SamyGO

Code: Select all

.................................................
in loader.so:
...
   void *prev_injection = NULL;

	// Injecting!
 	int page = ((unsigned) KeyCommon_SendKeyPressInput) & ~0x0FFF;
	mprotect((void *) page, 8192, PROT_READ | PROT_WRITE | PROT_EXEC);

	if (KeyCommon_SendKeyPressInput[4] == 0xE51FF004)	// remapped already ?
	{
	   prev_injection = (void *)KeyCommon_SendKeyPressInput[5];
	   KeyCommon_SendKeyPressInput[4] = 0xE51FF004;         // <----------- BTW, what instructions are there
	   KeyCommon_SendKeyPressInput[5] = (unsigned)ex_nextinjection;
	}
	else	// first remapping?
	{
	   KeyCommon_SendKeyPressInput[4] = 0xE51FF004;         // <----------- BTW, what instructions are there? call or jump???
	   KeyCommon_SendKeyPressInput[5] = (unsigned)ex_injection;
	}
	mprotect((void *) page, 8192, PROT_READ | PROT_EXEC);

..................................................................................
in main library (assume, prev_injection was received from loader):

void nextinjection(int a, int key, int arg_r2)
{
	// gcc should put "STMFD SP!, {R4,LR}" on top, if everything goes as planned (LDMFD...? - I don't think so)
	asm volatile(
		"STMFD   SP!, {R0,R2,R3,R12}\n"		// store some registers
	);

	if (prev_injection) execute_previous_injection_function_here();   // <------- HOW ?????

	button_pressed(key);				// our function returning integer (in R0?)
	
	asm volatile(
		"MOV     R1, R0\n"			// remapped keycode
		"MOV     R6, R0\n"			// remapped keycode
		"LDMFD   SP!, {R0,R2,R3,R12}\n"		// restore registers stored before
		"LDMFD   SP!, {R4,LR}\n"		// restore ...
		"MOV     R7, R2\n"			//This is original command that we overwrite
		"LDR     R3, [R8]\n"			//This is original command that we overwrite
		"LDR     PC, =(_ZN9KeyCommon17SendKeyPressInputEii + 0x18 )\n"	//return after injection
	);
}