Page 3 of 13

Re: .so injection

Posted: Sat Aug 31, 2013 6:53 am
by juusso
emm, there is hijack_v2.tgz from 08.24. Have you forgotten to attach smth? :)

Re: .so injection

Posted: Sat Aug 31, 2013 8:03 am
by bugficks
guess i forgot to click upload button after selecting file.. was late yesterday:)

Re: .so injection

Posted: Sat Aug 31, 2013 8:19 am
by juusso
Definitelly i saw somewhere, can you post one byte patching example for so file. For example, how should be test.so which does this:

Code: Select all

{ "_ZN14CViewerManager17ShowChannelBannerEbi", 0x00000000, 0x00000240, 0x00000260, 0xE3560000, 0xE35600FF, 0 }
Just to have all in one for "newbies" :? :mrgreen:

Re: .so injection

Posted: Sat Aug 31, 2013 8:31 am
by bugficks
that channelinfo.tgz i ve sent you included a cpp file on how to do patching from .so :)

Re: .so injection

Posted: Sat Aug 31, 2013 9:39 am
by bugficks
you could use viewtopic.php?t=2974 also.. it uses instruction size based index, so translating from memjack to that src 0x240/4 etc...

Re: .so injection (patching exeDSP/exeAPP)

Posted: Sat Feb 22, 2014 10:58 am
by bugficks
1st post updated

Re: .so injection (patching exeDSP/exeAPP)

Posted: Thu Oct 09, 2014 10:26 am
by sectroyer
Some fixes to version 1.2.1 of samyGOso:
  • * now loading non-existent .so will not succeed ;)
    * added -n option so now you can use procname instead of pid
    * added -D,-A,T for using standard proc names (exeDSP,exeAPP,exeTV)
    * added -B switch which causes samyGOso to use exeDSP if exeAPP/exeTV fails
Sample usage:

Code: Select all

/tmp/samyGOso -d -l /tmp/test.so -n exeAPP

Code: Select all

/tmp/samyGOso -d -l /tmp/test.so -A

Code: Select all

/tmp/samyGOso -d -l /tmp/test.so -A -B

Re: samyGOso (.so injection - patching exeDSP/exeAPP)

Posted: Mon Nov 10, 2014 10:11 am
by beatfreak
Let me try to expand this a little bit:
current usage information:

Code: Select all

# samyGOso
samyGOso v1.2.4 (c) bugficks 2013, sectroyer 2014
usage: samyGOso [-p PID | -n procname | -A | -T | -D ] [-B ] {-c CONFIG | -l /full/path/to/inject.so [-r (=resident)]} [-d (=debug on)] [-a (=add libc addressoffset )] [arg0,...,argN]
#

Code: Select all

_mandatory parameters:
__targeting (choose one of these parameters):
-p [PID] specifies target process by PID [decimal value] (old parameter, usually used like [i]-p `pidof exeDSP`[/i] to automatically get the right PID)
-n [procname] specifies target process by name of process
-A specifies "exeAPP" as target process name
-D specifies "exeDSP" as target process name
-T specifies "exeTV" as target process name

___optional additional targeting:
-B usable in combination with -A -T, sets "exeDSP" as fallback target (need more details here)

__source lib
-l [path to lib] specifies the lib*.so to be used

_optional parameters:
-r switch on resident mode, causes samyGOso to inject the libso in resident mode, depending on type of libso wether it's necessary
-d switch on debug mode, causes samyGOso to create a Logfile with debug output in /dtv (tmpfs, deleted at poweroff/reboot)
-a [0x#######] sets an addtess offset [?bit hex value], only use if you exactly know why (need more details here)

you may additionally add arguments to be passed to lib*.so to influence its behavior


Re: samyGOso (.so injection - patching exeDSP/exeAPP)

Posted: Mon Nov 10, 2014 1:41 pm
by zoelechat
Spoiled to 1st post. Anyway nearly everybody will deal with given syntax for a specific patch, without caring about samyGOso itself usage :)

Re: samyGOso (.so injection - patching exeDSP/exeAPP)

Posted: Mon Nov 10, 2014 4:21 pm
by sectroyer
zoelechat wrote:Spoiled to 1st post. Anyway nearly everybody will deal with given syntax for a specific patch, without caring about samyGOso itself usage :)
Documenting stuff is always a good habit ;)