hook 代理函数问题

[AriaLyy]

大佬这种方法应该怎么hook

__int64 __fastcall FK::PageLayer::createScene(FK::PageLayer *this)
{
  return FK::PageLayer::createScene(this);
}

我是这样hook的，一hook就崩溃

typedef size_t (*createScene_t)(void);
static int64_t createScene_proxy() {
    BYTEHOOK_CALL_PREV(createScene_proxy, createScene_t);
   BYTEHOOK_POP_STACK();
}

bytehook_hook_single(ELLA_SO_NAME, NULL,
                                                      "_ZN2FK9PageLayer11createSceneEv",  createScene_proxy,
                                                      schedule_hooked_callback, NULL);

但是一hook就崩溃，出现下面的错误

Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 16630 (pool-3-thread-1), pid 16550 (en.anibook.demo)
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'google/redfin/redfin:13/TP1A.220624.014/8819323:user/release-keys'
Revision: 'MP1.0'
ABI: 'arm64'
Timestamp: 2023-02-02 18:02:44.017404745+0800
Process uptime: 4s
Cmdline: com.jojoread.huiben.anibook.demo
pid: 16550, tid: 16630, name: pool-3-thread-1  >>> com.jojoread.huiben.anibook.demo <<<
uid: 10283
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000000
Cause: null pointer dereference
    x0  0000000000000000  x1  0000000000000001  x2  000000714afab490  x3  000000747b3a67a8
    x4  000000714afab610  x5  000000714afab3e8  x6  0000000000000000  x7  0000000000000000
    x8  0000000080000081  x9  b4000071ff928d60  x10 000000748d31069c  x11 0000000000000018
    x12 0000000000000000  x13 0000000000000000  x14 000000714afaad00  x15 000000000000000f
    x16 0000007161ad94d8  x17 0000007483ff8ebc  x18 000000714a924000  x19 0000007161acf6bc
    x20 0000007473b1c0cc  x21 000000747b3a67a8  x22 000000714afab490  x23 0000000000000002
    x24 0000007161ada000  x25 000000714afad000  x26 b40000729f8f5a70  x27 000000714afad000
    x28 000000714afabb2c  x29 000000714afab3f0
    lr  0000007161ad4c10  sp  000000714afab3f0  pc  0000007161ad4c10  pst 0000000020001000
backtrace:
      #00 pc 000000000000ec10  /data/app/~~1UGQVbAXykDmTu6yKhnr9w==/com.jojoread.huiben.anibook.demo-uHJWDLyMaJ0qBC8yo7caEg==/lib/arm64/libellahook.so (bh_trampo_get_prev_func+16) (BuildId: b0514f717f119d07a4f8eb8eb11983cffe846900)
      #01 pc 0000000000009710  /data/app/~~1UGQVbAXykDmTu6yKhnr9w==/com.jojoread.huiben.anibook.demo-uHJWDLyMaJ0qBC8yo7caEg==/lib/arm64/libellahook.so (BuildId: b0514f717f119d07a4f8eb8eb11983cffe846900)
      #02 pc 00000000000010c8  /apex/com.android.runtime/lib64/bionic/libdl.so (android_dlopen_ext+16) (BuildId: ce71fb830f8ed38a9446bf6688f75929)
      #03 pc 000000000001c7a4  /apex/com.android.art/lib64/libnativeloader.so (android::NativeLoaderNamespace::Load(char const*) const+184) (BuildId: e4db16053a7fbf0f31088a717774ea84)
      #04 pc 000000000000ce20  /apex/com.android.art/lib64/libnativeloader.so (OpenNativeLibraryInNamespace+68) (BuildId: e4db16053a7fbf0f31088a717774ea84)
      #05 pc 000000000000c564  /apex/com.android.art/lib64/libnativeloader.so (OpenNativeLibrary+132) (BuildId: e4db16053a7fbf0f31088a717774ea84)
      #06 pc 000000000058a14c  /apex/com.android.art/lib64/libart.so (art::JavaVMExt::LoadNativeLibrary(_JNIEnv*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, _jobject*, _jclass*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >
      #07 pc 0000000000005178  /apex/com.android.art/lib64/libopenjdkjvm.so (JVM_NativeLoad+416) (BuildId: 268fd6b3328a09b0de726b049858b4a8)
      #08 pc 000000000009393c  /system/framework/arm64/boot.oat (art_jni_trampoline+156) (BuildId: ea692a544a012e5ae0589def08d76ae73b248ab5)
      #09 pc 0000000000209398  /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #10 pc 00000000000ed842  /apex/com.android.art/javalib/core-oj.jar (java.lang.Runtime.nativeLoad+2)
      #11 pc 0000000000209334  /apex/com.android.art/lib64/libart.so (nterp_helper+52) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #12 pc 00000000000edd80  /apex/com.android.art/javalib/core-oj.jar (java.lang.Runtime.loadLibrary0+92)
      #13 pc 000000000020a254  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #14 pc 00000000000edd0c  /apex/com.android.art/javalib/core-oj.jar (java.lang.Runtime.loadLibrary0+8)
      #15 pc 000000000020a254  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #16 pc 00000000000f40b0  /apex/com.android.art/javalib/core-oj.jar (java.lang.System.loadLibrary+16)
      #17 pc 0000000000436c00  /apex/com.android.art/lib64/libart.so (art_quick_invoke_static_stub+576) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #18 pc 0000000000575e0c  /apex/com.android.art/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+1472) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #19 pc 00000000002139dc  /apex/com.android.art/lib64/libart.so (void art::interpreter::ExecuteSwitchImplCpp<false, false>(art::interpreter::SwitchImplContext*)+9484) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #20 pc 0000000000442bd8  /apex/com.android.art/lib64/libart.so (ExecuteSwitchImplAsm+8) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #21 pc 0000000000292888  [anon:dalvik-classes.dex extracted in memory from /data/app/~~1UGQVbAXykDmTu6yKhnr9w==/com.jojoread.huiben.anibook.demo-uHJWDLyMaJ0qBC8yo7caEg==/base.apk] (cn.ellabook.EllaBookViewer.initLib+0)
      #22 pc 0000000000473dd4  /apex/com.android.art/lib64/libart.so (art::interpreter::Execute(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame&, art::JValue, bool, bool) (.__uniq.112435418011751916792819755956732575238.llvm.1589324478210638323)+396) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #23 pc 0000000000473438  /apex/com.android.art/lib64/libart.so (artQuickToInterpreterBridge+1104) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #24 pc 0000000000440488  /apex/com.android.art/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #25 pc 0000000000209398  /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #26 pc 0000000000300342  [anon:dalvik-classes.dex extracted in memory from /data/app/~~1UGQVbAXykDmTu6yKhnr9w==/com.jojoread.huiben.anibook.demo-uHJWDLyMaJ0qBC8yo7caEg==/base.apk] (com.ellabook.saassdk.EllaReaderApi$a$a.run+110)
      #27 pc 000000000020b074  /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #28 pc 0000000000222570  /apex/com.android.art/javalib/core-oj.jar (java.util.concurrent.ThreadPoolExecutor.runWorker+156)
      #29 pc 000000000020a254  /apex/com.android.art/lib64/libart.so (nterp_helper+3924) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #30 pc 0000000000221374  /apex/com.android.art/javalib/core-oj.jar (java.util.concurrent.ThreadPoolExecutor$Worker.run+4)
      #31 pc 000000000020b074  /apex/com.android.art/lib64/libart.so (nterp_helper+7540) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #32 pc 00000000000f6748  /apex/com.android.art/javalib/core-oj.jar (java.lang.Thread.run+8)
      #33 pc 000000000043696c  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+556) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #34 pc 0000000000468738  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+156) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #35 pc 0000000000468420  /apex/com.android.art/lib64/libart.so (art::JValue art::InvokeVirtualOrInterfaceWithJValues<art::ArtMethod*>(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, art::ArtMethod*, jvalue const*)+388) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #36 pc 0000000000617f0c  /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+1668) (BuildId: 97fdb979efb7d2b596fa4fceabaad95b)
      #37 pc 00000000000b62b8  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 058e3ec96fa600fb840a6a6956c6b64e)
      #38 pc 0000000000052fb8  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 058e3ec96fa600fb840a6a6956c6b64e)
) for package com.jojoread.huiben.anibook.demo ----------------------------

[caikelun]

typedef int64_t (*createScene_t)(void *);
static int64_t createScene_proxy(void *thiz) {
    int64_t ret = BYTEHOOK_CALL_PREV(createScene_proxy, createScene_t, thiz);
    BYTEHOOK_POP_STACK();
    return ret;
}

bytehook_hook_single(ELLA_SO_NAME, NULL, "_ZN2FK9PageLayer11createSceneEv",
    createScene_proxy, schedule_hooked_callback, NULL);

[AriaLyy]

谢谢大佬的回复，还是不行，hook没问题，但是当动态库运行来这个方法后，还是出现崩溃。。