Hooks overwriting eachother

[x1mus]

Hello,

When hooking libc functions such as access and faccessat. If I only hook access and capture the calls from an application that performs java.io.File.exists(), I get the calls to the access function.

If I add the faccessat to the hooked functions, it replaces the call to access which in theory shouldn't happen since access is calling faccessat (cf. libc). Is it a wanted behavior ?

[yanivagman]

If I add the faccessat to the hooked functions, it replaces the call to access which in theory shouldn't happen since access is calling faccessat (cf. libc). Is it a wanted behavior ?

Not sure I understand the question.
What do you mean by "replaces the call"?

[x1mus]

If my hooks.json file contains only this hook (and the android API probe also) :

{
    "lib_path": "/apex/com.android.runtime/lib64/bionic/libc.so",
    "sym_name": "access",
    "offset": "",
    "args_types": [ "char*", "int" ]
},

The output will be :

...
73086.630253   10262  tg.uncrackable1  0       5       0                generic_api_uprobe  fn=java.io.File.exists() 
73086.630299   10262  tg.uncrackable1  0       5       -1               generic_uprobe      fn=/apex/com.android.runtime/lib64/bionic/libc.so:access arg1=/vendor/xbin/su arg2=0 
73086.630331   10262  tg.uncrackable1  0       5       0                generic_api_uprobe  fn=java.io.File.exists() 
73086.630368   10262  tg.uncrackable1  0       5       -1               generic_uprobe      fn=/apex/com.android.runtime/lib64/bionic/libc.so:access arg1=/system/app/Superuser.apk arg2=0 
...

But If my hooks.json file contains both hooks:

{
    "lib_path": "/apex/com.android.runtime/lib64/bionic/libc.so",
    "sym_name": "access",
    "offset": "",
    "args_types": [ "char*", "int" ]
},
{
    "lib_path": "/apex/com.android.runtime/lib64/bionic/libc.so",
    "sym_name": "faccessat",
    "offset": "",
    "args_types": [ "int", "char*", "int", "int" ]
},

The output will be:

...
75341.484463   10262  tg.uncrackable1  0       6       0                generic_api_uprobe  fn=java.io.File.exists() 
75341.484527   10262  tg.uncrackable1  0       6       -1               generic_uprobe      fn=/apex/com.android.runtime/lib64/bionic/libc.so:faccessat arg1=-100 arg2=/vendor/xbin/su arg3=0 arg4=0 
75341.484569   10262  tg.uncrackable1  0       6       0                generic_api_uprobe  fn=java.io.File.exists() 
75341.484638   10262  tg.uncrackable1  0       6       -1               generic_uprobe      fn=/apex/com.android.runtime/lib64/bionic/libc.so:faccessat arg1=-100 arg2=/system/app/Superuser.apk arg3=0 arg4=0
...

[yanivagman]

Looks like both access and faccessat point to the same address (you may be able to validate it by looking at the symbols in your libc). In that case - one of the hooks overrides the other (it's just a mapping from an address to the function name)

[x1mus]

Just checked with nm and they do not point to the same address

$ nm -gD libc.so
000000000005c250 T access
000000000005fcf0 T faccessat