rwx size is too small to hold 56 bytes backup instructions

When trying to hook some system functions (e.g. fork, execve), I see an error in logcat that reads rwx size is too small to hold 56 bytes backup instructions, and hooking fails. Looking at https://github.com/rrrfff/And64InlineHook/blob/master/And64InlineHook.cpp the hook trampoline size seems to be limited to 50 bytes, hence the error.

Call site looks like so:

#include <jni.h>
#include <unistd.h>
#include <sys/types.h>
#include "AndHook.h"

#define AKLog(...) __android_log_print(ANDROID_LOG_INFO, "AndHook", __VA_ARGS__)

static decltype(fork) *sys_fork;

pid_t __unused hook_fork() {
    AKLog("fork called");
    pid_t child_pid = sys_fork();
    if (child_pid != 0) {
        AKLog("fork child pid: %d, parent pid: %d", static_cast<int>(child_pid), static_cast<int>(getpid()));
    }
    return child_pid;
}

extern "C" JNIEXPORT jint JNICALL __unused JNI_OnLoad(JavaVM *vm, void __unused *reserved) {
    JNIEnv *env;
    if (vm->GetEnv(reinterpret_cast<void **>(&env), JNI_VERSION_1_6) != JNI_OK) {
        return JNI_EVERSION;
    }

    AKHookFunction(fork, hook_fork, &sys_fork);
    return JNI_VERSION_1_6;
}

My system is a OnePlus 3 running OxygenOS - Android 8.0.0, arm64-v8a.

I seem to have gotten it working by copying the A64HookFunction as a wrapper around theAKHookFunctionV exported from the .so files here, and increasing the trampoline size to 70 from 50.

Attached is libc.so pulled from my device: libc.so.zip

[Rprop]

Yes, it may require more room if there are too many pc-relative instructions (e.g, mixed adr/adrp) that need to be relocated and aligned. I will fix it as soon as possible, thanks.

[Rprop]

Well I’m pleased to hear that😄. Close it.