-
-
[原创]JEB脚本(二)(交叉引用 调用图)
-
发表于: 2020-10-27 15:21
-
https://github.com/acbocai/jeb_script
.
.
查询DEX中方法的交叉引用信息,
使用ActionXrefsData和ActionContext
.
.
查询一个函数被谁调用了,或查询它内部调用了谁,
关注:
INativeCodeAnalyzer
INativeCodeModel
ICallGraphManager
ICallGraph
.
查询一个Function的交叉引用情况
或查询一个Block入口指令的引用交叉引用情况
关注:
INativeCodeAnalyzer
INativeCodeModel
IReferenceManager
IReference
.
.
获取一条指令的地址,所属Function或Block.
# -*- coding: utf-8 -*-from com.pnfsoftware.jeb.client.api import IClientContext
from com.pnfsoftware.jeb.core import IRuntimeProject
from com.pnfsoftware.jeb.core.actions import ActionXrefsData, Actions, ActionContext
from com.pnfsoftware.jeb.core.units import IUnit
from com.pnfsoftware.jeb.core.units.code.android import IDexUnit
from com.pnfsoftware.jeb.core.units.code.android.dex import IDexMethod, IDexClass
def Test(ctx):
input_path = r"D:\tmp\2\project\about_dex_diff\code\jsq\jsq.dex"
class_sign = "Lcom/BestCalculatorCN/MyCalculator;"
method_sign = "Lcom/BestCalculatorCN/MyCalculator;->b(Lcom/BestCalculatorCN/MyCalculator;Ljava/lang/String;)V"
unit = ctx.open(input_path);
prj = ctx.getMainProject();
dexUnit = prj.findUnit(IDexUnit);
clz = dexUnit.getClass(class_sign);
method = dexUnit.getMethod(method_sign);
# 1 查询某method交叉引用列表
# 使用(unit,操作,地址,itemid)来创建一个context对象,提供给JEB引擎,用于后续执行
print "------------------------------------------------"
actionXrefsData = ActionXrefsData()
actionContext = ActionContext(dexUnit, Actions.QUERY_XREFS, method.getItemId(), None)
if unit.prepareExecution(actionContext,actionXrefsData):
for xref_addr in actionXrefsData.getAddresses():
print xref_addr
# 2 查询整个class的交叉引用列表
print "------------------------------------------------"
actionXrefsData = ActionXrefsData()
actionContext = ActionContext(dexUnit, Actions.QUERY_XREFS, clz.getItemId(), None)
if unit.prepareExecution(actionContext,actionXrefsData):
for idx,xref_addr in enumerate(actionXrefsData.getAddresses()):
print idx,xref_addr
# -*- coding: utf-8 -*-from com.pnfsoftware.jeb.client.api import IClientContext
from com.pnfsoftware.jeb.core import IRuntimeProject
from com.pnfsoftware.jeb.core.actions import ActionXrefsData, Actions, ActionContext
from com.pnfsoftware.jeb.core.units import IUnit
from com.pnfsoftware.jeb.core.units.code.android import IDexUnit
from com.pnfsoftware.jeb.core.units.code.android.dex import IDexMethod, IDexClass
def Test(ctx):
input_path = r"D:\tmp\2\project\about_dex_diff\code\jsq\jsq.dex"
class_sign = "Lcom/BestCalculatorCN/MyCalculator;"
method_sign = "Lcom/BestCalculatorCN/MyCalculator;->b(Lcom/BestCalculatorCN/MyCalculator;Ljava/lang/String;)V"
unit = ctx.open(input_path);
prj = ctx.getMainProject();
dexUnit = prj.findUnit(IDexUnit);
clz = dexUnit.getClass(class_sign);
method = dexUnit.getMethod(method_sign);
# 1 查询某method交叉引用列表
# 使用(unit,操作,地址,itemid)来创建一个context对象,提供给JEB引擎,用于后续执行
print "------------------------------------------------"
actionXrefsData = ActionXrefsData()
actionContext = ActionContext(dexUnit, Actions.QUERY_XREFS, method.getItemId(), None)
if unit.prepareExecution(actionContext,actionXrefsData):
for xref_addr in actionXrefsData.getAddresses():
print xref_addr
# 2 查询整个class的交叉引用列表
print "------------------------------------------------"
actionXrefsData = ActionXrefsData()
actionContext = ActionContext(dexUnit, Actions.QUERY_XREFS, clz.getItemId(), None)
if unit.prepareExecution(actionContext,actionXrefsData):
for idx,xref_addr in enumerate(actionXrefsData.getAddresses()):
print idx,xref_addr
# -*- coding: utf-8 -*-from com.pnfsoftware.jeb.client.api import IClientContext
from com.pnfsoftware.jeb.core import IRuntimeProject
from com.pnfsoftware.jeb.core.units import IUnit, INativeCodeUnit
from com.pnfsoftware.jeb.core.units.code.asm.analyzer import INativeCodeAnalyzer, INativeCodeModel, IReferenceManager, ICallGraphManager, ICallGraph, CallGraphVertex
from com.pnfsoftware.jeb.core.units.code.asm.items import INativeMethodItem
# callees/callers 调用与被调用信息def Test(ctx):
assert isinstance(ctx,IClientContext)
input_path = r"D:\tmp\2\project\about_dex_diff\code\xmly\libFace3D.so"
unit = ctx.open(input_path)
prj = ctx.getMainProject()
# 获取INativeCodeUnit并执行解析
nativeCodeUnit = prj.findUnit(INativeCodeUnit)
bool = nativeCodeUnit.process()
# 获取INativeCodeAnalyzer,获取INativeCodeModel
nativeCodeAnalyzer = nativeCodeUnit.getCodeAnalyzer()
nativeCodeAnalyzer.analyze()
nativeCodeModel = nativeCodeAnalyzer.getModel()
# 获取ICallGraph
callGraph = nativeCodeModel.getCallGraphManager().getGlobalCallGraph()
# 函数
funcName = "libunwind::LocalAddressSpace::findFunctionName"
nativeMethodItem = nativeCodeUnit.getMethod(funcName)
print ">>> funcAddr:",hex(nativeMethodItem.getRoutineAddress())
# callees 目标函数调用了谁
callGraphVertexList = callGraph.getCallees(nativeMethodItem,False)
for callGraphVertex in callGraphVertexList:
print ">>> Callee:",hex(callGraphVertex.getInternalAddress().getAddress())
# callers 目标函数被谁调用
callerList = callGraph.getCallers(nativeMethodItem,False)
for caller in callerList:
print ">>> Callers:",hex(caller)
# >>> funcAddr: 0x19a1cL# >>> Callee: 0xabfcL# >>> Callee: 0xac08L# >>> Callee: 0x9cc0L# >>> Callers: 0x196b2L# -*- coding: utf-8 -*-from com.pnfsoftware.jeb.client.api import IClientContext
from com.pnfsoftware.jeb.core import IRuntimeProject
from com.pnfsoftware.jeb.core.units import IUnit, INativeCodeUnit
from com.pnfsoftware.jeb.core.units.code.asm.analyzer import INativeCodeAnalyzer, INativeCodeModel, IReferenceManager, ICallGraphManager, ICallGraph, CallGraphVertex
from com.pnfsoftware.jeb.core.units.code.asm.items import INativeMethodItem
# callees/callers 调用与被调用信息def Test(ctx):
assert isinstance(ctx,IClientContext)
input_path = r"D:\tmp\2\project\about_dex_diff\code\xmly\libFace3D.so"
unit = ctx.open(input_path)
prj = ctx.getMainProject()
# 获取INativeCodeUnit并执行解析
nativeCodeUnit = prj.findUnit(INativeCodeUnit)
bool = nativeCodeUnit.process()
# 获取INativeCodeAnalyzer,获取INativeCodeModel
nativeCodeAnalyzer = nativeCodeUnit.getCodeAnalyzer()
nativeCodeAnalyzer.analyze()
nativeCodeModel = nativeCodeAnalyzer.getModel()
# 获取ICallGraph
callGraph = nativeCodeModel.getCallGraphManager().getGlobalCallGraph()
# 函数
funcName = "libunwind::LocalAddressSpace::findFunctionName"
nativeMethodItem = nativeCodeUnit.getMethod(funcName)
print ">>> funcAddr:",hex(nativeMethodItem.getRoutineAddress())
# callees 目标函数调用了谁
callGraphVertexList = callGraph.getCallees(nativeMethodItem,False)
for callGraphVertex in callGraphVertexList:
print ">>> Callee:",hex(callGraphVertex.getInternalAddress().getAddress())
# callers 目标函数被谁调用
callerList = callGraph.getCallers(nativeMethodItem,False)
for caller in callerList:
print ">>> Callers:",hex(caller)
# >>> funcAddr: 0x19a1cL# >>> Callee: 0xabfcL# >>> Callee: 0xac08L# >>> Callee: 0x9cc0L# >>> Callers: 0x196b2L[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
最后于 2020-10-28 14:32
被爱吃菠菜编辑
，原因：
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
