```
public async void inject_library_file (uint pid, PathTemplate path_template, string entrypoint, string data,
string temp_path, uint
id
, Cancellable? cancellable) throws Error, IOError {
var helper
=
yield
obtain_for_cpu_type (cpu_type_from_pid (pid), cancellable);
try
{
yield
helper.inject_library_file (pid, path_template, entrypoint, data, temp_path,
id
, cancellable);
injectee_ids[
id
]
=
helper;
} catch (GLib.Error e) {
throw_dbus_error (e);
}
}
```
helper是从obtain_for_cpu_type返回的,obtain_for_cpu_type会根据不同的架构调用 obtain_for_32bit 和 obtain_for_64bit
```
private async LinuxHelper obtain_for_32bit (Cancellable? cancellable) throws Error, IOError {
if
(factory32
=
=
null) {
var store
=
get_resource_store ();
if
(sizeof (void
*
) !
=
4
&& store.helper32
=
=
null)
throw new Error.NOT_SUPPORTED (
"Unable to handle 32-bit processes due to build configuration"
);
factory32
=
new HelperFactory (store.helper32, store, main_context);
factory32.lost.connect (on_factory_lost);
factory32.output.connect (on_factory_output);
factory32.uninjected.connect (on_factory_uninjected);
}
return
yield
factory32.obtain (cancellable);
}
private async LinuxHelper obtain_for_64bit (Cancellable? cancellable) throws Error, IOError {
if
(factory64
=
=
null) {
var store
=
get_resource_store ();
if
(sizeof (void
*
) !
=
8
&& store.helper64
=
=
null)
throw new Error.NOT_SUPPORTED (
"Unable to handle 64-bit processes due to build configuration"
);
factory64
=
new HelperFactory (store.helper64, store, main_context);
factory64.lost.connect (on_factory_lost);
factory64.output.connect (on_factory_output);
factory64.uninjected.connect (on_factory_uninjected);
}
return
yield
factory64.obtain (cancellable);
}
```
get_resource_store 这里释放文件frida
-
helper
然后将文件传入HelperFactory中,调用他的obtain返回,返回一个helper
src\linux\frida
-
helper
-
process.vala
```
public async LinuxHelper obtain (Cancellable? cancellable) throws Error, IOError {
.......
obtain_request
=
new Promise<LinuxHelper> ();
if
(helper_file
=
=
null) {
assign_helper (new LinuxHelperBackend ());
obtain_request.resolve (helper);
return
helper;
}
.........
try
{
string socket_path
=
Path.build_filename (resource_store.tempdir.path, Uuid.string_random ());
string socket_address
=
"unix:abstract="
+
socket_path;
/
/
dbus类型
.........
string[] envp
=
Environ.unset_variable (Environ.get (),
"LD_LIBRARY_PATH"
);
try
{
string cwd
=
"/"
;
string[] argv
=
new string[] {
"su"
,
"-c"
, helper_file.path, socket_address };
/
/
超级权限启动
bool
capture_output
=
false;
pending_superprocess
=
yield
SuperSU.spawn (cwd, argv, envp, capture_output, cancellable);
/
/
启动进程
} catch (Error e) {
string[] argv
=
{ helper_file.path, socket_address };
GLib.SpawnFlags flags
=
GLib.SpawnFlags.LEAVE_DESCRIPTORS_OPEN |
/
*
GLib.SpawnFlags.CLOEXEC_PIPES
*
/
256
;
GLib.Process.spawn_async (null, argv, envp, flags, null, out pending_pid);
}
........
var incoming_handler
=
service.incoming.connect ((c)
=
> {
/
/
管道连接的时候会返回一个流
pending_stream
=
c;
obtain.callback ();
return
true;
});
........
yield
;
service.disconnect (incoming_handler);
service.stop ();
service
=
null;
timeout_source.destroy ();
timeout_source
=
null;
if
(pending_error
=
=
null) {
pending_connection
=
yield
new DBusConnection (pending_stream, null, DBusConnectionFlags.NONE, null,
cancellable);
/
/
通过这个生成一个DBusConnection
pending_proxy
=
yield
pending_connection.get_proxy (null, ObjectPath.HELPER, DO_NOT_LOAD_PROPERTIES,
cancellable);
/
/
这里,获取对应进程的ObjectPath.HELPER服务,helper进程在启动后注册这个服务。
if
(pending_connection.is_closed ())
throw new Error.NOT_SUPPORTED (
"Helper terminated prematurely"
);
}
} catch (GLib.Error e) {
if
(timeout_source !
=
null)
timeout_source.destroy ();
if
(service !
=
null)
service.stop ();
if
(e
is
Error || e
is
IOError.CANCELLED)
pending_error
=
e;
else
pending_error
=
new Error.PERMISSION_DENIED (
"%s"
, e.message);
}
if
(pending_error
=
=
null) {
superprocess
=
pending_superprocess;
process_pid
=
pending_pid;
connection
=
pending_connection;
connection.on_closed.connect (on_connection_closed);
assign_helper (new HelperSession (pending_proxy));
/
/
pending_proxy 就是可以远程调用helper进程的对象
obtain_request.resolve (helper);
return
helper;
/
/
返回的这helper 是HelperSession类型,见assign_helper
}
else
{
if
(pending_pid !
=
0
)
Posix.kill ((Posix.pid_t) pending_pid, Posix.Signal.KILL);
obtain_request.reject (pending_error);
obtain_request
=
null;
throw_api_error (pending_error);
}
}
```
所以obtain_for_cpu_type返回的是 HelperSession这个对象,然后调用inject_library_file
```
public async void inject_library_file (uint pid, PathTemplate path_template, string entrypoint, string data,
string temp_path, uint
id
, Cancellable? cancellable) throws Error, IOError {
try
{
yield
proxy.inject_library_file (pid, path_template, entrypoint, data, temp_path,
id
, cancellable);
} catch (GLib.Error e) {
throw_dbus_error (e);
}
}
```
调用的实际就是dbus的对象,调用的就是pending_proxy