最近做dex加壳的项目,但是加载速度太慢,dalvik虚拟机下自己实现了dex文件的解析,解决了这个问题,但是art虚拟机下参考下面链接中的方法:
http://bbs.pediy.com/showthread.php?p=1402842#post1402842
试验版本Android4.4,虚拟机选的是art。Android5.1按上面帖子的方法是没有问题的。
用hook的方法,在DexClassLoader加载dex的时候绕过dex2oat这一步,我现在已经成功hook了execl函数,绕过了dex2oat,但是会崩溃并报错:
03-29 17:32:24.958: E/art(10253): Failed to open generated oat file: /data/data/com.test.android/.ocache/payload.dex
03-29 17:32:24.958: W/art(10253): Failed to open dex file: /data/data/com.test.android/.cache/payload.dex
03-29 17:32:24.958: E/System(10253): Unable to load dex file: /data/data/com.test.android/.cache/payload.dex
03-29 17:32:24.968: E/System(10253): java.io.IOException: Unable to open dex file: /data/data/com.test.android/.cache/payload.dex
03-29 17:32:24.968: E/System(10253): at dalvik.system.DexFile.openDexFileNative(Native Method)
03-29 17:32:24.968: E/System(10253): at dalvik.system.DexFile.openDexFile(DexFile.java:296)
03-29 17:32:24.968: E/System(10253): at dalvik.system.DexFile.<init>(DexFile.java:111)
03-29 17:32:24.968: E/System(10253): at dalvik.system.DexFile.loadDex(DexFile.java:151)
03-29 17:32:24.968: E/System(10253): at dalvik.system.DexPathList.loadDexFile(DexPathList.java:266)
03-29 17:32:24.968: E/System(10253): at dalvik.system.DexPathList.makeDexElements(DexPathList.java:221)
03-29 17:32:24.968: E/System(10253): at dalvik.system.DexPathList.<init>(DexPathList.java:112)
03-29 17:32:24.968: E/System(10253): at dalvik.system.BaseDexClassLoader.<init>(BaseDexClassLoader.java:48)
03-29 17:32:24.968: E/System(10253): at dalvik.system.DexClassLoader.<init>(DexClassLoader.java:57)
03-29 17:32:24.968: E/System(10253): at com.test.android.ProxyApplication.attachBaseContext(ProxyApplication.java:107)
03-29 17:32:24.968: E/System(10253): at android.app.Application.attach(Application.java:181)
03-29 17:32:24.968: E/System(10253): at android.app.Instrumentation.newApplication(Instrumentation.java:991)
03-29 17:32:24.968: E/System(10253): at android.app.Instrumentation.newApplication(Instrumentation.java:975)
03-29 17:32:24.968: E/System(10253): at android.app.LoadedApk.makeApplication(LoadedApk.java:502)
03-29 17:32:24.968: E/System(10253): at android.app.ActivityThread.handleBindApplication(ActivityThread.java:4301)
03-29 17:32:24.968: E/System(10253): at android.app.ActivityThread.access$1500(ActivityThread.java:135)
03-29 17:32:24.968: E/System(10253): at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1256)
03-29 17:32:24.968: E/System(10253): at android.os.Handler.dispatchMessage(Handler.java:102)
03-29 17:32:24.968: E/System(10253): at android.os.Looper.loop(Looper.java:136)
03-29 17:32:24.968: E/System(10253): at android.app.ActivityThread.main(ActivityThread.java:5001)
03-29 17:32:24.968: E/System(10253): at java.lang.reflect.Method.invoke(Native Method)
03-29 17:32:24.968: E/System(10253): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:785)
03-29 17:32:24.968: E/System(10253): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:601)
参看了一下android5.0的系统源码,在下面函数中:
1028 const OatFile* ClassLinker::CreateOatFileForDexLocation(const char* dex_location,
1029 int fd, const char* oat_location,
1030 std::vector<std::string>* error_msgs) {
1031 // Generate the output oat file for the dex file
1032 VLOG(class_linker) << "Generating oat file " << oat_location << " for " << dex_location;
1033 std::string error_msg;
1034 if (!GenerateOatFile(dex_location, fd, oat_location, &error_msg)) {
1035 CHECK(!error_msg.empty());
1036 error_msgs->push_back(error_msg);
1037 return nullptr;
1038 }
1039 std::unique_ptr<OatFile> oat_file(OatFile::Open(oat_location, oat_location, nullptr,
1040 !Runtime::Current()->IsCompiler(),
1041 &error_msg));
1042 if (oat_file.get() == nullptr) {
1043 std::string compound_msg = StringPrintf("\nFailed to open generated oat file '%s': %s",
1044 oat_location, error_msg.c_str());
1045 error_msgs->push_back(compound_msg);
1046 return nullptr;
1047 }
1048
1049 return oat_file.release();
1050 }
也就是说,在dex2oat以后,系统会去打开这个oat文件,但是hook以后并没有生成这个oat文件,打开也就失败了,求助版上大神们这个应该怎么办?多谢!!
[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法