Android漫游记(4)---.so文件动态调试一例

http://blog.csdn.net/lifeshow/article/details/32914081

Android平台的动态调试一直以来是个困扰我等Coder的头疼问题，特别是对于本地的动态调试支持，可以说是“弱智”级别的，不知道Google的新版NDK和新出的Android Studio对这块支持如何，让我们拭目以待。

    言归正传，我这里采用的是cygwin+ndk-gdb的调试模式，灵感来自于XDA的一篇博文（点击打开链接），平台和原文作者不同：

    1、Win7 64

    2、NDK r9d x86_64

    3、Android 4.2.2

    4、cygwin 64

    5、IDA pro 6.1

    话不多话，开始正题，调试步骤如下：

    1、环境搭建这类的各位可以自行Google之，这里就不多说了。

    2、首先我们随便找个网站，下载游戏的APK包。Android的APK包的正式发布版本是取消了debug属性的，在调试之前，我们还需要做些准备工作。

    3、用apktool解包apk文件，然后修改AndroidManifest.xml，在重新打包，再用signapk签名。

    4、为ndk-gdb调试做准备工作，这个上面那篇博文已经写得很详细，这里不再赘述。说明一点：我们调试的目标是.\libs\armeabi\libgame.so，这个so是游戏主库文件。

          准备好后的目录结构大致如下：

          

    5、好了，准备工作完毕，开始我们的调试之旅！

    首先，安装我们重新打包的apk到手机，然后进入cygwin shell，进入本地的游戏解包后的目录。这里要重点说明一点：由于一些兼容性问题，我们不能直接使用google原来的ndk-gdb调试脚本，需要做一些修改：

    

我这里直接给DATA_DIR赋值为app目录：/data/data/com.umonistudio.tile。这步骤很重要，否则你会遇到run-as之类的错误，导致无法继续调试！

好了，终于准备完毕了，切换到cygwin shell，开始调试，如果没有问题的话，就会顺利进入gdb提示符，我的输出如下：

[plain] view plain copy

1. $ ndk-gdb --verbose --start --nowait  
2. Android NDK installation path: /cygdrive/e/Tools/android-ndk-r9d-windows-x86_64/       android-ndk-r9d  
3. Using default adb command: /cygdrive/e/Tools/adt-bundle-windows-x86_64-20131030/       adt-bundle-windows-x86_64-20131030/sdk/platform-tools/adb  
4. ADB version found: Android Debug Bridge version 1.0.31  
5. Using ADB flags:  
6. Using JDB command: /cygdrive/e/Tools/Java/jdk1.7.0_15/bin/jdb  
7. Using auto-detected project path: .  
8. Found package name: com.umonistudio.tile  
9. ABIs targetted by application: armeabi  
10. Device API Level: 17  
11. Device CPU ABIs: armeabi-v7a armeabi  
12. Compatible device ABI: armeabi  
13. Using gdb setup init: ./libs/armeabi/gdb.setup  
14. Using toolchain prefix: /cygdrive/e/Tools/android-ndk-r9d-windows-x86_64/android-ndk-r9  
15. Using app out directory: ./obj/local/armeabi  
16. Found debuggable flag: true  
17. Found data directory: '/data/data/com.umonistudio.tile'  
18. Found device gdbserver: /data/data/com.umonistudio.tile/lib/gdbserver  
19. Found first launchable activity: .tile  
20. Launching activity: com.umonistudio.tile/.tile  
21. ## COMMAND: adb_cmd shell am start -n com.umonistudio.tile/.tile  
22. Starting: Intent { cmp=com.umonistudio.tile/.tile }  
23. ## COMMAND: adb_cmd shell sleep 2  
24. Found running PID: 8706  
25. Launched gdbserver succesfully.  
26. Setup network redirection  
27. ## COMMAND: adb_cmd shell run-as com.umonistudio.tile /data/data/com.umonistudio       .tile/lib/gdbserver +debug-socket --attach 8706  
28. ## COMMAND: adb_cmd forward tcp:5039 localfilesystem:/data/data/com.umonistudio.       tile/debug-socket  
29. Attached; pid = 8706  
30. Listening on Unix socket debug-socket  
31. ## COMMAND: adb_cmd pull /system/bin/app_process obj/local/armeabi/app_process  
32. 2384 KB/s (21980 bytes in 0.009s)  
33. Pulled app_process from device/emulator.  
34. ## COMMAND: adb_cmd pull /system/bin/linker obj/local/armeabi/linker  
35. 3246 KB/s (63176 bytes in 0.019s)  
36. Pulled linker from device/emulator.  
37. ## COMMAND: adb_cmd pull /system/lib/libc.so obj/local/armeabi/libc.so  
38. 4186 KB/s (424460 bytes in 0.099s)  
39. Pulled libc.so from device/emulator.  
40. GNU gdb (GDB) 7.3.1-gg2  
41. Copyright (C) 2011 Free Software Foundation, Inc.  
42. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>  
43. This is free software: you are free to change and redistribute it.  
44. There is NO WARRANTY, to the extent permitted by law.  Type "show copying"  
45. and "show warranty" for details.  
46. This GDB was configured as "--host=x86_64-pc-mingw32msvc --target=arm-linux-android".  
47. For bug reporting instructions, please see:  
48. <http://source.android.com/source/report-bugs.html>.  
49. Warning: E:\works\apktools\biecaibaikuaier_an_debug_sign/system/core/include/cutils: No such file or directory.  
50. Remote debugging from host 0.0.0.0  
51. 0x400f44b8 in epoll_wait () from E:/works/apktools/biecaibaikuaier_an_debug_sign/obj/local/armeabi/libc.so  
52. warning: Could not load shared library symbols for 108 libraries, e.g. libstdc++.so.  
53. Use the "info sharedlibrary" command to see the complete listing.  
54. Do you need "set solib-search-path" or "set sysroot"?  
55. warning: Breakpoint address adjusted from 0x400b4ab7 to 0x400b4ab6.  
56. (gdb)  

这里需要说明一点，我输入的调试命令：ndk-gdb --verbose --start --nowait，加了一个nowait参数：如果不加nowait会在libgame.so这个目标so加载前，gdb就断下来，导致我们无法调试目标库。

好了，我们在gdb命令号输入：

[plain] view plain copy

1. (gdb) info shared  
2. From        To          Syms Read   Shared Object Library  
3. 0x400b2280  0x400bb418  Yes (*)     E:/works/apktools/biecaibaikuaie                                                                                                                    r_an_debug_sign/obj/local/armeabi/linker  
4. 0x400df830  0x4012e294  Yes (*)     E:/works/apktools/biecaibaikuaie                                                                                                                    r_an_debug_sign/obj/local/armeabi/libc.so  
5.                         No          libstdc++.so  
6.                         No          libm.so  
7.                         No          liblog.so  
8.                         No          libcutils.so  
9.                         No          libgccdemangle.so  
10.                         No          libcorkscrew.so  
11.                         No          libz.so  
12.                         No          libutils.so  
13.                         No          libbinder.so  
14.                         No          libemoji.so  
15.                         No          libjpeg.so  
16.                         No          libexpat.so  
17.                         No          libm4u.so  
18.                         No          libstlport.so  
19.                         No          libnetutils.so  
20.                         No          libbwc.so  
21.                         No          libhardware.so  
22.                         No          libsync.so  
23.                         No          libui.so  
24.                         No          libGLES_trace.so  
25.                         No          libEGL.so  
26.                         No          libGLESv2.so  
27.                         No          libion.so  
28.                         No          libdpframework_os.so  
29.                         No          libdpframework_plat.so  
30.                         No          libdpframework.so  
31.                         No          libgui.so  
32.                         No          libcamera_client.so  
33.                         No          libcam.utils.so  
34.                         No          libaed.so  
35.                         No          libcameracustom.so  
36.                         No          libcam_camera_exif.so  
37.                         No          libnativehelper.so  
38.                         No          libmatv_cust.so  
39.                         No          libcamdrv.so  
40.                         No          libimageio.so  
41.                         No          libcam.campipe.so  
42.                         No          libGdmaScalerPipe.so  
43.                         No          libSwJpgCodec.so  
44.                         No          libvcodec_oal.so  
45.                         No          libsched.so  
46.                         No          libvcodec_utility.so  
47.                         No          libmp4enc_xa.ca7.so  
48.                         No          libvcodecdrv.so  
49.                         No          libJpgDecPipe.so  
50.                         No          libmhalImageCodec.so  
51.                         No          libalmkdrv.so  
52.                         No          libskia.so  
53.                         No          libtinyxml.so  
54.                         No          libandroidfw.so  
55.                         No          libgabi++.so  
56.                         No          libicuuc.so  
57.                         No          libicui18n.so  
58.                         No          libsqlite.so  
59.                         No          libdvm.so  
60.                         No          libGLESv1_CM.so  
61.                         No          libETC1.so  
62.                         No          libwpa_client.so  
63.                         No          libhardware_legacy.so  
64.                         No          libsonivox.so  
65.                         No          libcrypto.so  
66.                         No          libssl.so  
67.                         No          libstagefright_foundation.so  
68.                         No          libspeexresampler.so  
69.                         No          libaudioutils.so  
70.                         No          libmedia_native.so  
71.                         No          libmedia.so  
72.                         No          libusbhost.so  
73.                         No          libharfbuzz.so  
74.                         No          libhwui.so  
75.                         No          libmtkbtextadpa2dp.so  
76.                         No          libextjsr82.so  
77.                         No          libandroid_runtime.so  
78.                         No          libjavacore.so  
79.                         No          libdrmframework.so  
80.                         No          libdrmmtkwhitelist.so  
81.                         No          libdrmmtkutil.so  
82.                         No          libdrmframework_jni.so  
83.                         No          libstagefright_memutil.so  
84.                         No          libstagefright_omx.so  
85.                         No          libstagefright_yuv.so  
86.                         No          libvorbisidec.so  
87.                         No          libstagefright_enc_common.so  
88.                         No          libstagefright_avc_common.so  
89.                         No          libstagefright.so  
90.                         No          libmtp.so  
91.                         No          libexif.so  
92.                         No          libstagefright_amrnb_common.so  
93.                         No          libmtk_drvb.so  
94.                         No          libamr_wrap.so  
95.                         No          libmedia_jni.so  
96.                         No          libbcinfo.so  
97.                         No          libbcc.so  
98.                         No          libRS.so  
99.                         No          librs_jni.so  
100.                         No          libandroid.so  
101.                         No          libchromium_net.so  
102.                         No          libwebcore.so  
103. 0x5dd4a500  0x5dfb591c  Yes (*)     E:/works/apktools/biecaibaikuaie                                                                                                                    r_an_debug_sign/obj/local/armeabi/libgame.so  
104.                         No          libsoundpool.so  
105.                         No          libsrv_um.so  
106.                         No          libIMGegl.so  
107.                         No          libEGL_mtk.so  
108.                         No          libusc.so  
109.                         No          libGLESv1_CM_mtk.so  
110.                         No          libGLESv2_mtk.so  
111.                         No          libpvrANDROID_WSEGL.so  
112.                         No          libpvr2d.so  
113.                         No          gralloc.mt6589.so  
114. (*): Shared library is missing debugging information.  

可以看到我们的目标库已经成功加载，地址0x5dd5a500---0x5dfb591c，终于可以开始愉快的玩耍了

这里我们打开IDA，查看libgame.so的反汇编，找到GameOver::initscore(int,bool)这个函数：

先说明下这个函数的作用：在游戏结束后，显示当前局的分数！我们看下其函数名导出为：_ZN8GameOver9initScoreEib。好了，我们在GDB输入：

[plain] view plain copy

1. (gdb) br _ZN8GameOver9initScoreEib  
2. Breakpoint 1 at 0x5dd4c612  
3. (gdb) info b  
4. Num     Type           Disp Enb Address    What  
5. 1       breakpoint     keep y   0x5dd4c612 <GameOver::initScore(int, bool)+26>  
6. (gdb) disas 0x5dd4c612,+20  
7. Dump of assembler code from 0x5dd4c612 to 0x5dd4c626:  
8.    0x5dd4c612 <_ZN8GameOver9initScoreEib+26>:   cmp     r1, #0  
9.    0x5dd4c614 <_ZN8GameOver9initScoreEib+28>:   beq.n   0x5dd4c61a <_ZN8GameOver9initScoreEib+34>  
10.    0x5dd4c616 <_ZN8GameOver9initScoreEib+30>:   ldr     r3, [pc, #284]  ; (0x5dd4c734 <_ZN8GameOver9initScoreEib+316>)  
11.    0x5dd4c618 <_ZN8GameOver9initScoreEib+32>:   str     r3, [sp, #4]  
12.    0x5dd4c61a <_ZN8GameOver9initScoreEib+34>:   adds    r4, r5, #0  
13.    0x5dd4c61c <_ZN8GameOver9initScoreEib+36>:   adds    r4, #252        ; 0xfc  
14.    0x5dd4c61e <_ZN8GameOver9initScoreEib+38>:   bl      0x5dde73d4 <_ZN7cocos2d13CCUserDefault17sharedUserDefaultEv>  
15.    0x5dd4c622 <_ZN8GameOver9initScoreEib+42>:   ldr     r2, [r4, #32]  
16.    0x5dd4c624 <_ZN8GameOver9initScoreEib+44>:   ldr     r3, [pc, #272]  ; (0x5dd4c738 <_ZN8GameOver9initScoreEib+320>)  
17. End of assembler dump.  
18. (gdb)  

对照IDA反汇编，可以看到是断在了函数的内部，当然我们可以调整断点到函数入口，这里主要是为了演示，就不做调整。

好了，断点下好了，我们开始游戏，选择“街机”模式开始游戏，然后点几下，再随便点个白块儿让游戏结束。

看看gdb的输出窗口：

[plain] view plain copy

1. (gdb) c  
2. Continuing.  
3. [New Thread 8720]  
4. [Switching to Thread 8720]  
5.   
6.   
7. Breakpoint 1, 0x5dd4c612 in GameOver::initScore(int, bool) () from E:/works/apktools/biecaibaikuaier_an_debug_sign/obj/local/armeabi/libgame.so  
8. (gdb) info registers  
9. r0             0x65cf59f8       1708087800  
10. r1             0x0      0  
11. r2             0x6e0aeb37       1846209335  
12. r3             0x4013d1f4       1075040756  
13. r4             0x65cf5af4       1708088052  
14. r5             0x65cf59f8       1708087800  
15. r6             0x7      7  
16. r7             0x5dde3b2d       1574845229  
17. r8             0x5e1c2c70       1578904688  
18. r9             0x5e0c2f3c       1577856828  
19. r10            0x5cdd5a88       1558010504  
20. r11            0x5e1c2c84       1578904708  
21. r12            0x5e088afc       1577618172  
22. sp             0x5e1c2af8       0x5e1c2af8  
23. lr             0x5dd4ca0f       1574226447  
24. pc             0x5dd4c612       0x5dd4c612 <GameOver::initScore(int, bool)+26>  
25. cpsr           0x30     48  
26. (gdb)set $r6=99999  

YES，成功断下！输入info registers查看当前寄存器状态，注意查看r6寄存器，值为0x7(我刚才点了7个黑块儿)。我们开始个好玩的东西，gdb输入：set $r6=99999，然后让游戏继续，看看有什么 ！！！

总结一下：

这里主要是演示了下Android平台下，对于无源码的第三方动态库的汇编级调试过程（不针对任何游戏，不用于任何商业目的），目前google官方的调试工具对native调试支持不好，希望后面google能对这块给力些。上面所涉及的内容只用于技术交流之用处，不用于任何商业目的。