[原创]Android下的art的ArtMethod一些学习分享-Android安全-看雪安全社区

# Android下的art的ArtMethod一些学习分享
为什么会写这个呢？其实很多东西都是之前写的，最近又整理了一下，也算是一个温故而知新吧！
之前一直找看一下传说中的goto类抽取，也想看看到底是怎么实现的，以及对比bangbang/ijm等有什么区别。
也问了很多人，也委托几个大佬帮我留意一下样本，也是没了后续。
直到今年又有了几个新的样本，也蛮有意思的，分析完了就找到了那个goto样本，分析之后。这篇文章也就对我最近捣鼓的样本的一些总结吧！
如果看下去的话，请不要嫌弃文章的啰嗦，因为要照顾一些刚接触的。所以我会尽可能地完整的去过一遍流程。为了方便学习，这里以Android8.1，在Android12等高版本就有有很多的不适用性，但相应的也出现了一些配套的Api，这里不展开细说。

## 先放结论，好让大佬按需阅读
- 类加载/方法加载/类初始化/dex等等关键入口。
- 不同时期的加固技术发展的演变。
- 多种不同实现的类抽取以及一些小实验。
- 其他的一些东西，再说吧！
- 至于为什么会以这种方式去做分享，最后我们提到。
- 最后！如果有哪里有误，那就感谢大佬们的斧正！非常感谢！

## 开篇
本篇文章以一个Java的方法执行的全过程为切入点的，即如下的伪代码
```text
DexClassLoader classLoader = new DexClassLoader(file.getAbsolutePath(), null, null, classLoader);
Class<?> TestClass = classLoader.loadClass(clazz.getName());
Method TestMethod = TestClass.getDeclaredMethod(method.getName(), method.getParameterTypes());
int number = (int) method.invoke(null, args);
```

## 开始

谈到安卓的Java虚拟机，那必定离不开安卓的art虚拟机。早期还有dalvikvm虚拟器。不过也成为了一种过去式的历史。不过现在也一另外的形式存在。那就是<a href="elink@ca1K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7@1i4K6u0W2x3#2)9#2k6Y4t1I4i4K6u0W2x3g2)9J5c8Y4S2J5k6h3k6Q4x3V1k6V1j5h3I4$3K9h3E0Q4x3V1k6$3L8g2)9J5c8X3#2@1k6i4u0H3i4K6u0r3">dexvmp</a>
那么我么今天就以Java的代码如何在Android的上运行做一个分享。

## <a href="elink@8ccK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3">art</a>
![img_4.png](upload/attach/202511/794149_FH5VDQTA9EMF4TB.png)

在Android中有几个版本跨域比较大，那就是4.4.4/7.12/8.1/12/15，art虚拟机就是在Android的4.4.4中发布，伴随这art虚拟机的引入，安卓也走入了一个全新的时代，即从解释型虚拟机到编译后的二进制文件。

## dex加载
如果有学习过Java的开发，那都会遇到jar，dex就是在Android上的“jar”。姑且可以这样子理解（jar可以直接改为.zip打开，dex不行，jar可以放一些资源，dex只能放smail文件）
涉及到jar/dex，那么就会有一个属性的东西类加载器“ClassLoader”，这个在上一次分享中，有介绍过不同JDK实现有提过类加载的一个过程，这次会比较详细的分享他的一些过程。

### <a href="elink@10cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3!0B7L8s2g2F1K9g2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3K9X3q4$3j5g2)9J5c8X3I4S2L8X3N6Q4x3V1k6o6L8r3q4K6M7@1I4G2j5h3c8W2M7W2)9J5k6h3A6S2N6X3p5`.">ClassLoader</a>

![img_7.png](upload/attach/202511/794149_U4GSKZ4HFFEHAD2.png)

![img_6.png](upload/attach/202511/794149_NTM9VDJ9CCHQ3F5.png)

他的默认实现，从这里也很生动的体现他的“双亲委派机制”解决类加载器的重复加载问题，从中也可以发现，loadClass的会调用findClass进行查找，以及他们的权限修饰符，可以通过继承的形式进行覆盖。
下面三个就是他在Android的三个实现子类

### <a href="elink@501K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3d9h3&6y4k6h3#2G2M7Y4W2p5k6i4S2o6L8r3q4K6M7@1I4G2j5h3c8W2M7W2)9J5k6h3A6S2N6X3p5`.">InMemoryDexClassLoader</a>
![img.png](upload/attach/202511/794149_QDVSSADRSBH5Q4S.png)

### <a href="elink@cf9K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3c8r3g2^5b7$3I4S2M7%4y4x3L8$3q4V1k6i4u0Q4x3X3g2B7j5i4k6S2">DexClassLoader</a>
![img_1.png](upload/attach/202511/794149_J85Q7CH6X7N6DVQ.png)

### <a href="elink@019K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3f1r3q4@1K9p5y4D9j5i4y4K6e0r3!0S2k6r3g2J5i4K6u0W2K9X3q4$3j5b7`.`.">PathClassLoader</a>
![img_2.png](upload/attach/202511/794149_2296U3GG4ZGW6CS.png)

通过上面的图片来看，他们并没有在这里实现什么，甚至也没什么区别，都是继承于BaseDexClassLoader这个类，那么我们重点就在这了。
上面三个实现ClassLoader的子类，我们也比较容易理解他们的作用。

<a href="elink@d82K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3!0B7L8s2g2F1K9g2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3K9X3q4$3j5g2)9J5c8X3I4S2L8X3N6Q4x3V1k6o6L8r3q4K6M7@1I4G2j5h3c8W2M7W2)9J5k6h3A6S2N6X3q4Q4x3U0x3I4x3K6x3$3">BootClassLoader</a>
这个看名字就知道啦，所以跳过咯

## 类加载
- 隐性加载
- 主动加载

### <a href="elink@ec2K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3b7X3q4K6k6f1c8W2P5p5y4D9j5i4y4K6e0r3!0S2k6r3g2J5i4K6u0W2K9X3q4$3j5b7`.`.">BaseDexClassLoader</a>
![img_3.png](upload/attach/202511/794149_QYWDAUAJSGZVQSW.png)

通过ClassLoader的代码分析，我们知道loadClass会调用findClass去查找并加载类，那么我们只需要关注findClass的实现即可
![img_8.png](upload/attach/202511/794149_Z9V8FYUWVZJCTUR.png)

在这里我们可以看到会调用pathList的findClass调用，以及下面的方法，addDexPath，也是调用pathList的.addDexPath方法

pathList的定义
![img_9.png](upload/attach/202511/794149_QW8FGQBZHYX3RCQ.png)

### <a href="elink@ab9K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3c8r3g2^5f1r3q4@1K9p5I4A6M7%4c8Q4x3X3g2B7j5i4k6S2">DexPathList</a>

![img_10.png](upload/attach/202511/794149_QK5S5S7E2VP7YD7.png)
这里我们可以看到DexPathList的findClass也是调用dexElements数组的中实现的findClass方法

dexElements初始化刚好在DexPathList的构造函数中，也就是在makeInMemoryDexElements这个函数中
![img_14.png](upload/attach/202511/794149_3QVE6YFBXCQ4Q6J.png)

![img_15.png](upload/attach/202511/794149_HFSSKNV9ZJDC6QQ.png)
dexElements是makeInMemoryDexElements返回的，Element初始化的过程中还会创建一个DexFile对象，

![img_16.png](upload/attach/202511/794149_JDNU5G5U8CB7QVX.png)
可以通过这两个相邻的函数可以发现，这就是加载两种不同形式的dex的函数，上面的是通过ByteBuffer[]，下面的是通过List<File>的形式

那我们以文件加载的形式去分析Dex的加载，那也就是会调用makeDexElements方法中的loadDexFile中返回

那也就是
![img_17.png](upload/attach/202511/794149_Z3HJBW7AJW6QPJQ.png)

![img_18.png](upload/attach/202511/794149_GPF5H37WB6M3CRA.png)
我们跟一下DexFile的构造函数，这里也很明显可以看到有两个不同的构造函数，一个是传递的是ByteBuffer，一个是String的fileName

然后我们回到Element的findClass
<a href="elink@588K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3c8r3g2^5f1r3q4@1K9p5I4A6M7%4c8Q4x3X3g2B7j5i4k6S2i4K6t1K6y4e0f1&6">Element</a>
![img_12.png](upload/attach/202511/794149_B9BBZDHZ9YE283J.png)

那么最终的类加载就会变成
DexFile的<a href="elink@d56K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3c8r3g2^5c8X3W2D9k6g2)9J5k6h3A6S2N6X3q4Q4x3@1k6X3K9g2)9K6c8r3c8W2k6X3W2F1k6f1y4D9j5i4y4K6e0X3q4@1K9i4k6W2i4K6t1K6x3K6R3@1">defineClassNative</a>
![img_19.png](upload/attach/202511/794149_5AJ8WWMH9BHRXZZ.png)

正常逆向分析的思维就是，一路跟到底，最后才是看如何构造一个全链路。
先到初始化，再到查找嘛，????
这里我们就换一下，先看他如何出初始化再捣鼓的

####### 插眼

<a href="elink@9b5K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3k6r3q4D9N6X3W2C8i4K6u0r3M7%4W2K6N6r3g2E0i4K6u0r3c8r3g2^5c8X3W2D9k6g2)9J5k6h3A6S2N6X3q4Q4x3U0x3K6y4e0l9`.">openDexFile</a>
这个是在DexFile的初始化的时候，可能会执行，取决于是传递byte[]还是dexPath，也就是不同类加载器的区别了。
现在我们以DexClassLoader的形式去加载的话（PathClassLoader也是一样的）去进行分析，也就是会执行dexPath的这个构造函数

![img_54.png](upload/attach/202511/794149_VTW88EKEWDRP55D.png)

最终调用到native的方法，那么我们继续跟去
<a href="elink@072K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3&6S2N6r3W2$3k6g2)9J5c8X3c8S2L8s2k6A6K9#2)9#2k6Y4y4&6M7%4c8W2L8g2)9#2k6V1c8W2P5p5k6A6L8r3g2Q4x3X3g2U0j5H3`.`.">dalvik_system_DexFile.cc</a>

DexFile_openDexFileNative
![img_21.png](upload/attach/202511/794149_KBF42CP5JAT967Q.png)
这里会调用OpenDexFilesFromOat返回，然后通过ConvertDexFilesToJavaArray函数处理之后返回到Java层

<a href="elink@fd5K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3!0S2N6q4)9#2k6X3k6A6L8r3g2Q4y4h3k6E0j5h3&6S2k6$3g2J5i4K6u0W2j5$3y4Q4x3@1k6J5i4K6y4p5i4K6t1$3L8h3!0Q4x3@1b7I4y4o6l9&6x3W2)9J5y4X3k6A6i4K6y4p5x3K6R3J5i4K6t1K6x3K6R3J5">OpenDexFilesFromOat</a>

![img_53.png](upload/attach/202511/794149_3DS32UFT52HXNSE.png)

会先判断是否加载oat相关的代码。这里我们默认第一次执行，也就不会涉及到oat/odex/vdex等相关的东西了，因为可以通过这里dump到完整的dex，壳代码会禁止相关的优化，或者是屏蔽了。。。
屏蔽也有一些好处，有一些inline的优化，也是很头疼，屏蔽之后就可以一劳永逸了，代价没那么快了。
这里的快的概念，是对于正常开发者的，而对于我们学习来说，也就没那么重要了。

![img_24.png](upload/attach/202511/794149_U6CUUAKJFZZJT65.png)

![img_25.png](upload/attach/202511/794149_2RUKMSEFC9DENJ3.png)
所以上面的dex_files就会为空，从而执行DexFile::Open

### oat的加载
，这里就不一路分析到底了，感兴趣的可以继续分析下去
<a href="elink@66dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3!0S2N6q4)9#2k6X3k6A6L8r3g2Q4x3X3g2U0j5#2)9K6c8Y4u0Q4x3@1c8Q4x3U0k6E0L8#2)9K6c8o6j5H3x3o6N6Q4x3U0k6X3K9g2)9K6c8o6p5&6x3W2)9J5x3K6p5I4x3K6b7`.">OatFile* OatFile::Open</a>
<a href="elink@4f1K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3!0S2N6q4)9#2k6X3k6A6L8r3g2Q4y4h3k6S2M7%4y4A6M7%4c8S2L8Y4c8Q4x3X3g2U0j5#2)9J5x3K6x3K6x3l9`.`.">LoadDexFiles</a>
<a href="elink@9d6K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3!0S2N6q4)9#2k6X3k6A6L8r3g2Q4y4h3k6S2M7%4y4A6M7%4c8S2L8Y4c8Q4x3X3g2U0j5#2)9J5x3K6x3K6x3l9`.`.">OatFileAssistant::LoadDexFiles</a>
<a href="elink@c7eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3!0S2N6q4)9#2k6X3k6A6L8r3g2Q4x3X3g2U0j5#2)9J5x3K6p5@1x3e0x3`.">std::unique_ptr<const DexFile> OatFile::OatDexFile::OpenDexFile</a>
<a href="elink@ed2K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3!0S2N6q4)9#2k6X3k6A6L8r3g2Q4x3X3g2U0j5#2)9J5x3K6p5#2x3R3`.`.">OatFileBase* OatFileBase::OpenOatFile</a>

### dex的加载
<a href="elink@69fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3c8W2P5q4)9#2k6X3k6A6L8r3g2Q4x3X3g2U0j5#2)9J5x3K6t1I4x3H3`.`.">DexFile::Open</a>
这里的DexFile::Open也是一路执行到DexFile::OpenFile

<a href="elink@accK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3c8W2P5q4)9#2k6X3k6A6L8r3g2Q4x3X3g2U0j5#2)9J5x3K6t1%4x3H3`.`.">DexFile::OpenFile</a>

![img_26.png](upload/attach/202511/794149_87K9JTFT5NK7U38.png)
在这里我们就会进入到一个特殊的点了，开始将dex文件映射到内存中去。至于为什么特殊？
等下会解释。

<a href="elink@016K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3#2W2L8g2)9#2k6X3#2S2M7q4)9J5k6h3S2Q4x3@1k6X3K9g2)9K6c8p5#2S2M7p5k6A6L8r3g2Q4x3U0x3^5x3H3`.`.">MemMap* MapFile</a>
![img_27.png](upload/attach/202511/794149_VEND6T276S7K24X.png)
MapFile也是调用MapFileAtAddress

<a href="elink@9eaK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6K6i4K6y4r3M7X3g2X3M7#2)9K6c8p5#2S2M7p5k6A6L8r3g2m8N6p5q4V1k6s2u0W2M7%4y4Q4x3U0k6H3M7X3!0B7k6h3y4@1i4K6y4p5j5i4u0@1">MemMap::MapFileAtAddress</a>
![img_28.png](upload/attach/202511/794149_V9FUWDU7EMF2MPT.png)
MapFileAtAddress进一步调用MapInternal

<a href="elink@71fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3#2W2L8g2)9#2k6X3#2S2M7q4)9J5k6h3y4U0i4K6y4r3k6X3W2Q4x3@1c8y4j5i4m8r3K9h3I4W2b7i4c8m8k6r3c8J5k6i4y4K6i4K6t1K6z5e0l9J5">MemMap::MapInternal</a>
MapInternal之后就到了我们遇到的特殊点了，使用mmap去映射内存
![img_55.png](upload/attach/202511/794149_5P3J8YPUU77HGR9.png)
我们可以往上翻，会注意到他的权限是PROT_READ,

![img_29.png](upload/attach/202511/794149_Z355PWRZDMM64J8.png)

<a href="elink@224K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3c8W2P5q4)9#2k6X3k6A6L8r3g2Q4x3X3g2U0j5#2)9J5x3K6b7^5x3b7`.`.">DexFile::OpenCommon</a>

到这里我们就看完分配内存了，我们接下来往下看DexFile::OpenCommon

![img_30.png](upload/attach/202511/794149_95W7W6QAZRFFJG4.png)

中也没存做啥，只是创建个DexFile对象，然后返回

## 彩蛋1
ConvertDexFilesToJavaArray
![img_22.png](upload/attach/202511/794149_Y3ZWWKGS8U45AST.png)·
我们可以看到他是传递个oat_file以及DexFile的vec
细心的看的话，就知道她他会创建个数据，第一个元素放到的是oat的对象的地址，第二个就是DexFile（一个或多个）
然后返回，最终就是DexFile的mCookie对象了，下面会有图片比较直观的体现

<a href="elink@75fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4S2J5k6h3k6S2L8X3c8J5L8$3W2V1i4K6u0W2j5$3!0E0i4K6u0r3j5h3&6V1M7X3!0A6k6q4)9J5k6o6S2Q4x3X3f1I4i4K6u0W2x3q4)9#2k6Y4t1^5x3g2)9J5c8Y4S2J5k6h3k6Q4x3V1k6S2M7Y4c8Q4x3V1k6J5N6h3&6@1K9h3#2W2i4K6u0r3L8X3q4@1K9i4k6W2i4K6u0r3k6r3q4D9N6X3W2C8i4K6g2X3M7%4W2K6N6r3g2E0i4K6g2X3c8r3g2^5c8X3W2D9k6g2)9J5k6h3S2Q4x3@1k6X3K9g2)9K6c8r3E0a6j5i4c8r3K9h3I4W2d9h3&6V1k6i4S2Q4x3U0y4C8e0$3q4@1c8X3W2D9k6f1W2F1k6r3g2^5">dalvik_system_DexFile.h</a>
```javascript
25 constexpr size_t kOatFileIndex = 0;
26 constexpr size_t kDexFileIndexStart = 1;
```
```javascript
96 long_data[kOatFileIndex] = reinterpret_cast<uintptr_t>(oat_file);
97 for (size_t i = 0; i < vec.size(); ++i) {
98 long_data[kDexFileIndexStart + i] = reinterpret_cast<uintptr_t>(vec[i].get());
99 }
100
```

![img_74.png](upload/attach/202511/794149_KG43KGKCFS4NA9E.png)
![img_75.png](upload/attach/202511/794149_2V9FG3N9N6S27E2.png)

## 回来
刚才我们去看了DexFile的创建以及初始化过程，接下来我们继续看类的定义

DexFile_defineClassNative
![img_20.png](upload/attach/202511/794149_PKBBD6SG6FCD5CK.png)
调用class_linker->DefineClass的

<a href="elink@48fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3y4D9j5i4y4K6i4K6g2X3L8r3W2F1K9$3g2J5i4K6u0W2j5$3x3`.">class_linker.cc</a>

<a href="elink@ed3K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3y4D9j5i4y4K6i4K6g2X3L8r3W2F1K9$3g2J5i4K6u0W2j5$3y4Q4x3U0x3J5z5o6t1^5">ClassLinker::DefineClass</a>
![img_31.png](upload/attach/202511/794149_T8QV7JKUNNJZMKJ.png)
DefineClass中也是进一步调用LoadClass

<a href="elink@76dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3y4D9j5i4y4K6i4K6g2X3L8r3W2F1K9$3g2J5i4K6u0W2j5$3y4Q4x3U0x3K6x3U0b7^5">ClassLinker::LoadClass</a>
![img_32.png](upload/attach/202511/794149_NY77M8XJYZQPY4E.png)
LoadClass进一步调用LoadClassMembers

<a href="elink@32bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3y4D9j5i4y4K6i4K6g2X3L8r3W2F1K9$3g2J5i4K6u0W2j5$3y4Q4x3U0x3K6x3K6p5%4">ClassLinker::LoadClassMembers</a>
![img_33.png](upload/attach/202511/794149_GWP4Q2ZGQ4455W2.png)

在这里我们就可以看到比较的多东西了

## 方法加载

<a href="elink@2ecK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3y4D9j5i4y4K6i4K6g2X3L8r3W2F1K9$3g2J5i4K6u0W2j5$3y4Q4x3U0x3K6y4o6x3@1">ClassLinker::LoadMethod</a>
![img_34.png](upload/attach/202511/794149_U9N9AED3K5A29DF.png)

<a href="elink@8d6K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3y4D9j5i4y4K6i4K6g2X3L8r3W2F1K9$3g2J5i4K6u0W2j5$3y4Q4x3U0x3K6x3e0M7J5">static void LinkCode</a>
```text
3200 // For static methods excluding the class initializer, install the trampoline.
3201 // It will be replaced by the proper entry point by ClassLinker::FixupStaticTrampolines
3202 // after initializing class (see ClassLinker::InitializeClass method).
```
在这里我们就可以触发第二个彩蛋

## 彩蛋2
<a href="elink@f7aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4S2J5k6h3k6S2L8X3c8J5L8$3W2V1i4K6u0W2j5$3!0E0i4K6u0r3j5h3&6V1M7X3!0A6k6q4)9J5k6o6S2Q4x3X3f1I4i4K6u0W2x3q4)9#2k6Y4t1^5x3g2)9J5c8Y4S2J5k6h3k6Q4x3V1k6S2M7Y4c8Q4x3V1k6J5N6h3&6@1K9h3#2W2i4K6u0r3L8X3q4@1K9i4k6W2i4K6u0r3K9X3q4$3j5g2)9#2k6X3I4S2L8X3N6Q4y4h3k6o6L8r3q4K6M7#2)9J5k6h3y4U0i4K6y4r3M7W2)9K6c8q4)9J5y4X3#2G2i4K6y4p5x3U0j5&6z5e0g2Q4x3U0k6X3K9g2)9K6c8o6j5%4y4q4)9J5x3K6j5%4y4l9`.`.">Class_newInstance</a>
![img_56.png](upload/attach/202511/794149_PSVVV32P25NWMGG.png)
类实例的创建

![img_57.png](upload/attach/202511/794149_JG5D7Z5UT65QYXA.png)
这里我们能看到类的初始化入口

或者这个路径（没有测试，只是代码搜素搜到这个）

<a href="elink@4b6K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3A6F1K9g2)9#2k6X3W2F1N6r3g2J5L8X3q4D9i4K6u0W2j5$3y4Q4x3U0x3I4x3K6l9K6">GetFieldID</a>
![img_36.png](upload/attach/202511/794149_RM7BU7MKDS6MGF3.png)

<a href="elink@2aeK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3A6F1K9g2)9#2k6X3W2F1N6r3g2J5L8X3q4D9i4K6u0W2j5$3y4Q4x3U0x3J5y4K6R3`.">FindFieldID</a>

![img_37.png](upload/attach/202511/794149_UUPZSKUW7KRADSZ.png)

<a href="elink@3eeK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3A6F1K9g2)9#2k6X3W2F1N6r3g2J5L8X3q4D9i4K6u0W2j5$3y4Q4x3U0x3J5x3e0b7`.">EnsureInitialized</a>

![img_35.png](upload/attach/202511/794149_24B6KYNENFDWVK7.png)

最终也是会执行到ClassLinker::EnsureInitialized

<a href="elink@680K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3y4D9j5i4y4K6i4K6g2X3L8r3W2F1K9$3g2J5i4K6u0W2j5$3y4Q4x3U0x3#2x3K6b7#2">ClassLinker::EnsureInitialized</a>

![img_38.png](upload/attach/202511/794149_EY7C25C686W9W3C.png)
ClassLinker::EnsureInitialized调用ClassLinker::InitializeClass

<a href="elink@4b6K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3y4D9j5i4y4K6i4K6g2X3L8r3W2F1K9$3g2J5i4K6u0W2j5$3y4Q4x3U0x3@1y4K6R3#2">ClassLinker::InitializeClass</a>

![img_39.png](upload/attach/202511/794149_VQ2XJ3EXTZUV4AR.png)
ClassLinker::InitializeClass调用ClassLinker::FixupStaticTrampolines

<a href="elink@d69K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3y4D9j5i4y4K6i4K6g2X3L8r3W2F1K9$3g2J5i4K6u0W2j5$3y4Q4x3U0x3K6x3e0p5@1">ClassLinker::FixupStaticTrampolines</a>

![img_40.png](upload/attach/202511/794149_F48C6P74U4PVDAH.png)

到这里我们就可以看到他的参数了klass，至于这个是什么，后面会有测试进行的说明

## 方法执行
既然我们说了类是怎么加载的，然后到类定义，方法的加载，类的初始化，那么就顺便把最后的一个：方法的执行

<a href="elink@526K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3!0B7L8s2g2F1K9g2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3K9X3q4$3j5g2)9J5c8X3I4S2L8X3N6Q4x3V1k6J5k6h3k6D9k6h3y4@1i4K6u0r3e0h3g2@1K9r3!0V1i4K6u0W2K9X3q4$3j5b7`.`.">Method</a>

![img_42.png](upload/attach/202511/794149_G4Q7CHEMUAK92A6.png)

Method继承于Executable。这个需要考的，现在先记住这个就好了

<a href="elink@5bfK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3!0B7L8s2g2F1K9g2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3K9X3q4$3j5g2)9J5c8X3I4S2L8X3N6Q4x3V1k6J5k6h3k6D9k6h3y4@1i4K6u0r3e0h3g2@1K9r3!0V1i4K6u0W2K9X3q4$3j5g2)9J5x3K6b7H3y4H3`.`.">invoke</a>
![img_41.png](upload/attach/202511/794149_QWAZQZUVBBW8UEZ.png)
这个就是Java的方法反射执行的入口了

<a href="elink@55fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3&6S2N6r3W2$3k6g2)9J5c8X3A6S2N6X3q4Q4y4h3k6D9j5h3&6Y4i4K6g2X3M7X3g2X3L8r3g2U0N6q4)9#2k6V1#2W2N6r3S2G2k6q4)9J5k6h3y4U0i4K6t1K6z5o6b7`.">Method_invoke</a>
![img_43.png](upload/attach/202511/794149_8TK8ZQNHWX3BXDV.png)
Method_invoke调用InvokeMethod

<a href="elink@a6eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8Y4u0W2k6X3I4W2j5%4c8A6L8$3&6Q4x3X3g2U0j5#2)9K6c8X3k6A6i4K6y4p5d9h3&6$3L8$3E0W2e0h3g2@1K9r3!0V1i4K6t1K6y4e0R3@1">InvokeMethod</a>

![img_23.png](upload/attach/202511/794149_F3AQQ9F32Y8UVKC.png)
InvokeMethod调用InvokeWithArgArray
同时我们也看到了
```text
595 ObjPtr<mirror::Executable> executable = soa.Decode<mirror::Executable>(javaMethod);
596 const bool accessible = executable->IsAccessible();
597 ArtMethod* m = executable->GetArtMethod();
598 
```
这种奇怪的代码转换，在后面还会有很多，，哈哈哈

<a href="elink@c53K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8Y4u0W2k6X3I4W2j5%4c8A6L8$3&6Q4x3X3g2U0j5#2)9K6c8X3k6A6i4K6y4p5d9h3&6$3L8$3E0W2e0h3g2@1K9r3!0V1i4K6t1K6y4o6b7$3">InvokeWithArgArray</a>
![img_47.png](upload/attach/202511/794149_HG6VG5AZJ5PVRSR.png)

InvokeWithArgArray做好准备参数检查的准备
就执行method->Invoke

![img_48.png](upload/attach/202511/794149_9FGBBBR2KARWHBN.png)
<a href="elink@101K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3q4J5N6q4)9#2k6X3#2W2N6r3S2G2k6q4)9J5k6h3y4U0i4K6t1K6x3K6p5I4">ArtMethod::Invoke</a>
![img_49.png](upload/attach/202511/794149_VS5TXKB3FUGR8WU.png)

到这一步我们就进入了ArtMethod的世界！
开源的类抽取还原框架fart，也就是以这个为入口进行虚假调用并触发方法的修复
这里我们可以看到一段描述
```text
329    // Call the invoke stub, passing everything as arguments.
330    // If the runtime is not yet started or it is required by the debugger, then perform the
331    // Invocation by the interpreter, explicitly forcing interpretation over JIT to prevent
332    // cycling around the various JIT/Interpreter methods that handle method invocation.
```
然后我们就执行到了
art::interpreter::EnterInterpreterFromInvoke
进入解释模式

<a href="elink@096K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3W2F1N6r3g2J5M7s2u0W2N6r3g2J5i4K6u0r3K9h3&6@1k6i4u0H3M7X3g2@1k6i4u0Q4x3X3g2U0j5#2)9K6c8X3k6A6i4K6y4p5c8h3&6@1k6i4u0u0L8Y4c8W2M7Y4m8J5k6i4c8W2M7V1k6J5L8$3#2u0L8Y4k6G2K9$3g2Q4x3U0x3K6y4U0t1`.">EnterInterpreterFromInvoke</a>
![img_50.png](upload/attach/202511/794149_DUYKWH3FXMC4BND.png)
在这里会判断是否为jni方法
```java
450 if (LIKELY(!method->IsNative())) {
451 JValue r = Execute(self, code_item, *shadow_frame, JValue(), stay_in_interpreter);
452 if (result != nullptr) {
453 *result = r;
454 }
455 } else {
456 // We don't expect to be asked to interpret native code (which is entered via a JNI compiler
457 // generated stub) except during testing and image writing.
458 // Update args to be the args in the shadow frame since the input ones could hold stale
459 // references pointers due to moving GC.
460 args = shadow_frame->GetVRegArgs(method->IsStatic() ? 0 : 1);
461 if (!Runtime::Current()->IsStarted()) {
462 UnstartedRuntime::Jni(self, method, receiver.Ptr(), args, result);
463 } else {
464 InterpreterJni(self, method, shorty, receiver, args, result);
465 }
```
我们此次分析的是普通的Java函数，所以会执行Execute

<a href="elink@354K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3W2F1N6r3g2J5M7s2u0W2N6r3g2J5i4K6u0r3K9h3&6@1k6i4u0H3M7X3g2@1k6i4u0Q4x3X3g2U0j5#2)9K6c8X3k6A6i4K6y4p5c8h3&6@1k6i4u0u0L8Y4c8W2M7Y4m8J5k6i4c8W2M7V1k6J5L8$3#2u0L8Y4k6G2K9$3g2Q4x3U0x3J5x3K6V1`.">Execute</a>
![img_51.png](upload/attach/202511/794149_VS8XUAA995C7XCQ.png)
```java
265 
266 if (!stay_in_interpreter) {
267 jit::Jit* jit = Runtime::Current()->GetJit();
268 if (jit != nullptr) {
269 jit->MethodEntered(self, shadow_frame.GetMethod());
270 if (jit->CanInvokeCompiledCode(method)) {
271 JValue result;
272 
273 // Pop the shadow frame before calling into compiled code.
274 self->PopShadowFrame();
275 // Calculate the offset of the first input reg. The input registers are in the high regs.
276 // It's ok to access the code item here since JIT code will have been touched by the
277 // interpreter and compiler already.
278 uint16_t arg_offset = code_item->registers_size_ - code_item->ins_size_;
279 ArtInterpreterToCompiledCodeBridge(self, nullptr, &shadow_frame, arg_offset, &result);
280 // Push the shadow frame back as the caller will expect it.
281 self->PushShadowFrame(&shadow_frame);
282 
283 return result;
284 }
285 }
286 }
287 }
```
这里应该是执行到一些优化之后的代码吧？我们要看的是解释模式，所以忽略

<a href="elink@9beK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3W2F1N6r3g2J5M7s2u0W2N6r3g2J5i4K6u0r3K9h3&6@1k6i4u0H3M7X3g2@1k6i4u0Q4y4h3k6U0L8$3#2E0L8$3&6Q4x3X3g2U0j5#2)9K6c8X3k6A6i4K6y4p5b7i4u0@1d9h3&6@1k6i4u0H3M7X3g2@1k6i4u0f1L8@1y4G2L8i4m8A6L8r3g2V1b7$3!0V1k6f1u0J5K9h3c8Y4k6g2)9J5x3@1q4J5N6p5W2F1N6r3g2J5M7s2u0W2N6r3g2J5g2r3!0o6L8$3#2H3K9h3I4W2k6p5y4G2k6r3g2n7M7X3W2V1k6$3f1`.">ArtInterpreterToCompiledCodeBridge</a>

![img_58.png](upload/attach/202511/794149_NNYSTBZPAUT3TDV.png)
这里也是从新执行一遍method->Invoke，
最终应该会执行到EnterInterpreterFromInvoke的InterpreterJni去吗？

<a href="elink@5caK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3W2F1N6r3g2J5M7s2u0W2N6r3g2J5i4K6u0r3K9h3&6@1k6i4u0H3M7X3g2@1k6i4u0Q4y4h3k6K6N6$3W2@1j5$3S2Q4y4h3k6A6L8i4m8D9i4K6u0W2j5$3y4Q4x3@1k6X3K9g2)9K6c8p5g2^5k6h3y4#2N6r3g2e0N6$3W2@1j5$3S2u0L8i4m8D9i4K6t1K6x3e0f1@1">ExecuteSwitchImpl</a>
![img_52.png](upload/attach/202511/794149_ETR8NYBDMX4HQSV.png)

在这里解析指令了咯？所以结束了？
不，这才刚开始。
上面的说那么多无非就是想引入一些点：LoadMethod、、DexFile::Open、Execute等等方法 还有mCookie等字段是什么？

## 结构体（类）介绍
e4aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3q4J5N6q4)9#2k6X3#2W2N6r3S2G2k6q4)9J5k6h3R3`.

59bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3#2A6M7Y4u0G2M7W2)9J5c8X3y4D9j5i4y4K6i4K6u0W2K9l9`.`.

3acK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3c8W2P5q4)9#2k6X3k6A6L8r3g2Q4x3X3g2Z5

31fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3!0B7L8s2g2F1K9g2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3K9X3q4$3j5g2)9J5c8X3I4S2L8X3N6Q4x3V1k6o6L8r3q4K6M7#2)9J5k6h3A6S2N6X3p5`.

![img_59.png](upload/attach/202511/794149_3XCY6A8ZJXBXD4C.png)

看到这图，是不是一切都豁然开朗了？
那么费力的去讲解这么多的流程，无非就是想解释，最终的数据加载到内存了，都成了什么样子了？
到这里我们是不是会有很多奇怪的想法？

那我们以一个demo为例：
![img_60.png](upload/attach/202511/794149_AUS36G9STWPZJTD.png)

比如我们可以拿到一个Method，进一步我们可以拿到他的类定义、然后就是dex缓存，从而拿到dexFile，然后是就是计算code_item的偏移？然后拿到指令？
对的，就顺便脱壳，也做了类修复
![img_67.png](upload/attach/202511/794149_UKRFDZNRM7PCND8.png)
![img_66.png](upload/attach/202511/794149_TVPGBZ37K8YAN8A.png)

既然可以拿到指令？ 那我是否可以修改指令？
是的，上面也提到了类加载的内存映射只有READ的权限，也就需要hook去修改，或者使用下面的方式（详情可以看dpt-shell的作者分析的文章）
![img_65.png](upload/attach/202511/794149_5NMBMV7KWXXBMZD.png)
然后就根据实际需求去修改就好了

或者替换偏移？
![img_64.png](upload/attach/202511/794149_FQD3D53QRKAD35X.png)

如果指令大小不够了怎么办？
直接mmap一个区域也给他弄个偏移就好了
![img_63.png](upload/attach/202511/794149_RUWMK7Q725YGBKJ.png)

或者我们可以做一个动态的指令生成？ 如何动态的生成指令？
![img_62.png](upload/attach/202511/794149_687BJ4P7QDWF6WH.png)
直接编译拿到之后直接整个方法定义长得差不多的，直接拿过来就可以用了（fid，mid，这些可能会错乱哈哈啊哈）

如何直接写指令去实现？
![img_61.png](upload/attach/202511/794149_SXD6J2AQTETEAVX.png)
直接用asm去写就好了
这里的参数传递的规则有点奇怪，得从3/4开始的

上面的一个整体效果：：：

![img_76.png](upload/attach/202511/794149_4QSKBXXGWQBGAMS.png)

输出
这两个是偏移替换的，可以看到run执行了fake/fake2的代码
![img_77.png](upload/attach/202511/794149_C4WHNP7XD65KQ6Z.png)
![img_78.png](upload/attach/202511/794149_MB2THEE3B352AUK.png)

......
动态修改&执行？提高我们的风控难度？对吧？

## 构造器
<a href="elink@5efK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3!0B7L8s2g2F1K9g2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3K9X3q4$3j5g2)9J5c8X3I4S2L8X3N6Q4x3V1k6J5k6h3k6D9k6h3y4@1i4K6u0r3b7$3!0F1M7%4c8J5N6h3y4@1L8%4u0Q4x3X3g2B7j5i4k6S2">Constructor</a>
![img_46.png](upload/attach/202511/794149_94776HC2R3SPYF4.png)
这里的是构造函数，同理分析也是差不多的，所以跳过吧！哈哈哈

## Executable
[Executable](Åa87K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3!0B7L8s2g2F1K9g2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3K9X3q4$3j5g2)9J5c8X3I4S2L8X3N6Q4x3V1k6J5k6h3k6D9k6h3y4@1i4K6u0r3c8i4S2W2j5%4g2@1j5h3u0D9k6g2)9J5k6h3A6S2N6X3q4Q4x3U0V1`.

Executable的定义
![img_45.png](upload/attach/202511/794149_ZEQWNHMC9UUTH2Z.png)

![img_44.png](upload/attach/202511/794149_Y5GRSPMUYHP5VJ4.png)
artMethod指针

<a href="elink@651K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3!0B7L8s2g2F1K9g2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3K9X3q4$3j5g2)9J5c8X3I4S2L8X3N6Q4x3V1k6J5k6h3k6D9k6h3y4@1i4K6u0r3c8i4S2W2j5%4g2@1j5h3u0D9k6g2)9J5k6h3A6S2N6X3q4Q4x3U0x3#2y4K6b7`.">private long artMethod;</a>
这个东西就很关键了，那就是artMethod的地址

## 调试方法
还能有栈回溯方便吗？

### 调试器
![img_73.png](upload/attach/202511/794149_VTGVQU7XKY7XJ2G.png)

### 主动打印
new Exception().printStackTrace();
abort
### 破坏指令，制造异常
![img_72.png](upload/attach/202511/794149_28GRE6RAGSEYQYZ.png)

## <a href="elink@78fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3c8W2P5q4)9#2k6X3W2F1M7%4c8J5N6h3y4@1K9h3!0F1i4K6u0W2j5$3x3`.">smali指令</a>
<a href="elink@7ffK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3c8W2P5q4)9#2k6X3W2F1M7%4c8J5N6h3y4@1K9h3!0F1i4K6u0W2j5$3y4Q4x3U0x3I4y4e0f1`.">Instruction::DumpString</a>

## <a href="elink@188K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2U0L8X3u0D9L8$3N6K6i4K6u0W2j5$3!0E0i4K6u0r3L8r3q4F1M7X3g2F1P5r3W2F1P5r3W2F1i4K6u0r3M7q4)9J5c8U0f1J5x3o6M7I4y4K6c8Q4x3X3g2Z5N6r3#2D9">jmethodID跟ArtMethod的转换</a>
ArtMethod *artmeth = reinterpret_cast<ArtMethod *>(methid);
还有上面的，很多的都是可以直接转换的了

## 代码动态编译
占坑，不填

## 安卓加固/安卓脱壳
如上

## 类初始化/方法加载/方法执行
![img_68.png](upload/attach/202511/794149_UPNA65SMB4MP6QW.png)
![img_69.png](upload/attach/202511/794149_EV2FMPXA3Z6SP94.png)
![img_70.png](upload/attach/202511/794149_W2H59TQUT6AEAE5.png)

如上
为啥提到这个？因为我们需要有个事件告知我们，这里的都是被动触发的，或者我们主动出击！
我们也可以主动通过tls相关的代码判断环境，比如ArtThread，从而进一步提高对抗难度，相应的也会提高开发难度（稳定性方面）。

## 动态代理/类替换
有机会继续

这两个也可以作为通知的一种手段
### <a href="elink@9d7K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3A6V1N6%4m8Q4x3V1j5`.">jdwp</a>
### <a href="elink@b13K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3!0H3k6h3&6B7k6r3E0B7N6X3#2@1K9g2)9J5c8R3`.`.">jvmti</a>
1eaK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6K6L8%4g2J5j5$3g2Q4x3X3g2S2L8X3c8J5L8$3W2V1i4K6u0W2k6$3!0G2k6$3I4W2i4K6u0W2j5$3&6Q4x3V1k6V1L8$3y4K6i4K6u0r3j5$3!0J5k6g2)9J5c8Y4u0#2L8Y4c8A6L8h3g2Q4x3V1k6S2M7Y4c8Q4x3X3c8@1K9g2)9K6c8X3S2D9i4K6y4p5P5X3S2Q4x3X3c8U0L8R3`.`.
a62K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6V1L8$3y4K6i4K6u0W2L8%4u0S2j5$3I4W2i4K6u0W2j5$3!0E0i4K6u0r3K9X3q4$3j5i4y4W2i4K6u0r3y4#2)9J5c8X3c8G2j5%4y4Q4x3V1k6H3L8r3q4@1k6X3!0J5L8g2)9J5c8X3A6$3L8i4c8A6i4K6u0r3K9Y4k6E0N6r3W2Q4x3X3g2Z5N6r3#2D9i4K6t1K6f1%4m8W2j5$3W2X3K9h3y4S2N6r3W2G2L8V1W2F1N6s2u0G2

## 课后作业
<a href="elink@7beK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4S2J5k6h3k6S2L8X3c8J5L8$3W2V1i4K6u0W2j5$3!0E0i4K6u0r3j5h3&6V1M7X3!0A6k6q4)9J5k6o6S2Q4x3X3f1I4i4K6u0W2x3q4)9#2k6Y4t1^5x3g2)9J5c8Y4S2J5k6h3k6Q4x3V1k6T1K9h3!0F1K9h3y4Q4x3V1k6D9K9h3u0U0i4K6u0r3j5X3W2G2L8X3W2U0i4K6u0r3L8h3#2S2M7q4)9J5k6h3y4H3M7l9`.`.">mmap</a>
<a href="elink@9feK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4S2J5k6h3k6S2L8X3c8J5L8$3W2V1i4K6u0W2j5$3!0E0i4K6u0r3j5h3&6V1M7X3!0A6k6q4)9J5k6o6S2Q4x3X3f1I4i4K6u0W2x3q4)9#2k6Y4t1^5x3g2)9J5c8Y4S2J5k6h3k6Q4x3V1k6T1K9h3!0F1K9h3y4Q4x3V1k6D9K9h3u0U0i4K6u0r3j5X3W2G2L8X3W2U0i4K6u0r3L8h3q4D9L8r3!0U0i4K6g2X3j5$3!0E0L8h3!0F1i4K6u0W2j5%4m8H3">malloc</a>
为啥dexFile会选择mmap？

## 安卓加固发展历程

到这里，想必你的心里已经有答案了，下面的也已经说完了，也就没必要过多的介绍了
看看图心里也会有答案了
至于怎么脱壳/修复，这里给了那么多点了，随便找一些就好啦

### 整体加固
### goto类抽取/回填抽取/偏移型类抽取
#### goto类抽取
![20251106024356.png](upload/attach/202511/794149_AE77H7U8J75JX7V.png)
![20251106024050.png](upload/attach/202511/794149_M9C56Z3BKEYGPGW.png)
![20251106024116.png](upload/attach/202511/794149_3FQM26BA84BQYVA.png)
![20251106024240.png](upload/attach/202511/794149_ERPESKJYXWZE4PB.png)

### <a href="elink@ec1K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6D9N6h3!0&6k6i4y4A6M7h3W2#2i4K6u0r3k6s2m8@1i4K6u0V1M7$3S2W2L8r3H3`.">dpt</a>
### <a href="elink@aaaK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6S2L8h3W2E0L8#2)9J5c8X3c8U0j5H3`.`.">Dex2C</a>
### <a href="elink@ac3K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6E0j5h3!0S2j5X3y4Q4x3V1k6F1L8h3#2H3">dexvmp</a>

<a href="elink@131K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3W2F1N6r3g2J5M7s2u0W2N6r3g2J5i4K6u0r3K9h3&6@1k6i4u0H3M7X3g2@1k6i4u0Q4y4h3k6K6N6$3W2@1j5$3S2Q4y4h3k6A6L8i4m8D9i4K6u0W2j5$3x3`.">dexvmp的实现</a>
![img_5.png](upload/attach/202511/794149_PWFNZ22CBHZEARN.png)
1eeK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6E0j5h3!0S2j5X3y4Q4x3V1k6F1L8h3#2H3i4K6u0r3j5X3I4G2j5W2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8X3&6E0L8i4k6E0i4K6u0r3L8X3#2E0N6X3#2Q4x3V1k6K6M7X3y4Q4x3V1k6E0j5h3W2F1i4K6u0r3j5%4m8H3i4K6u0r3N6X3#2Q4x3V1k6u0L8Y4c8W2M7Y4m8o6i4K6u0V1M7r3!0J5N6r3q4T1L8r3g2Q4x3X3g2U0M7s2l9`.

```text
.class public Lcom/xgtl/aggregate/activities/SplashActivity;

0x6A5868
```

```java
byte[] header = HexParser.parse("0100000001000000000000000F000000");
byte[] code_item = HexParser.parse("28080000000000000000000000000E0014007B18000071104EDF000028F3");
byte[] fix_code_item = HexParser.parse("000014002500000071104ddf00000e0014007b18000071104edf000028f3");

```

## 彩蛋3

### <a href="elink@06aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8Y4y4@1j5h3y4C8i4K6u0W2j5$3y4Q4x3U0x3%4y4e0R3`.">栈回溯</a>

7abK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3L8r3W2T1j5$3!0J5k6g2)9J5c8X3!0B7L8s2g2F1K9g2)9J5c8Y4y4J5j5#2)9J5c8X3#2S2K9h3&6Q4x3V1k6B7j5i4k6S2i4K6u0r3K9X3q4$3j5g2)9J5c8X3I4S2L8X3N6Q4x3V1k6f1K9s2u0W2j5h3c8Q4x3X3g2B7j5i4k6S2i4K6t1K6L8X3q4@1K9i4k6W2b7%4u0W2j5i4c8W2
089K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8X3&6S2N6r3W2$3k6g2)9J5c8X3A6S2N6X3q4Q4y4h3k6D9j5h3&6Y4i4K6g2X3g2r3S2J5k6h3q4V1i4K6u0W2j5$3x3`.
434K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5M7X3g2X3j5h3&6V1M7X3!0A6k6q4)9J5k6h3y4G2L8g2)9J5c8X3q4F1k6s2u0G2K9h3c8Q4x3X3b7^5i4K6u0W2x3g2)9J5k6e0m8Q4y4h3k6J5z5o6q4Q4x3V1k6^5M7X3g2X3i4K6u0r3j5i4u0@1i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5c8Y4c8Z5M7X3g2S2k6q4)9J5k6h3y4U0

![img_71.png](upload/attach/202511/794149_BDZ3A34J2486MYV.png)

```javascript
57 template <StackVisitor::CountTransitions kCount>
758 void StackVisitor::WalkStack(bool include_transitions) {
759 if (check_suspended_) {
760 DCHECK(thread_ == Thread::Current() || thread_->IsSuspended());
761 }
762 CHECK_EQ(cur_depth_, 0U);
763 bool exit_stubs_installed = Runtime::Current()->GetInstrumentation()->AreExitStubsInstalled();
764 uint32_t instrumentation_stack_depth = 0;
765 size_t inlined_frames_count = 0;
766 
767 for (const ManagedStack* current_fragment = thread_->GetManagedStack();
768 current_fragment != nullptr; current_fragment = current_fragment->GetLink()) {
769 cur_shadow_frame_ = current_fragment->GetTopShadowFrame();
770 cur_quick_frame_ = current_fragment->GetTopQuickFrame();
```

### 致谢
#### <a href="elink@024K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6x3f1#2m8G2M7$3g2V1i4K6u0r3e0q4y4b7L8%4y4W2k6l9`.`.">LSPosed</a> 
#### <a href="elink@c50K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6B7L8i4m8W2N6%4y4Q4x3V1k6p5L8$3u0T1P5b7`.`.">Dobby</a> 
#### <a href="elink@575K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6D9N6h3!0&6k6i4y4A6M7h3W2#2i4K6u0r3k6s2m8@1i4K6u0V1M7$3S2W2L8r3H3`.">dpt-shell</a>
#### <a href="elink@0b8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6f1K9r3g2Z5k6i4m8@1j5g2)9J5c8X3q4F1k6s2u0G2K9h3c8s2f1W2m8o6">androidGRPC</a>
以上排名不分前后！！！非常感谢开源的各位大佬们！！！
还有一些一下忘了的开源库，或者脚本，或者代码片段，等我识别出是那个库，我会在这里补充的，感谢！

能看到这里，你也是很最棒的！
这篇也就是浓缩了这些年的加固的一些变化，如果大佬们还有有趣的样本，可以分享出来，让我们一起学习有意思的东西，哈哈哈

回复或点赞可查看完整内容

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

最后于 2025-11-7 03:22 被陈可牛编辑，原因：上传图片

#混淆加固 #脱壳反混淆

最新回复 (79) 1 2 3 4 ▶
陈可牛雪币： 6559 活跃值： (6687) 能力值： ( LV5，RANK：76 ) 在线值：发帖 3 回帖 111 粉丝 37 关注私信	陈可牛 1 2 楼前三是我的 2025-11-7 01:46 0
陈可牛雪币： 6559 活跃值： (6687) 能力值： ( LV5，RANK：76 ) 在线值：发帖 3 回帖 111 粉丝 37 关注私信	陈可牛 1 3 楼前三是我的 2025-11-7 01:46 0
陈可牛雪币： 6559 活跃值： (6687) 能力值： ( LV5，RANK：76 ) 在线值：发帖 3 回帖 111 粉丝 37 关注私信	陈可牛 1 4 楼前三是我的 2025-11-7 01:46 0
SomeMx 雪币： 4211 活跃值： (5614) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 158 粉丝 1 关注私信	SomeMx 5 楼图片是不是挂了呀 2025-11-7 01:58 0
陈可牛雪币： 6559 活跃值： (6687) 能力值： ( LV5，RANK：76 ) 在线值：发帖 3 回帖 111 粉丝 37 关注私信	陈可牛 1 6 楼 SomeMx 图片是不是挂了呀是的，在私信处理了，这个我也不知道咋弄 2025-11-7 02:05 0
mb_ldbucrik 雪币： 6 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 707 粉丝 7 关注私信	mb_ldbucrik 7 楼感谢分享 2025-11-7 10:08 0
mb_mmlkqxal 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 27 粉丝 0 关注私信	mb_mmlkqxal 8 楼 1111111111111111 2025-11-7 12:54 0
baichisi 雪币： 39 活跃值： (2693) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 115 粉丝 0 关注私信	baichisi 9 楼 hhh 2025-11-7 15:04 0
xianhuimin 雪币： 9341 活跃值： (6228) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 231 粉丝 2 关注私信	xianhuimin 10 楼学习学习 2025-11-7 15:54 0
clz3216 雪币： 1491 活跃值： (4525) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 28 粉丝 1 关注私信	clz3216 11 楼 6 2025-11-7 16:20 0
mb_pesxllvn 雪币： 378 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 122 粉丝 2 关注私信	mb_pesxllvn 12 楼 666 2025-11-7 17:00 0
mb_xxezghuh 雪币： 229 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 13 粉丝 0 关注私信	mb_xxezghuh 13 楼学习学习 2025-11-7 17:20 0
shutu 雪币： 1 活跃值： (201) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 12 粉丝 0 关注私信	shutu 14 楼 666666666666 2025-11-7 18:41 0
mb_euhyowpw 雪币： 2 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 152 粉丝 0 关注私信	mb_euhyowpw 15 楼 666 2025-11-7 22:29 0
mb_mrjjcxgk 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 82 粉丝 0 关注私信	mb_mrjjcxgk 16 楼 666 2025-11-8 10:32 0
mb_asiwnxyv 雪币： 6 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 100 粉丝 0 关注私信	mb_asiwnxyv 17 楼感谢分享 2025-11-8 11:14 0
mb_wjytplsl 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 25 粉丝 0 关注私信	mb_wjytplsl 18 楼 666 2025-11-8 14:26 0
LQ6H 雪币： 530 活跃值： (2627) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 80 粉丝 1 关注私信	LQ6H 19 楼 666 2025-11-8 15:40 0
KanXue_NG 雪币： 678 能力值： ( LV1，RANK：0 ) 在线值：发帖 7 回帖 100 粉丝 66 关注私信	KanXue_NG 20 楼 666 2025-11-8 16:58 0
huangjw 雪币： 6747 活跃值： (11957) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 514 粉丝 2 关注私信	huangjw 21 楼好文章 2025-11-10 09:17 0
fangliangz 雪币： 5717 活跃值： (4104) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 112 粉丝 1 关注私信	fangliangz 22 楼 666 2025-11-10 09:28 0
GEKEZYX 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 157 粉丝 0 关注私信	GEKEZYX 23 楼 666 2025-11-10 09:55 0
NshIdE 雪币： 427 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 15 粉丝 0 关注私信	NshIdE 24 楼 666 2025-11-10 11:49 0
mb_qimctavn 雪币： 5327 活跃值： (6780) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 401 粉丝 1 关注私信	mb_qimctavn 25 楼 6 2025-11-10 12:20 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复