首页课程文章
无痕注入APC注入线程注入读写驱动注入技术句柄表进程线程系统调用保护模式内存管理远程CALL软件调试驱动封装云下发驱动开发FPS数据方框透视FPS方框FPS自瞄CED3DHOOKD3D绘制Imgui绘制DWM
内核课程驱动出租学习路线聊天室免责声明提问技巧

NDK加载 LLVM Pass方案

推荐 原创

周杰伦

文章分类CTF对抗企业安全阅读数 : 950阅读时长 : 9分钟

NDK加载 LLVM Pass方案

本文基于 ndk r25c （25.2.9519653）
仅测试 Linux 和 macOS

获取ndk r25c

直接下载

点只因下载：

使用sdkmanager安装

1
$ANDROID_HOME / tools / bin / sdkmanager - - install "ndk;25.2.9519653"

坑：archlinux 需要 sudo archlinux-java set java-8-openjdk

查看clang信息

1
cat $ANDROID_HOME / ndk / 25.2 . 9519653 / toolchains / llvm / prebuilt / linux - x86_64 / AndroidVersion.txt

内容：

1
2
3
14.0 . 7
based on r450784d1
for additional information on LLVM revision and cherry - picks, see clang_source_info.md

下载未精简的clang

Untitled

 

然后去Google的 prebuilt clang仓库找到 r450784d1 相关的分支并打开：

 

 

Untitled

 

点开最新的一个commit，进入

 

 

然后点击tgz下载这一份clang

 

Untitled

 

然后基于这一份clang直接编译llvm动态库插件就可以直接用ndk加载了

 

解压

1
2
mkdir clang
tar xzvf clang - r450784d1.tar.gz - C clang

编译使用pass实例

  1. 下载代码
1
git clone https: / / github.com / LeadroyaL / llvm - pass - tutorial
  1. 修改 CMakeLists.txt，在project()后加上
1
2
3
set (CMAKE_C_COMPILER / home / ylarod / ndk - r25c / clang / bin / clang)
set (CMAKE_CXX_COMPILER / home / ylarod / ndk - r25c / clang / bin / clang)
set (ENV{LLVM_HOME} / home / ylarod / ndk - r25c / clang)

这个时候cmake ..会报错

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
CMake Error at / home / ylarod / ndk - r25c / clang / lib64 / cmake / llvm / LLVMExports.cmake: 1036 (message):
   The imported target "LLVMDemangle" references the file
 
      "/home/ylarod/ndk-r25c/clang/lib64/libLLVMDemangle.a"
 
   but this file does not exist.  Possible reasons include:
 
   * The file was deleted, renamed, or moved to another location.
 
   * An install or uninstall procedure did not complete successfully.
 
   * The installation package was faulty and contained
 
      "/home/ylarod/ndk-r25c/clang/lib64/cmake/llvm/LLVMExports.cmake"
 
   but not all the files it references.
 
Call Stack (most recent call first):
   / home / ylarod / ndk - r25c / clang / lib64 / cmake / llvm / LLVMConfig.cmake: 251 (include)
   CMakeLists.txt: 14 (find_package)

这个时候去注释掉clang/lib64/cmake/llvm/LLVMExports.cmake 下面这一段代码

 

Untitled

 

然后

1
2
3
mkdir build && cd build
cmake .. - DCMAKE_BUILD_TYPE = Release - G Ninja
ninja

Untitled

 

测试代码来自

 

build.sh:

1
2
3
4
export CC = / home / ylarod / Android / Sdk / ndk / 25.2 . 9519653 / toolchains / llvm / prebuilt / linux - x86_64 / bin / clang + +
 
$CC aes.cpp test.cpp - o no_obf
$CC - fpass - plugin = / home / ylarod / ndk - r25c / llvm - pass - tutorial / build / Hikari / libHikari.so - Xclang - load - Xclang / home / ylarod / ndk - r25c / llvm - pass - tutorial / build / Hikari / libHikari.so - mllvm - split_num = 3 - mllvm - fw_prob = 100 - mllvm - fw_times = 4 - mllvm - bcf_prob = 100 - mllvm - bcf_loop = 3 aes.cpp test.cpp - o obf

编译后：

 

Untitled

 

差不多鸟～

当我们来到macOS上

由于Google编译macOS工具链的系统版本太低，加载so的时候会报错

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
In file included from aes.cpp: 1 :
. / aes.h: 6 : 10 : fatal error: 'cstring' file not found
#include <cstring>
          ^~~~~~~~~
1 error generated.
test.cpp: 1 : 10 : fatal error: 'cstdio' file not found
#include <cstdio>
          ^~~~~~~~
1 error generated.
error: unable to load plugin '/Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so' : 'dlopen(/Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so, 0x0009): symbol not found in flat namespace ' __ZN4llvm10CallbackVH6anchorEv''
clang (LLVM option parsing): Unknown command line argument '-split_num=3' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--print-bfi=3' ?
clang (LLVM option parsing): Unknown command line argument '-fw_prob=100' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--color=100' ?
clang (LLVM option parsing): Unknown command line argument '-fw_times=4' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--fast-isel=4' ?
clang (LLVM option parsing): Unknown command line argument '-bcf_prob=100' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--icp-lto=100' ?
clang (LLVM option parsing): Unknown command line argument '-bcf_loop=3' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--icp-lto=3' ?
error: unable to load plugin '/Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so' : 'dlopen(/Users/ylarod/ndk-r25c/llvm-pass-tutorial/build/Hikari/libHikari.so, 0x0009): symbol not found in flat namespace ' __ZN4llvm10CallbackVH6anchorEv''
clang (LLVM option parsing): Unknown command line argument '-split_num=3' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--print-bfi=3' ?
clang (LLVM option parsing): Unknown command line argument '-fw_prob=100' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--color=100' ?
clang (LLVM option parsing): Unknown command line argument '-fw_times=4' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--fast-isel=4' ?
clang (LLVM option parsing): Unknown command line argument '-bcf_prob=100' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--icp-lto=100' ?
clang (LLVM option parsing): Unknown command line argument '-bcf_loop=3' .  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '--icp-lto=3' ?

解决办法：

 

使用下载的clang替换掉ndk里面的clang

1
2
mv clang - 14 clang - 14.bak
cp ~ / ndk - r25c / clang / bin / clang - 14 clang - 14

找不到头文件是macOS的问题，修改 build.sh 为

1
2
3
4
export CC = / Users / ylarod / Library / Android / sdk / ndk / 25.2 . 9519653 / toolchains / llvm / prebuilt / darwin - x86_64 / bin / aarch64 - linux - android33 - clang + +
 
$CC aes.cpp test.cpp - o no_obf
$CC - fpass - plugin = / Users / ylarod / ndk - r25c / llvm - pass - tutorial / build / Hikari / libHikari.so - Xclang - load - Xclang / Users / ylarod / ndk - r25c / llvm - pass - tutorial / build / Hikari / libHikari.so - mllvm - split_num = 3 - mllvm - fw_prob = 100 - mllvm - fw_times = 4 - mllvm - bcf_prob = 100 - mllvm - bcf_loop = 3 aes.cpp test.cpp - o obf

后重新编译，成功混淆

 

Untitled

参考

 

在我的博客中查看：



更多【 NDK加载 LLVM Pass方案】相关视频教程：www.yxfzedu.com




相关文章推荐

记录自己的技术轨迹
文章规则：
1)：文章标题请尽量与文章内容相符
2)：严禁色情、血腥、暴力
3)：严禁发布任何形式的广告贴
4)：严禁发表关于中国的政治类话题
5)：严格遵守中国互联网法律法规
6)：有侵权,疑问可发邮件至service@yxfzedu.com
近期原创 更多

Markdown Editor

友情链接
内核结构FAQ
免责声明
课程目录
Windows内核
游戏逆向(FPS)
技术交流QQ群
342478842215039827137189196
314055665159620936
www.yxfzedu.com是一个分享游戏安全,游戏外挂与反外挂,游戏驱动保护的视频网站！
接各种驱动定制如：游戏读写驱动，软件内存保护，防止调试等功能定制。
出租读写驱动，调试驱动，无痕注入支持各种游戏。
邮箱：service@yxfzedu.com
QQ：851920120
特别说明：不接游戏数据分析，外挂编写，登陆协议等类似业务。