查了n多资料 官网 github 网页发的 结果发现是自己apk忘了更新了
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
|
package com.iyue.exampleunidbg;
import
com.github.unidbg.
*
;
import
com.github.unidbg.Module;
import
com.github.unidbg.arm.backend.DynarmicFactory;
import
com.github.unidbg.arm.backend.Unicorn2Factory;
import
com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import
com.github.unidbg.linux.android.AndroidResolver;
import
com.github.unidbg.linux.android.dvm.
*
;
import
com.github.unidbg.linux.android.dvm.jni.ProxyDvmObject;
import
com.github.unidbg.memory.Memory;
import
com.github.unidbg.memory.MemoryBlock;
import
com.github.unidbg.pointer.UnidbgPointer;
import
java.io.
File
;
import
java.util.ArrayList;
import
java.util.Collection;
import
java.util.
List
;
public
class
MainActivity extends AbstractJni {
public String apkName
=
"";
public AndroidEmulator emulator
=
null;
public Memory memory
=
null;
public VM vm
=
null;
public Module module
=
null;
/
*
*
*
初始化虚拟机
*
/
public MainActivity() {
/
/
1.
创建Android模拟器实例
emulator
=
AndroidEmulatorBuilder
.for32Bit()
/
/
new Unicorn2Factory(true) new DynarmicFactory(true)
.addBackendFactory(new DynarmicFactory(true))
/
/
.setProcessName(
"com.iyue.example"
)
/
/
vm 加载apk后 就不用指定 进程名称
.build();
memory
=
emulator.getMemory();
memory.setLibraryResolver(new AndroidResolver(
23
));
/
/
VM vm
=
emulator.createDalvikVM();
vm
=
emulator.createDalvikVM(new
File
(
"unidbg-android/src/test/iyuenative/android/apk/app-release.apk"
));
/
/
vm.setVerbose(true);
vm.setJni(this);
/
/
Module module
=
emulator.loadLibrary(new
File
(
"unidbg-android/src/test/iyuenative/android/libs/armeabi-v7a/libexampleunidbg.so"
), true);
/
/
vm.callJNI_OnLoad(emulator, module);
DalvikModule docModule
=
vm.loadLibrary(
"exampleunidbg"
, true);
module
=
docModule.getModule();
docModule.callJNI_OnLoad(emulator);
}
/
*
*
*
调用静态方法
*
/
public void callJavaStaticRegisterFunc() {
try
{
/
/
通过代理创建对象可以不用指定类名
/
/
创建一个类的实例对象
DvmObject<?> obj
=
vm.resolveClass(
"com/iyue/exampleunidbg/MainActivity"
).newObject(null);
/
/
调用 静态注册的 普通方法
/
/
Java_com_iyue_exampleunidbg_MainActivity_stringFromJNI
DvmObject
str
=
obj.callJniMethodObject(emulator,
"stringFromJNI()Ljava/lang/String;"
);
System.out.println(
"[main]D/iyue->: "
+
"stringFromJNI()->result :"
+
str
.toString());
/
/
调用 静态注册的 静态方法
/
/
int
__fastcall Java_com_iyue_exampleunidbg_MainActivity_staticGetNumber(JNIEnv
*
env, jclass _jclass, jint num)
int
result
=
obj.callJniMethodInt(emulator,
"staticGetNumber(I)I"
,
10
);
System.out.println(
"[main]D/iyue->: "
+
"staticGetNumber(I)I->result :"
+
result);
} catch (Exception e) {
e.printStackTrace();
}
}
/
*
*
*
通过偏移地址调用方法 void __fastcall printFunc1(char
*
a1)
*
/
public void callprintFunc1() {
String
str
=
"nniha你好"
;
MemoryBlock malloc
=
memory.malloc(
str
.length()
+
1
, false);
UnidbgPointer pointer
=
malloc.getPointer();
pointer.write(
str
.getBytes());
module.callFunction(emulator,
0x34AA8
+
1
,
str
);
/
/
System.out.println(
"[main]D/iyue->: "
+
"callOtherFunc:"
+
number.intValue());
malloc.free();
}
/
*
*
*
/
/
int
__fastcall printFunc2(char
*
a1)
*
/
public void callprintFunc2(){
String
str
=
"nniha你好aaaaa"
;
MemoryBlock malloc
=
memory.malloc(
str
.length()
+
1
, false);
UnidbgPointer pointer
=
malloc.getPointer();
pointer.write(
str
.getBytes());
module.callFunction(emulator,
"_Z10printFunc2Pc"
,
str
);
/
/
pointer 都可以
}
/
*
*
*
jobject __fastcall isOK(JNIEnv
*
a1)
*
{
*
jclass v2;
/
/
r5
*
struct _jfieldID
*
v3;
/
/
r2
*
*
_android_log_print(
3
,
"iyue->"
,
"call isOK return FALSE!"
);
*
v2
=
(
*
a1)
-
>FindClass(a1,
"java/lang/Boolean"
);
*
v3
=
(
*
a1)
-
>GetStaticFieldID(a1, v2,
"FALSE"
,
"Ljava/lang/Boolean;"
);
*
return
(
*
a1)
-
>GetStaticObjectField(a1, v2, v3);
*
}
*
/
public boolean callisOK(){
List
<
Object
> args
=
new ArrayList<
Object
>();
args.add(vm.getJNIEnv());
DvmObject<?> obj
=
vm.resolveClass(
"com/iyue/exampleunidbg/MainActivity"
).newObject(null);
args.add(vm.addLocalObject(obj));
Number number
=
module.callFunction(emulator,
"_Z4isOKP7_JNIEnvP8_jobject"
, args.toArray());
Boolean value
=
(Boolean) vm.getObject(number.intValue()).getValue();
System.out.println(
"[main]D/iyue->: "
+
"callisOK: "
+
value);
return
value ;
}
/
*
*
*
获取所有已经加载过的模块
*
/
public void printModules() {
Collection<Module> loadedModules
=
memory.getLoadedModules();
for
(Module module2 : loadedModules) {
System.out.println(
"[main]D/iyue->: "
+
"module2.name:"
+
module2.name);
}
}
/
*
*
*
监听加载到内存的模块
*
/
public void lisenLoadSo() {
memory.addModuleListener(new ModuleListener() {
@Override
public void onLoaded(Emulator<?> emulator, Module module) {
System.out.println(
"[main]D/iyue->: "
+
emulator.getProcessName()
+
":"
+
module.name
+
"已被加载"
);
}
});
}
@Override
public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) {
if
(signature.equals(
"java/lang/Boolean->FALSE:Ljava/lang/Boolean;"
)){
DvmObject <?> obj
=
vm.resolveClass(
"java/lang/Boolean"
).newObject(false);
return
obj;
}
return
super
.getStaticObjectField(vm, dvmClass, signature);
}
}
|
main()
|
1
2
3
4
5
6
7
8
9
10
11
12
|
package com.iyue.exampleunidbg;
class
Example{
public static void main(String[] args) {
MainActivity example
=
new MainActivity();
example.printModules();
example.callJavaStaticRegisterFunc();
example.callprintFunc1();
example.callprintFunc2();
example.callisOK();
}
}
|
更多【初试Unidbg demo】相关视频教程：www.yxfzedu.com