OpenGL Leak学习记录

gl_hooks_t *get_gl_hooks() {
    // 获取 TLS，即从寄存器中获取指针数组
    volatile void *tls_base = __get_tls();

    // 强制类型转换，将Void*类型的指针转化为函数指针结构体
    gl_hooks_t *volatile *tls_hooks =
            reinterpret_cast<gl_hooks_t *volatile *>(tls_base);
    
    // 声明一个用来指向api函数的指针
    gl_hooks_t *hooks = NULL;

    // android >= 10 TLS 位置有变化
    char sdk[128] = "0";
    __system_property_get("ro.build.version.sdk", sdk);
    int sdk_version = atoi(sdk);

    // 为api函数指针赋值，指向api函数结构体的起始位置
    if (sdk_version >= 29) {
        // android 10
        hooks = tls_hooks[4];
    } else {
        hooks = tls_hooks[3];
    }

    return hooks;
}

extern "C" JNIEXPORT jint JNICALL
Java_com_tencent_matrix_openglleak_detector_FuncSeeker_getTargetFuncIndex(JNIEnv *env, jclass, jstring target_func_name) {
    // 首先，拿到OpenGL ES api对应的函数指针结构体
    gl_hooks_t *hooks = get_gl_hooks();
    if (NULL == hooks) {
        return 0;
    }

    // 获取到函数名对应的原函数的指针
    System_GlNormal_TYPE target_func = get_target_func_ptr(
            env->GetStringUTFChars(target_func_name, JNI_FALSE));
    if (NULL == target_func) {
        return 0;
    }

    for (i_glGenNormal = 0; i_glGenNormal < 500; i_glGenNormal++) {
        // has_hook_glGenNormal是一个标志位，_my_glNormal中会将这个标志位置为true；
        if (has_hook_glGenNormal) {
            // 由于_my_glNormal执行完后index会+1，所以这里判断标志位为true以后，要将index减去1得到的才是函数真正的位置
            i_glGenNormal = i_glGenNormal - 1;
            // 将原函数放回原来的位置
            void **method = (void **) (&hooks->gl.foo1 + i_glGenNormal);
            *method = (void *) _system_glGenNormal;
            break;
        }

        // 第一次遍历的时候，_system_glGenNormal为NULL，所以不用担心索引为-1
        if (_system_glGenNormal != NULL) {
            void **method = (void **) (&hooks->gl.foo1 + (i_glGenNormal - 1));
            *method = (void *) _system_glGenNormal;
        }

        // 这里比较关键：将原函数的位置替换成_my_glNormal，然后后续执行一下原函数，如果能顺利执行，也就意味着_my_glNormal被执行了一遍，那么has_hook_glGenNormal标志位就会被设置为true，就可以跳出循环并返回函数的位置了
        void **replaceMethod = (void **) (&hooks->gl.foo1 + i_glGenNormal);
        _system_glGenNormal = (System_GlNormal_TYPE) *replaceMethod;

        *replaceMethod = (void *) _my_glNormal;

        // 执行一下原函数，验证是否已经拿到偏移值
        HOOK_O_FUNC(target_func, 0, 0);
    }

    // 遍历到头都没有找到对应的函数，认为函数不存在
    if (i_glGenNormal == 500) {
        i_glGenNormal = 0;
    }

    // release
    _system_glGenNormal = NULL;
    has_hook_glGenNormal = false;
    int result = i_glGenNormal;
    i_glGenNormal = 0;

    return result;
}

extern "C" JNIEXPORT jboolean JNICALL
Java_com_tencent_matrix_openglleak_hook_OpenGLHook_hookGlGenRenderbuffers
        (JNIEnv *, jclass, jint index) {
    gl_hooks_t *hooks = get_gl_hooks();
    if (NULL == hooks) {
        return false;
    }

    void **origFunPtr = NULL;

    origFunPtr = (void **) (&hooks->gl.foo1 + index);
    system_glGenRenderbuffers = (System_GlNormal_TYPE) *origFunPtr;
    *origFunPtr = (void *) my_glGenRenderbuffers;

    return true;
}

GL_APICALL void GL_APIENTRY my_glGenTextures(GLsizei n, GLuint *textures) {
    if (NULL != system_glGenTextures) {
        // 首先执行原函数
        system_glGenTextures(n, textures);

        // 判断是否在RenderThread中，如果是的话则不做后续的逻辑了（等于没Hook）
        if (is_render_thread()) {
            return;
        }

        // 后续操作：将函数生成的纹理，native堆栈，tid，context等等的很多统计数据，然后将这些统计数据回调到Java层对应的Callback中
        GLuint *copy_textures = new GLuint[n];
        memcpy(copy_textures, textures, n * sizeof(GLuint));

        wechat_backtrace::Backtrace *backtracePrt = get_native_backtrace();

        int throwable = get_java_throwable();

        pid_t tid = pthread_gettid_np(pthread_self());

        EGLContext egl_context = eglGetCurrentContext();

        EGLSurface egl_draw_surface = eglGetCurrentSurface(EGL_DRAW);
        EGLSurface egl_read_surface = eglGetCurrentSurface(EGL_READ);

        char *activity_info = static_cast<char *>(malloc(BUF_SIZE));
        if (curr_activity_info != nullptr) {
            strcpy(activity_info, curr_activity_info);
        } else {
            strcpy(activity_info, "null");
        }

        messages_containers->
                enqueue_message((uintptr_t) egl_context,
                                [n, copy_textures, throwable, tid, backtracePrt, egl_context, egl_read_surface, egl_draw_surface, activity_info]() {

                                    gen_jni_callback(n, copy_textures, throwable, tid,
                                                     backtracePrt, egl_context, egl_draw_surface,
                                                     egl_read_surface,
                                                     activity_info, method_onGlGenTextures);

                                });
    }
}