andkittyinjector's Introduction

AndKittyInjector

Shared library injector based on ptrace with help of KittyMemoryEx.

Requires C++11 or above.
Inject from /data for Android

Support:

Tested on Android 5.0 ~ 13
ABI arm, arm64, x86, x86_64
Houdini support for emulators 32 & 64 bit
Inject emulated arm64 & arm32
Bypass android linker namespace restrictions
memfd dlopen support
App launch monitor
Hide lib segments from /maps
Hide lib from linker solist ( dladdr & dl_iterate_phdr )

How to use:

Make sure to chmod +x or 755

Usage: ./path/to/AndKittyInjector [-h] [-pkg] [-pid] [-lib] [ options ]

Required arguments:
   -pkg                Target app package.
   
   -lib                Library path to inject.

Optional arguments:
   -h, --help          show available arguments.
   
   -pid                Target app pid.
   
   -dl_memfd           Use memfd_create & dlopen_ext to inject library, useful to bypass path restrictions.

   -hide               Try to hide lib from /maps and linker solist.
   
   -watch              Monitor process launch then inject, useful if you want to inject as fast as possible.
   
   -delay              Set a delay in microseconds before injecting.

Notes:

When using -hide do not use library constructor, instead define and export a function called hide_init

extern "C" __attribute__((used)) void hide_init()
{
    // will be called after hide complete.
}

When using -watch to inject as soon as the target app launches, you may need to use -delay as well, especially when injecting emulated lib.
When using -dl_memfd and it fails then legacy dlopen will be called.