[原创]X浪脱壳分析-Android安全-看雪安全社区｜专业技术交流与安全研究论坛

**版本：**
x_14.10.0_vcode_7021_wm_3333_1001_so_32_64_x_6165_225001

**运行环境：**
ANDROID 14
Magisk 面具
magisk-frida

**使用工具：**
抓包工具Charles
JAVA逆向工具JADX
SO逆向工具IDA
动态分析工具FRIDA

**ANDROID 14 环境配置：**
Magisk 的环境配置11cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6@1L8%4m8B7L8$3S2F1N6%4g2Q4x3V1k6y4j5h3N6A6M7$3D9`.
Magisk 的Frida环境e1fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6h3K9g2u0T1x3#2)9J5c8X3#2S2k6$3W2K6K9#2)9J5k6r3k6J5K9h3c8S2
ANDROID 14的证书配置 bb4K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6%4K9X3j5H3x3U0p5@1i4K6u0r3e0h3q4Y4K9i4y4C8i4K6u0V1e0h3!0$3k6f1y4m8b7$3g2J5N6s2x3`.

**CA证书的重要变化**
原来是 /system/etc/security/cacerts目录
新增加 /apex/com.android.conscrypt/cacerts目录

**IDA动态调试的重要变化**
现象为DDMS界面白屏，无待调试的进程。Android官方的更新文档解释为：

> 运行时
JDWP 线程创建
Android 14 添加了 persist.debug.dalvik.vm.jdwp.enabled 系统属性，用于控制是否在 userdebug build 中创建 Java 调试网络协议 (JDWP) 线程。如需了解详情，请参阅 JDWP 选项。

> JDWP 选项
persist.debug.dalvik.vm.jdwp.enabled 系统属性用于控制是否在 userdebug build 中创建 Java 调试网络协议 (JDWP) 线程。默认情况下，系统不会设置此属性，且系统只会为可调试应用创建 JDWP 线程。如需同时为可调试和不可调试应用启用 JDWP 线程，请将 persist.debug.dalvik.vm.jdwp.enabled 设为 1。必须重新启动设备，才能使属性更改生效。
如需在 userdebug build 中调试某个不可调试应用，请运行以下命令来启用 JDWP：
  adb shell setprop persist.debug.dalvik.vm.jdwp.enabled 1
  adb reboot
  注意：将 persist.debug.dalvik.vm.jdwp.enabled 属性设为 1，这不会使应用变得可调试，而只会允许将调试程序附加到进程。
对于搭载 Android 13 或更低版本的设备，运行时会在 userdebug build 中为可调试和不可调试应用创建 JDWP 线程。这意味着，您可以在 userdebug build 中附加调试程序或分析应用性能。

**Magisk命令为**

```
su

magisk resetprop ro.debuggable 1
magisk resetprop ro.force.debuggable 1

magisk resetprop ro.build.type eng
magisk resetprop ro.build.type userdebug
magisk resetprop persist.debug.dalvik.vm.jdwp.enabled 1

stop;start
```

***

抓包确定需要的分析的关键点在com.sina.weibo.security下的SLib类八个native函数

```

private native boolean nativeCheck();

private native String nativeGetCheckErr();

private native int nativeGetCheckErrType();

private native long nativeGetPkgTimeCost();

private native long nativeGetV1TimeCost();

private native long nativeGetV2TimeCost();

private native void nativeInit(String str);

private native String nativeNewCalculateS(Context context, String str, int i);
```

同时com.sina.weibo.security 下的WBSecurity类的四个native函数

```
public native String getSignature(String str);

public native String getTimeCost();

public native String getUnPackResult();

public native boolean isUnpackSuccess();
```

他对应的SO文件为libslib.so，正常流程为加载libslib.so模型，运行nativeInit初始化环境参数，运行nativeNewCalculateS来计算s参数的值；
查看IDA的导出表 发现没有静态注册的JNI函数
 ![](upload/attach/202507/920134_DDWAHVP4KDXD2P3.webp)

直接上Android的unidbg跑了一下（f13K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6*7K9r3E0D9x3o6t1J5z5q4)9J5c8Y4g2F1K9h3c8T1k6#2!0q4c8W2!0n7b7#2)9^5z5g2!0q4c8W2!0n7b7#2)9^5b7#2!0q4y4#2)9&6b7W2!0n7y4q4!0q4y4W2)9^5c8g2!0m8y4g2!0q4y4W2)9^5c8W2)9&6x3q4!0q4y4#2!0m8y4q4!0n7b7b7`.`.

```
INFO [com.github.unidbg.linux.AndroidElfLoader] (AndroidElfLoader:481) - libsoshell.so load dependency libziparchive-private.so failed
```

查看了一下libziparchive-private.so这个文件，他是一个解压文件，把libziparchive-private.so文件放入libslib.so的同目录再次运行
 ![](upload/attach/202507/920134_BR7X2PVCPF64U5D.webp)

这时的运行结果没有任何提示，发现原来的so内有JNI_OnLoad函数和.init_array的段，.init_array 段的函数 在加载so时会自动执行，JNI_OnLoad需要手动调用mDalvikModule.callJNI_OnLoad(emulator);来执行；
 ![](upload/attach/202507/920134_TR7AWG2SARMJ8R7.webp)

这时的运行结果为RegisterNative动态注册了WBSecurity下的三个native函数，但是SLib的函数并没有注册；调用isUnpackSuccess()和getUnPackResult()两个结果，提示原so并没有解压成功。
 ![](upload/attach/202507/920134_FAQ34C4E5UH5V9E.webp)

这时就需要分析libslib.so这个文件，他的共享名称竟然是libsoshell.so，他的依赖库包含libziparchive-private.so，说明这是一个壳文件，在内部运行中调用zip来对原文件进行解压，生成的文件才是libslib.so文件。
 ![](upload/attach/202507/920134_SF8RDYN9W7DWPHT.webp)

其在init_array 内执行了解压的操作，sub_EEE0为关键的解压解压函数；
 ![](upload/attach/202507/920134_8P8X5Q5TEVSJBR9.webp)

这时的一个简单的方法是对这个ZIP解压的函数进行HOOK，就可以得到真正的libslib.so文件。
 ![](upload/attach/202507/920134_2C358Q9SY4VKVY2.webp)

使用Frida的trace功能来对init_array下的所有函数进行trace，发现其根本没有调用解压函数。

再比较真机上Frida的trace结果和unidbg的trace结果，发现其调用的流程发生了变化，有可能是根据环境来判断的执行流程，在diff两个trace结果时发现了许多的跳转错乱问题，这个壳是经过Obfuscator-LLVM clang version 4.0.1  (based on Obfuscator-LLVM 4.0.1)混淆的，流程已经发生了许多变化。

HOOK了libc的open函数，发现其在sub_EEE0中打开了/proc/self/maps文件和/lib/arm64/libslib.so 文件。其打开 maps 文件有可能是进行反调试，来查看进程运行的实时信息，也是为了得到libslib.so在Android系统中的绝对路径。

HOOK libc 的pread 函数，来查看so读取了壳文件的哪些内容，首先使用open来打开了/lib/arm64/libslib.so 这个动态库，返回的 fd 是 0x84，然后调用pread 来读取了文件的部分内容

```
一：读取了ELF的头文件 
pread arg 0: 0x84 
pread arg 1: 0x7febe06928 
pread arg 2: 0x40 
pread arg 3: 0x0

二：读取了0x6c008处的0x20个字节信息 
pread arg 0: 0x84 
pread arg 1: 0xb400007563533b98 
pread arg 2: 0x20 
pread arg 3: 0x6c008

三：再次读取了0x6c008出的0x20个字节的信息 
pread arg 0: 0x84 
pread arg 1: 0xb40000773365efd0 
pread arg 2: 0x20 
pread arg 3: 0x6c008

四：读取了0x0x6c028处的0x140个字节信息 
pread arg 0: 0x84 
pread arg 1: 0xb40000773365eff0 
pread arg 2: 0x140 
pread arg 3: 0x6c028 
 
五：读取了0x6c168处的0x40e28个字节的信息 
pread arg 0: 0x84 
pread arg 1: 0xb40000773365f1d0 
pread arg 2: 0x40e28 
pread arg 3: 0x6c168 
```

![](upload/attach/202507/920134_CFKEPC9JSXUN2JJ.webp)

其中目的地址并不是连续的，而从0xb40000773365efd0至0xb40000773365f1d0的地址是连续的，拷贝了0x6c008处的0x20个字节，0x6c028处的0x140个字节，0x6c168处的0x40e28 个字节。使用Python根据以上的信息拼接成一个文件来分析一下，生成的新的so 文件，还需要再次解压。

在进行trace的时候发现Frida的默认Stalker.follow并没有跟踪call 和arm 的bl，需要在设置events的call 为true，但是在我的运行环境，只要开启了这个选项，Frida运行就崩溃。

```
events: { 
    call: true, // CALL instructions: yes please 
    ret: false, // RET instructions 
    exec: false, // all instructions: not recommended as it's 
    block: false, // block executed: coarse execution trace 
    compile: false // block compiled: useful for coverage 
}
```

这段需要进行后续的详细分析，分析其解压的逻辑，其中其密文是确定的。

![](upload/attach/202507/920134_BVQ36DY7BB8XUJK.webp)

其执行流程为

```
一：打开/lib/arm64/libslib.so 文件； 
open arg: /data/app/~~M0_AMbekAj3bHBcAv32Zmg==/com.sina.weibo
1yMlgldzELG6p0wvPZePqw==/lib/arm64/libslib.so 
open retval: 0x87

二：依次读取/lib/arm64/libslib.so 各段的地址内容；读取密文至0xb400007733604fd0 的开始处。 
pread arg 0: 0x87 
pread arg 1: 0xb400007733604fd0 
pread arg 2: 0x20 
pread arg 3: 0x6c008 
pread arg 0: 0x87 
pread arg 1: 0xb400007733604ff0 
pread arg 2: 0x140 
pread arg 3: 0x6c028 
pread arg 0: 0x87 
pread arg 1: 0xb4000077336051d0 
pread arg 2: 0x40e28 
pread arg 3: 0x6c168 
 
三：按照内部的解压函数，来解压0xb400007733604fd0开始处的密文； 
 
 
四：将解压后的内容拷贝至0x7733370000处； 
memcpy arg 0: 0x7733370000 
memcpy arg 1: 0xb400007733604fd0 
memcpy arg 2: 0x3f5b8 
 
memcpy arg 0: 0x77333bf000 
memcpy arg 1: 0xb400007733643fd0 
memcpy arg 2: 0x1ed4 
 
五：设置0x7733370000处的内容执行权限为执行权限； 
 
mprotect arg 0: 0x7733370000 
mprotect arg 1: 0x3f5b8 
 
mprotect arg 0: 0x77333bf000 
mprotect arg 1: 0x1ed4 
```

详细信息：

```
open onEnter: 0x7745350f00 
open arg: /data/app/~~M0_AMbekAj3bHBcAv32Zmg==/com.sina.weibo
1yMlgldzELG6p0wvPZePqw==/lib/arm64/libslib.so 
open retval: 0x87 
open onLeave: 0x7745350f00 
pread onEnter: 0x77453aba80 
pread arg 0: 0x87 
pread arg 1: 0xb400007733604fd0 
pread arg 2: 0x20 
pread arg 3: 0x6c008 
pread onLeave: 0x77453aba80 
pread onEnter: 0x77453aba80 
pread arg 0: 0x87 
pread arg 1: 0xb400007733604ff0 
pread arg 2: 0x140 
pread arg 3: 0x6c028 
pread onLeave: 0x77453aba80 
pread onEnter: 0x77453aba80 
pread arg 0: 0x87 
pread arg 1: 0xb4000077336051d0 
pread arg 2: 0x40e28 
pread arg 3: 0x6c168 
pread onLeave: 0x77453aba80 
memcpy onEnter: 0x774533c480 
memcpy arg 0: 0x7733370000 
memcpy arg 1: 0xb400007733604fd0 
memcpy arg 2: 0x3f5b8 
memcpy onLeave: 0x774533c480 
mprotect onEnter: 0x77453abc40 
mprotect arg 0: 0x7733370000 
mprotect arg 1: 0x3f5b8 
mprotect onLeave: 0x77453abc40 
memcpy onEnter: 0x774533c480 
memcpy arg 0: 0x77333bf000 
memcpy arg 1: 0xb400007733643fd0 
memcpy arg 2: 0x1ed4 
memcpy onLeave: 0x774533c480 
mprotect onEnter: 0x77453abc40 
mprotect arg 0: 0x77333bf000 
mprotect arg 1: 0x1ed4 
mprotect onLeave: 0x77453abc40 
```

***

**其他的解决方案:**

HOOK真机上的RegisterNatives函数（a5cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6D9j5i4y4@1K9h3&6Y4i4K6u0V1P5h3q4F1k6#2)9J5c8X3k6J5K9h3c8S2i4K6g2X3K9r3!0G2K9#2)9#2k6X3I4A6j5X3q4J5N6q4!0q4c8W2!0n7b7#2)9^5z5g2!0q4c8W2!0n7b7#2)9^5b7#2!0q4y4W2)9&6c8q4!0m8y4g2!0q4y4W2)9^5z5g2)9&6x3#2!0q4y4g2)9^5c8q4!0n7x3q4!0q4y4q4!0n7z5q4)9^5x3q4!0q4y4q4!0n7z5q4)9^5b7W2!0q4z5q4!0n7x3q4)9^5x3#2!0q4z5q4!0m8c8W2)9&6y4g2!0q4y4#2)9&6b7g2)9^5y4q4!0q4y4#2!0n7b7W2)9&6x3#2!0q4y4W2)9&6c8g2)9&6b7#2!0q4x3#2)9^5x3q4)9^5x3R3`.`.

发现其动态注册了SLib的nativeInit函数和nativeNewCalculateS函数，并且给出了其调用动态注册函数的地址和nativeInit函数和nativeNewCalculateS函数的地址。

![](upload/attach/202507/920134_WG5VM7ETCZSSZG9.webp)

现在只需要根据nativeInit的地址来找到在maps中对应的so文件的起始地址和结束地址，使用Frida的dump功能将内存dump下来就是脱壳后的so文件。

***

**ELF 头文件修复**

内存DUMP的so文件的ELF的头是损坏的，与原来的libslib的壳头文件相比，前0x200处的头不一致，从0x200开始一致。

脱壳后我ELF头如下：
 ![](upload/attach/202507/920134_65AQ96NV6E4RCDM.webp)

原始的libslib 的头文件如下：
 ![](upload/attach/202507/920134_TYFR9Y2VMECSE2H.webp)

将libslib 的原始的前0x200个头拷贝至脱壳文件，然后修改内存dump文件的elf_header各项的值为其真实的值；

将Section header table 的所有项的值都置为0；主要是修复Program header table 各项的值；
 ![](upload/attach/202507/920134_HF2YHZG9MD6VSMG.webp)

主要是修复program_header_table 的各项的值：
 ![](upload/attach/202507/920134_ASKFSD9MHZJSTH5.webp)

其中 (R_X) Loadable Segment 和 (RW_) Loadable Segment ,可以根据内存的 maps 信息，来查看各个段的执行权限和读写权限；为方便我将所有的地址都设置为RWX权限；

(RW_) Dynamic Segment 就是动态表的地址，他与got表相关，需要在找到其动态表的开始地址；可以根据原libslib的特征值，来找到动态段的开始地址；

![](upload/attach/202507/920134_V9KP84CE3G4BAY7.webp)

其他的各项值都设置为了0：

```
(R__) Note 
(R__) Note 
(R__) GCC .eh_frame_hdr Segment 
(RW_) GNU Stack (executability) 
(R__) GNU Read-only After Relocation
```

修复后的信息如下: 
 ![](upload/attach/202507/920134_U8GDRYF4YEKKP5Z.webp)

![](upload/attach/202507/920134_74ZT4Z262A8NVUT.webp)

IDA 打开修复后的文件，发现其动态库的名称已经有libsoshell.so变为了libslib.so, 动态库的依赖也发生了变化，不再依赖libziparchive-private.so。
 ![](upload/attach/202507/920134_3ZE7FA8UBA4UPPX.webp)

GOT表的修复也正常，错误的GOT表__imp_内容显示的就是0x开始的内存地址。
 ![](upload/attach/202507/920134_U7EB6ETHNDGAG2U.webp)

代码执行处的内容显示为：
 ![](upload/attach/202507/920134_A9RGXKN4JR3BHCA.webp)

字符串处也出现了 nativeInit 和nativeNewCalculateS函数名称，和PackageManager 、PackageInfo 和 Signature 的Android的签名校验的类。
 ![](upload/attach/202507/920134_58DZ8WBVNFPDXGS.webp)

把修复后的脱壳文件放到unidbg-android项目中，调用JNI_OnLoad加载函数mDalvikModule.callJNI_OnLoad(emulator) 出现动态成功的信息。
 ![](upload/attach/202507/920134_J528A57GNFXV3UA.webp)

***

现在只需要按照要求调用nativeInit(Ljava/lang/String;)V 来初始化环境，和调用
nativeNewCalculateS(Landroid/content/Context;Ljava/lang/String;I)Ljava/lang/String;来计算 S 值即可。

调用nativeInit 的代码如下：

```
public void nativeInit(){

String M = "10EA095010"; 
    String N = "10EA095010"; 
    String O = "10EA095060";

String nativeInit = "nativeInit(Ljava/lang/String;)V"; 
    SLib.callStaticJniMethod(emulator, nativeInit, M);

} 
```

提示调用成功图如下：
 ![](upload/attach/202507/920134_7FP9UN44RSN96YJ.webp)

调用nativeNewCalculateS 的函数代码如下：

```
public void nativeNewCalculateS(){

Object custom = null;

DvmObject context = 
    vm.resolveClass("android/content/Context").newObject(custom); 
    System.out.println(context);

String str = "2015876998797";

int mode = 3;

String nativeNewCalculateS = 
    "nativeNewCalculateS(Landroid/content/Context;Ljava/lang/String;I)Ljava/
     lang/String;";

Object obj = SLib.callStaticJniMethodObject(emulator, 
    nativeNewCalculateS, context, str, mode);

System.out.println(obj); 
}
```
运行报错，提示信息如下：
 ![](upload/attach/202507/920134_UZ7ZXFPNTZGP9FH.webp)

日志信息如下

```
FindClass(android/content/ContextWrapper) was called from 
RX@0x120046a0[libslib.so]0x46a0 
JNIEnv->GetMethodID(android/content/ContextWrapper.getPackageManager()La
 ndroid/content/pm/PackageManager;) => 0x53f2c391 was called from 
RX@0x12004440[libslib.so]0x4440 
JNIEnv->FindClass(android/content/pm/PackageManager) was called from 
RX@0x120047f8[libslib.so]0x47f8 
[17:05:57 267]  WARN [com.github.unidbg.linux.ARM64SyscallHandler] 
(ARM64SyscallHandler:410) - handleInterrupt intno=2, NR=-130432, 
svcNumber=0x11f, PC=unidbg@0xfffe0284, 
LR=RX@0x12004af8[libslib.so]0x4af8, syscall=null 
com.github.unidbg.arm.backend.BackendException: 
dvmObject=android.content.Context@50675690, dvmClass=class 
android/content/Context, jmethodID=unidbg@0x53f2c391 
 at 
com.github.unidbg.linux.android.dvm.DalvikVM64$32.handle(DalvikVM64.java
 :556) 
 at 
com.github.unidbg.linux.ARM64SyscallHandler.hook(ARM64SyscallHandler.jav
 a:119) 
 at 
com.github.unidbg.arm.backend.Unicorn2Backend$11.hook(Unicorn2Backend.ja
 va:352) 
 at 
com.github.unidbg.arm.backend.unicorn.Unicorn$NewHook.onInterrupt(Unicor
 n.java:109) 
 at com.github.unidbg.arm.backend.unicorn.Unicorn.emu_start(Native 
Method) 
 at 
com.github.unidbg.arm.backend.unicorn.Unicorn.emu_start(Unicorn.java:312
 ) 
 at 
com.github.unidbg.arm.backend.Unicorn2Backend.emu_start(Unicorn2Backend.
 java:389) 
 at 
com.github.unidbg.AbstractEmulator.emulate(AbstractEmulator.java:378) 
 at com.github.unidbg.thread.Function64.run(Function64.java:39) 
 at com.github.unidbg.thread.MainTask.dispatch(MainTask.java:19) 
 at 
com.github.unidbg.thread.UniThreadDispatcher.run(UniThreadDispatcher.jav
 a:165) 
 at 
com.github.unidbg.thread.UniThreadDispatcher.runMainForResult(UniThreadD
 ispatcher.java:97) 
 at 
com.github.unidbg.AbstractEmulator.runMainForResult(AbstractEmulator.jav
 a:341) 
 at 
com.github.unidbg.arm.AbstractARM64Emulator.eFunc(AbstractARM64Emulator.
 java:262) 
 at com.github.unidbg.Module.emulateFunction(Module.java:163) 
 at 
com.github.unidbg.linux.android.dvm.DvmObject.callJniMethod(DvmObject.ja
 va:135) 
 at 
com.github.unidbg.linux.android.dvm.DvmClass.callStaticJniMethodObject(D
 vmClass.java:316) 
at com.sina.weibo.security.SLib.nativeNewCalculateS(SLib.java:70) 
at com.sina.weibo.security.SLib.main(SLib.java:91) 
[17:05:57 269]  WARN [com.github.unidbg.AbstractEmulator] 
(AbstractEmulator:417) - emulate RX@0x1200241c[libslib.so]0x241c 
exception sp=unidbg@0xe4fff1d0, 
msg=dvmObject=android.content.Context@50675690, dvmClass=class 
android/content/Context, jmethodID=unidbg@0x53f2c391, offset=12ms @ 
Runnable|Function64 address=0x1200241c, arguments=[unidbg@0xfffe1640, 
1627241951, 1348949648, 834133664, 3] 
Null
```

根据其提示的信息android/content/pm/PackageManager 可以断定其主要功能为获取APK的签名信息，来进行环境判断，是进行反调试的功能。其android/content/Context的获取就是我们传进去的第一个参数。

定位其出错的信息DalvikVM64.java:556 处的代码如下： 
 ![](upload/attach/202507/920134_D9BVAHC2EJ29FAY.webp)

其报错的主要原因是dvmClass 根据jmethodID来找DvmMethod发生错误，错误的原因有可能是我们传入参数android/content/Context 时发生错误。

定位Android 源码，我们发现Context 类和getPackageManager的方法都是abstract抽象的，Java的抽象类不能被实例化，他的实现方法必须由子类来继承和实现。

![](upload/attach/202507/920134_QVGC3YQQ6DN8GHD.webp)

继续分析错误提示，jmethodID=unidbg@0x53f2c391 这个报错，而这个jmethodID的值是从JNIEnv->GetMethodID(android/content/ContextWrapper.getPackageManager()Landroid/content/pm/PackageManager;) => 0x53f2c391 处获取的，而参数传入的是他的父类android/content/Context，应该修改为他自己的类名android/content/ContextWrapper。

修改后这段代码调试通过，不再提示错误。

新的错误提示信息如下：
 ![](upload/attach/202507/920134_MZYEJ9JESS2JPJ3.webp)

日志信息如下

```
JNIEnv->GetStringUtfChars("2015876998797") was called from 
RX@0x1203b48c[libslib.so]0x3b48c 
JNIEnv->ReleaseStringUTFChars("2015876998797") was called from 
RX@0x1203b390[libslib.so]0x3b390 
[18:23:33 969]  WARN [com.github.unidbg.linux.ARM64SyscallHandler] 
(ARM64SyscallHandler:410) - handleInterrupt intno=2, NR=-128048, 
svcNumber=0x1b4, PC=unidbg@0xfffe0bd4, 
LR=RX@0x1203b3d4[libslib.so]0x3b3d4, syscall=null 
java.lang.NullPointerException 
 at java.util.Objects.requireNonNull(Objects.java:203) 
 at 
com.github.unidbg.linux.android.dvm.DalvikVM64$181.handle(DalvikVM64.jav
 a:2962) 
 at 
com.github.unidbg.linux.ARM64SyscallHandler.hook(ARM64SyscallHandler.jav
 a:119) 
 at 
com.github.unidbg.arm.backend.Unicorn2Backend$11.hook(Unicorn2Backend.ja
 va:352) 
 at 
com.github.unidbg.arm.backend.unicorn.Unicorn$NewHook.onInterrupt(Unicor
 n.java:109) 
 at com.github.unidbg.arm.backend.unicorn.Unicorn.emu_start(Native 
Method) 
 at 
com.github.unidbg.arm.backend.unicorn.Unicorn.emu_start(Unicorn.java:312
 ) 
 at 
com.github.unidbg.arm.backend.Unicorn2Backend.emu_start(Unicorn2Backend.
 java:389) 
 at 
com.github.unidbg.AbstractEmulator.emulate(AbstractEmulator.java:378) 
 at com.github.unidbg.thread.Function64.run(Function64.java:39) 
 at com.github.unidbg.thread.MainTask.dispatch(MainTask.java:19) 
 at 
com.github.unidbg.thread.UniThreadDispatcher.run(UniThreadDispatcher.jav
 a:165) 
 at 
com.github.unidbg.thread.UniThreadDispatcher.runMainForResult(UniThreadD
 ispatcher.java:97) 
 at 
com.github.unidbg.AbstractEmulator.runMainForResult(AbstractEmulator.jav
 a:341) 
 at 
com.github.unidbg.arm.AbstractARM64Emulator.eFunc(AbstractARM64Emulator.
 java:262) 
 at com.github.unidbg.Module.emulateFunction(Module.java:163) 
 at 
com.github.unidbg.linux.android.dvm.DvmObject.callJniMethod(DvmObject.ja
 va:135) 
 at 
com.github.unidbg.linux.android.dvm.DvmClass.callStaticJniMethodObject(D
 vmClass.java:316) 
 at com.sina.weibo.security.SLib.nativeNewCalculateS(SLib.java:70) 
 at com.sina.weibo.security.SLib.main(SLib.java:91) 
```

提示的信息为java.lang.NullPointerException，可能的原因是C环境的指针传入Java环境内错误。 
 
启用调试模式，在03B3D0处下断点。
```
public void setDebug(){ 
 
    Module module = mDalvikModule.getModule(); 
    Debugger debugger = emulator.attach(DebuggerType.CONSOLE); 
    debugger.addBreakPoint(module.base+0x03B3D0); 
 
}
```

根据其汇编代码，可以确定其三个参数为 X0 X1 X8 ,根据错误的提示信息，可以确定其是JNI调用的Java代码，X0 和 X1 是参数，X8是地址。 
 ![](upload/attach/202507/920134_RSYV6QMQMY474R5.webp)

![](upload/attach/202507/920134_QGKHTEG9NK72WRW.webp)

```
x0=0xfffe1640(-125376) x1=0x3930015a x8=0xfffe0bd0 
```

s 进入发现其调用的是svc软中断，来调用Java代码。
 ![](upload/attach/202507/920134_JM337PA3U3TV8AB.webp)
```
LDR             X8, [X8,#0x520] 中的 0x520 就是SVC 的偏移值。 
```

在log4j.properties 文件开启 log4j.logger.com.github.unidbg.linux.android.dvm=DEBUG 的调试模式。
 ![](upload/attach/202507/920134_DQDWFA6R67SN2UC.webp)

日志信息如下

```
svcNumber=0x1b4, PC=unidbg@0xfffe0bd4, 
LR=RX@0x1203b3d4[libslib.so]0x3b3d4, syscall=null 
java.lang.NullPointerException 
 at java.util.Objects.requireNonNull(Objects.java:203) 
 at 
com.github.unidbg.linux.android.dvm.DalvikVM64$181.handle(DalvikVM64.jav
 a:2962) 
 at 
com.github.unidbg.linux.ARM64SyscallHandler.hook(ARM64SyscallHandler.jav
 a:119) 
 at 
com.github.unidbg.arm.backend.Unicorn2Backend$11.hook(Unicorn2Backend.ja
 va:352) 
 at 
com.github.unidbg.arm.backend.unicorn.Unicorn$NewHook.onInterrupt(Unicor
 n.java:109) 
 at com.github.unidbg.arm.backend.unicorn.Unicorn.emu_start(Native 
Method) 
 at 
com.github.unidbg.arm.backend.unicorn.Unicorn.emu_start(Unicorn.java:312
 ) 
 at 
com.github.unidbg.arm.backend.Unicorn2Backend.emu_start(Unicorn2Backend.
 java:389) 
 at 
com.github.unidbg.AbstractEmulator.emulate(AbstractEmulator.java:378) 
 at com.github.unidbg.thread.Function64.run(Function64.java:39) 
 at com.github.unidbg.thread.MainTask.dispatch(MainTask.java:19) 
 at 
com.github.unidbg.thread.UniThreadDispatcher.run(UniThreadDispatcher.jav
 a:165) 
 at 
com.github.unidbg.thread.UniThreadDispatcher.runMainForResult(UniThreadD
 ispatcher.java:97) 
 at 
com.github.unidbg.AbstractEmulator.runMainForResult(AbstractEmulator.jav
 a:341) 
 at 
com.github.unidbg.arm.AbstractARM64Emulator.eFunc(AbstractARM64Emulator.
 java:262) 
 at com.github.unidbg.Module.emulateFunction(Module.java:163) 
at 
com.github.unidbg.linux.android.dvm.DvmObject.callJniMethod(DvmObject.ja
 va:135) 
at 
com.github.unidbg.linux.android.dvm.DvmClass.callStaticJniMethodObject(D
 vmClass.java:316) 
at com.sina.weibo.security.SLib.nativeNewCalculateS(SLib.java:80) 
at com.sina.weibo.security.SLib.main(SLib.java:102)
```

提示的错误信息是string类型为NULL，所以提示NULL指针错误。

提示错误的代码为：
 ![](upload/attach/202507/920134_6D46YX65RMWQH27.webp)

基本功能是_GetStringLength 返回字符串的长度，其对应的offset正是前述的0x520。
 ![](upload/attach/202507/920134_WEX9UABKMX4A8S5.webp)

正常的调用_GetStringLength 方法的参数：

```
x0=0xfffe1640(-125376) x1=0x3930015a x8=0xfffe0bd0 
```

报错时调用_GetStringLength 方法的参数：

```
x0=0xfffe1640(-125376) x1=0x31aa x8=0xfffe0bd0 
```

可以确定为x1=0x31aa为NULL,查看函数的调用栈，发现了0x00F160处的代码如下：
 ![](upload/attach/202507/920134_ESHFRDDG78W63GY.webp)

第一次调用sub_3B4E4是正常的，第二次调用sub_3B4E4就出现了NULL指针的错误，而qword_50F58 的值正是0x31AA。
 ![](upload/attach/202507/920134_HE83RX65MDBFGVP.webp)

因为这个SO是从内存dump的，0x50F58处的值为运行时的信息，查看0x50F58处的引用，发现有STR用于写值。
 ![](upload/attach/202507/920134_2Z8XHSPM55SR7UF.webp)

在0x00E9A8处是写值到0x050F58，在0x00E9A8处下断点，发现根本没有执行，这个有可能是因为0x050F58处已经有值，所以就不再写值。 
 
在0x50F58处下内存访问断点

```
public void setMemoryHook(){ 
    Module module = mDalvikModule.getModule(); 
 
    emulator.getBackend().hook_add_new(new ReadHook() { 
        private UnHook unHook; 
 
        @Override 
        public void hook(Backend backend, long address, int size, Object user) { 
            String hexAddress = Long.toHexString(address - module.base); 
            System.err.println("ReadHook Address: 0x" + hexAddress); 
            System.err.println("user: " + user); 
            AndroidEmulator muser = (AndroidEmulator)user; 
            System.err.println("MemoryHook PC: " + muser.getContext().getPCPointer()); 
        } 
 
        @Override 
        public void onAttach(UnHook unHook) { 
            this.unHook = unHook; 
        } 
 
        @Override 
        public void detach() { 
            this.unHook.unhook(); 
        } 
    }, module.base + 0x50F58, module.base + 0x50F58 + 8L, emulator); 
 
}
```
 
提示信息如下： 
 ![](upload/attach/202507/920134_8VG8VAMKA3V3S3B.webp)

第一个值0xeb88为判断是否为0的代码，第二个值0xf17c就是调用其报错的代码。 
 ![](upload/attach/202507/920134_542VGHCKF6PHTRV.webp)

提示e_shnum is SHN_UNDEF(0) 错误，修改 ELF的头的项值：e_shnum_NUMBER_OF_SECTION_HEADER_ENTRIES 为 1 。

![](upload/attach/202507/920134_FSAMJ9BBQUR8WTH.webp)

动态修改0x50F58处的值为0； 
```
public void fix_0x50F58(){ 
    Module module = mDalvikModule.getModule(); 
    Pointer pointer_base = UnidbgPointer.pointer(emulator, module.base); 
    pointer_base.setLong(0x50F58, 0x0); 
}
```

修改后运行正常取得S的值。

![](upload/attach/202507/920134_6DTU4D8HTHK5K9V.webp)

完整的运行信息如下：

```
[20:46:10 870] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x76f84423, global=true 
[20:46:10 871] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x1fd6c1a, global=true 
[20:46:10 871] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x76f84423, global=true 
[20:46:10 871] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffff9f024221, global=true 
[20:46:10 871] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikModule] 
(DalvikModule:31) - Call [libslib.so]JNI_OnLoad: 0x1200274c 
[20:46:10 872] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$232:3878) - AttachCurrentThread vm=unidbg@0xfffe0080, 
env=null, args=null 
JNIEnv->FindClass(com/sina/weibo/security/SLib) was called from 
RWX@0x120026d4[libslib.so]0x26d4 
[20:46:10 873] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffff9f024221, global=true 
[20:46:10 873] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$3:87) - FindClass env=unidbg@0xfffe1640, 
className=com/sina/weibo/security/SLib, hash=0x9f024221 
[20:46:10 873] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$212:3366) - RegisterNatives dvmClass=class 
com/sina/weibo/security/SLib, 
methods=RWX@0x12050008[libslib.so]0x50008, nMethods=8 
JNIEnv->RegisterNatives(com/sina/weibo/security/SLib, 
RWX@0x12050008[libslib.so]0x50008, 8) was called from 
RWX@0x1200259c[libslib.so]0x259c 
[20:46:10 874] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$212:3379) - RegisterNatives dvmClass=class 
com/sina/weibo/security/SLib, name=nativeInit, 
signature=(Ljava/lang/String;)V, 
fnPtr=RWX@0x120023b8[libslib.so]0x23b8 
RegisterNative(com/sina/weibo/security/SLib, 
nativeInit(Ljava/lang/String;)V, 
RWX@0x120023b8[libslib.so]0x23b8) 
[20:46:10 874] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$212:3379) - RegisterNatives dvmClass=class 
com/sina/weibo/security/SLib, name=nativeNewCalculateS, 
signature=(Landroid/content/Context;Ljava/lang/String;I)Ljava/lan
 g/String;, fnPtr=RWX@0x1200241c[libslib.so]0x241c 
RegisterNative(com/sina/weibo/security/SLib, 
nativeNewCalculateS(Landroid/content/Context;Ljava/lang/String;I)
 Ljava/lang/String;, RWX@0x1200241c[libslib.so]0x241c) 
[20:46:10 874] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$212:3379) - RegisterNatives dvmClass=class 
com/sina/weibo/security/SLib, name=nativeGetV1TimeCost, 
signature=()J, fnPtr=RWX@0x12002080[libslib.so]0x2080 
RegisterNative(com/sina/weibo/security/SLib, 
nativeGetV1TimeCost()J, RWX@0x12002080[libslib.so]0x2080) 
[20:46:10 874] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$212:3379) - RegisterNatives dvmClass=class 
com/sina/weibo/security/SLib, name=nativeGetV2TimeCost, 
signature=()J, fnPtr=RWX@0x12002150[libslib.so]0x2150 
RegisterNative(com/sina/weibo/security/SLib, 
nativeGetV2TimeCost()J, RWX@0x12002150[libslib.so]0x2150) 
[20:46:10 874] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$212:3379) - RegisterNatives dvmClass=class 
com/sina/weibo/security/SLib, name=nativeCheck, signature=()Z, 
fnPtr=RWX@0x120022e4[libslib.so]0x22e4 
RegisterNative(com/sina/weibo/security/SLib, nativeCheck()Z, 
RWX@0x120022e4[libslib.so]0x22e4) 
[20:46:10 874] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$212:3379) - RegisterNatives dvmClass=class 
com/sina/weibo/security/SLib, name=nativeGetCheckErr, 
signature=()Ljava/lang/String;, 
fnPtr=RWX@0x12001e08[libslib.so]0x1e08 
RegisterNative(com/sina/weibo/security/SLib, 
nativeGetCheckErr()Ljava/lang/String;, 
RWX@0x12001e08[libslib.so]0x1e08) 
[20:46:10 876] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$212:3379) - RegisterNatives dvmClass=class 
com/sina/weibo/security/SLib, name=nativeGetCheckErrType, 
signature=()I, fnPtr=RWX@0x12001fb8[libslib.so]0x1fb8 
RegisterNative(com/sina/weibo/security/SLib, 
nativeGetCheckErrType()I, RWX@0x12001fb8[libslib.so]0x1fb8) 
[20:46:10 876] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$212:3379) - RegisterNatives dvmClass=class 
com/sina/weibo/security/SLib, name=nativeGetPkgTimeCost, 
signature=()J, fnPtr=RWX@0x12002218[libslib.so]0x2218 
RegisterNative(com/sina/weibo/security/SLib, 
nativeGetPkgTimeCost()J, RWX@0x12002218[libslib.so]0x2218) 
[20:46:10 876] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0x9f024221 
[20:46:10 877] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikModule] 
(DalvikModule:36) - Call [libslib.so]JNI_OnLoad finished: 
version=0x10006, offset=6ms 
Find native function Java_com_sina_weibo_security_SLib_nativeInit 
=> RWX@0x120023b8[libslib.so]0x23b8 
[20:46:10 877] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffff9f024221, global=false 
[20:46:10 878] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x76f84423, global=true 
[20:46:10 878] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffff83d61724, global=true 
[20:46:10 878] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x17ed40e0, global=false 
[20:46:10 878] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$18:268) - NewGlobalRef object=unidbg@0x17ed40e0, 
dvmObject="10EA095010" 
JNIEnv->NewGlobalRef("10EA095010") was called from 
RWX@0x120023f0[libslib.so]0x23f0 
[20:46:10 879] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x17ed40e0, global=true 
[20:46:10 894] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x76f84423, global=true 
[20:46:10 894] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffffd2318c19, global=true 
android.content.ContextWrapper@50675690 
Find native function 
Java_com_sina_weibo_security_SLib_nativeNewCalculateS => 
RWX@0x1200241c[libslib.so]0x241c 
[20:46:10 895] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffff9f024221, global=false 
[20:46:10 895] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x50675690, global=false 
[20:46:10 895] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffff83d61724, global=true 
[20:46:10 895] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x31b7dea0, global=false 
JNIEnv->FindClass(android/content/ContextWrapper) was called from 
RWX@0x120046a0[libslib.so]0x46a0 
[20:46:10 896] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffffd2318c19, global=true 
[20:46:10 896] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$3:87) - FindClass env=unidbg@0xfffe1640, 
className=android/content/ContextWrapper, hash=0xd2318c19 
[20:46:10 897] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$30:502) - GetMethodID class=unidbg@0xd2318c19, 
methodName=getPackageManager, 
args=()Landroid/content/pm/PackageManager;, 
LR=RWX@0x12004440[libslib.so]0x4440 
[20:46:10 897] DEBUG 
[com.github.unidbg.linux.android.dvm.DvmClass] (DvmClass:133) - 
getMethodID 
signature=android/content/ContextWrapper->getPackageManager()Land
 roid/content/pm/PackageManager;, hash=0x53f2c391 
JNIEnv->GetMethodID(android/content/ContextWrapper.getPackageMana
 ger()Landroid/content/pm/PackageManager;) => 0x53f2c391 was 
called from RWX@0x12004440[libslib.so]0x4440 
JNIEnv->FindClass(android/content/pm/PackageManager) was called 
from RWX@0x120047f8[libslib.so]0x47f8 
[20:46:10 898] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x76f84423, global=true 
[20:46:10 898] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffffdd884762, global=true 
[20:46:10 898] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$3:87) - FindClass env=unidbg@0xfffe1640, 
className=android/content/pm/PackageManager, hash=0xdd884762 
[20:46:10 898] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$32:550) - CallObjectMethodV object=unidbg@0x50675690, 
jmethodID=unidbg@0x53f2c391, va_list=unidbg@0xe4fff290, 
lr=RWX@0x12004af8[libslib.so]0x4af8 
[20:46:10 898] DEBUG 
[com.github.unidbg.linux.android.dvm.VaList64] (VaList64:131) - 
VaList64 base_p=0xe4fff300, base_integer=0xe4fff290, 
base_float=0xe4fff260, mask_integer=0xffffffd8, 
mask_float=0xffffff80, 
args=()Landroid/content/pm/PackageManager;, shorty=[] 
[20:46:10 898] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffffdd884762, global=true 
JNIEnv->CallObjectMethodV(android.content.ContextWrapper@50675690
 , getPackageManager() => 
android.content.pm.PackageManager@47d384ee) was called from 
RWX@0x12004af8[libslib.so]0x4af8 
[20:46:10 899] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x47d384ee, global=false 
JNIEnv->FindClass(android/content/pm/PackageInfo) was called from 
RWX@0x120049ec[libslib.so]0x49ec 
[20:46:10 899] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x76f84423, global=true 
[20:46:10 899] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x30f944f7, global=true 
[20:46:10 899] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$3:87) - FindClass env=unidbg@0xfffe1640, 
className=android/content/pm/PackageInfo, hash=0x30f944f7 
[20:46:10 899] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$30:502) - GetMethodID class=unidbg@0xdd884762, 
methodName=getPackageInfo, 
args=(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;, 
LR=RWX@0x12004700[libslib.so]0x4700 
[20:46:10 899] DEBUG 
[com.github.unidbg.linux.android.dvm.DvmClass] (DvmClass:133) - 
getMethodID 
signature=android/content/pm/PackageManager->getPackageInfo(Ljava
 /lang/String;I)Landroid/content/pm/PackageInfo;, hash=0x3bca8377 
JNIEnv->GetMethodID(android/content/pm/PackageManager.getPackageI
 nfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;) => 
0x3bca8377 was called from RWX@0x12004700[libslib.so]0x4700 
[20:46:10 900] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$30:502) - GetMethodID class=unidbg@0xd2318c19, 
methodName=getPackageName, args=()Ljava/lang/String;, 
LR=RWX@0x12004964[libslib.so]0x4964 
[20:46:10 900] DEBUG 
[com.github.unidbg.linux.android.dvm.DvmClass] (DvmClass:133) - 
getMethodID 
signature=android/content/ContextWrapper->getPackageName()Ljava/l
 ang/String;, hash=0xffffffff8bcc2d71 
JNIEnv->GetMethodID(android/content/ContextWrapper.getPackageName
 ()Ljava/lang/String;) => 0x8bcc2d71 was called from 
RWX@0x12004964[libslib.so]0x4964 
[20:46:10 900] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$32:550) - CallObjectMethodV object=unidbg@0x50675690, 
jmethodID=unidbg@0xffffffff8bcc2d71, va_list=unidbg@0xe4fff290, 
lr=RWX@0x12004af8[libslib.so]0x4af8 
[20:46:10 900] DEBUG 
[com.github.unidbg.linux.android.dvm.VaList64] (VaList64:131) - 
VaList64 base_p=0xe4fff300, base_integer=0xe4fff290, 
base_float=0xe4fff260, mask_integer=0xffffffd8, 
mask_float=0xffffff80, args=()Ljava/lang/String;, shorty=[] 
[20:46:11 012] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffff83d61724, global=true 
JNIEnv->CallObjectMethodV(android.content.ContextWrapper@50675690
 , getPackageName() => "com.sina.weibo") was called from 
RWX@0x12004af8[libslib.so]0x4af8 
[20:46:11 013] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x506e6d5e, global=false 
[20:46:11 013] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$32:550) - CallObjectMethodV object=unidbg@0x47d384ee, 
jmethodID=unidbg@0x3bca8377, va_list=unidbg@0xe4fff290, 
lr=RWX@0x12004af8[libslib.so]0x4af8 
[20:46:11 013] DEBUG 
[com.github.unidbg.linux.android.dvm.VaList64] (VaList64:131) - 
VaList64 base_p=0xe4fff300, base_integer=0xe4fff290, 
base_float=0xe4fff260, mask_integer=0xffffffe8, 
mask_float=0xffffff80, 
args=(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;, 
shorty=[Ljava/lang/String;, I] 
[20:46:11 013] DEBUG 
[com.github.unidbg.linux.android.dvm.AbstractJni] 
(AbstractJni:318) - callObjectMethodV getPackageInfo 
packageName=com.sina.weibo, flags=0x40 
[20:46:11 013] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x30f944f7, global=true 
JNIEnv->CallObjectMethodV(android.content.pm.PackageManager@47d38
 4ee, getPackageInfo("com.sina.weibo", 0x40) => 
android.content.pm.PackageInfo@96532d6) was called from 
RWX@0x12004af8[libslib.so]0x4af8 
[20:46:11 014] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x96532d6, global=false 
[20:46:11 014] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$12:203) - ExceptionOccurred: 0x0 
[20:46:11 014] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$91:1406) - GetFieldID class=unidbg@0x30f944f7, 
fieldName=signatures, args=[Landroid/content/pm/Signature; 
[20:46:11 014] DEBUG 
[com.github.unidbg.linux.android.dvm.DvmClass] (DvmClass:167) - 
getFieldID 
signature=android/content/pm/PackageInfo->signatures:[Landroid/co
 ntent/pm/Signature;, hash=0x25f17218 
JNIEnv->GetFieldID(android/content/pm/PackageInfo.signatures 
[Landroid/content/pm/Signature;) => 0x25f17218 was called from 
RWX@0x12004794[libslib.so]0x4794 
[20:46:11 015] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$92:1428) - GetObjectField object=unidbg@0x96532d6, 
jfieldID=unidbg@0x25f17218 
[20:46:11 055] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x76f84423, global=true 
[20:46:11 055] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffffdb4a449b, global=true 
JNIEnv->GetObjectField(android.content.pm.PackageInfo@96532d6, 
signatures [Landroid/content/pm/Signature; => 
[android.content.pm.Signature@3551a94]) was called from 
RWX@0x12004618[libslib.so]0x4618 
[20:46:11 055] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x531be3c5, global=false 
JNIEnv->FindClass(android/content/pm/Signature) was called from 
RWX@0x1200473c[libslib.so]0x473c 
[20:46:11 055] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffffdb4a449b, global=true 
[20:46:11 055] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$3:87) - FindClass env=unidbg@0xfffe1640, 
className=android/content/pm/Signature, hash=0xdb4a449b 
[20:46:11 056] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$30:502) - GetMethodID class=unidbg@0xdb4a449b, 
methodName=toByteArray, args=()[B, 
LR=RWX@0x120045ac[libslib.so]0x45ac 
[20:46:11 056] DEBUG 
[com.github.unidbg.linux.android.dvm.DvmClass] (DvmClass:133) - 
getMethodID 
signature=android/content/pm/Signature->toByteArray()[B, 
hash=0x6a3e2031 
JNIEnv->GetMethodID(android/content/pm/Signature.toByteArray()[B) 
=> 0x6a3e2031 was called from RWX@0x120045ac[libslib.so]0x45ac 
[20:46:11 056] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$163:2693) - GetObjectArrayElement 
array=[android.content.pm.Signature@3551a94], index=0 
JNIEnv->GetObjectArrayElement([android.content.pm.Signature@3551a
 94], 0) => android.content.pm.Signature@3551a94 was called from 
RWX@0x12004844[libslib.so]0x4844 
[20:46:11 057] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x3551a94, global=false 
[20:46:11 057] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$32:550) - CallObjectMethodV object=unidbg@0x3551a94, 
jmethodID=unidbg@0x6a3e2031, va_list=unidbg@0xe4fff290, 
lr=RWX@0x12004af8[libslib.so]0x4af8 
[20:46:11 057] DEBUG 
[com.github.unidbg.linux.android.dvm.VaList64] (VaList64:131) - 
VaList64 base_p=0xe4fff300, base_integer=0xe4fff290, 
base_float=0xe4fff260, mask_integer=0xffffffd8, 
mask_float=0xffffff80, args=()[B, shorty=[] 
[20:46:11 057] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x76f84423, global=true 
[20:46:11 057] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xb66, global=true 
JNIEnv->CallObjectMethodV(android.content.pm.Signature@3551a94, 
toByteArray() => [B@52af6cff) was called from 
RWX@0x12004af8[libslib.so]0x4af8 
[20:46:11 057] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x735b478, global=false 
[20:46:11 057] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0x3551a94 
[20:46:11 057] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$174:2826) - GetByteArrayElements 
arrayPointer=unidbg@0x735b478, isCopy=null 
JNIEnv->GetByteArrayElements(false) => [B@52af6cff was called 
from RWX@0x12003f74[libslib.so]0x3f74 
[20:46:11 064] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0xd2318c19 
[20:46:11 064] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0xdd884762 
[20:46:11 064] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0x47d384ee 
[20:46:11 064] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0x30f944f7 
[20:46:11 064] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0x96532d6 
[20:46:11 064] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0x531be3c5 
[20:46:11 064] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0xdb4a449b 
[20:46:11 065] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$189:3075) - ReleaseByteArrayElements 
arrayPointer=unidbg@0x735b478, 
pointer=RW@0x12081000[libc++.so]0x1000, mode=0 
[20:46:11 065] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0x735b478 
[20:46:11 065] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0x506e6d5e 
[20:46:11 072] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$184:3023) - NewStringUTF bytes=RW@0x124d30c0, 
string=5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo 
JNIEnv->NewStringUTF("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was 
called from RWX@0x1200e97c[libslib.so]0xe97c 
[20:46:11 072] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffff83d61724, global=true 
[20:46:11 072] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x2096442d, global=false 
[20:46:11 072] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$18:268) - NewGlobalRef object=unidbg@0x2096442d, 
dvmObject="5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo" 
JNIEnv->NewGlobalRef("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was 
called from RWX@0x1200e9a4[libslib.so]0xe9a4 
[20:46:11 072] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x2096442d, global=true 
[20:46:11 072] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$20:309) - DeleteLocalRef object=unidbg@0x2096442d 
[20:46:11 074] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$181:2960) - GetStringLength string="2015876998797", 
lr=RWX@0x1203b3d4[libslib.so]0x3b3d4 
JNIEnv->GetStringUtfChars("2015876998797") was called from 
RWX@0x1203b48c[libslib.so]0x3b48c 
[20:46:11 074] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$159:2616) - GetStringUTFChars string="2015876998797", 
isCopy=null, value=2015876998797, 
lr=RWX@0x1203b48c[libslib.so]0x3b48c 
JNIEnv->ReleaseStringUTFChars("2015876998797") was called from 
RWX@0x1203b390[libslib.so]0x3b390 
[20:46:11 075] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$160:2636) - ReleaseStringUTFChars 
string="2015876998797", pointer=RW@0x12081000[libc++.so]0x1000, 
lr=RWX@0x1203b390[libslib.so]0x3b390 
[20:46:11 075] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$225:3563) - ExceptionCheck throwable=null 
[20:46:11 075] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$181:2960) - GetStringLength 
string="5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo", 
lr=RWX@0x1203b3d4[libslib.so]0x3b3d4 
JNIEnv->GetStringUtfChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was 
called from RWX@0x1203b48c[libslib.so]0x3b48c 
[20:46:11 075] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$159:2616) - GetStringUTFChars 
string="5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo", isCopy=null, 
value=5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo, 
lr=RWX@0x1203b48c[libslib.so]0x3b48c 
JNIEnv->ReleaseStringUTFChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") 
was called from RWX@0x1203b390[libslib.so]0x3b390 
[20:46:11 076] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$160:2636) - ReleaseStringUTFChars 
string="5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo", 
pointer=RW@0x12081000[libc++.so]0x1000, 
lr=RWX@0x1203b390[libslib.so]0x3b390 
[20:46:11 076] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$225:3563) - ExceptionCheck throwable=null 
[20:46:11 076] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$181:2960) - GetStringLength string="10EA095010", 
lr=RWX@0x1203b3d4[libslib.so]0x3b3d4 
JNIEnv->GetStringUtfChars("10EA095010") was called from 
RWX@0x1203b48c[libslib.so]0x3b48c 
ReadHook Address: 0x50f58 
user: 
com.github.unidbg.linux.android.AndroidARM64Emulator@2c9f9fb0 
MemoryHook PC: RWX@0x1200eb88[libslib.so]0xeb88 
ReadHook Address: 0x50f58 
user: 
com.github.unidbg.linux.android.AndroidARM64Emulator@2c9f9fb0 
MemoryHook PC: RWX@0x1200f17c[libslib.so]0xf17c 
[20:46:11 076] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$159:2616) - GetStringUTFChars string="10EA095010", 
isCopy=null, value=10EA095010, 
lr=RWX@0x1203b48c[libslib.so]0x3b48c 
JNIEnv->ReleaseStringUTFChars("10EA095010") was called from 
RWX@0x1203b390[libslib.so]0x3b390 
[20:46:11 077] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$160:2636) - ReleaseStringUTFChars 
string="10EA095010", pointer=RW@0x12081000[libc++.so]0x1000, 
lr=RWX@0x1203b390[libslib.so]0x3b390 
[20:46:11 077] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$225:3563) - ExceptionCheck throwable=null 
[20:46:11 088] DEBUG 
[com.github.unidbg.linux.android.dvm.DalvikVM64] 
(DalvikVM64$184:3023) - NewStringUTF bytes=unidbg@0xe4fff631, 
string=a17486b9 
JNIEnv->NewStringUTF("a17486b9") was called from 
RWX@0x1200ec2c[libslib.so]0xec2c 
[20:46:11 088] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0xffffffff83d61724, global=true 
[20:46:11 088] DEBUG [com.github.unidbg.linux.android.dvm.BaseVM] 
(BaseVM:146) - addObject hash=0x9f70c54, global=false 
"a17486b9" 
```

回复或点赞可查看完整内容

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

#逆向分析 #NDK分析 #协议分析 #脱壳反混淆

最新回复 (66) 1 2 3 ▶
mb_ldbucrik 雪币： 6 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 707 粉丝 7 关注私信	mb_ldbucrik 2 楼感谢分享 2025-7-28 16:46 0
猫子雪币： 396 活跃值： (4388) 能力值： ( LV3，RANK：30 ) 在线值：发帖 5 回帖 412 粉丝 4 关注私信	猫子 3 楼学习一下 2025-7-28 17:34 0
mb_cfjwplfo 雪币： 319 能力值： ( LV1，RANK：0 ) 在线值：发帖 6 回帖 95 粉丝 20 关注私信	mb_cfjwplfo 4 楼大佬，dlopen加载后可不可以直接从maps中dump这个libslib.so文件，一些so壳我看都是这样做的 2025-7-28 17:38 0
4Chan 雪币： 375 活跃值： (4087) 能力值： ( LV3，RANK：30 ) 在线值：发帖 9 回帖 202 粉丝 12 关注私信	4Chan 5 楼 6666 2025-7-28 19:44 0
mb_4nrpVMxJ 雪币： 3837 活跃值： (215) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 96 粉丝 0 关注私信	mb_4nrpVMxJ 6 楼 666 2025-7-28 19:52 0
kkte 雪币： 309 活跃值： (1361) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 28 粉丝 3 关注私信	kkte 7 楼 mark 2025-7-28 20:30 0
SomeMx 雪币： 4211 活跃值： (5614) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 158 粉丝 1 关注私信	SomeMx 8 楼 mark 2025-7-28 20:47 0
mb_dmryhnwz 雪币： 10 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 92 粉丝 0 关注私信	mb_dmryhnwz 9 楼 666 2025-7-28 20:53 0
Cure. 雪币： 60 活跃值： (170) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 41 粉丝 2 关注私信	Cure. 10 楼 1 2025-7-28 22:01 0
Imxz 雪币： 110 活跃值： (9571) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 775 粉丝 9 关注私信	Imxz 11 楼 tql 2025-7-29 09:33 0
xianhuimin 雪币： 9341 活跃值： (6228) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 231 粉丝 2 关注私信	xianhuimin 12 楼感谢分享 2025-7-29 16:09 0
软件君子雪币： 537 能力值： ( LV1，RANK：0 ) 在线值：发帖 3 回帖 68 粉丝 3 关注私信	软件君子 13 楼感谢大佬分享 2025-7-29 17:59 0
bluegatar 雪币： 6 活跃值： (5949) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 241 粉丝 6 关注私信	bluegatar 14 楼感谢分析，很棒的从头来讲的 2025-7-29 21:36 0
litianp 雪币： 2943 活跃值： (2820) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 36 粉丝 1 关注私信	litianp 15 楼跟着大佬学习 2025-7-29 22:07 0
英俊雪币： 4231 活跃值： (4339) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 66 粉丝 0 关注私信	英俊 16 楼跟着大佬学习一下。 2025-7-30 09:49 0
aerfaxing 雪币： 43 活跃值： (2349) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 41 粉丝 0 关注私信	aerfaxing 17 楼跟大佬学习以西 2025-7-30 11:13 0
Arsylk 雪币： 1938 活跃值： (1775) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 80 粉丝 9 关注私信	Arsylk 18 楼 66 2025-7-30 11:45 0
mb_tfcfxtnk 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	mb_tfcfxtnk 19 楼 66 2025-7-30 22:14 0
mb_mrjjcxgk 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 82 粉丝 0 关注私信	mb_mrjjcxgk 20 楼 66 2025-7-31 11:51 0
小菜菜ID 雪币： 8219 活跃值： (5459) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 66 粉丝 2 关注私信	小菜菜ID 21 楼感谢大佬分享，学习学习 2025-7-31 13:28 0
kingking888 雪币： 3235 活跃值： (6337) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 302 粉丝 6 关注私信	kingking888 22 楼 666 2025-7-31 21:53 1
godiand 雪币： 3 活跃值： (1264) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 56 粉丝 0 关注私信	godiand 23 楼你的分享对大家帮助很大，非常感谢！ 2025-8-1 09:04 0
威兹曼雪币： 317 活跃值： (650) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 62 粉丝 0 关注私信	威兹曼 24 楼感谢大佬分享 2025-8-1 09:06 0
丶咖啡猫丶雪币： 2769 活跃值： (3986) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 178 粉丝 4 关注私信	丶咖啡猫丶 25 楼 6666 2025-8-5 14:53 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复