静态补丁脚本 - 修改 libtolua.so
直接改arm64的so， 使用python脚本。
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
静态补丁脚本 - 修改 libtolua.so
主要功能：
1. 修改 luaL_loadbuffer 函数，将跳转目标从 luaL_loadbufferx 改为 luaL_loadfilex
2. 在 luaL_loadfilex 函数中实现跳转到自定义的 my_custom_luaL_loadbufferx 函数
"""import struct
import os
import shutil
from pathlib import Pathclass LibtoluaPatcher:def __init__(self, target_so_path, custom_so_path):self.target_so_path = Path(target_so_path)self.custom_so_path = Path(custom_so_path)self.backup_path = self.target_so_path.with_suffix('.so.backup')# 关键地址定义 (基于提供的信息)self.luaL_loadbuffer_offset = 0x8A728 # luaL_loadbuffer 函数偏移self.luaL_loadfilex_offset = 0x8A530 # luaL_loadfilex 函数偏移 (未使用的函数)def backup_original(self):"""备份原始文件"""if not self.backup_path.exists():shutil.copy2(self.target_so_path, self.backup_path)print(f"已备份原始文件到: {self.backup_path}")else:print(f"备份文件已存在: {self.backup_path}")def calculate_branch_instruction(self, from_addr, to_addr):"""计算ARM64分支指令"""# 计算相对偏移offset = to_addr - from_addr# 检查是否在B指令范围内 (±128MB)if abs(offset) < (1 << 27):# 使用B指令 (无条件分支)# B指令格式: 0x14000000 | ((offset >> 2) & 0x3FFFFFF)offset_encoded = (offset >> 2) & 0x3FFFFFFinstruction = 0x14000000 | offset_encodedreturn struct.pack('<I', instruction)else:# 超出B指令范围，需要使用间接跳转raise ValueError(f"分支距离太远: {offset}, 需要使用间接跳转")def patch_luaL_loadbuffer(self, data):"""修改 luaL_loadbuffer 函数"""print("正在修改 luaL_loadbuffer 函数...")# 原始代码:# .text:000000000008A728 MOV X4, #0# .text:000000000008A72C B luaL_loadbufferx# 新代码:# .text:000000000008A728 MOV X4, #0 (保持不变)# .text:000000000008A72C B luaL_loadfilex (修改跳转目标)# 计算从 luaL_loadbuffer+4 到 luaL_loadfilex 的分支指令from_addr = self.luaL_loadbuffer_offset + 4 # +4 因为要修改第二条指令to_addr = self.luaL_loadfilex_offsettry:branch_instruction = self.calculate_branch_instruction(from_addr, to_addr)# 修改数据patch_offset = self.luaL_loadbuffer_offset + 4data[patch_offset:patch_offset+4] = branch_instructionprint(f"已修改 luaL_loadbuffer+4 (0x{patch_offset:X}) 的跳转目标")except ValueError as e:print(f"修改 luaL_loadbuffer 失败: {e}")return Falsereturn Truedef patch_luaL_loadfilex(self, data):"""在 luaL_loadfilex 函数中实现跳转到自定义函数"""print("正在修改 luaL_loadfilex 函数...")# 创建一个简化的hook代码，直接跳转到我们预设的地址# 在实际应用中，这个地址需要通过运行时解析获得# 创建hook代码桩stub_code = self.create_dynamic_dlopen_dlsym_and_call_stub()# 将代码写入 luaL_loadfilex 位置patch_offset = self.luaL_loadfilex_offsetif len(stub_code) <= 0x1F8: # 确保不超出函数空间 (到下一个函数的距离)data[patch_offset:patch_offset+len(stub_code)] = stub_codeprint(f"已在 luaL_loadfilex (0x{patch_offset:X}) 处植入hook代码")return Trueelse:print(f"Hook代码太长 ({len(stub_code)} 字节)，超出可用空间")return False# def create_dynamic_loader_stub(self):# """创建SVC系统调用代码桩"""# # 使用SVC指令调用自定义的lua_loadbuffer系统调用# # 根据lua_file_writer.c中的定义：SVC_LUA_LOADBUFFER = 0x1001# instructions = []# # 函数参数已经在X0-X4寄存器中:# # X0 = lua_State *L# # X1 = const char *buff # # X2 = size_t sz# # X3 = const char *name# # X4 = const char *mode# # 直接调用SVC指令，无需保存/恢复寄存器# # SVC #0x1001 (SVC_LUA_LOADBUFFER)# svc_num = 0x1001# svc_instruction = 0xD4000001 | (svc_num << 5)# instructions.append(struct.pack('<I', svc_instruction))# # 返回到调用者# # RET# instructions.append(struct.pack('<I', 0xD65F03C0))# return b''.join(instructions)def create_dynamic_dlopen_dlsym_and_call_stub(self):"""创建动态加载和调用代码桩"""# 这个函数生成ARM64汇编代码，实现:# 1. dlopen("liblua_file_writer.so", RTLD_LAZY)# 2. dlsym(handle, "my_custom_luaL_loadbufferx")# 3. 跳转到获取的函数地址instructions = []#000000000008A6FC luaL_loadbufferx ; CODE XREF: sub_C1B80+110↓p
#000000000008A530 F4 FF FF 17 B luaL_loadbufferx (从0x00000000008A530跳转到0x8A6FC)# 正确计算从0x8A530跳转到0x8A6FC的B指令# 偏移量：0x8A6FC - 0x8A530 = 0x1CC = 460字节# 指令偏移：460 / 4 = 115# B指令编码：0x14000000 | 115 = 0x14000073#instructions.append(struct.pack('<I', 0x14000073)) # B luaL_loadbufferx# => 0x0000007f3d352530 <+0>: sub sp, sp, #0x80
# 0x0000007f3d352534 <+4>: stp x24, x23, [sp]
# 0x0000007f3d352538 <+8>: stp x22, x21, [sp,#16]
# 0x0000007f3d35253c <+12>: stp x20, x19, [sp,#32]
# 0x0000007f3d352540 <+16>: stp x29, x30, [sp,#48]
# 0x0000007f3d352544 <+20>: str x5, [sp,#56]# 保存参数寄存器 X0-X4 (逐个保存到不同栈位置)instructions.append(struct.pack('<I',0xD102C3FF)) # FF C3 02 D1 SUB SP, SP, #0xB0 instructions.append(struct.pack('<I',0xA9005FF8)) #F8 5F 00 A9 STP X24, X23, [SP]instructions.append(struct.pack('<I',0xA90157F6)) #F6 57 01 A9 STP X22, X21, [SP,#0x10]instructions.append(struct.pack('<I',0xA9024FF4)) #F4 4F 02 A9 STP X20, X19, [SP,#0x30]instructions.append(struct.pack('<I',0xA9037BFD)) #FD 7B 03 A9 STP X29, X30, [SP,#0x40]instructions.append(struct.pack('<I',0xF90057E5)) #E5 57 00 F9 STR X5, [SP,#0xA8]instructions.append(struct.pack('<I',0xAA0203F5)) #F5 03 02 AA MOV X21, X2instructions.append(struct.pack('<I',0xAA0103F6)) #F6 03 01 AA MOV X22, X1instructions.append(struct.pack('<I',0xAA0003F7)) #F7 03 00 AA MOV X23, X0instructions.append(struct.pack('<I',0xAA0403F3)) #F3 03 04 AA MOV X19, X4instructions.append(struct.pack('<I',0xAA0303F4)) #F4 03 03 AA MOV X20, X3# 准备dlopen参数# 需要将"liblua_file_writer.so"字符串地址加载到X0# RTLD_LAZY (1) 加载到X1# 使用原始SO文件中已存在的字符串# "liblua_file_writer.so" 在 0x133C20# 当前函数在 0x8A530，计算相对偏移lib_string_addr = 0x133C20#0000000000133C68# GROUP# lib_string_addr = 0x00DD668current_addr = self.luaL_loadfilex_offset + (len(instructions) * 4)lib_offset = lib_string_addr - current_addr# ADR X0, #lib_offset ; 获取"liblua_file_writer.so"地址if abs(lib_offset) < (1 << 20): # ADR指令范围检查adr_instruction = 0x10000000 | ((lib_offset >> 2) & 0x7FFFF) << 5instructions.append(struct.pack('<I', adr_instruction))else:# 如果超出ADR范围，使用ADRP+ADD组合page_offset = (lib_offset >> 12) & 0x1FFFFFadrp_instruction = 0x90000000 | (page_offset << 5)instructions.append(struct.pack('<I', adrp_instruction))# ADD X0, X0, #(lib_offset & 0xFFF)add_instruction = 0x91000000 | ((lib_offset & 0xFFF) << 10)instructions.append(struct.pack('<I', add_instruction))# MOV X1, #1 ; RTLD_LAZYinstructions.append(struct.pack('<I', 0xD2800021))# 调用dlopen# 这里需要通过GOT表调用dlopen，简化处理：# 假设dlopen在已知偏移处，实际应该通过PLT调用# BL dlopen ; 计算到dlopen的偏移# dlopen在.plt:0x17980，当前位置大约在0xB8AC0附近dlopen_plt_addr = 0x17980current_bl_addr = self.luaL_loadfilex_offset + (len(instructions) * 4)dlopen_offset = dlopen_plt_addr - current_bl_addr# BL指令格式: 0x94000000 | ((offset >> 2) & 0x3FFFFFF)bl_instruction = 0x94000000 | ((dlopen_offset >> 2) & 0x3FFFFFF)instructions.append(struct.pack('<I', bl_instruction))# 检查dlopen返回值，如果不为空则跳过异常触发指令# CBNZ X0, #8 ; 如果X0不为0，跳过下一条指令instructions.append(struct.pack('<I', 0xB5000040))# LDR X16, [X0] ; 如果X0为0，这里会触发空指针异常instructions.append(struct.pack('<I', 0xF9400010))# 准备dlsym参数# X0已经是handle，需要设置X1为符号名# "luaL_loadbufferx" 在 0x1336DEsymbol_string_addr = 0x1336DE;current_addr2 = self.luaL_loadfilex_offset + (len(instructions) * 4)symbol_offset = symbol_string_addr - current_addr2 +2# ADR X1, #symbol_offset ; 获取"luaL_loadbufferx"地址if abs(symbol_offset) < (1 << 20): # ADR指令范围检查adr_instruction2 = 0x10000000 | ((symbol_offset >> 2) & 0x7FFFF) << 5 | 1 # 目标寄存器X1instructions.append(struct.pack('<I', adr_instruction2))else:# 如果超出ADR范围，使用ADRP+ADD组合page_offset2 = (symbol_offset >> 12) & 0x1FFFFFadrp_instruction2 = 0x90000000 | (page_offset2 << 5) | 1 # 目标寄存器X1instructions.append(struct.pack('<I', adrp_instruction2))# ADD X1, X1, #(symbol_offset & 0xFFF)add_instruction2 = 0x91000000 | ((symbol_offset & 0xFFF) << 10) | (1 << 5) | 1instructions.append(struct.pack('<I', add_instruction2))# 调用dlsym# BL dlsym ; 计算到dlsym的偏移# dlsym在.plt:0x17A40dlsym_plt_addr = 0x17A40current_bl_addr2 = self.luaL_loadfilex_offset + (len(instructions) * 4)dlsym_offset = dlsym_plt_addr - current_bl_addr2# BL指令格式: 0x94000000 | ((offset >> 2) & 0x3FFFFFF)bl_instruction2 = 0x94000000 | ((dlsym_offset >> 2) & 0x3FFFFFF)instructions.append(struct.pack('<I', bl_instruction2))# 检查dlopen返回值，如果为空则访问其指针值造成异常# CBNZ X0, #8 ; 如果X0不为0，跳过下一条指令instructions.append(struct.pack('<I', 0xB5000040))# LDR X16, [X0] ; 如果X0为0，这里会触发空指针异常instructions.append(struct.pack('<I', 0xF9400010))# 保存dlsym返回的函数地址到X16# MOV X17, X0instructions.append(struct.pack('<I', 0xAA0003F1))instructions.append(struct.pack('<I',0xAA1703E0)) #E0 03 17 AA MOV X0, X23instructions.append(struct.pack('<I',0xAA1603E1)) #E1 03 16 AA MOV X1, X22instructions.append(struct.pack('<I',0xAA1503E2)) #E2 03 15 AA MOV X2, X21instructions.append(struct.pack('<I',0xAA1403E3)) #E3 03 14 AA MOV X3, X20instructions.append(struct.pack('<I',0xAA1303E4)) #E4 03 13 AA MOV X4, X19# 跳转到目标函数instructions.append(struct.pack('<I',0xA9424FF4)) #F4 4F 42 A9 LDP X20, X19, [SP,#0x30+var_10]instructions.append(struct.pack('<I',0xA94157F6)) #F6 57 41 A9 LDP X22, X21, [SP,#0x30+var_20]instructions.append(struct.pack('<I',0xA9405FF8)) #F8 5F 40 A9 LDP X24, X23, [SP]instructions.append(struct.pack('<I',0xA9437BFD)) #FD 7B 43 A9 LDP X29, X30, [SP,#0x30+var_s0]instructions.append(struct.pack('<I',0xF9401FE5)) #E5 1F 40 F9 LDR X5, [SP,#0x38]instructions.append(struct.pack('<I',0x9102C3FF)) #FF C3 02 91 ADD SP, SP, #0xB0 ;instructions.append(struct.pack('<I', 0xD61F0220)) #20 02 1F D6 BR X17 return b''.join(instructions)def apply_patches(self):"""应用所有补丁"""# 读取目标文件with open(self.target_so_path, 'rb') as f:data = bytearray(f.read())print(f"文件大小: {len(data)} 字节")# 应用补丁success = Trueif not self.patch_luaL_loadbuffer(data):success = Falseif not self.patch_luaL_loadfilex(data):success = Falseif success:# 写回修改后的文件with open(self.target_so_path, 'wb') as f:f.write(data)print(f"补丁应用成功！修改后的文件: {self.target_so_path}")else:print("补丁应用失败！")return successdef restore_backup(self):"""恢复备份文件"""if self.backup_path.exists():shutil.copy2(self.backup_path, self.target_so_path)print(f"已恢复备份文件: {self.target_so_path}")else:print("备份文件不存在！")def main():# 文件路径target_so = "libtolua.so"custom_so = "iblua_file_writer.so"# 检查文件是否存在if not os.path.exists(target_so):print(f"目标文件不存在: {target_so}")returnif not os.path.exists(custom_so):print(f"自定义SO文件不存在: {custom_so}")return# 创建补丁器patcher = LibtoluaPatcher(target_so, custom_so)# 应用补丁if patcher.apply_patches():print("\n补丁应用完成！")print("使用说明:")print("1. 修改后的libtolua.so会在luaL_loadbuffer调用时跳转到我们的hook函数")print("2. 如需恢复原始文件，请运行: patcher.restore_backup()")else:print("\n补丁应用失败！")if __name__ == "__main__":main()