Package: droidhack
DroidHackA toolkit that provides easy access with procfs and devfsHow to useFirst, follow the guide I provided inSetupsection, so you can run/debug your python code in any rooted android system (real system, NOT chrooted)After python dev env being successfully setup, this python package will empower you to control your android phone fully by python.With this package, you can:search/edit process memory in your phoneread/write opcodes in a process, or hook them.dump a module from a running processWith python dev env, you can (DIY):run system calls and library functions withctypes, e.g libcdo any other cool stuffs based on syscalls and libraries.SetupGTFO if you cant understand steps below.DO NOT FOLLOW THE STEPS UNLESS YOU REALLY UNDERSTAND THEM.or you might just fuck up your phone.Android Side:Download & install termux on yourROOTEDandroid systemVerify root by runningsuin termux. Remember root for termux so magisk automatically allow root requests.In termux, install packages by runningpkg install tsu openssh python cmake clangIn termux, configure openssh by:writing your public key to~/.ssh/authorized_keysedit~/../usr/etc/ssh/sshd_config, appendStrictModes noandAllowTcpForwarding yesIn termux, runtsuto enter su with termux envs, then runsshdto start openssh server as root.In termux, runpip install droidhackPC SideInstall PyCharmsSettings -> Deployment, setup your remote android ssh server here.Server:ssh root@<android_ip> -p 8022Root Path:/Deployment Path:/data/local/tmp/your_projector something similarSettings -> Project -> Python Interpreter: add deployment target with python interpreter path:/data/data/com.termux/files/usr/bin/pythonDebug your pycharm project with remote python interpreter created above.NoteIf you have trouble connecting by remote ip address of android phone,adb forward tcp:8022 tcp:8022will forward 8022 port from remote to your local address.
So you can connected to127.0.0.1:8022instead.PyCharms 2020.1 has a bug in.pycharm_helper, remember to fix the bug manually.Usagefromcapstoneimport*fromkeystoneimport*fromdroidhack.procfsimport*fromdroidhack.devfsimport*# get a random processprocs=Processes()msg=procs.find('messaging')assertlen(msg)>0msg=msg[0]# dump a modulemsg.dump('libopenjdk.so','/data/local/tmp/libopenjdk.so')# search the whole memorygoogle_msg_ptrs=msg.search(pattern="GNU",limit=5,verbose=False)forptringoogle_msg_ptrs:print(msg.mem.readcstr(ptr).replace('\r','\n'))# search memory by moduleforminmsg.maps:if'.so'inm.pathand'r-'inm.perm:# advanced usagecopyright_addrs=msg.search(pattern="CREATE ",addr=m.addr,size=m.size,limit=1)ifcopyright_addrs:print(m.path)forcaincopyright_addrs:print('    '+msg.mem.readcstr(ca))# patch code dynamicallyasm=Ks(KS_ARCH_ARM64,KS_MODE_LITTLE_ENDIAN)dism=Cs(CS_ARCH_ARM64,KS_MODE_LITTLE_ENDIAN)opcodes="""MOV             X19, X0MOV             X20, X1"""target_codes=asm.asm(opcodes,as_bytes=True)[0]print(f'finding{opcodes}=>{target_codes}')possible_targets=msg.search(pattern=target_codes,verbose=True)# possible_targets = qq.search(pattern=bytearray(target_opcodes).hex(), pattern_type='aob') # example for AOB searchforptrinpossible_targets:print(f'found at{ptr:x}, region:{msg.get_ptr_info(ptr)}\ndumping opcodes:')foriindism.disasm(msg.mem.readbuf(ptr,4*4),offset=ptr):print(i)print('hacking...')old_perm=msg.get_perm(ptr)msg.set_perm(ptr,'rwx')old_opcodes=msg.mem.readbuf(ptr+4*2,4)msg.mem.writebuf(ptr+4*2,asm.asm('mov x0, x1',as_bytes=True)[0])print(f'modified instructions at{ptr:x}, dumping opcodes:')foriindism.disasm(msg.mem.readbuf(ptr,4*4),offset=ptr):print(i)# restore opcodesmsg.mem.writebuf(ptr+4*2,old_opcodes)print('restore perm')msg.set_perm(ptr,old_perm)print(f'current ptr info:{msg.get_ptr_info(ptr)}')# interactive searchcandidates=msg.search(int(input('current value:')),limit=0,verbose=True)whileTrue:cand=[]forcincandidates:ifmsg.search(pattern=int(input('current value:')),addr=c,size=4):cand.append(c)candidates=candprint(f'found{len(candidates)}results.')iflen(candidates)<10:break# play with found candidatespass# [[unlikely]] RKmem operationkmem=DevKmem()sys_open_addr=kmem.get_sym('sys_open')[0].addrprint(f'{sys_open_addr:x}')