import
idaapi
global_table
=
0x78D05D8E80
fun_id
=
158
fun_addr_ref
=
0x0
instr_fun_table
=
0x0
translator_8_12
=
[
3
,
2
,
1
,
0
,
7
,
6
,
5
,
4
,
0xb
,
0xA
,
9
,
8
,
0xF
,
0xE
,
0xD
,
0xC
]
translator_12_16
=
[
0xB
,
0xA
,
9
,
8
,
0xF
,
0xE
,
0xD
,
0xC
,
3
,
2
,
1
,
0
,
7
,
6
,
5
,
4
]
def
aget(instr_addr,x10):
print
(
"aget"
,
"arg:"
)
return
4
def
const_4(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
arg0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
]
arg1
=
translator_12_16[instr_0_2 >>
12
]
print
(
"const/4 v%d, %d"
%
(arg0,arg1))
return
2
def
const_16(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
arg0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
print
(
"const/16 v%d, %d"
%
(arg0,instr_2_4))
return
4
def
const(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
arg0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
print
(
"const v%d, %d"
%
(arg0,instr_2_4))
return
6
def
const_string(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
v60
=
instr_0_2 >>
12
v61
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
v63
=
16
*
(translator_12_16[v60] &
0xF
)
v75
=
v63 | v61
a38_index_11
=
read_mem_to_Int(x10
+
0x58
,
8
)
a38_index_2
=
read_mem_to_Int(x10
+
0x10
,
8
)
v3
=
read_mem_to_Int(instr_2_4
*
4
+
a38_index_2,
4
)
string
=
v3
+
a38_index_11
print
(
"const-string v%d, %s"
%
(v75,
hex
(string)))
return
4
def
xor(instr_addr,x10):
print
(
"xor"
,
"arg:"
)
return
4
def
move_16(instr_addr,x10):
print
(
"move-16"
,
"arg:"
)
return
2
def
iput_object(instr_addr,x10):
print
(
"iput_object"
,
"arg:"
)
return
4
def
aput_object(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v37
=
(instr_0_2 >>
8
) &
0xF
v38
=
instr_0_2 >>
12
v40
=
translator_8_12[v37];
v41
=
translator_12_16[v38];
arg_v1
=
v40 &
0xF
| (
16
*
(v41 &
0xF
))
arg_v2
=
read_mem_to_Int(instr_addr
+
2
,
1
)
arg_v3
=
read_mem_to_Int(instr_addr
+
3
,
1
)
print
(
"aput-object v%d, v%d, v%d"
%
(arg_v1,arg_v2,arg_v3))
return
4
def
goto(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v3
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
if
v3 >
=
128
:
int_num
=
(v3
-
256
)
*
2
else
:
int_num
=
v3
*
2
print
(
"goto"
,
"arg:"
,
hex
(instr_addr
+
int_num),int_num)
return
2
def
rsub(instr_addr,x10):
print
(
"rsub"
,
"arg:"
)
return
4
def
cmp
(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v1
=
read_mem_to_Int(instr_addr
+
2
,
1
)
v2
=
read_mem_to_Int(instr_addr
+
3
,
1
)
v3
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
print
(
"cmp"
,
"arg:"
,v3,v1,v2)
return
4
def
invoke_super(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_add_4
=
read_mem_to_Int(instr_addr
+
4
,
2
)
v63
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
));
register_size
=
v63 >>
4
arg1
=
instr_add_4 &
0xF
arg2
=
instr_add_4 >>
4
&
0xF
arg3
=
(instr_add_4 >>
8
) &
0xf
arg4
=
instr_add_4 >>
12
arg5
=
v63 &
0xF
ref_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
classname_str
=
get_class_name(x10,ref_index)
method_name_str
=
get_method_name(x10,ref_index)
type_name_str
=
get_proto_type_name(x10, ref_index)
print
(
"invoke-super "
,classname_str
+
"->"
+
method_name_str
+
type_name_str,
"method_ref_index"
,
hex
(ref_index),
"register:"
,register_size,
"arg1:"
,arg1,
"arg2:"
,arg2,
"arg3:"
,arg3,
"arg4:"
,arg4,
"arg5:"
,arg5)
return
6
def
invoke_direct(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_add_4
=
read_mem_to_Int(instr_addr
+
4
,
2
)
v63
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
));
register_size
=
v63 >>
4
arg1
=
instr_add_4 &
0xF
arg2
=
instr_add_4 >>
4
&
0xF
arg3
=
(instr_add_4 >>
8
) &
0xf
arg4
=
instr_add_4 >>
12
arg5
=
v63 &
0xF
ref_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
classname_str
=
get_class_name(x10,ref_index)
method_name_str
=
get_method_name(x10,ref_index)
type_name_str
=
get_proto_type_name(x10, ref_index)
print
(
"invoke-direct "
,classname_str
+
"->"
+
method_name_str
+
type_name_str,
"method_ref_index"
,
hex
(ref_index),
"register:"
,register_size,
"arg1:"
,arg1,
"arg2:"
,arg2,
"arg3:"
,arg3,
"arg4:"
,arg4,
"arg5:"
,arg5)
return
6
def
invoke_static(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_add_4
=
read_mem_to_Int(instr_addr
+
4
,
2
)
v63
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
));
register_size
=
v63 >>
4
arg1
=
instr_add_4 &
0xF
arg2
=
instr_add_4 >>
4
&
0xF
arg3
=
(instr_add_4 >>
8
) &
0xf
arg4
=
instr_add_4 >>
12
arg5
=
v63 &
0xF
ref_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
classname_str
=
get_class_name(x10,ref_index)
method_name_str
=
get_method_name(x10,ref_index)
type_name_str
=
get_proto_type_name(x10, ref_index)
print
(
"invoke-static "
,classname_str
+
"->"
+
method_name_str
+
type_name_str,
"method_ref_index"
,
hex
(ref_index),
"register:"
,register_size,
"arg1:"
,arg1,
"arg2:"
,arg2,
"arg3:"
,arg3,
"arg4:"
,arg4,
"arg5:"
,arg5)
return
6
def
invoke_interface(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_add_4
=
read_mem_to_Int(instr_addr
+
4
,
2
)
v63
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
));
register_size
=
v63 >>
4
arg1
=
instr_add_4 &
0xF
arg2
=
instr_add_4 >>
4
&
0xF
arg3
=
(instr_add_4 >>
8
) &
0xf
arg4
=
instr_add_4 >>
12
arg5
=
v63 &
0xF
ref_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
classname_str
=
get_class_name(x10,ref_index)
method_name_str
=
get_method_name(x10,ref_index)
type_name_str
=
get_proto_type_name(x10, ref_index)
print
(
"invoke-interface "
,classname_str
+
"->"
+
method_name_str
+
type_name_str,
"method_ref_index"
,
hex
(ref_index),
"register:"
,register_size,
"arg1:"
,arg1,
"arg2:"
,arg2,
"arg3:"
,arg3,
"arg4:"
,arg4,
"arg5:"
,arg5)
return
6
def
invoke_virutal(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_add_4
=
read_mem_to_Int(instr_addr
+
4
,
2
)
v63
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
));
register_size
=
v63 >>
4
arg1
=
instr_add_4 &
0xF
arg2
=
instr_add_4 >>
4
&
0xF
arg3
=
(instr_add_4 >>
8
) &
0xf
arg4
=
instr_add_4 >>
12
arg5
=
v63 &
0xF
ref_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
classname_str
=
get_class_name(x10,ref_index)
method_name_str
=
get_method_name(x10,ref_index)
type_name_str
=
get_proto_type_name(x10, ref_index)
print
(
"invoke-virtual "
,classname_str
+
"->"
+
method_name_str
+
type_name_str,
"method_ref_index"
,
hex
(ref_index),
"register:"
,register_size,
"arg1:"
,arg1,
"arg2:"
,arg2,
"arg3:"
,arg3,
"arg4:"
,arg4,
"arg5:"
,arg5)
return
6
def
rem_doule(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
print
(
"rem-doule"
,
hex
(v_arg_0),
hex
(instr_2_4))
return
4
def
move_result_object(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
print
(
"move-result-object v%d"
%
v_arg_0)
return
2
def
MonitorEnter(instr_addr,x10):
print
(
"MonitorEnter"
,
"arg:"
)
return
2
def
return_object(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
print
(
"return-object v%d"
%
v_arg_0)
return
2
def
move_object(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
];
v_arg_1
=
translator_12_16[instr_0_2 >>
12
]
print
(
"move-object v%d, v%d"
%
(v_arg_0,v_arg_1))
return
2
def
new_instance(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
ref_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
dex_base_addr
=
read_mem_to_Int(x10
+
0x58
,
8
)
dex_type_off
=
read_mem_to_Int(x10
+
0x18
,
8
)
dex_string_list_off
=
read_mem_to_Int(x10
+
0x10
,
8
)
classname_str
=
byIndexGet_dex_type_name(dex_base_addr,dex_type_off,dex_string_list_off,ref_index)
print
(
"new-instance v%d, %s"
%
(v_arg_0,classname_str))
return
4
def
move_result(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
print
(
"move-result v%d"
%
v_arg_0)
return
2
def
new_array(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg_size
=
translator_12_16[instr_0_2 >>
12
]
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
];
ref_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
dex_base_addr
=
read_mem_to_Int(x10
+
0x58
,
8
)
dex_type_off
=
read_mem_to_Int(x10
+
0x18
,
8
)
dex_string_list_off
=
read_mem_to_Int(x10
+
0x10
,
8
)
classname_str
=
byIndexGet_dex_type_name(dex_base_addr,dex_type_off,dex_string_list_off,ref_index)
print
(
"new-array v%d, v%d, %s"
%
(v_arg_0,v_arg_size,classname_str))
return
4
def
if_ne(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
arg1
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
];
arg2
=
translator_12_16[instr_0_2 >>
12
];
print
(
"if-ne v%d, v%x, %x"
%
(arg1,arg2,instr_addr
+
instr_2_4
*
2
))
return
4
def
if_eqz(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
v63
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
));
print
(
"if-eqz v%d, %x"
%
(v63,instr_addr
+
instr_2_4
*
2
))
return
4
def
if_gt(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
arg1
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
];
arg2
=
translator_12_16[instr_0_2 >>
12
];
print
(
"if-gt v%d, v%x, %x"
%
(arg1,arg2,instr_addr
+
instr_2_4
*
2
))
return
4
def
if_lt(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
arg1
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
];
arg2
=
translator_12_16[instr_0_2 >>
12
];
print
(
"if-lt v%d, v%x, %x"
%
(arg1,arg2,instr_addr
+
instr_2_4
*
2
))
return
4
def
if_lez(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
v63
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
));
print
(
"if-lez v%d, %x"
%
(v63,instr_addr
+
instr_2_4
*
2
))
return
4
def
if_nez(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
instr_2_4
=
read_mem_to_Int(instr_addr
+
2
,
2
)
v63
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
));
print
(
"if-nez v%d, %x"
%
(v63,instr_addr
+
instr_2_4
*
2
))
return
4
def
iput(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
filed_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
v_arg_0
=
translator_12_16[instr_0_2 >>
12
]
v_arg_1
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
]
dex_filed_off
=
read_mem_to_Int(x10
+
0x20
,
8
)
class_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off,
2
)
filed_type_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off
+
2
,
2
)
name_string_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off
+
4
,
2
)
dex_base_addr
=
read_mem_to_Int(x10
+
0x58
,
8
)
dex_type_off
=
read_mem_to_Int(x10
+
0x18
,
8
)
dex_string_list_off
=
read_mem_to_Int(x10
+
0x10
,
8
)
class_type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, class_index)
filed_type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, filed_type_index)
name_string
=
byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,name_string_index)
print
(
"iput-object v%d, v%d, %s"
%
(v_arg_1,v_arg_0,class_type_string
+
"->"
+
name_string
+
":"
+
filed_type_string
+
" filed_index: "
+
filed_index))
return
4
def
aget_object(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
arg_1
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
arg_v2
=
read_mem_to_Int(instr_addr
+
2
,
1
)
arg_v3
=
read_mem_to_Int(instr_addr
+
3
,
1
)
print
(
"aget-object v%d, v%d, v%d"
%
(arg_1,arg_v2,arg_v3))
return
4
def
iget_object(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
filed_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
v_arg_0
=
translator_12_16[instr_0_2 >>
12
]
v_arg_1
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
]
dex_filed_off
=
read_mem_to_Int(x10
+
0x20
,
8
)
class_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off,
2
)
filed_type_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off
+
2
,
2
)
name_string_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off
+
4
,
2
)
dex_base_addr
=
read_mem_to_Int(x10
+
0x58
,
8
)
dex_type_off
=
read_mem_to_Int(x10
+
0x18
,
8
)
dex_string_list_off
=
read_mem_to_Int(x10
+
0x10
,
8
)
class_type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, class_index)
filed_type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, filed_type_index)
name_string
=
byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,name_string_index)
print
(
"iget-object v%d, v%d, %s"
%
(v_arg_1,v_arg_0,class_type_string
+
"->"
+
name_string
+
":"
+
filed_type_string
+
" filed_index: "
+
filed_index))
return
4
def
check_cast(instr_addr,x10):
type_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
dex_base_addr
=
read_mem_to_Int(x10
+
0x58
,
8
)
dex_type_off
=
read_mem_to_Int(x10
+
0x18
,
8
)
dex_string_list_off
=
read_mem_to_Int(x10
+
0x10
,
8
)
type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, type_index)
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
print
(
"check-cast v%d, %s"
%
(v_arg,type_string))
return
4
def
sget_object(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
filed_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
dex_filed_off
=
read_mem_to_Int(x10
+
0x20
,
8
)
class_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off,
2
)
filed_type_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off
+
2
,
2
)
name_string_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off
+
4
,
2
)
dex_base_addr
=
read_mem_to_Int(x10
+
0x58
,
8
)
dex_type_off
=
read_mem_to_Int(x10
+
0x18
,
8
)
dex_string_list_off
=
read_mem_to_Int(x10
+
0x10
,
8
)
class_type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, class_index)
filed_type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, filed_type_index)
name_string
=
byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,name_string_index)
print
(
"sget-object v%d, %s"
%
(v_arg_0,class_type_string
+
"->"
+
name_string
+
":"
+
filed_type_string))
return
4
def
sget_boolean(instr_addr, x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
filed_index
=
read_mem_to_Int(instr_addr
+
2
,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
dex_filed_off
=
read_mem_to_Int(x10
+
0x20
,
8
)
class_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off,
2
)
filed_type_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off
+
2
,
2
)
name_string_index
=
read_mem_to_Int(
8
*
filed_index
+
dex_filed_off
+
4
,
2
)
dex_base_addr
=
read_mem_to_Int(x10
+
0x58
,
8
)
dex_type_off
=
read_mem_to_Int(x10
+
0x18
,
8
)
dex_string_list_off
=
read_mem_to_Int(x10
+
0x10
,
8
)
class_type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, class_index)
filed_type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, filed_type_index)
name_string
=
byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,name_string_index)
print
(
"sget-boolean v%d, %s"
%
(v_arg_0,class_type_string
+
"->"
+
name_string
+
":"
+
filed_type_string))
return
4
def
nop(instr_addr,x10):
print
(
"nop"
)
return
2
def
return_void(instr_addr,x10):
print
(
"return-void"
)
return
2
def
throw(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
print
(
"throw v%d"
%
v_arg_0)
return
2
def
throw_2(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
v_arg_0
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
] &
0xF
| (
16
*
(translator_12_16[instr_0_2 >>
12
] &
0xF
))
print
(
"move-exception v%d"
%
v_arg_0)
return
2
def
array_length(instr_addr,x10):
instr_0_2
=
read_mem_to_Int(instr_addr,
2
)
arg_0
=
translator_12_16[instr_0_2 >>
12
]
arg_1
=
translator_8_12[(instr_0_2 >>
8
) &
0xF
]
print
(
"array-length v%d, v%d"
%
(arg_1,arg_0))
return
2
switch
=
{
0x0
:iput,
0x1
:invoke_super,
0x2
:aget,
0x3
:xor,
0x4
:move_16,
0x5
:iput_object,
0x5a
:nop,
0xd
:goto,
0xda
:aput_object ,
0x7
:rsub,
0x8
:
cmp
,
0x1e
:if_lez,
0x2b
:if_nez,
0x3e
:if_eqz,
0x3c
:if_gt,
0x21
:if_lt,
0x44
:const_16,
0xc3
:const,
0x5e
:move_result ,
0x68
:invoke_direct,
0xA6
:invoke_virutal,
0xAA
:new_instance,
0xc7
:move_result_object,
0xbb
:return_object,
0x92
:return_void,
0xfc
:move_object,
0x79
:invoke_interface,
0xf9
:check_cast,
0xf0
:const_4,
0xfa
:if_ne,
0x93
:sget_object,
0xc2
:sget_boolean,
0x9a
:invoke_static,
0x9b
:const_string,
0x1f
:new_array,
0x19
:iget_object,
0x9d
:MonitorEnter,
0xc4
:array_length,
0x6b
:aget_object,
0xf5
:throw,
0xee
:throw_2}
def
ByFunIDgetFunAddr(
id
):
offset_mem
=
int
.from_bytes(idaapi.dbg_read_memory(
4
*
id
+
global_table,
4
),byteorder
=
'little'
)
method_addr
=
global_table
+
offset_mem
print
(
"fun_id:"
,
hex
(
id
),
"method_addr:"
,
hex
(offset_mem),
"method_addr:"
,
hex
(method_addr))
return
method_addr
def
read_mem_to_String(addr,size):
mem
=
idaapi.dbg_read_memory(addr,size)
return
mem
def
read_mem_to_Int(addr, size):
mem
=
int
.from_bytes(idaapi.dbg_read_memory(addr,size),byteorder
=
'little'
)
return
mem
def
get_proto_type_name(x10, type_index):
dex_method_off
=
read_mem_to_Int(x10
+
0x28
,
8
)
dex_string_list_off
=
read_mem_to_Int(x10
+
0x10
,
8
)
dex_type_off
=
read_mem_to_Int(x10
+
0x18
,
8
)
dex_base_addr
=
read_mem_to_Int(x10
+
0x58
,
8
)
dex_proto_off
=
read_mem_to_Int(x10
+
0x30
,
8
)
proto_index
=
read_mem_to_Int(
8
*
type_index
+
dex_method_off
+
2
,
2
)
return_type_index
=
read_mem_to_Int(dex_proto_off
+
12
*
proto_index
+
4
,
4
)
pararm_off
=
read_mem_to_Int(dex_proto_off
+
12
*
proto_index
+
8
,
4
)
sign_type_string_list
=
"("
if
pararm_off !
=
0
:
pararm_size
=
read_mem_to_Int(dex_base_addr
+
pararm_off,
4
)
for
i
in
range
(pararm_size):
pararm_type_index
=
read_mem_to_Int(dex_base_addr
+
pararm_off
+
4
+
i
*
2
,
2
)
pararm_type_string
=
byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, pararm_type_index)
sign_type_string_list
=
sign_type_string_list
+
pararm_type_string
return_type_string
=
byIndexGet_dex_type_name(dex_base_addr,dex_type_off,dex_string_list_off,return_type_index)
sign_type_string_list
=
sign_type_string_list
+
")"
+
return_type_string
return
sign_type_string_list
def
byIndexGet_dex_type_name(dex_base_addr,dex_type_off,dex_string_list_off,pararm_type_index):
string_index
=
read_mem_to_Int(pararm_type_index
*
4
+
dex_type_off,
4
)
type_string
=
byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,string_index)
return
type_string
def
byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,string_index):
v3
=
read_mem_to_Int(string_index
*
4
+
dex_string_list_off,
4
)
cla_len
=
read_mem_to_Int(dex_base_addr
+
v3,
1
)
class_str
=
idaapi.dbg_read_memory(dex_base_addr
+
v3
+
1
, cla_len).decode(
'utf-8'
)
print
(
"byIndexGet_dex_string_name:"
,
hex
(dex_base_addr
+
v3))
return
class_str
def
get_class_name(x10,class_index):
a38_index_5
=
read_mem_to_Int(x10
+
0x28
,
8
)
a38_index_2
=
read_mem_to_Int(x10
+
0x10
,
8
)
a38_index_3
=
read_mem_to_Int(x10
+
0x18
,
8
)
a38_index_11
=
read_mem_to_Int(x10
+
0x58
,
8
)
v1
=
read_mem_to_Int(
8
*
class_index
+
a38_index_5,
2
)
v2
=
read_mem_to_Int(v1
*
4
+
a38_index_3,
4
)
v3
=
read_mem_to_Int(v2
*
4
+
a38_index_2,
4
)
class_str_addr
=
v3
+
a38_index_11
cla_len
=
read_mem_to_Int(class_str_addr,
1
)
class_str
=
idaapi.dbg_read_memory(class_str_addr
+
1
, cla_len).decode(
'utf-8'
)
return
class_str
def
get_method_name(x10, method_index):
a38_index_5
=
read_mem_to_Int(x10
+
0x28
,
8
)
a38_index_2
=
read_mem_to_Int(x10
+
0x10
,
8
)
a38_index_3
=
read_mem_to_Int(x10
+
0x18
,
8
)
a38_index_11
=
read_mem_to_Int(x10
+
0x58
,
8
)
v1
=
read_mem_to_Int(
8
*
method_index
+
a38_index_5
+
4
,
2
)
v3
=
read_mem_to_Int(v1
*
4
+
a38_index_2,
4
)
method_name_str_addr
=
v3
+
a38_index_11
method_name_str_len
=
read_mem_to_Int(method_name_str_addr,
1
)
method_name_str
=
idaapi.dbg_read_memory(method_name_str_addr
+
1
, method_name_str_len).decode(
'utf-8'
)
return
method_name_str
def
get_method_arg(x10, index):
a38_index_5
=
read_mem_to_Int(x10
+
0x28
,
8
)
a38_index_2
=
read_mem_to_Int(x10
+
0x10
,
8
)
a38_index_3
=
read_mem_to_Int(x10
+
0x18
,
8
)
a38_index_11
=
read_mem_to_Int(x10
+
0x58
,
8
)
a38_index_6
=
read_mem_to_Int(x10
+
0x30
,
8
)
v0
=
read_mem_to_Int(
8
*
index
+
a38_index_5
+
2
,
2
)
v80
=
read_mem_to_Int(a38_index_6
+
12
*
v0
+
8
,
4
)
print
(
"arg_addr a38_index_5:"
,
hex
(a38_index_5))
print
(
"arg_addr a38_index_2:"
,
hex
(a38_index_2))
print
(
"arg_addr a38_index_3:"
,
hex
(a38_index_3))
print
(
"arg_addr a38_index_11:"
,
hex
(a38_index_11))
print
(
"arg_addr a38_index_6:"
,
hex
(a38_index_6))
print
(
"arg_addr v80:"
,v80)
v81
=
v80
+
a38_index_11
v1
=
read_mem_to_Int(v81
+
2
,
4
)
v2
=
read_mem_to_Int(v1
*
4
+
a38_index_3,
4
)
v3
=
read_mem_to_Int(v2
*
4
+
a38_index_2,
4
)
return_type
=
v3
+
a38_index_11
print
(
"arg_addr:"
,return_type)
return
return_type
def
get_segment_address(segment_name):
seg
=
idaapi.get_segm_by_name(segment_name)
if
seg
is
not
None
:
return
seg.start_ea, seg.end_ea
else
:
return
None
def
main():
method_addr
=
ByFunIDgetFunAddr(fun_id)
register_size
=
read_mem_to_Int(method_addr,
2
)
ins_size
=
read_mem_to_Int(method_addr
+
2
,
2
)
insns_size
=
read_mem_to_Int(method_addr
+
12
,
4
)
print
(
"method registers_size:"
,
hex
(register_size))
print
(
"method ins_size:"
,
hex
(ins_size))
print
(
"method insns_size:"
,
hex
(insns_size))
method_addr_2
=
ByFunIDgetFunAddr(fun_id
+
1
)
funSize
=
method_addr_2
-
method_addr
print
(
"method_size:"
,
hex
(funSize))
instr_addr
=
method_addr
+
0x10
print
(
"method_end:"
,
hex
(instr_addr
+
insns_size
*
2
))
while
(
1
):
offset
=
read_mem_to_Int(instr_addr,
2
) &
0xff
instr_fun_addr
=
instr_fun_table
+
offset
*
8
print
(
"-----------------------------------"
)
print
(
"instr_fun_addr:"
,
hex
(instr_fun_addr),
hex
(offset))
instr_handle
=
switch[offset]
print
(
"instr_addr:"
,
hex
(instr_addr))
print
(
hex
(offset))
if
(instr_handle
=
=
None
):
break
instr_len
=
instr_handle(instr_addr, fun_addr_ref)
instr_addr
=
instr_addr
+
instr_len
print
(
hex
(offset))
def
init_var():
global
global_table
global
instr_fun_table
global
fun_addr_ref
bss_start, bss_end
=
get_segment_address(
".bss"
)
qword_78B9BFCDC8
=
read_mem_to_Int(bss_start
+
0x2B8
,
8
)
global_table
=
read_mem_to_Int(bss_start
+
0x270
,
8
)
yaq2__sec
=
read_mem_to_Int(bss_start
+
0x2B0
,
8
)
v6
=
yaq2__sec
+
fun_id
*
12
v6_index_1
=
read_mem_to_Int(v6
+
4
,
4
)
v6_index_2
=
read_mem_to_Int(v6
+
8
,
4
)
fun_addr_ref
=
read_mem_to_Int(
8
*
(v6_index_2
-
1
)
+
qword_78B9BFCDC8,
8
)
instr_fun_table, data_rel_end
=
get_segment_address(
".data.rel.ro"
)
print
(
"qword_78B9BFCDC8"
,
hex
(qword_78B9BFCDC8))
print
(
"global_table"
,
hex
(global_table))
print
(
"v6_index_1"
,
hex
(v6_index_1))
print
(
"v6_index_2"
,
hex
(v6_index_2))
print
(
"fun_addr_ref"
,
hex
(fun_addr_ref))
if
__name__
=
=
'__main__'
:
init_var()
main()