Android逆向工程

void Handle_X_Combination() {

    LOGE("Handle_X_Combination");

    gen_Horizontal_Matrix(6);

    get_Horizontal_X_Match();

    gen_Vertical_Matrix(0, 6);

    get_Vertical_X_Match();
}

void simulate_press_event(int touch, int fromX, int fromY) {

    pthread_mutex_lock(&global.writeEventLock);

    LOGE("simulate_press_event");

    INPUT_EVENT event;

    // 0. Multi-Touch
    // 此项目非必要，因为没有用到多点触摸，是另一个项目使用到了
    event.type = 0x3;
    event.code = 0x2f;
    event.value = touch;
    write(global.fd_event, &event, sizeof(event));

    // 1. ABS_MT_TRACKING_ID:
    // 理论上必要，因为Android事件输入是批量处理的，需要用到输入id，
    // 但是这里偷懒使用了同步锁，并且没有多点触摸需求，所以不会有Tracking_ID串扰问题，也就不需要记数了
    event.type = 0x3;
    event.code = 0x39;
    event.value = global.event_id > 60000 ? 10 : global.event_id++;
    write(global.fd_event, &event, sizeof(event));

    // 2. At screen coordinates:
    // 触摸点x，y坐标
    event.type = 0x3;
    event.code = 0x35;
    event.value = fromX;
    write(global.fd_event, &event, sizeof(event));
    event.type = 0x3;
    event.code = 0x36;
    event.value = fromY;
    write(global.fd_event, &event, sizeof(event));

    // 4. Sync
    // 数据同步到设备
    event.type = 0x0;
    event.code = 0x0;
    event.value = 0x0;
    write(global.fd_event, &event, sizeof(event));

    event.type = 0x3;
    event.code = 0x39;
    event.value = 0xffffffff;
    write(global.fd_event, &event, sizeof(event));

    // 4. Pure event separator:
    // 结束符
    event.type = 0x0;
    event.code = 0x0;
    event.value = 0x0;
    write(global.fd_event, &event, sizeof(event));

    pthread_mutex_unlock(&global.writeEventLock);
}

#ifdef EGL_ANDROID_swap_rectangle  
    if (extensions.hasExtension("EGL_ANDROID_swap_rectangle")) {  
        if (eglSetSwapRectangleANDROID(display, surface,  
                0, 0, mWidth, mHeight) == EGL_TRUE) {  
            // This could fail if this extension is not supported by this  
            // specific surface (of config)  
            mFlags |= SWAP_RECTANGLE;  
        }  
    }  
    // when we have the choice between PARTIAL_UPDATES and SWAP_RECTANGLE  
    // choose PARTIAL_UPDATES, which should be more efficient  
    if (mFlags & PARTIAL_UPDATES)  
        mFlags &= ~SWAP_RECTANGLE;  
#endif  

void DisplayHardware::flip(const Region& dirty) const  
{  
    checkGLErrors();  

    EGLDisplay dpy = mDisplay;  
    EGLSurface surface = mSurface;  

#ifdef EGL_ANDROID_swap_rectangle      
    if (mFlags & SWAP_RECTANGLE) {  
        const Region newDirty(dirty.intersect(bounds()));  
        const Rect b(newDirty.getBounds());  
        eglSetSwapRectangleANDROID(dpy, surface,  
                b.left, b.top, b.width(), b.height());  
    }  
#endif  

    if (mFlags & PARTIAL_UPDATES) {  
        mNativeWindow->setUpdateRectangle(dirty.getBounds());  
    }  

    mPageFlipCount++;  
    eglSwapBuffers(dpy, surface);  
    checkEGLErrors("eglSwapBuffers");  

    // for debugging  
    //glClearColor(1,0,0,0);  
    //glClear(GL_COLOR_BUFFER_BIT);  
}  

typedef struct framebuffer_device_t {  
    struct hw_device_t common;  

    /* flags describing some attributes of the framebuffer */  
    const uint32_t  flags;  

    /* dimensions of the framebuffer in pixels */  
    const uint32_t  width;  
    const uint32_t  height;  

    /* frambuffer stride in pixels */  
    const int       stride;  

    /* framebuffer pixel format */  
    const int       format;  

    /* resolution of the framebuffer's display panel in pixel per inch*/  
    const float     xdpi;  
    const float     ydpi;  

    /* framebuffer's display panel refresh rate in frames per second */  
    const float     fps;  

    /* min swap interval supported by this framebuffer */  
    const int       minSwapInterval;  

    /* max swap interval supported by this framebuffer */  
    const int       maxSwapInterval;  

    int reserved[8];  

    int (*setSwapInterval)(struct framebuffer_device_t* window,  
            int interval);  

    int (*setUpdateRect)(struct framebuffer_device_t* window,  
            int left, int top, int width, int height);  

    int (*post)(struct framebuffer_device_t* dev, buffer_handle_t buffer);  

    int (*compositionComplete)(struct framebuffer_device_t* dev);  

    void* reserved_proc[8];  

} framebuffer_device_t; 

int main(int argc, char** argv) {

    pid_t target_pid;
    target_pid = find_pid_of("/system/bin/surfaceflinger");
    if (-1 == target_pid) {
        printf("Can't find the process\n");
        return -1;
    }

    //target_pid = find_pid_of("/data/test");
    inject_remote_process(target_pid, argv[1], "hook_entry",  argv[2], strlen(argv[2]));

    return 0;  
} 

int hook_entry(char * argv) {

    LOGD("Hook success\n");

    LOGD("pipe path:%s", argv);

    if(mkfifo(argv, 0777) != 0 && errno != EEXIST) {
        LOGD("pipe create failed:%d",errno);
        return -1;
    } else {
        LOGD("pipe create successfully");
    }

    LOGD("Start injecting\n");

    elfHook(LIB_PATH, "eglSwapBuffers", (void *)new_eglSwapBuffers, (void **)&old_eglSwapBuffers);

    while(1){

        int fPipe = open(argv, O_TRUNC, O_RDWR);
        if (fPipe == -1) {
            LOGD("pipe open failed");
            break;
        } else {
            LOGD("pipe open successfully");
        }

        char command[10];
        memset(command, 0x0, 10);

        int ret = read(fPipe, &command, 10);
        if(ret > 0 && strcmp(command, "done") == 0) {
            LOGD("ptrace detach successfully with %s", command);
            break;
        } else {
            LOGD("ret:%d received command: %s", ret, command);
        }

        // close the pipe
        close(fPipe);

        usleep(100);

    }

    elfHook(LIB_PATH, "eglSwapBuffers", (void *)old_eglSwapBuffers, (void **)&new_eglSwapBuffers);

}