1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7
8. 8
9. 9
10. 10
11. 11
12. 12
13. 13
14. 14
15. 15
16. 16
17. 17
18. 18
19. 19
20. 20
21. 21
22. 22
23. 23
24. 24
25. 25
26. 26
27. 27
28. 28
29. 29
30. 30
31. 31
32. 32
33. 33
34. 34
35. 35
36. 36
37. 37
38. 38
39. 39
40. 40
41. 41
42. 42
43. 43
44. 44
45. 45
46. 46
47. 47
48. 48
49. 49
50. 50
51. 51
52. 52
53. 53
54. 54
55. 55
56. 56
57. 57
58. 58
59. 59
60. 60
61. 61
62. 62
63. 63
64. 64
65. 65
66. 66
67. 67
68. 68
69. 69
70. 70
71. 71
72. 72
73. 73
74. 74
75. 75
76. 76
77. 77
78. 78
79. 79
80. 80
81. 81
82. 82
83. 83
84. 84
85. 85
86. 86
87. 87
88. 88
89. 89
90. 90
91. 91
92. 92
93. 93
94. 94
95. 95
96. 96
97. 97
98. 98

thread_local bool nuke_nanosleep;
#include <syscall.h>
#include <sys/mman.h>
#include <dlfcn.h>
#ifndef PAGE_SIZE
#define PAGE_SIZE 4096UL
#define PAGE_MASK (~(PAGE_SIZE-1))
#endif
#define PAGE_ALIGN(addr) ((((size_t)addr)+PAGE_SIZE-1)&PAGE_MASK)
static int fun_rewrite( void *dst, const void *src, const size_t bytes, void *srcBackup )
{
	void *start_page;
	size_t size_of_page;

	if( !( dst && src && bytes ) )
	{
		return -1;
	}

	// At first, backup original src bytes
	if( srcBackup )
	{
		memcpy( srcBackup, src, bytes );
	}

	// Calculate page for mprotect
	start_page = (void*)(PAGE_ALIGN( dst ) - PAGE_SIZE);

	if( (size_t)((char*)dst + bytes) > PAGE_ALIGN( dst ) )
	{
		// bytes are located on two pages
		size_of_page = PAGE_SIZE*2;
	}
	else
	{
		// bytes are located entirely on one page.
		size_of_page = PAGE_SIZE;
	}

	// Call mprotect, so dst memory will be writable
	if( mprotect( start_page, size_of_page, PROT_READ | PROT_WRITE | PROT_EXEC ) ) // This will succeeded only if dst was allocated by mmap().
	{
		return -1;
	}

	// rewrite function
	memcpy( dst, src, bytes );

	// just in case
	if( mprotect( start_page, size_of_page, PROT_READ | PROT_EXEC ) )
	{
		return -1;
	}

	// clear instruction caches
	__clear_cache( (char*)start_page, (char*)start_page + size_of_page );

	return 0;
}
static int my_nanosleep(const struct timespec *req, struct timespec *rem)
{
	if(nuke_nanosleep)
		return 0;
	return syscall(__NR_nanosleep, req, rem);
}

static void patch_nanosleep()
{
	void *libc = dlopen("libc.so", RTLD_NOW);
	void *pnanosleep = dlsym(libc, "nanosleep");
	uint64_t my_nanosleep_addr = (uint64_t)&my_nanosleep;
#ifdef __aarch64__
	uint32_t shellcode[] =
		{
			0x58000042,
			0x14000003,
			(uint32_t)(my_nanosleep_addr & 0xFFFFFFFF),
			(uint32_t)(my_nanosleep_addr >> 32),
			0xD61F0040
			//0xd65f03c0
		};
	fun_rewrite(pnanosleep, shellcode, sizeof(shellcode), NULL);
#elif defined(__x86_64__)
	uint8_t shellcode[] =
		{
		0x48, 0x8b, 0x15, 0x02, 0x00, 0x00, 0x00, 0xff,
		0xe2,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
		};
	memcpy(&shellcode[0] + 9, &my_nanosleep_addr, 8);

	fun_rewrite(pnanosleep, shellcode, sizeof(shellcode), NULL);
#endif
}
...
nuke_nanosleep = 1;
xrWaitFrame(session, NULL, &frameState);
nuke_nanosleep = 0;