iqiyi/xHook
XHook
xHook este o bibliotecă de instrumentare și hooking de nivel scăzut pentru binare Android ELF. Funcționează ca un framework pentru interceptarea simbolurilor native și redirecționarea apelurilor de funcții prin modificarea tabelei de legături de proceduri (procedure linkage table).
Instrumentul utilizează expresii regulate pentru a filtra fișiere binare și simboluri specifice pentru interceptare. Acesta permite redirecționarea apelurilor native către implementări de funcții personalizate fără a altera fișierele binare originale.
Framework-ul acoperă rezoluția dinamică a simbolurilor, modificarea tabelelor ELF și analiza de securitate a bibliotecilor native. Include, de asemenea, mecanisme de stabilitate care utilizează handler-e de semnal pentru a intercepta segmentation faults și a preveni crash-urile aplicațiilor în timpul calculelor de pointeri.
Features
- PLT Hooking - Intercepts native functions by patching the Procedure Linkage Table in compiled Android binaries.
- Native Function Interception - Provides the ability to intercept internal native function calls to redirect execution flow for data capture or manipulation.
- Native Hooking Libraries - Provides a specialized library for intercepting and redirecting native function calls in Android ELF binaries.
- Android Hooking Frameworks - Provides a toolkit for intercepting and redirecting native layer functions to modify Android application behavior at runtime.
- Executable File Modifications - Modifies the structural relocation and linkage sections of ELF binaries to alter program execution flow.
- Symbol Interception - Implements runtime redirection of native function calls by replacing symbols in the procedure linkage table.
- Binary Instrumentation - Injects diagnostic and monitoring code into Android native binaries to change execution flow.
- Android ELF Instrumenters - Functions as a low-level instrumenter for modifying the execution flow of Android native binaries.
- Runtime Symbol Resolution - Locates memory addresses of native functions by resolving symbols across compiled modules during program execution.
- Function Redirection - Implements techniques for altering the call path of native functions by modifying the procedure linkage table.
- Runtime Crash Prevention - Intercepts internal memory errors via signal handlers to prevent the host process from terminating.
- Symbol Filtering - Uses regular expressions to include or exclude specific binary symbols during the hooking process.
- Signal Handlers - Utilizes system signal handlers to intercept segmentation faults and maintain process stability during pointer calculations.
- Native Crash Protection - Intercepts native memory access errors to prevent application crashes in production environments.
- Android Native Library Analysis - Enables security analysis of native libraries by replacing target symbols to observe data flow.
- Symbol Filtering Patterns - Employs regular expression matching to isolate specific binary files and symbols for interception.
- Android Hooking Frameworks - PLT hook library for Android native ELF binaries.
