安卓 dex 通用脱壳技术研究

【安卓 dex 通用脱壳技术研究】亦余心之所善兮，虽九死其犹未悔。这篇文章主要讲述安卓 dex 通用脱壳技术研究相关的知识，希望能为你提供帮助。

/* 此为DexHunter实现的主要功能，进行内存dump，将class_def_items中dump出classdef和extra部分 */ void* DumpClass(void *parament) { while (timer_flag) { sleep(5); } DvmDex* pDvmDex=((struct arg*)parament)-> pDvmDex; //pDvmDex代表一个dex文件 Object *loader=((struct arg*)parament)-> loader; DexFile* pDexFile=pDvmDex-> pDexFile; MemMapping * mem=& pDvmDex-> memMap; u4 time=dvmGetRelativeTimeMsec(); ALOGI("GOT IT begin: %d ms",time); char *path = new char[100]; strcpy(path,dumppath); strcat(path,"classdef"); //构造classdef文件路径 FILE *fp = fopen(path, "wb+"); strcpy(path,dumppath); strcat(path,"extra"); //构造extra文件路径 FILE *fp1 = fopen(path,"wb+"); uint32_t mask=0x3ffff; char padding=0; const char* header="Landroid"; unsigned int num_class_defs=pDexFile-> pHeader-> classDefsSize; //dex文件的Header域，class_defs_size，标示了class_def域有几个class_def_item uint32_t total_pointer = mem-> length-uint32_t(pDexFile-> baseAddr-(const u1*)mem-> addr); uint32_t rec=total_pointer; while (total_pointer& 3) { total_pointer++; } int inc=total_pointer-rec; uint32_t start = pDexFile-> pHeader-> classDefsOff+sizeof(DexClassDef)*num_class_defs; uint32_t end = (uint32_t)((const u1*)mem-> addr+mem-> length-pDexFile-> baseAddr); for (size_t i=0; i< num_class_defs; i++) //遍历所有class_def_item { bool need_extra=false; ClassObject * clazz=NULL; const u1* data=https://www.songbingjia.com/android/NULL; DexClassData* pData = NULL; bool pass=false; const DexClassDef *pClassDef = dexGetClassDef(pDvmDex-> pDexFile, i); const char *descriptor = dexGetClassDescriptor(pDvmDex-> pDexFile,pClassDef); if(!strncmp(header,descriptor,8)||!pClassDef-> classDataOff) { pass=true; goto classdef; } clazz = dvmDefineClass(pDvmDex, descriptor, loader); //First Step:class加载 if (!clazz) { continue; } ALOGI("GOT IT class: %s",descriptor); if (!dvmIsClassInitialized(clazz)) { //Second Step:class初始化，遍历所有类进行初始化 if(dvmInitClass(clazz)){ //与dvmIsClassInitialized()函数共同完成初始化 ALOGI("GOT IT init: %s",descriptor); } } if(pClassDef-> classDataOff< start || pClassDef-> classDataOff> end) { need_extra=true; //是不是需要extra这一块，当存在class_data_off不在dex范围内时，就需要 } data=https://www.songbingjia.com/android/dexGetClassData(pDexFile, pClassDef); pData = ReadClassData(& data); if (!pData) { continue; } if (pData-> directMethods) { for (uint32_t i=0; i< pData-> header.directMethodsSize; i++) { Method *method = & (clazz-> directMethods[i]); uint32_t ac = (method-> accessFlags) & mask; ALOGI("GOT IT direct method name %s.%s",descriptor,method-> name); if (!method-> insns||ac& ACC_NATIVE) { if (pData-> directMethods[i].codeOff) { need_extra = true; pData-> directMethods[i].accessFlags=ac; pData-> directMethods[i].codeOff=0; } continue; } u4 codeitem_off = u4((const u1*)method-> insns-16-pDexFile-> baseAddr); if (ac != pData-> directMethods[i].accessFlags) { ALOGI("GOT IT method ac"); need_extra=true; pData-> directMethods[i].accessFlags=ac; } if (codeitem_off!=pData-> directMethods[i].codeOff& & ((codeitem_off> =start& & codeitem_off< =end)||codeitem_off==0)) { ALOGI("GOT IT method code"); need_extra=true; pData-> directMethods[i].codeOff=codeitem_off; } if ((codeitem_off< start || codeitem_off> end) & & codeitem_off!=0) { //如果code_item_off不在dex文件范围内，则写入extra; fp1为extra的句柄 //这里使用的是slider.pptx，中的第二种方案，见p42 need_extra=true; pData-> directMethods[i].codeOff = total_pointer; DexCode *code = (DexCode*)((const u1*)method-> insns-16); uint8_t *item=(uint8_t *) code; int code_item_len = 0; if (code-> triesSize) { const u1 * handler_data = dexGetCatchHandlerData(code); const u1** phandler=(const u1**)& handler_data; uint8_t * tail=codeitem_end(phandler); code_item_len = (int)(tail-item); }else{ code_item_len = 16+code-> insnsSize*2; } ALOGI("GOT IT method code changed"); fwrite(item,1,code_item_len,fp1); fflush(fp1); total_pointer+=code_item_len; while (total_pointer& 3) { fwrite(& padding,1,1,fp1); fflush(fp1); total_pointer++; } } } } if (pData-> virtualMethods) { for (uint32_t i=0; i< pData-> header.virtualMethodsSize; i++) { Method *method = & (clazz-> virtualMethods[i]); uint32_t ac = (method-> accessFlags) & mask; ALOGI("GOT IT virtual method name %s.%s",descriptor,method-> name); if (!method-> insns||ac& ACC_NATIVE) { if (pData-> virtualMethods[i].codeOff) { need_extra = true; pData-> virtualMethods[i].accessFlags=ac; pData-> virtualMethods[i].codeOff=0; } continue; } u4 codeitem_off = u4((const u1 *)method-> insns - 16 - pDexFile-> baseAddr); if (ac != pData-> virtualMethods[i].accessFlags) { ALOGI("GOT IT method ac"); need_extra=true; pData-> virtualMethods[i].accessFlags=ac; } if (codeitem_off!=pData-> virtualMethods[i].codeOff& & ((codeitem_off> =start& & codeitem_off< =end)||codeitem_off==0)) { ALOGI("GOT IT method code"); need_extra=true; pData-> virtualMethods[i].codeOff=codeitem_off; } if ((codeitem_off< start || codeitem_off> end)& & codeitem_off!=0) { need_extra=true; pData-> virtualMethods[i].codeOff = total_pointer; DexCode *code = (DexCode*)((const u1*)method-> insns-16); uint8_t *item=(uint8_t *) code; int code_item_len = 0; if (code-> triesSize) { const u1 *handler_data = dexGetCatchHandlerData(code); const u1** phandler=(const u1**)& handler_data; uint8_t * tail=codeitem_end(phandler); code_item_len = (int)(tail-item); }else{ code_item_len = 16+code-> insnsSize*2; } ALOGI("GOT IT method code changed"); fwrite(item,1,code_item_len,fp1); fflush(fp1); total_pointer+=code_item_len; while (total_pointer& 3) { fwrite(& padding,1,1,fp1); fflush(fp1); total_pointer++; } } } }classdef: DexClassDef temp=*pClassDef; uint8_t *p = (uint8_t *)& temp; if (need_extra) { ALOGI("GOT IT classdata before"); int class_data_len = 0; uint8_t *out = EncodeClassData(pData,class_data_len); if (!out) { continue; } temp.classDataOff = total_pointer; fwrite(out,1,class_data_len,fp1); fflush(fp1); total_pointer+=class_data_len; while (total_pointer& 3) { fwrite(& padding,1,1,fp1); fflush(fp1); total_pointer++; } free(out); ALOGI("GOT IT classdata written"); }else{ if (pData) { free(pData); } } if (pass) { temp.classDataOff=0; temp.annotationsOff=0; } ALOGI("GOT IT classdef"); fwrite(p, sizeof(DexClassDef), 1, fp); fflush(fp); } fclose(fp1); fclose(fp); //目前已经准备好了part1,classdef,data和extra 4部分文件 strcpy(path,dumppath); strcat(path,"whole.dex"); //组合4部分，并写入whole.dex fp = fopen(path,"wb+"); rewind(fp); int fd=-1; int r=-1; int len=0; char *addr=NULL; struct stat st; strcpy(path,dumppath); strcat(path,"part1"); fd=open(path,O_RDONLY,0666); if (fd==-1) { return NULL; } r=fstat(fd,& st); if(r==-1){ close(fd); return NULL; } len=st.st_size; addr=(char*)mmap(NULL,len,PROT_READ,MAP_PRIVATE,fd,0); fwrite(addr,1,len,fp); fflush(fp); munmap(addr,len); close(fd); strcpy(path,dumppath); strcat(path,"classdef"); fd=open(path,O_RDONLY,0666); if (fd==-1) { return NULL; } r=fstat(fd,& st); if(r==-1){ close(fd); return NULL; } len=st.st_size; addr=(char*)mmap(NULL,len,PROT_READ,MAP_PRIVATE,fd,0); fwrite(addr,1,len,fp); fflush(fp); munmap(addr,len); close(fd); strcpy(path,dumppath); strcat(path,"data"); fd=open(path,O_RDONLY,0666); if (fd==-1) { return NULL; } r=fstat(fd,& st); if(r==-1){ close(fd); return NULL; } len=st.st_size; addr=(char*)mmap(NULL,len,PROT_READ,MAP_PRIVATE,fd,0); fwrite(addr,1,len,fp); fflush(fp); munmap(addr,len); close(fd); while (inc> 0) { fwrite(& padding,1,1,fp); fflush(fp); inc--; } strcpy(path,dumppath); strcat(path,"extra"); fd=open(path,O_RDONLY,0666); if (fd==-1) { return NULL; } r=fstat(fd,& st); if(r==-1){ close(fd); return NULL; } len=st.st_size; addr=(char*)mmap(NULL,len,PROT_READ,MAP_PRIVATE,fd,0); fwrite(addr,1,len,fp); fflush(fp); munmap(addr,len); close(fd); fclose(fp); delete path; time=dvmGetRelativeTimeMsec(); ALOGI("GOT IT end: %d ms",time); return NULL; } //------------------------added end----------------------//

安卓 dex 通用脱壳技术研究

推荐阅读

滑翔翼多少钱一架_基德的滑翔翼合理吗

易出汗的男人吃什么好哪些食物适合易出汗的男人吃

绝绝子指什么意思绝绝子的意思

广东省人民医院服务态度省人民医院看病好不好

折弯机加压太慢怎么解决折弯机一直加压

2023年福州市体育中考报名详情公告 2023年福州市体育中考报名详情

移动怎么退订自动续费怎么取消流量套餐

经济适用房是什么意思

2023年中山教师资格证笔试报名时间 2023年中山教师资格证笔试报名时间是多少

将实体SIM卡抛之弃之,“一卡走天下”时代真的要来了吗未来手机会有什么手机卡套餐

离婚后男方不给女儿抚养费,如何维权

佳能G2800打印机错误代码1471的解决方法详解

破天荒的来历破天荒的由来

李白有位移吗李白如何长距离位移，李白的位移怎么那么远

mysql并发是什么意思 mysql数据库并发读写

江苏扬州快递到广东茂名要几天

angular6|angular6 使用mockjs模拟后台数据

发霉的茶叶可以食用吗

大海里有什么

一百以内罗技和双飞燕雷柏和罗技哪个好