-
-
[求助]8.59 x-mini-mua 卡再内存找不到了 unidbg版
-
发表于: 2025-2-11 17:21
-
如果注释掉这行代码memory.addHookListener(systemPropertyHook);
不hook系统属性是可以出结果但是结果会少很多。
如果补系统文件，就会报内存找不到，看日志是获取ro.product.brand后就找不到了
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 | [17:18:06 562] DEBUG [com.github.unidbg.pointer.UnidbgPointer] (UnidbgPointer:348) - getString pointer=RW@0x40757860, size=16, encoding=UTF-8, ret=ro.product.brand[17:18:06 562] DEBUG [com.github.unidbg.linux.android.SystemPropertyHook] (SystemPropertyHook$5:96) - __system_property_find key=ro.product.brand, LR=RX@0x4028ea4c[libtiny.so]0x28ea4c地址=fffe18a4长度8返回=[1, 0, 0, -44]String �地址=406c25b4长度8返回=[103, 111, 111, 103, 108, 101, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]Stringgoogle [17:18:06 563] DEBUG [com.github.unidbg.pointer.UnidbgPointer] (UnidbgPointer:348) - getString pointer=R@0x406c25b4, size=6, encoding=UTF-8, ret=google[17:18:06 563] DEBUG [com.github.unidbg.linux.android.SystemPropertyHook] (SystemPropertyHook$5:109) - __system_property_find key=ro.product.brand, pi=R@0x406c25b0, value=google地址=405cbf1c长度8返回=[1, 0, 0, -44]String �地址=404f6cc0长度8返回=[4, 0, 0, 0]String [17:18:06 564] DEBUG [com.github.unidbg.linux.AndroidSyscallHandler] (AndroidSyscallHandler:308) - futex uaddr=RW@0x404f6cc0[libtiny.so]0x4f6cc0, isPrivate=true, cmd=1, val=0x7fffffff, old=0x4, LR=RX@0x40617934[libc.so]0x67934[17:18:06 564] DEBUG [com.github.unidbg.linux.AndroidSyscallHandler] (AndroidSyscallHandler:340) - futex FUTEX_WAKE val=0x7fffffff, old=4, task=Runnable|Function64 address=0x401ab2d0, arguments=[wxw@0xfffe1640[libandroid.so]0x640, 621541985, 828356434, 110771485][17:18:06 564] WARN [com.github.unidbg.arm.AbstractARM64Emulator] (AbstractARM64Emulator$1:66) - Fetch memory failed: address=0x165ff2dc8, size=1, value=0x0debugger break at: 0x165ff2dc8 @ Runnable|Function64 address=0x401ab2d0, arguments=[wxw@0xfffe1640[libandroid.so]0x640, 621541985, 828356434, 110771485]>>> x0=0x406c25b0 x1=0x0 x2=0xbffffffffffde98 x3=0x0 x4=0x0 x5=0x1 x6=0x0 x7=0x81 x8=0x165ff2dc8 x9=0x1f6fbb6c x10=0xc x11=0x80 x12=0x40656a80 x13=0xc x14=0xd>>> x15=0x6 x16=0x404ed708 x17=0x0 x18=0x40742020 x19=0xbffffffffffe060 x20=0x406c25b0 x21=0xbfffffffffff718 x22=0x404ac000 x23=0x66011558 x24=0x1f6fbad4 x25=0x3ee8cc60 x26=0x3ee8cc68 x27=0xbffffffffffec78 x28=0xbfffffffffff718 fp=0xbffffffffffdf00>>> q0=0x3f800000(1.0) q1=0x3f800000(1.0) q2=0x0(0.0) q3=0x0(0.0) q4=0x80200802802008028020080280200802(-4.458850023827439E-308, -4.458850023827439E-308) q5=0x1000000000000000100000(5.180654E-318, 5.180654E-318) q6=0x0(0.0) q7=0x80200802802008028020080280200802(-4.458850023827439E-308, -4.458850023827439E-308) q8=0x0(0.0) q9=0x0(0.0) q10=0x0(0.0) q11=0x0(0.0) q12=0x0(0.0) q13=0x0(0.0) q14=0x0(0.0) q15=0x0(0.0)>>> q16=0x40100401401004014010040140100401(4.003911019303815, 4.003911019303815) q17=0xa00aa00aa00aa00aaaaaaaaa00100010(-3.7206606621968206E-103, -2.4822441395927015E-154) q18=0x80200802802008028020080280200802(-4.458850023827439E-308, -4.458850023827439E-308) q19=0x0(0.0) q20=0x0(0.0) q21=0x0(0.0) q22=0x0(0.0) q23=0x0(0.0) q24=0x0(0.0) q25=0x0(0.0) q26=0x0(0.0) q27=0x0(0.0) q28=0x0(0.0) q29=0x0(0.0) q30=0x0(0.0) q31=0x0(0.0)LR=RX@0x40258018[libtiny.so]0x258018SP=0xbffffffffffde70PC=wxw@0x165ff2dc8nzcv: N=0, Z=1, C=1, V=0, EL0, use SP_EL0地址=165ff2dc4长度9地址=165ff2dc8长度9地址=165ff2dc4长度9com.github.unidbg.arm.backend.BackendException: mem_read address=0x165ff2dc4, size=60 at com.github.unidbg.arm.backend.Unicorn2Backend.mem_read(Unicorn2Backend.java:127) at com.github.unidbg.arm.AbstractARM64Emulator.disassemble(AbstractARM64Emulator.java:221) at com.github.unidbg.arm.AbstractARMDebugger.disassemble(AbstractARMDebugger.java:963) at com.github.unidbg.arm.SimpleARM64Debugger.loop(SimpleARM64Debugger.java:52) at com.github.unidbg.arm.AbstractARMDebugger.debug(AbstractARMDebugger.java:279) at com.github.unidbg.arm.AbstractARM64Emulator$1.hook(AbstractARM64Emulator.java:68) at com.github.unidbg.arm.backend.Unicorn2Backend$9.hook(Unicorn2Backend.java:324) at com.github.unidbg.arm.backend.unicorn.Unicorn$NewHook.onMemEvent(Unicorn.java:117) at com.github.unidbg.arm.backend.unicorn.Unicorn.emu_start(Native Method) at com.github.unidbg.arm.backend.unicorn.Unicorn.emu_start(Unicorn.java:312) at com.github.unidbg.arm.backend.Unicorn2Backend.emu_start(Unicorn2Backend.java:397) at com.github.unidbg.AbstractEmulator.emulate(AbstractEmulator.java:378) at com.github.unidbg.thread.Function64.run(Function64.java:39) at com.github.unidbg.thread.MainTask.dispatch(MainTask.java:19) at com.github.unidbg.thread.UniThreadDispatcher.run(UniThreadDispatcher.java:175) at com.github.unidbg.thread.UniThreadDispatcher.runMainForResult(UniThreadDispatcher.java:99) at com.github.unidbg.AbstractEmulator.runMainForResult(AbstractEmulator.java:341) at com.github.unidbg.arm.AbstractARM64Emulator.eFunc(AbstractARM64Emulator.java:262) at com.github.unidbg.Module.emulateFunction(Module.java:163) at com.github.unidbg.linux.android.dvm.DvmObject.callJniMethod(DvmObject.java:135) at com.github.unidbg.linux.android.dvm.DvmClass.callStaticJniMethodObject(DvmClass.java:317) at com.anjuke.mobile.sign.xhs.XHSMiniMua.a(XHSMiniMua.java:185) at com.anjuke.mobile.sign.xhs.XHSMiniMua.init(XHSMiniMua.java:126) at com.anjuke.mobile.sign.xhs.XHSMiniMua.main(XHSMiniMua.java:1040)Caused by: unicorn.UnicornException: Invalid memory read (UC_ERR_READ_UNMAPPED)有没有大佬一起交流 |
最后于 2025-2-11 17:22
被mb_darczqhk编辑
，原因：
