夜神模拟器跑unity应用,hook libunity.so #32
Replies: 5 comments 1 reply
-
我用真机跑,是毫无问题的。 |
Beta Was this translation helpful? Give feedback.
-
2021-12-18 14:35:43.629 2174-2360/? I/ActivityManager: START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10200000 cmp=com.example.mylibrarytest/com.example.mylibrary.MainActivity bnds=[934,368][1202,522]} from uid 1000 on display 0
2021-12-18 14:35:43.632 2174-2764/? E/ActivityManager: Sending non-protected broadcast com.vphone.launcher.action.LAUNCH from system 2607:com.vphone.launcher/1000 pkg com.vphone.launcher
2021-12-18 14:35:43.935 5314-5339/? A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0xe483e589 in tid 5339 (UnityMain) 这是夜神模拟器完整的日志,hook了就闪退 |
Beta Was this translation helpful? Give feedback.
-
兄弟,模拟器转译了代码,底层是libhoudi.so,要自己修改代码。 |
Beta Was this translation helpful? Give feedback.
-
@shuixi2013 大佬,要怎么修改代码呀,能给个大概方向么? |
Beta Was this translation helpful? Give feedback.
-
模拟器的话,可以试下“手动模式”(默认是自动模式),手动模式相当于是xHook的直接跳转,没有trampoline。 |
Beta Was this translation helpful? Give feedback.
-
我现在在夜神模拟器7.0.0.8 32位上跑bhook,hook了libunity的fseek函数或者其他函数,fopen等等。我单纯调用bytehook_init没问题,但是一旦调用了bytehook_hook_single去hook函数,也是显示hook成功的,但是后面就闪退了:
2021-12-17 12:12:00.127 5510-5510/? A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0xfff33011 in tid 5510 (xxx.xxx.xxx)
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: Build fingerprint: 'samsung/dream2qltezh/dream2qltechn:7.1/N2G48H/G9550ZHU1AQEE:user/release-keys'
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: Revision: '12'
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: ABI: 'x86'
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: pid: 5510, tid: 5510, name: xxx.xxx.xxx >>> xxx.xxx.xxx <<<
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xfff33011
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: eax f66d4127 ebx 98724ff4 ecx 00000001 edx fff32e99
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: esi 989a720c edi fff32e99
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: xcs 00000073 xds 0000007b xes 0000007b xfs 0000003b xss 0000007b
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: eip 984fa373 ebp 988c67e4 esp bfa9c334 flags 00010282
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: backtrace:
2021-12-17 12:12:00.133 5567-5567/? A/DEBUG: #00 pc 00238373 /system/lib/libhoudini.so
我的应用是只打了arm32和arm64的,没打x86,在模拟器上应该是跑的arm32。应该是libhoudini.so转码导致的。用你的demo只打arm32和arm64,在模拟器上跑却没问题。
Beta Was this translation helpful? Give feedback.
All reactions