查了n多资料 官网 github 网页发的 结果发现是自己apk忘了更新了
main()
package com.iyue.exampleunidbg;
import com.github.unidbg.*;
import com.github.unidbg.Module;
import com.github.unidbg.arm.backend.DynarmicFactory;
import com.github.unidbg.arm.backend.Unicorn2Factory;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.linux.android.dvm.jni.ProxyDvmObject;
import com.github.unidbg.memory.Memory;
import com.github.unidbg.memory.MemoryBlock;
import com.github.unidbg.pointer.UnidbgPointer;
import java.io.File;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
public class MainActivity extends AbstractJni {
public String apkName = "";
public AndroidEmulator emulator = null;
public Memory memory = null;
public VM vm = null;
public Module module = null;
/**
* 初始化虚拟机
*/
public MainActivity() {
// 1.创建Android模拟器实例
emulator = AndroidEmulatorBuilder
.for32Bit() // new Unicorn2Factory(true) new DynarmicFactory(true)
.addBackendFactory(new DynarmicFactory(true))
// .setProcessName("com.iyue.example") // vm 加载apk后 就不用指定 进程名称
.build();
memory = emulator.getMemory();
memory.setLibraryResolver(new AndroidResolver(23));
//VM vm = emulator.createDalvikVM();
vm = emulator.createDalvikVM(new File("unidbg-android/src/test/iyuenative/android/apk/app-release.apk"));
//vm.setVerbose(true);
vm.setJni(this);
//Module module = emulator.loadLibrary(new File("unidbg-android/src/test/iyuenative/android/libs/armeabi-v7a/libexampleunidbg.so"), true);
//vm.callJNI_OnLoad(emulator, module);
DalvikModule docModule = vm.loadLibrary("exampleunidbg", true);
module = docModule.getModule();
docModule.callJNI_OnLoad(emulator);
}
/**
* 调用静态方法
*/
public void callJavaStaticRegisterFunc() {
try {
// 通过代理创建对象可以不用指定类名
// 创建一个类的实例对象
DvmObject<?> obj = vm.resolveClass("com/iyue/exampleunidbg/MainActivity").newObject(null);
// 调用 静态注册的 普通方法
// Java_com_iyue_exampleunidbg_MainActivity_stringFromJNI
DvmObject str = obj.callJniMethodObject(emulator, "stringFromJNI()Ljava/lang/String;");
System.out.println("[main]D/iyue->: " + "stringFromJNI()->result :" + str.toString());
// 调用 静态注册的 静态方法
// int __fastcall Java_com_iyue_exampleunidbg_MainActivity_staticGetNumber(JNIEnv *env, jclass _jclass, jint num)
int result = obj.callJniMethodInt(emulator, "staticGetNumber(I)I", 10);
System.out.println("[main]D/iyue->: " + "staticGetNumber(I)I->result :" + result);
} catch (Exception e) {
e.printStackTrace();
}
}
/**
* 通过偏移地址调用方法 void __fastcall printFunc1(char *a1)
*/
public void callprintFunc1() {
String str = "nniha你好";
MemoryBlock malloc = memory.malloc(str.length() + 1, false);
UnidbgPointer pointer = malloc.getPointer();
pointer.write(str.getBytes());
module.callFunction(emulator, 0x34AA8 + 1,str);
//System.out.println("[main]D/iyue->: " + "callOtherFunc:" + number.intValue());
malloc.free();
}
/**
* // int __fastcall printFunc2(char *a1)
*/
public void callprintFunc2(){
String str = "nniha你好aaaaa";
MemoryBlock malloc = memory.malloc(str.length() + 1, false);
UnidbgPointer pointer = malloc.getPointer();
pointer.write(str.getBytes());
module.callFunction(emulator,"_Z10printFunc2Pc",str);//pointer 都可以
}
/**
* jobject __fastcall isOK(JNIEnv *a1)
* {
* jclass v2; // r5
* struct _jfieldID *v3; // r2
*
* _android_log_print(3, "iyue->", "call isOK return FALSE!");
* v2 = (*a1)->FindClass(a1, "java/lang/Boolean");
* v3 = (*a1)->GetStaticFieldID(a1, v2, "FALSE", "Ljava/lang/Boolean;");
* return (*a1)->GetStaticObjectField(a1, v2, v3);
* }
*/
public boolean callisOK(){
List<Object> args = new ArrayList<Object>();
args.add(vm.getJNIEnv());
DvmObject<?> obj = vm.resolveClass("com/iyue/exampleunidbg/MainActivity").newObject(null);
args.add(vm.addLocalObject(obj));
Number number = module.callFunction(emulator, "_Z4isOKP7_JNIEnvP8_jobject", args.toArray());
Boolean value = (Boolean) vm.getObject(number.intValue()).getValue();
System.out.println("[main]D/iyue->: " +"callisOK: "+ value);
return value ;
}
/**
* 获取所有已经加载过的模块
*/
public void printModules() {
Collection<Module> loadedModules = memory.getLoadedModules();
for (Module module2 : loadedModules) {
System.out.println("[main]D/iyue->: " + "module2.name:" + module2.name);
}
}
/**
* 监听加载到内存的模块
*/
public void lisenLoadSo() {
memory.addModuleListener(new ModuleListener() {
@Override
public void onLoaded(Emulator<?> emulator, Module module) {
System.out.println("[main]D/iyue->: " + emulator.getProcessName() + ":" + module.name + "已被加载");
}
});
}
@Override
public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) {
if (signature.equals("java/lang/Boolean->FALSE:Ljava/lang/Boolean;")){
DvmObject <?> obj = vm.resolveClass("java/lang/Boolean").newObject(false);
return obj;
}
return super.getStaticObjectField(vm, dvmClass, signature);
}
}
package com.iyue.exampleunidbg;
import com.github.unidbg.*;
import com.github.unidbg.Module;
import com.github.unidbg.arm.backend.DynarmicFactory;
import com.github.unidbg.arm.backend.Unicorn2Factory;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.linux.android.dvm.jni.ProxyDvmObject;
import com.github.unidbg.memory.Memory;
import com.github.unidbg.memory.MemoryBlock;
import com.github.unidbg.pointer.UnidbgPointer;
import java.io.File;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
public class MainActivity extends AbstractJni {
public String apkName = "";
public AndroidEmulator emulator = null;
public Memory memory = null;
public VM vm = null;
public Module module = null;
/**
* 初始化虚拟机
*/
public MainActivity() {
// 1.创建Android模拟器实例
emulator = AndroidEmulatorBuilder
.for32Bit() // new Unicorn2Factory(true) new DynarmicFactory(true)
.addBackendFactory(new DynarmicFactory(true))
// .setProcessName("com.iyue.example") // vm 加载apk后 就不用指定 进程名称
.build();
memory = emulator.getMemory();
memory.setLibraryResolver(new AndroidResolver(23));
//VM vm = emulator.createDalvikVM();
vm = emulator.createDalvikVM(new File("unidbg-android/src/test/iyuenative/android/apk/app-release.apk"));
//vm.setVerbose(true);
vm.setJni(this);
//Module module = emulator.loadLibrary(new File("unidbg-android/src/test/iyuenative/android/libs/armeabi-v7a/libexampleunidbg.so"), true);
//vm.callJNI_OnLoad(emulator, module);
DalvikModule docModule = vm.loadLibrary("exampleunidbg", true);
module = docModule.getModule();
docModule.callJNI_OnLoad(emulator);
}
/**
* 调用静态方法
*/
public void callJavaStaticRegisterFunc() {
try {
// 通过代理创建对象可以不用指定类名
// 创建一个类的实例对象
DvmObject<?> obj = vm.resolveClass("com/iyue/exampleunidbg/MainActivity").newObject(null);
// 调用 静态注册的 普通方法
// Java_com_iyue_exampleunidbg_MainActivity_stringFromJNI
DvmObject str = obj.callJniMethodObject(emulator, "stringFromJNI()Ljava/lang/String;");
System.out.println("[main]D/iyue->: " + "stringFromJNI()->result :" + str.toString());
// 调用 静态注册的 静态方法
// int __fastcall Java_com_iyue_exampleunidbg_MainActivity_staticGetNumber(JNIEnv *env, jclass _jclass, jint num)
int result = obj.callJniMethodInt(emulator, "staticGetNumber(I)I", 10);
System.out.println("[main]D/iyue->: " + "staticGetNumber(I)I->result :" + result);
} catch (Exception e) {
e.printStackTrace();
}
}
/**
* 通过偏移地址调用方法 void __fastcall printFunc1(char *a1)
*/
public void callprintFunc1() {
String str = "nniha你好";
MemoryBlock malloc = memory.malloc(str.length() + 1, false);
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
