ddi SmsManager hook test

ddi test

/*
 *  Collin's Dynamic Dalvik Instrumentation Toolkit for Android
 *  Collin Mulliner <collin[at]mulliner.org>
 *
 *  (c) 2012,2013
 *
 *  License: LGPL v2.1
 *
 */

#define _GNU_SOURCE
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <dlfcn.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <sys/select.h>
#include <string.h>
#include <termios.h>
#include <pthread.h>
#include <sys/epoll.h>

#include <jni.h>
#include <stdlib.h>

#include "dexstuff.h"
#include "dalvik_hook.h"
#include "base.h"
#include "hook.h"
 #include <android/log.h>

#undef log
#define LOGI(...) ((void)__android_log_print(ANDROID_LOG_INFO, "hook-epoll", __VA_ARGS__))
#define LOGE(...) ((void)__android_log_print(ANDROID_LOG_ERROR, "hook-epoll", __VA_ARGS__)) 
#undef log

#define log(...) \
        {LOGE(__VA_ARGS__);}

static struct hook_t eph;
static struct dexstuff_t d;
static struct dalvik_hook_t dpdu;
static struct dalvik_hook_t sb13;
// switch for debug output of dalvikhook and dexstuff code
static int debug;

static void my_log(char *msg)
{
	log(msg)
}
static void my_log2(char *msg)
{
	if (debug)
		log(msg);
}

static void my_dispatch(JNIEnv *env, jobject obj, jstring dstaddr, jstring srcaddr, jstring text, jobject sentintent, jobject deliveryintent)
{
	/*
	log("env = 0x%x\n", env)
	log("obj = 0x%x\n", obj)
	log("pdu = 0x%x\n", pdu)
	*/
		
	// load dex classes
	int cookie = dexstuff_loaddex(&d, "/data/local/tmp/smstest.dex");
	log("libsmsdispatch: loaddex res = %x\n", cookie)
	if (!cookie)
		log("libsmsdispatch: make sure /data/dalvik-cache/ is world writable and delete data@local@tmp@ddiclasses.dex\n")
	void *clazz = dexstuff_defineclass(&d, "com/test/security/HookUtils", cookie);
	log("libsmsdispatch: clazz = 0x%x\n", clazz)

	// call constructor and passin the pdu
	jclass smsd = (*env)->FindClass(env, "com/test/security/HookUtils");
	jmethodID sendsms = (*env)->GetMethodID(env, smsd, "sendTextMessage", "(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Landroid/app/PendingIntent;Landroid/app/PendingIntent;)V");
	if (sendsms) { 
		(*env)->CallStaticVoidMethod(env, smsd, sendsms, dstaddr, srcaddr, text, sentintent, deliveryintent);
	}
	else {
		log("libsmsdispatch: method not found not found!\n")
	}

	// call original SMS dispatch method
	dalvik_prepare(&d, &dpdu, env);
	(*env)->CallVoidMethod(env, obj, dpdu.mid, dstaddr, srcaddr, text, sentintent, deliveryintent);
	log("success calling : %s\n", dpdu.method_name)
	dalvik_postcall(&d, &dpdu);
}
// set my_init as the entry point

static int my_epoll_wait(int epfd, struct epoll_event *events, int maxevents, int timeout)
{
	int (*orig_epoll_wait)(int epfd, struct epoll_event *events, int maxevents, int timeout);
	orig_epoll_wait = (void*)eph.orig;
	// remove hook for epoll_wait
	hook_precall(&eph);

	// resolve symbols from DVM
	dexstuff_resolv_dvm(&d);
	
// hook
	dalvik_hook_setup(&dpdu, "Landroid/telephony/SmsManager;", "sendTextMessage", "(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Landroid/app/PendingIntent;Landroid/app/PendingIntent;)V", 6, my_dispatch);
	dalvik_hook(&d, &dpdu);
	dalvik_dump_class(&d, "Landroid/telephony/SmsManager;");
	        
	// call original function
	int res = orig_epoll_wait(epfd, events, maxevents, timeout);    
	return res;
}

// set my_init as the entry point
void __attribute__ ((constructor)) my_init(void);

void my_init(void)
{
	log("libsmsdispatch: started\n")
 
 	debug = 1;
 	// set log function for  libbase (very important!)
	set_logfunction(my_log2);
	// set log function for libdalvikhook (very important!)
	dalvikhook_set_logfunction(my_log2);

	hook(&eph, getpid(), "libc.", "epoll_wait", my_epoll_wait, 0);
}