Insert logging into existing binary code, ARM

Question

I want to add logging to some function(s) in the shared (.so) library. (ARM, Android, a mix of Arm and Thumb modes; C++, some functions are virtual and therefore nameless, invoked via VFT.)

Does anyone already have code that does this or almost this? (Adds logging to existing functions.)

(I am thinking about patching at run-time (on-the-fly), but you may suggest something static.)

The procedures usually start with a PUSH/STM instruction, but it's difficult to place a branch into just one instruction, at least in the thumb mode. How do I modify existing procedures?

One more issue is to detect code residing in PLT. How do I detect code in PLT, how do I "dereference" the plt entry?

Related info:

The caching issues are discussed here: Patching ARM7 code during runtime (but no code at the moment).

Qt-specific stuff: http://www.ntcore.com/files/qtrev.htm or (the same) http://www.codeproject.com/Articles/31330/Qt-Internals-Reversing and about Qt signals&slots.

About printing out RTTI (when it's available, of course).

UPD: reDroid: reverse-engineering tools for Android NDK/C++/Qt (source at github).

Answer 1

The Android Dynamic Binary Instrumentation Toolkit (adbi) should allow you to do what you need to do.

Simple binary instrumentation toolkit for Android ARM + Thumb.

Instrumentation is based on library injection and hooking function entry points (in-line hooking).

The toolkit consists of two main components the hijack tool and the base library.

hijack

The hijack tool provides the injection functionality. It supports a number of modes for supporting older and newer Android devices. hijack provides help on the command line.

libbase

The base library provides the hooking and unhooking functionality. The base library is compiled as a static library so it can be directly included in the actual instrumentation library. This is done so we can keep everything in /data/local/tmp.

Answer 2

You can use Dynamic Binary Instrumentation to achieve what you want as suggested by Jason Geffner.

You can use PINdroid by Intel. Read this presentation on Android Binary Instrumentation.

Answer 3

What i usually do, is find a suitable BL or BLX instruction, and replace it with a BL to my logging code, at the end of my logginghook, then jump to the original target.

original code:

MOV R0, #123
BLX  somefunction

then in C i write some function:

int hooksomefunction(int arg)
{
     // insert logging code here

     return somefunction(arg);
}

and change the original code to:

MOV R0, #123
BLX  hooksomefunction

Other methods of inserting a call of your own:

• insert your code over some error handling code, which is unlikely to be actually used.
• write a jump over some instructions, copy those instructions to the start of your hook, call your logging code, jump back.