Functions — github.com/Arsylk/gozinject

hub / github.com/Arsylk/gozinject / functions

Functions47 in github.com/Arsylk/gozinject

ReadMem reads `size` bytes from the target process's address space.

WriteMem writes data into the target process's address space via /proc/<pid>/mem. Requires PTRACE_MODE_ATTACH_FSCREDS — caller must be root or already

src/memory.go:11

↓ 4 callersFunctionGetModuleBase

GetModuleBase returns the lowest mapped address of the named module (substring match).

src/maps.go:52

↓ 4 callersFunctionIsProcessAlive

IsProcessAlive returns true if /proc/<pid> exists.

src/utils.go:150

↓ 4 callersFunctionVmaHideUsable

VmaHideUsable reports whether /proc/vma_hide hiding is currently active, so callers can skip the work and the (otherwise misleading) "hidden" logging.

src/soinfo.go:174

↓ 3 callersFunctionAppProcessAlive

AppProcessAlive returns true iff any process's cmdline starts with `pkgName` (followed by NUL for the main process or ':' for app sub-processes like `

src/utils.go:167

↓ 3 callersFunctionFindSymbolOffset

FindSymbolOffset returns the file/load offset of the named symbol. Searches dynamic symbols first, then the regular symbol table.

src/elf.go:12

↓ 3 callersFunctionParseMaps

ParseMaps reads and parses /proc/<pid>/maps. Hidden VMAs (via /proc/vma_hide) are transparently filtered out by the kernel; callers see what the targe

src/maps.go:22

↓ 3 callersFunctionReadPointer

ReadPointer reads a 64-bit little-endian pointer from process memory.

src/memory.go:34

↓ 2 callersFunctionChildrenOf

ChildrenOf returns the live child pids of `parentPid` by scanning /proc and parsing each process's stat file for its PPid field. PPid lives right afte

src/utils.go:128

↓ 2 callersFunctionForceStopApp

ForceStopApp invokes `am force-stop <pkg>` to terminate any running app instance.

src/utils.go:159

↓ 2 callersFunctionGetAppUID

GetAppUID returns the uid that owns /data/data/<pkg>. Zero on failure.

src/utils.go:251

↓ 2 callersMethodString

()

src/main.go:22

↓ 2 callersFunctionWritePointer

WritePointer writes a 64-bit little-endian pointer to process memory.

src/memory.go:43

↓ 2 callersFunctionhideVma

hideVma adds a per-UID hide entry to /proc/vma_hide. The kernel module filters this range out of /proc/<pid>/maps and /proc/<pid>/smaps for any proces

src/soinfo.go:213

↓ 2 callersFunctionppidOf

ppidOf returns the parent pid from /proc/<pid>/stat. The comm field is (...)-quoted and may itself contain spaces or parens, so PPid is the second whi

src/utils.go:18

↓ 2 callersFunctionprocStartTime

procStartTime returns the process start time (jiffies since boot) from proc/<pid>/stat field 22. Like ppidOf, it parses from the LAST ')' so a comm co

src/utils.go:44

↓ 2 callersFunctionrandomChromiumName

randomChromiumName returns an innocuous chromium-cache-style file name with a fresh 64-bit random suffix. Used for both the persistent payload copy a

src/main.go:255

↓ 2 callersFunctionuint64Bytes

(v uint64)

src/injector.go:37

↓ 2 callersFunctionwriteIntoAppSandbox

writeIntoAppSandbox writes data as <name> under the target app's data dir when accessible, falling back to /data/local/tmp. The file is chowned to uid

src/main.go:231

↓ 1 callersFunctionBuildDlopenStageImage

BuildDlopenStageImage patches the embedded 4 KB stage with the runtime addresses it needs and the staged payload paths. The stage loads libPaths in or

src/shellcode_builder.go:81

↓ 1 callersFunctionBuildStubShellcode

BuildStubShellcode patches the embedded 428-byte stub with the zygote pid, target app uid, original setArgV0 address (for the parent path + stage call

src/shellcode_builder.go:112

↓ 1 callersFunctionFindProcessPid

FindProcessPid scans /proc for the canonical top-level process whose cmdline argv[0] equals `processName` EXACTLY and whose parent is init (PPid == 1)

src/utils.go:85

↓ 1 callersFunctionFindSymbolAddress

FindSymbolAddress resolves a symbol to its runtime address in the target process, by combining the module's load base (from /proc/<pid>/maps) with the

src/elf.go:75

↓ 1 callersFunctionFindSymbolOffsetPrefix

FindSymbolOffsetPrefix finds a symbol by prefix match. Needed for LLVM-suffixed local symbols like "__dl__ZL6solist.llvm.XXXXX".

src/elf.go:43

↓ 1 callersFunctionGetAndroidAPILevel

()

src/utils.go:264

↓ 1 callersFunctionGetSoinfoOffsets

GetSoinfoOffsets returns the best-guess realpath offset for the given API level. The walker scans nearby offsets if the guess decodes nonsense, so the

src/soinfo.go:22

↓ 1 callersFunctionReadString

ReadString reads a null-terminated string from process memory (up to maxLen bytes).

src/memory.go:50

↓ 1 callersFunctionResolveMainActivity

ResolveMainActivity returns the canonical launcher activity for a package (component spec `pkg/.Activity`). Tries `cmd package resolve-activity` first

src/utils.go:216

↓ 1 callersFunctionRunInjector

RunInjector orchestrates the stub-and-stage injection: - patches a 428-byte stub at zygote's setArgV0; - on the first matching fork, the stub mmaps th

src/injector.go:58

↓ 1 callersFunctionSetLogLevel

SetLogLevel maps a string ("debug" | "info" | "warn" | "error") to the underlying log level. Empty string keeps the default (info).

src/logger.go:105

↓ 1 callersFunctionSetVmaHideMode

SetVmaHideMode resolves the --vma-hide mode and records whether the injector will use the kernel module: "never" forces it off, "always" forces it on,

src/soinfo.go:185

↓ 1 callersFunctionUnlinkSoinfo

UnlinkSoinfo finds the payload on the linker's solist, hides every VMA belonging to it (file-backed segments + linker guard pages + [anon:.bss]) from

src/soinfo.go:273

↓ 1 callersFunctionVmaHideStrict

VmaHideStrict reports whether hiding was explicitly demanded (--vma-hide=always), so the caller can treat degraded hiding as an error rather than a so

src/soinfo.go:178

↓ 1 callersFunctionWaitForAppGone

WaitForAppGone polls until no process for pkgName remains, or `timeout` elapses. Returns true if the app exited, false on timeout. Replaces the fixed

src/utils.go:199

↓ 1 callersFunctionclearHiddenVmasForUID

clearHiddenVmasForUID wipes only the entries belonging to one app UID. Called once at the start of each injection so stale entries from a previous run

src/soinfo.go:234

↓ 1 callersFunctiondecodeStdString

(pid int, addr uint64)

src/soinfo.go:68

↓ 1 callersFunctionfindPayloadVmaRanges

findPayloadVmaRanges returns every VMA belonging to the loaded payload: the three file-backed PT_LOAD segments and the linker's adjacent satellite map

src/soinfo.go:101

↓ 1 callersFunctionreadSoinfoRealpath

readSoinfoRealpath decodes the libc++ std::string realpath field. libc++ SSO encodes either a short string (inline up to 22 bytes) or a long string (8

src/soinfo.go:53

↓ 1 callersFunctionrealpathCandidateOffsets

realpathCandidateOffsets returns the offsets to try when probing for the realpath std::string. The struct layout has drifted by ±8 between minor AOSP

src/soinfo.go:41

↓ 1 callersFunctionstagePayloadCopy

stagePayloadCopy copies the user-supplied payload into the app sandbox so the stage's dlopen() inside the child can open it cleanly. Only the COPY is

src/main.go:266

↓ 1 callersFunctionstopChild

stopChild binds the injected target's lifetime to the tool's: on exit in -logcat / -logtag mode it kills the spawned pid and force-stops the package s

src/main.go:213

↓ 1 callersFunctionstreamLogcat

streamLogcat tails logcat for the freshly injected child and blocks until one of three things ends it: the child process exits, the operator interrupt

src/main.go:127

MethodFullyHidden

FullyHidden reports that every discovered payload VMA was hidden. Trivially false when vma_hide is inactive (the payload is then deliberately visible)