Skip to content

Commit

Permalink
Change to use ptrace for memory writes to prevent SELinux
Browse files Browse the repository at this point in the history
  • Loading branch information
tkmru committed Jan 6, 2021
1 parent f7774af commit e55d6f1
Show file tree
Hide file tree
Showing 2 changed files with 37 additions and 4 deletions.
23 changes: 22 additions & 1 deletion cmd/cmd.go
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,7 @@ func Filter(pid string, targetVal string, prevFounds []Found) ([]Found, error) {
return founds, nil
}

func Patch(pid string, targetVal string, targetAddrs []Found) error {
func PatchWithoutPtrace(pid string, targetVal string, targetAddrs []Found) error {
memPath := fmt.Sprintf("/proc/%s/mem", pid)
f, err := os.OpenFile(memPath, os.O_WRONLY, 0600)
if err != nil {
Expand All @@ -297,6 +297,27 @@ func Patch(pid string, targetVal string, targetAddrs []Found) error {
return nil
}

func PatchWithPtrace(pid string, targetVal string, targetAddrs []Found) error {
if !isAttached {
if err := Attach(pid); err != nil {
fmt.Println(err)
}
}
for _, found := range targetAddrs {
targetBytes, _ := found.converter(targetVal)
for _, targetAddr := range found.addrs {
tid_int, _ := strconv.Atoi(pid)
_, err := sys.PtracePokeData(tid_int, uintptr(targetAddr), targetBytes)
if err != nil {
return err
}
}
}
Detach()
fmt.Println("Successfully patched!")
return nil
}

func Detach() error {
if !isAttached {
fmt.Println("Already detached.")
Expand Down
18 changes: 15 additions & 3 deletions main.go
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package main

import (
"flag"
"fmt"
"log"
"os"
Expand All @@ -15,6 +16,7 @@ import (

var appPID string
var addrCache []cmd.Found
var withoutPtrace bool

func executor(in string) {
if in == "ps" {
Expand Down Expand Up @@ -74,9 +76,16 @@ func executor(in string) {
fmt.Println("Target value cannot be specified.")
return
}
err := cmd.Patch(appPID, slice[1], addrCache)
if err != nil {
fmt.Println(err)
if withoutPtrace {
err := cmd.PatchWithoutPtrace(appPID, slice[1], addrCache)
if err != nil {
fmt.Println(err)
}
} else {
err := cmd.PatchWithPtrace(appPID, slice[1], addrCache)
if err != nil {
fmt.Println(err)
}
}

} else if in == "detach" {
Expand Down Expand Up @@ -143,6 +152,9 @@ func completer(t prompt.Document) []prompt.Suggest {
}

func main() {
flag.BoolVar(&withoutPtrace, "without-ptrace", false, "Memory modification without ptrace, which is not available in Android 10 and later")
flag.Parse()

// for ptrace attach
runtime.LockOSThread()
defer runtime.UnlockOSThread()
Expand Down

0 comments on commit e55d6f1

Please sign in to comment.