1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
| use crate::define_impl;
use crate::hide::Nao;
use crate::utils::ptrace::Tracee;
use anyhow::{bail, Context, Error, Result};
use common_utils::debug_on;
use common_utils::ext::LogIfError;
use log::debug;
use nix::libc::{c_char, c_int, iovec, uintptr_t, PTRACE_GETREGSET};
use once_cell::sync::OnceCell;
use std::arch::asm;
use std::ffi::c_void;
use std::mem::offset_of;
use std::{fs, result};
const TLS_SLOT_BIONIC_TLS: isize = -1;
#[repr(C)]
#[allow(non_camel_case_types)]
struct pthread_key_data_t {
_seq: uintptr_t,
_data: *const c_void,
}
#[repr(C)]
#[allow(non_camel_case_types)]
struct mntent {
_mnt_fstype: *const c_char,
_mnt_dir: *const c_char,
_mnt_types: *const c_char,
_mnt_opts: *const c_char,
_mnt_freq: c_int,
_mnt_passno: c_int,
}
#[repr(C)]
#[allow(non_camel_case_types)]
struct bionic_tls {
_key_data: [pthread_key_data_t; 130],
_locale: *const c_void,
_basename_buf: [u8; 4096],
_dirname_buf: [u8; 4096],
_mntent_buf: mntent,
mntent_strings: [u8; 1024],
}
#[derive(Default)]
struct CleanBuffer {
clean_buffer: OnceCell<Vec<u8>>,
}
extern "C" {
fn setmntent(filename: *const c_char, ty: *const c_char) -> *const c_void;
fn getmntent(stream: *const c_void) -> *mut mntent;
fn endmntent(stream: *const c_void) -> i32;
}
impl CleanBuffer {
fn dirty_buffer(&self) -> Result<Vec<u8>> {
unsafe {
let fp = setmntent(c"/proc/mounts".as_ptr(), c"r".as_ptr());
while !getmntent(fp).is_null() {}
endmntent(fp);
}
let tls: *const *const c_void;
unsafe {
asm!("mrs {0}, tpidr_el0", out(reg) tls);
}
let bionic_tls = unsafe { *tls.offset(TLS_SLOT_BIONIC_TLS) as *const bionic_tls };
let bionic_tls = unsafe { &*bionic_tls };
Ok(bionic_tls.mntent_strings.to_vec())
}
fn clean_buffer(&self) -> Result<Vec<u8>> {
let mut clean_buffer = [0u8; 1024];
let mounts = fs::read_to_string("/proc/mounts")?;
mounts.lines().for_each(|line| {
let parts: Vec<_> = line.split(' ').collect();
if parts[0] == "KSU" {
debug!("skip ksu mount: {line}");
return;
}
if parts[1].starts_with("/data/adb") {
debug!("skip module mount: {line}");
return;
}
clean_buffer[..line.len()].copy_from_slice(line.as_bytes());
clean_buffer[line.len()] = 0;
let mut index = 0;
#[allow(clippy::needless_range_loop)]
for i in 0..4 {
index += parts[i].len();
clean_buffer[index] = 0;
index += 1;
}
});
Ok(clean_buffer.to_vec())
}
fn buffer_to_string(&self, buffer: &[u8]) -> String {
let filtered: Vec<_> = buffer.iter().map(|ch| if ch.is_ascii_graphic() { *ch } else { b' ' }).collect();
String::from_utf8_lossy(&filtered).trim_ascii_end().into()
}
fn replace_remote_buffer(&self, tracee: &Tracee) -> Result<()> {
let mut tpidr_el0: usize = 0;
let iov = iovec {
iov_base: &mut tpidr_el0 as *mut _ as _,
iov_len: size_of_val(&tpidr_el0),
};
tracee.ptrace_raw(PTRACE_GETREGSET, 0x401 , &iov as *const _ as _)?;
let bionic_tls_ptr = tpidr_el0 as isize + TLS_SLOT_BIONIC_TLS * size_of::<usize>() as isize;
let bionic_tls = tracee.peek(bionic_tls_ptr as usize)?;
let Some(buffer) = self.clean_buffer.get() else {
bail!("clean buffer is not ready");
};
if debug_on!("hide.mntent") {
debug!("{tracee} remote tls = 0x{tpidr_el0:0>12x}, bionic_tls = 0x{bionic_tls:0>12x}");
}
tracee.poke_data(bionic_tls + offset_of!(bionic_tls, mntent_strings), buffer)?;
Ok(())
}
}
impl Nao for CleanBuffer {
fn on_post_fs_data(&self) {
let result: result::Result<_, Error> = self.clean_buffer.get_or_try_init(|| {
let clean_buffer = self.clean_buffer()?;
if debug_on!("hide.mntent") {
debug!("mntent strings (dirty): {}", self.buffer_to_string(&self.dirty_buffer()?));
debug!("mntent strings (clean): {}", self.buffer_to_string(&clean_buffer));
}
Ok(clean_buffer)
});
result.context("failed to handle mntent buffer").log_if_error()
}
fn on_embryo_start(&self, embryo: &Tracee) {
self.replace_remote_buffer(embryo)
.context("failed to replace remote buffer")
.log_if_error();
}
}
define_impl!(CleanBuffer);
|
