调用so中未导出函数的两种方法

 typedef void (*PrintTest)() ;
	LOGW("handc 00000");
    void *hand = 0;//dlopen("/data/data/com.test.secure/libhts.so", RTLD_LAZY );
   //我编译时so为64位，所以dlopen也需要是64位的。(同时ps -Z时进程不能是untrusted_app)
	void *hand64 = dlopen("/data/data/com.test.secure/libhts64.so", RTLD_LAZY );
    void *handc = 0;//dlopen("/data/data/com.test.secure/libc.so", RTLD_LAZY );
	LOGW("handc 11111111");
	LOGW("handc=%x", hand64);
    const char *error = dlerror();
    LOGW("hand=%x.hand64=%x,handc=%x,error=%s", hand, hand64, handc, error);
    if(hand64){
        void *sym = dlsym(hand64,  "_Z9printTestv");
        LOGW("hand sym=%x", sym);

        void *sym3 = dlsym(hand64,  "_ZN11GotHookToolC2Ev");
        LOGW("hand sym3=%x", sym3);

        //0x114A0 为需要执行函数的IDA地址
        unsigned long baseAddr = GetStartAddrByName("/data/data/com.test.secure/libhts64.so");
        PrintTest t1 = (PrintTest)((unsigned  char*)baseAddr + (0x114A0 ));//- 0xFD00
        LOGW("hand baseAddr=%x, t1=%x",  baseAddr, t1);

        if(sym){
            //这里sym必须是 导出函数才行
            LOGW("方法1 call sym... ");
            (*(PrintTest)sym)();
        }

        if(sym3){
            LOGW("方法3 call sym... ");
			unsigned long* addr = (unsigned long*)sym3;
            //0x11DDC 为 _ZN11GotHookToolC2Ev 在IDA中地址， 0x114A0为需要执行函数的IDA地址。addr减去差值就是 执行函数内存中的函数地址了。
			unsigned char* charAddr = (unsigned char*)addr - ( 0x11DDC - 0x114A0);//49E0 /93C
            LOGW("hand real sym3=%x", charAddr);

            (*(PrintTest)charAddr)();
        }

        LOGW("方法2 call ++ ");
        (*t1)();
    }

执行结果如下：调用so中未导出函数的两种方法

  //FileIOInfo *fileIOInfo = FileUtils::readFile(soPath);


  unsigned  long module_base = GetStartAddrByName(soPath);

  //字符串表.字符串表头在节区头部表的第Elf32_Ehdr.e_shstrndx项 . 通过节区头部表偏移和每个节区头的大小可以算出字符串表节头的地址
  Elf_Shdr *pStr_Shdr =  (Elf_Shdr*)  (module_base + pEhdr->e_shoff + pEhdr->e_shstrndx * pEhdr->e_shentsize);//索引 * 每个节区大小
/*  LOGE("size_string_table=%llu, off=%d,pEhdr->e_shentsize=%u,e_shstrndx=%u,%d", pStr_Shdr->sh_size, pEhdr->e_shstrndx * pEhdr->e_shentsize, pEhdr->e_shentsize,
          pEhdr->e_shstrndx, sizeof(Elf_Shdr));*/
  Elf_Off offff = pEhdr->e_shoff + pEhdr->e_shstrndx * pEhdr->e_shentsize;
  LOGE("offff=%d,pStr_Shdr=%x,pStr_Shdr type=%d", offff, pStr_Shdr, pStr_Shdr->sh_type);
  //SHT_STRTAB;
  char* pstr = (char*)(module_base+pStr_Shdr->sh_offset);
  int strl = strlen(pstr);
  LOGE("string    =%s",  pstr);
  pstr += strl + 1;
  strl = strlen(pstr);
  LOGE("string    =%s",  pstr);
  pstr += strl + 1;
  LOGE("string    =%s",  pstr);
  size_t size_string_table = pStr_Shdr->sh_size;