bytedance / bytedance/android-inline-hook

hook系统native函数后,代理函数只被调用了一次

Open
#105 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C
Stars
2.4k
Forks
410
Avg merge
3d 14h
Merged PRs (30d)
2

Description

### ShadowHook Version

2.0.0

### Android OS Version

12

### Android ABIs

armeabi-v7a

### Device Manufacturers and Models

xiaomi MIUI 13

### Describe the Bug

按照demo中的代码,对系统函数binder.getCallingUid进行hook,代码如下:
typedef jint (*android_runtime_func_getCallingUid)(void *);

// Proxy function
jint android_runtime_func_getCallingUid_proxy(void *thiz) {
// do something
jint oriUid = ((android_runtime_func_getCallingUid)orig)(thiz);
// do something
jint retUid = 10001;
LOGE("hook getCallingUid Success,ori = %d,ret =%d",oriUid,retUid);
return retUid;
}

void do_hook() {
stub = shadowhook_hook_sym_name(
"libbinder.so",
"_ZNK7android14IPCThreadState13getCallingUidEv",
(void *)android_runtime_func_getCallingUid_proxy,
(void **)&orig);

if(stub == NULL)
{
int err_num = shadowhook_get_errno();
const char *err_msg = shadowhook_to_errmsg(err_num);
LOGE("hook error %d - %s", err_num, err_msg);
}
else
{
LOGE("hook success");
}
}

hook成功后,仅接着调用Binder.getCallingUid执行了代理函数,后面再调Binder.getCallingUid就没有进入代理函数了。

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.