-
Notifications
You must be signed in to change notification settings - Fork 65
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improve SoList hiding #95
Conversation
To make `clangd` work properly, one needs to make symbolic links ``` ln -sf $PWD/loader/build/tools/debug/arm64-v8a/compile_commands.json loader/build ```
To get a clear idea, this pull-request will log new items like this:
|
e3cb1fb
to
e9498aa
Compare
Very interestingly, we cannot drop the soinfo of |
I made an app to detect ReZygisk: JingMatrix/Demo.
|
Current pull-request can be merged. To bypass the test of Demo, here is idea of injecting
Basically, we now move the memory block of |
On Android 15+ in some devices, the symbol names of some static variables such as `solist`, has a `llvm` suffix in its exported name. Current commit handles this case and close PerformanC#63 as fixed. Co-authored-by: ThePedroo <[email protected]>
In Bionic linker, the `soinfo` structure has a field `next`, which points to the next loaded library in a linked list consisting of all loaded libraries. Hence, an injected process can easily find all loaded libraries. Previously in ReZygisk, module library records are hidden by setting the `pathname` field to be empty, which is futile but easier to detect. Current idea of dropping record can be found in the following commit: RikkaApps/Riru@5d635e8
Changes
clangd
language server so that current project is more friendly for non-IDE users./linker
in Android 15 #63 )Why
In Bionic linker, the SoInfo structure has a field
next
, which points to the next loaded library in a linked list consisting of all loaded libraries.Hence, a hooked app can easily find all loaded libraries.
Previously in ReZygisk, module library items are hidden by setting the
pathname
to be empty. This was futile for two reasons:name
field still keeps the library nameBy contrast, dropping the item from SoList is a widely used methods in many projects, such as the well-known Riru.
You can search keyword
solist_remove_soinfo
on GitHub to find them.Checkmarks
Additional information
If you have any additional information, write it here