DOCSEARCHbyAlgolia
Submit Docs

0xss Blog

website·Indexed 31 days ago

https://blog.0xss.com/

A technical blog featuring guides and tutorials on C++ development, Android NDK, JNI, and kernel-level modifications. Topics include memory management (RAII), templates, exceptions, and Android-specific graphics and audio APIs like OpenGL ES, Vulkan, AAudio, and OpenSL ES, as well as Android rooting and kernel tools such as KernelSU, APatch, and bpftrace.

Tokens
289K
Snippets
1K
Records
1.7K
Agent score
49%

What's inside 0xss Blog

  1. Overview of LSPlt for Android Native PLT Hooking

    LSPlt is a lightweight PLT Hook library for Android. Unlike LSPlant, which modifies ART Java method entries, LSPlt operates on Native ELF dynamic linking information. It identifies the PLT/GOT relocation slot corresponding to a target symbol and replaces the function pointer in that slot with a custom callback function.

  2. Overview of DexKit for Obfuscated Code Search

    DexKit is a high-performance library based on DEX file analysis used to locate target classes in Android applications, especially when class and method names are obfuscated. Unlike traditional reflection which relies on hardcoded names, DexKit uses structural and content-based features to find targets.

  3. Overview of Linux Kernel Observation and Tracing Architecture

    The Linux kernel tracing architecture is organized into four layers to facilitate data collection and analysis. This architecture allows developers to move from high-level user-space tools down to the specific hardware or software probes that trigger data collection.
    Layer                | Examples                                     | Purpose
-------------------- | --------------------------------------------- | --------------------------------------------------
User-space Tools     | perf, bcc, trace-cmd, perf-tools              | Commands or scripts executed by the user
Interfaces & Mechanisms| perf_event_open(2), bpf(2), tracefs/debugfs, mmap ring buffer | Communication between user-space and kernel-space
Kernel Subsystems    | perf_event, eBPF, BPF map, ftrace            | Modules executing the observation logic in the kernel
Data Sources & Probes| hardware counter, software event, tracepoint, kprobe, uprobe, function tracer, latency tracer | The actual source of data collection

  4. Overview of LSPlt for Android Native PLT Hooking

    LSPlt is a lightweight PLT (Procedure Linkage Table) Hook library for Android. Unlike LSPlant, which modifies ART Java method entries, LSPlt operates on Native ELF dynamic linking information. It identifies the PLT/GOT relocation slot corresponding to a target symbol and replaces the function pointer in that slot with a custom callback function.

  5. Overview of Native Hooking via LSPosed Native API

    LSPosed Native API allows for dynamic injection into Android processes without modifying the original APK. This method supports intercepting both JNI exported functions and non-exported functions within .so libraries, enabling developers to intercept or modify function parameters and return values. Common use cases include reversing encryption algorithms and bypassing anti-debugging mechanisms.

  6. Overview of Linux Kernel Tracing and Observation Architecture

    Linux kernel observation and tracing is structured into four distinct layers that facilitate data collection from the kernel to user-space tools:

    1. User-space Tool Layer: The interface humans interact with (e.g., perf, bcc, trace-cmd, perf-tools).
    2. Interface and Mechanism Layer: The communication bridge between user-space and kernel-space, utilizing perf_event_open(2), bpf(2), tracefs/debugfs, and mmap ring buffers.
    3. Kernel Subsystem Layer: The modules executing the observation logic within the kernel, such as perf_event, eBPF, BPF map, and ftrace.
    4. Data Source and Probe Layer: The actual points of data collection, including hardware counters, software events, tracepoints, kprobes, uprobes, function tracers, and latency tracers.

  7. Overview of LSPlt for Android PLT Hooking

    LSPlt is a lightweight PLT Hook library for Android. Unlike LSPlant, which modifies ART Java method entries, LSPlt operates on Native ELF dynamic linking information. It identifies the PLT/GOT relocation slot corresponding to a target symbol and replaces the function pointer in that slot with a custom callback.

  8. Overview of Linux Kernel Observation and Tracing Architecture

    The Linux kernel tracing architecture is organized into four primary layers that facilitate the collection and analysis of system data:

    1. User-space Tool Layer: Tools that developers interact with directly, such as perf, bcc, trace-cmd, and perf-tools.
    2. Interface and Mechanism Layer: The communication bridge between user-space and kernel-space, utilizing perf_event_open(2), bpf(2), tracefs/debugfs, and mmap ring buffers.
    3. Kernel Subsystems: The modules responsible for executing the observation logic, including perf_event, eBPF, BPF map, and ftrace.
    4. Data Sources and Probes: The actual points of data collection, such as hardware counters, software events, tracepoints, kprobes, uprobes, function tracers, and latency tracers.

  9. Overview of LSPlt PLT Hooking

    LSPlt is a lightweight PLT Hook library for Android (supporting Android 5.0-15) that targets Native ELF dynamic linking. Unlike ART-based hooks, it identifies the PLT/GOT relocation slot for a target symbol and replaces the function pointer with a custom callback. This allows developers to intercept native calls and optionally call the original implementation using a backup pointer.

  10. Overview of Dobby Hooking Framework

    Dobby is a lightweight Hook framework supporting ARM, ARM64, x86, and x64 architectures. It is primarily used in Android Native Hooking scenarios and provides three distinct levels of hooking techniques depending on the reverse engineering requirement:

    1. DobbyHook (Function Replacement): Completely replaces the logic of a function while maintaining the ability to call the original function.
    2. DobbyInstrument (Instruction Instrumentation): Inserts a callback at a specific target address to modify registers and the execution flow.
    3. DobbyCodePatch (Code Patching): Directly modifies machine code bytes, providing the lowest-level method of modification.

  11. Overview of Linux Kernel Observation and Tracing Architecture

    The Linux kernel tracing architecture is organized into four distinct layers that facilitate the collection and analysis of system performance data:

    1. User-space Tool Layer: Tools that developers interact with directly (e.g., perf, bcc, trace-cmd, perf-tools).
    2. Interface and Mechanism Layer: The communication bridge between user-space and kernel-space, utilizing perf_event_open(2), bpf(2), tracefs/debugfs, and mmap ring buffers.
    3. Kernel Subsystem Layer: The modules executing the observation logic within the kernel, including perf_event, eBPF, BPF map, and ftrace.
    4. Data Source and Probe Layer: The actual points of data collection, such as hardware counters, software events, tracepoints, kprobes, uprobes, function tracers, and latency tracers.

  12. Overview of LSPlant InitNative Runtime Initialization

    The InitNative(env, info) function is the core initialization entry point for LSPlant. Its primary purpose is to prepare the Android Runtime (ART) environment before hooking Java methods. It performs three main categories of tasks:

    1. ART Private Structure and Symbol Resolution: Resolves internal ART details such as ArtMethod size, quick entry offsets, and the Runtime::instance_ pointer.
    2. Protective Inline Hooking: Applies inline hooks to critical ART paths to prevent interference or to monitor behavior, such as ClassLinker::FixupStaticTrampolines and Jit::AddCompileTask.
    3. State Management: Establishes tracking for hook targets, backup records, JIT movement, and deoptimization records.

    Note: Because these operations rely on private ART symbols and offsets in libart.so, behavior may vary across Android versions, OEMs, ABIs, and compiler optimizations.