info)) {
BH_LOG_INFO("hook chain: verify bypass ifunc: %s in %s", task->sym_name, info.dli_fname);
r = 0;
}
}
日志如下:
06-22 18:23:57.609 32110-32110/? I/bhook: hook symbol(dlopen) in /system/lib/libart.so
06-22 18:23:57.609 32110-32110/? I/bhook: trampo: created for GOT b4abcbf0 at b5de608c, size 20 + 8 = 28
06-22 18:23:57.609 32110-32110/? I/bhook: hook chain: created for GOT b4abcbf0, orig func ab53e961
06-22 18:23:57.609 32110-32110/? I/bhook: hook chain: add(new) func, GOT b4abcbf0, func b377cf61
06-22 18:23:57.610 32110-32110/? I/bhook: dladdr got_addr=b4abcbf0 callee: /system/lib/libsechook.so (null)
06-22 18:23:57.610 32110-32110/? I/bhook: /system/lib/libsechook.so(dlopen), sym:0x0
06-22 18:23:57.610 32110-32110/? I/bhook: hook chain: del func, GOT b4abcbf0, func b377cf61
这个问题可能是因为dlopen已经被别的库(/system/lib/libsechook.so)hook了，然后bhook就不处理了？
- Dominant language
- C
- Stars
- 2.6k
- Forks
- 407
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from bytedance/bhook
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 42/100
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Similar issues
-
[compiler-rt] Rtsan-aarch64-NoInstTest: error: no such file or directory: 'NOTFOUND' (libatomic)Openbuild-problem compiler-rt:rtsan platform:linux
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
llvm/llvm-project#239039 ·
Maintainers usually reply within 1 day
-
component:obi contribfest go test
Difficulty 2/5 Under an hour Newbie friendliness 83/100
open-telemetry/opentelemetry-ebpf-instrumentation#4143 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Bug :bug:
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
sonic-net/sonic-buildimage#30541 ·
Maintainers usually reply within 1 day