Skip to content
This repository has been archived by the owner on Sep 1, 2021. It is now read-only.

Commit

Permalink
update README
Browse files Browse the repository at this point in the history
  • Loading branch information
RikkaW committed Apr 12, 2019
1 parent 78a9f0e commit 3949d10
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 27 deletions.
28 changes: 14 additions & 14 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ The name Riru is from https://www.pixiv.net/member_illust.php?mode=medium&illust
In short, replace a shared library which will be loaded by the zygote process.

First, we need to find that library. The library needs to be as simple as possible, so we found libmemtrack, with only 10 exported functions.
Then we can provide a library named libmemtrack with all its functions, so the functionality will not be affected and we will able to in the zygote process.
Then we can provide a library named libmemtrack with all its functions, so the functionality will not be affected and we will able to in the zygote process. (However, it seems that choose libmemtrack is very good now)

Now the next question, how to know if we are in an app process or a system server process.
We found some JNI functions (`com.android.internal.os.Zygote#nativeForkAndSpecialize` & `com.android.internal.os.Zygote#nativeForkSystemServer`) will be called when a app or system server is forked.
Expand Down Expand Up @@ -50,28 +50,28 @@ From v8, core starts to providing some APIs, see [riru.h](https://github.com/Rik

## Where your own module needs attention

* To ensure your hook is not being overwritten by other modules, use API from core
* DO NOT overwrite `jniRegisterNativeMethods` hook in core in your `attribute constructor` func (or `LOCAL_LDFLAGS -init`)
(To get JNI method address, use `riru_get_native_method_func`)
* DO NOT overwrite `android.os.SystemProperties#native_set` in core, or your data may be wiped
([Detail info](https://github.com/RikkaApps/Riru/blob/v7/riru-core/jni/main/jni_native_method.cpp#L162-L176))
(If you really need to hook this, remember to clear exception)
* DO NO print log (`__android_log_print`) in `nativeForkAndSpecialize(Pre/Post)` `nativeForkSystemServer(Pre/Post)` when in zygote process, or it may cause zygote not work
(magic not confirmed, [Detail info](https://github.com/RikkaApps/Riru/blob/77adfd6a4a6a81bfd20569c910bc4854f2f84f5e/riru-core/jni/main/jni_native_method.cpp#L55-L66))
* Add `-ffixed-x18` to both compiler and linker parameter, or it will cause problems on Android Q (see template)

## Method to ensure your hook not being overwritten
## Riru API

```
#include "riru.h"
* Currently, one module version can only support one API version
* See template for details

your_hook_func(func, new_func, &old_func);
### v3 (core v18+)

if (riru_get_version() >= 8) { // determine riru version first
void *f = riru_get_func("func"); // if f is not null, other module has set it
if (f) old_func = f; // set your old_func as f (new_func in last module) to ensure last module's hook not being overwritten
riru_set_func("func", new_func); // set new_func to let next module get correct old_func
}
```
* Add `api=3` to `riru_module.prop` to declare API version
* Check and deny installation if Riru version is below v18 in `config.sh`
* Parameter of `nativeForkAndSpecializePre` changes (compare to v2, added `jstring *packageName, jobjectArray *packagesForUID, jobjectArray *visibleVolIDs` in the end)

### v2 (core v16-v17.1)

* Export `int getApiVersion() { return 2; }` to declare API version
* Parameter of `nativeForkAndSpecializePre` changes (compare to v1, all parameter is pointer)

## Install

Expand Down
28 changes: 15 additions & 13 deletions README.zh-CN.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Riru 这个名字是来自 https://www.pixiv.net/member_illust.php?mode=medium&i
简而言之,替换一个会被 zygote 进程加载的共享库。

首先要找到那个共享库,而且那个共享库要越简单越好,所以就盯上了只有 10 个导出函数的 libmemtrack。
然后就可以自己提供一个叫 libmemtrack 并且也提供了原来的函数们的库,这样就可以进去 zygote 进程也不会发生爆炸。
然后就可以自己提供一个叫 libmemtrack 并且也提供了原来的函数们的库,这样就可以进去 zygote 进程也不会发生爆炸。(然而现在看来选 libmemtrack 也不是很好)

接着如何知道自己已经在应用进程或者系统服务进程里面。
JNI 函数 (`com.android.internal.os.Zygote#nativeForkAndSpecialize` & `com.android.internal.os.Zygote#nativeForkSystemServer`) 会在应用进程或者系统服务进程被 fork 出来的时候被调用。
Expand Down Expand Up @@ -47,26 +47,28 @@ JNI 函数 (`com.android.internal.os.Zygote#nativeForkAndSpecialize` & `com.andr

## 自己的模块需要注意的地方

* 为了保证自己 hook 不被其他模块掩盖,需要使用 core 的 API
* 不要在自己的 `attribute constructor` 函数 (或 `LOCAL_LDFLAGS -init`) 掩盖 core 中 hook 的 `jniRegisterNativeMethods`(若想要得到 JNI 方法地址请使用 `riru_get_native_method_func`
* 不要掩盖 core 中 hook 的 `android.os.SystemProperties#native_set`
否则在 Android P 以上可能导致数据抹除([详细信息](https://github.com/RikkaApps/Riru/blob/v7/riru-core/jni/main/jni_native_method.cpp#L162-L176))(如果一定要 hook 则要记得清掉异常)
* 不要在 `nativeForkAndSpecialize(Pre/Post)` `nativeForkSystemServer(Pre/Post)` 中在还处于 zygote 进程时输出 log(`__android_log_print`),
否则可能导致 zygote 不工作(未确定的魔法,[详细信息](https://github.com/RikkaApps/Riru/blob/77adfd6a4a6a81bfd20569c910bc4854f2f84f5e/riru-core/jni/main/jni_native_method.cpp#L55-L66)
* 编译时需要为编译和链接指令加上 `-ffixed-x18`,否则在 Android Q 上会产生问题(参考 template)

## 保证 hook 不被掩盖的方法
## Riru API

```
#include "riru.h"
* 目前,一个模块版本只可支持一个 API 版本
* 看 template 来知道具体做法

your_hook_func(func, new_func, &old_func);
### v3 (core v18+)

if (riru_get_version() >= 8) { // 先判断 riru 版本
void *f = riru_get_func("func"); // 如果 f 不为 null 说明其他模块已经设定了
if (f) old_func = f; // 把 old_func 设为获得的 f(即上个模块 new_func)以保证上个模块的 hook 不被掩盖
riru_set_func("func", new_func); // 设定 new_func,让下一个模块正确得到 old_func
}
```
*`riru_module.prop` 加入 `api=3` 来声明 API 版本
*`config.sh` 检查并拒绝在 Riru v18 以下安装
* `nativeForkAndSpecializePre` 参数变化(相对 v2,末尾增加 `jstring *packageName, jobjectArray *packagesForUID, jobjectArray *visibleVolIDs`

### v2 (core v16-v17.1)

* 导出 `int getApiVersion() { return 2; }` 来声明版本号
* `nativeForkAndSpecializePre` 参数变化(相对 v1,所有参数都是指针)
* 加入 `shouldSkipUid`

## 安装

Expand Down

0 comments on commit 3949d10

Please sign in to comment.