evilsocket/arminject evilsocket/arminject

  • Stars
    star
    432
  • Rank 100,650 (Top 2 %)
  • Language
    C++
  • License
    Other
  • Created over 9 years ago
  • Updated about 8 years ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
evilsocket/arminject
github

evilsocket

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

An application to dynamically inject a shared object into a running process on ARM architectures.

ARM Inject

An application to dynamically inject a shared object into a running process on ARM architectures and hook API calls.

Read more on:

How to Test

In order to test this, you'll need the Android NDK installed and a device connected to your USB port, then simply run:

make test

This will launch a new Chrome browser instance and inject libhook into it. Once injected the library will hook the open function and print every call to it to the logcat.

@ Pushing files to /data/local/tmp ...
@ Starting com.android.chrome/com.google.android.apps.chrome.Main ...
@ Injection into PID 18233 starting ...

I/LIBHOOK (18233): LIBRARY LOADED FROM PID 18233.
I/LIBHOOK (18233): Found 104 loaded modules.
I/LIBHOOK (18233): Installing 12 hooks.
I/LIBHOOK (18233): [0xA0861000] Hooking /data/app/com.android.chrome-2/lib/arm/libchrome.so ...
I/LIBHOOK (18233): [0xA0A68000] Hooking /data/app/com.android.chrome-2/lib/arm/libchrome.so ...
I/LIBHOOK (18233): [0xAB8A9000] Hooking /system/vendor/lib/egl/libGLESv2_adreno.so ...
I/LIBHOOK (18233): [0xAB9EC000] Hooking /system/vendor/lib/egl/libGLESv1_CM_adreno.so ...
I/LIBHOOK (18233): [0xABA20000] Hooking /system/vendor/lib/libgsl.so ...
I/LIBHOOK (18233):   open - 0xb6f31951 -> 0xa446577c
I/LIBHOOK (18233):   write - 0xb6f55ec8 -> 0xa4464d5c
I/LIBHOOK (18233):   read - 0xb6f56964 -> 0xa4464c70
I/LIBHOOK (18233):   close - 0xb6f552e8 -> 0xa4464e54
I/LIBHOOK (18233):   connect - 0xb6f30365 -> 0xa44657fc
I/LIBHOOK (18233):   sendto - 0xb6f562a0 -> 0xa4465020
I/LIBHOOK (18233):   recvfrom - 0xb6f5679c -> 0xa4465318
I/LIBHOOK (18233):   shutdown - 0xb6f566ac -> 0xa4465518
I/LIBHOOK (18233):   send - 0xb6f33851 -> 0xa4464f28
I/LIBHOOK (18233):   recvmsg - 0xb6f560c0 -> 0xa446542c
I/LIBHOOK (18233):   sendmsg - 0xb6f55de0 -> 0xa4465134
...
...
I/LIBHOOK (18233): [18233] open('/dev/ashmem', 2) -> 18
I/LIBHOOK (18233): [18233] close( '/dev/ashmem' ) -> 0
I/LIBHOOK (18233): [18233] open('/dev/ashmem', 2) -> 18
I/LIBHOOK (18233): [18233] close( '/dev/ashmem' ) -> 0
I/LIBHOOK (18233): [18233] open('/data/data/com.android.chrome/shared_prefs/com.google.android.apps.chrome.omaha.xml', 0) -> 18
I/LIBHOOK (18233): [18233] open('/dev/ashmem', 2) -> 19
I/LIBHOOK (18233): [18233] close( '/dev/ashmem' ) -> 0
I/LIBHOOK (18233): [18233] open('/dev/ashmem', 2) -> 19
I/LIBHOOK (18233): [18233] close( '/dev/ashmem' ) -> 0
I/LIBHOOK (18233): [18233] read( '/data/data/com.android.chrome/shared_prefs/com.google.android.apps.chrome.omaha.xml', 0xb007c00c, 16384 ) -> 655
I/LIBHOOK (18233): [18233] close( '/data/data/com.android.chrome/shared_prefs/com.google.android.apps.chrome.omaha.xml' ) -> 0
I/LIBHOOK (18233): [18233] write( 'pipe:[4020814]', W, 1, 2147483647 ) -> 1
I/LIBHOOK (18233): [18233] write( '(14)', 18306, 5, -1601827487 ) -> 5
I/LIBHOOK (18233): [18233] open('/dev/ashmem', 2) -> 22
I/LIBHOOK (18233): [18233] close( '/dev/ashmem' ) -> 0
I/LIBHOOK (18233): [18233] open('/dev/ashmem', 2) -> 22
I/LIBHOOK (18233): [18233] close( '/dev/ashmem' ) -> 0
I/LIBHOOK (18233): [18233] close( '(22)' ) -> 0
I/LIBHOOK (18233): [18233] read( '(18)', 0xa0860b6c, 16 ) -> 1
I/LIBHOOK (18233): [18233] close( '(24)' ) -> 0
I/LIBHOOK (18233): [18233] close( '(22)' ) -> 0
I/LIBHOOK (18233): [18233] open('/dev/ashmem', 2) -> 22
I/LIBHOOK (18233): [18233] recvfrom( 'socket:[4043146]', nysv, 2400, 64, 0x0, 0 ) -> 24
I/LIBHOOK (18233): [18233] recvfrom( 'socket:[4043146]', nysv, 2400, 64, 0x0, 0 ) -> -1
I/LIBHOOK (18233): [18233] read( '(18)', 0xa0860b6c, 16 ) -> 1
I/LIBHOOK (18233): [18233] write( 'pipe:[4020814]', W, 1, 2147483647 ) -> 1
I/LIBHOOK (18233): [18233] recvfrom( 'socket:[4043184]', �, 2264, 64, 0x0, 0 ) -> -1
I/LIBHOOK (18233): [18233] write( 'pipe:[4043980]', W, 1, -1 ) -> 1
...
...
@ CTRL+C detected, killing process ...

Note

Most of the ELF manipulation code inside the file hook.cpp of libhook was taken from the Andrey Petrov's blog post "Android hacking: hooking system functions used by Dalvik" and fixed by me ( the original source code didn't work due to page align, memory protection, etc ).

License

Released under the BSD license.
Copyright © 2015, Simone Margaritelli [email protected]
All rights reserved.

More Repositories

1

opensnitch

OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
Python
10,819
star
2

pwnagotchi

(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.
JavaScript
5,830
star
3

bettercap

DEPRECATED, bettercap developement moved here: https://github.com/bettercap/bettercap
2,507
star
4

xray

XRay is a tool for recon, mapping and OSINT gathering from public networks.
Go
1,966
star
5

bleah

This repository is DEPRECATED, please use bettercap as this tool has been ported to its BLE modules.
1,094
star
6

dnssearch

A subdomain enumeration tool.
Go
879
star
7

arc

A manager for your secrets.
Go
838
star
8

ditto

A tool for IDN homograph attacks and detection.
Go
694
star
9

uroboros

A GNU/Linux monitoring and profiling tool focused on single processes.
Go
670
star
10

shellz

shellz is a small utility to manage your ssh, telnet, kubernetes, winrm, web or any custom shell in a single place.
Go
537
star
11

sg1

A wanna be swiss army knife for data encryption, exfiltration and covert communication.
Go
528
star
12

smali_emulator

This software will emulate a smali source file generated by apktool.
Python
458
star
13

jscythe

Abuse the node.js inspector mechanism in order to force any node.js/electron/v8 based process to execute arbitrary javascript code.
Rust
310
star
14

spycast

A crossplatform mDNS enumeration tool.
HTML
304
star
15

medusa

A fast and secure multi protocol honeypot.
Rust
285
star
16

ergo

🧠 A tool that makes AI easier.
Python
285
star
17

bettercap-proxy-modules

This repository contains some bettercap transparent proxy example modules.
285
star
18

dirsearch

A Go implementation of dirsearch.
Go
253
star
19

kitsune

🧠 🔎 🤖 Kitsune is an artificial neural network designed to detect and correlate Twitter profiles with similar behaviours.
Python
228
star
20

librestd

A low dependencies and self contained library to create C++ RESTful API services.
C++
199
star
21

shieldwall

zero-trust remote firewall instrumentation
Go
195
star
22

pwnagotchi-plugins-contrib

User contributed Pwnagotchi plugins.
Python
170
star
23

ergo-pe-av

🧠 🦠 An artificial neural network and API to detect Windows malware, based on Ergo and LIEF.
Python
166
star
24

sauron

A minimalistic cross-platform malware scanner with non-blocking realtime filesystem monitoring using YARA rules.
Rust
162
star
25

islazy

A Go library containing a set of opinionated packages, objects, helpers and functions implemented with the KISS principle in mind.
Go
153
star
26

gitstats

Git Repository Analyzer.
Go
145
star
27

gibson

A high performance tree-based cache server.
C
136
star
28

androswat

tool to inspect, dump, modify, search and inject libraries into Android processes.
C++
121
star
29

pdusms

PoC app for raw pdu manipulation on Android.
Java
119
star
30

veryfied

Mark pre-Musk era Twitter actually verified accounts.
JavaScript
113
star
31

ebpf-process-anomaly-detection

Process behaviour anomaly detection using eBPF and unsupervised-learning Autoencoders
Python
108
star
32

pwngrid

(⌐■_■) - API server for pwnagotchi.ai
Go
100
star
33

coffee

Smarter Coffee terminal client.
Python
97
star
34

joe

The Swiss Army knife for backend engineers.
Go
90
star
35

sum

A specialized database server for linear algebra and machine learning.
Go
87
star
36

www.pwnagotchi.ai

(⌐■_■) - pwnagotchi.ai
CSS
84
star
37

nikeplus-fuelband-se-reversed

A a proof of concept application that uses BLE api and the Nike+ FuelBand SE protocol to communicate with Nike BLE devices.
Java
82
star
38

takuan

Takuan is a system service that parses logs and detects noisy attackers in order to build a blacklist database of known cyber offenders.
Go
82
star
39

ftrace

Go library to trace Linux syscalls using the FTRACE kernel framework.
Go
76
star
40

openbank

OpenBank - Your BTC realtime tracker.
PHP
68
star
41

fang

A multi service threaded MD5 cracker
Python
66
star
42

dotfiles

My zsh, bash and vim dot files
Shell
66
star
43

libpe

A C/C++ library to parse Windows portable executables written with speed and stability in mind.
C
64
star
44

brutemachine

A Go library which main purpose is giving an interface to loop over a dictionary and use those words/lines as input for some custom logic such as HTTP file bruteforcing, DNS bruteforcing, etc.
Go
53
star
45

fido

Fido is a minimalistic, IDE and language agnostic project generator supporting various toolchains and build systems.
Python
52
star
46

mpcfw

Reverse engineering of Apple MultipeerConnectivity Framework
Python
51
star
47

quijote

Quijote is an highly configurable HTTP middleware for API security.
Go
48
star
48

altair

A Modular Web Vulnerability Scanner
Python
47
star
49

mcaptcha_bypass

PoC to bypass mCaptcha and its rate limiting capabilities from a fully automated bot.
Rust
47
star
50

ergo-planes-detector

🧠✈️ An ergo based project that relies on a convolutional neural network to detect airplanes from satellite imagery.
Python
44
star
51

stork

A small utility that aims to automate and simplify some tasks related to software release cycles.
Go
43
star
52

SafeInCloud

This repository contains a class to decrypt SafeInCloud (https://www.safe-in-cloud.com/) database files and a couple of command line utilities.
Python
41
star
53

pycryptocat

pyCryptoCat - A CryptoCat standalone python client.
JavaScript
36
star
54

unisbom

UniSBOM is a tool to build a software bill of materials on any platform with a unified data format.
Rust
34
star
55

dunmer

An ELF parasite command injector.
C
31
star
56

evilsocket.github.io

evilsocket.github.io files
HTML
28
star
57

dsploit-arpspoof

The dSploit arpspoof module.
C
27
star
58

octoghost

A python script to process Octopress markdown files and write a JSON file ready to import into Ghost.
Python
27
star
59

backup

Backup scripts I use on my drives.
Shell
26
star
60

SoftWire

SoftWire is a class library written in object-oriented C++ for compiling assembly code. It can be used in projects to generate x86 machine code at run-time as an alternative to self-modifying code. Scripting languages might also benefit by using SoftWire as a JIT-compiler back-end. It also allows to eliminate jumps for variables which are temporarily constant during run-time, like for efficient graphics processing by constructing an optimised pipeline. Because of its possibility for 'instruction rewiring' by run-time conditional compilation, I named it "SoftWire". It is targeted only at developers with a good knowledge of C++ and x86 assembly. Project originally by Nicolas Capens, new implementation by Simone Margaritelli aka evilsocket
C++
25
star
61

SWG

Static Website Generator
Python
23
star
62

hybris

Hybris scripting language interpreter engine and standard library modules.
C++
23
star
63

rubertooth

A complete Ruby porting of the ubertooth libraries and utilities.
Ruby
23
star
64

BioIdentify

BioIdentify is a command line tool for fingerprints feature extraction, 1on1 match and 1onN match .
C++
21
star
65

emoticode

This is the code repository for v2.0 of http://www.emoticode.net/
Ruby
21
star
66

gobench

A simple bash script that does its best to automate and visualize differential benchmarking for Go projects.
Shell
21
star
67

eve

(◍•﹏•) - Hi, I'm Eve
Python
21
star
68

clang-ebpf-builder

A Rust crate that simplifies the integration of Rust and eBPF programs written in C.
C
20
star
69

hackrfpp

HackRF C++ playground plus basic demodulation.
C++
20
star
70

wax

Wax is a mediocre fuzzer I'm prototyping to test some ideas and get rid of others.
Go
19
star
71

pineproxy

A ruby self contained, low resource consuming HTTP transparent proxy designed for the WiFi Pineapple MKV.
Ruby
16
star
72

pwngrid-queries-joe

PwnGRID queries for Joe
Go
15
star
73

octofairy

A machine learning based GitHub bot for Issues.
Python
15
star
74

webmon

A webpage monitor bot, currently used to monitor Twitter ToS.
Python
13
star
75

arc-android-wrapper

An Android wrapper for Arc
Java
13
star
76

twitter-num-followers-bot

A bot that'll monitor the number of followers of its followers and tweet when the counter gets to interesting values.
Go
13
star
77

update.dsploit.net

The code repository for the dSploit project update server.
Ruby
13
star
78

Eigetron

Face recognition program that uses Eigen faces with a fast Jacobi eigen decomposition
C++
13
star
79

Pynject

Pynject - An automatic MySQL injector and data dumper tool.
Python
13
star
80

keras-goodreads

book rating system using LSTM and Goodreads
Python
12
star
81

MSP

Multidimensional Space Processing Library
C++
11
star
82

phpgibson

The phpgibson extension provides an API for communicating with the Gibson cache server.
C
10
star
83

llama3-cake

Distributed LLama3 inference.
Rust
10
star
84

mmdb2json

A script to dump a MMDB ( MaxMind ) binary database to JSON.
Python
9
star
85

backupbox

Sup biatch?
Python
9
star
86

Kerby_Surveillance

Kerby - Light weight video surveillance system.
C++
9
star
87

charon

A Ruby library to query the Zen service on SpamHaus.org
Ruby
6
star
88

evilsocket

about me
6
star
89

42

.
5
star
90

sumphp

PHP client interface to the Sum linear algebra database.
PHP
5
star
91

gauntlet-nginx

Gauntlet IPS nginx module
C
5
star
92

libgibsonclient

Gibson cache server native client library.
C
5
star
93

dsploit-thomson

Assembly
5
star
94

rpi-l298n-motor-driver

Those are experimental scripts to be used with a Raspberry Pi, a L298N chip and two motors.
Python
5
star
95

codeforces

Solutions for the codeforces.com problemset section exercises.
C
5
star
96

caspermod

A modified version of the Casper theme for Ghost blog platform.
CSS
4
star
97

takuan-reports

4
star
98

TED

TED (acronym for neTwork Event Daemon) is a GNU/Linux daemon that will inform you upon new inbound connections, when an host on your network is alive or not, and so on .
C++
4
star
99

sumpy

Python client interface to the Sum linear algebra database.
Python
4
star
100

tman

A small utility to inspect and validate safetensors and ONNX files.
Rust
4
star