【Android安全】Dalvik字节码含义查询表

        下表中的Vx代表Dalvix寄存器，根据说明我们可以访问Vx-Vxxxx种类型的寄存器范围为Vx为V0-16，Vxx为V17-256，Vxxxx为V257-65535，如果存储Long或者Double值，则需要2个寄存器，如double值可以存储在V0和V1寄存器中。
Boolean值用1和0存储，对Boolean值的操作需要转换为整形操作。
所有例子都是大字节序，例如0F00 0A00是按0F, 00, 0A, 00顺序编码的。

注意：有一些没有解释，那意味着我们没有找到任何公开的信息，这些信息来自
Android opcode constant list.

Opcode (hex)	Opcode name	Explanation	Example
00	nop	No operation	0000 - nop
01	move vx,vy	Moves the content of vy into vx. Both registers must be in the first 256 register range.	0110 - move v0, v1 Moves v1 into v0.
02	move/from16 vx,vy	Moves the content of vy into vx. vy may be in the 64k register range while vx is one of the first 256 registers.	0200 1900 - move/from16 v0, v25 Moves v25 into v0.
03	move/16
04	move-wide
05	move-wide/from16 vx,vy	Moves a long/double value from vy to vx. vy may be in the 64k register range while wx is one of the first 256 registers.	0516 0000 - move-wide/from16 v22, v0 Moves v0 into v22.
06	move-wide/16
07	move-object vx,vy	Moves the object reference from vy to vx.	0781 - move-object v1, v8 Moves the object reference in v8 to v1.
08	move-object/from16 vx,vy	Moves the object reference from vy to vx, vy can address 64k registers and vx can address 256 registers.	0801 1500 - move-object/from16 v1, v21 Move the object reference in v21 to v1.
09	move-object/16
0A	move-result vx	Move the result value of the previous method invocation into vx.	0A00 - move-result v0 Move the return value of a previous method invocation into v0.
0B	move-result-wide vx	Move the long/double result value of the previous method invocation into vx,vx+1.	0B02 - move-result-wide v2 Move the long/double result value of the previous method invocation into v2,v3.
0C	move-result-object vx	Move the result object reference of the previous method invocation into vx.	0C00 - move-result-object v0
0D	move-exception vx	Move the exception object reference thrown during a method invocation into vx.	0D19 - move-exception v25
0E	return-void	Return without a return value	0E00 - return-void
0F	return vx	Return with vx return value	0F00 - return v0 Returns with return value in v0.
10	return-wide vx	Return with double/long result in vx,vx+1.	1000 - return-wide v0 Returns with a double/long value in v0,v1.
11	return-object vx	Return with vx object reference value.	1100 - return-object v0 Returns with object reference value in v0
12	const/4 vx,lit4	Puts the 4 bit constant into vx	1221 - const/4 v1, #int2 Moves literal 2 into v1. The destination register is in the lower 4 bit in the second byte, the literal 2 is in the higher 4 bit.
13	const/16 vx,lit16	Puts the 16 bit constant into vx	1300 0A00 - const/16 v0, #int 10 Puts the literal constant of 10 into v0.
14	const vx, lit32	Puts the integer constant into vx	1400 4E61 BC00 - const v0, #12345678 // #00BC614E Moves literal 12345678 into v0.
15	const/high16 v0, lit16	Puts the 16 bit constant into the topmost bits of the register. Used to initialize float values.	1500 2041 - const/high16 v0, #float 10.0 // #41200000 Moves the floating literal of 10.0 into v0. The 16 bit literal in the instruction carries the top 16 bits of the floating point number.
16	const-wide/16 vx, lit16	Puts the integer constant into vx and vx+1 registers, expanding the integer constant into a long constant..	1600 0A00 - const-wide/16 v0, #long 10 Moves literal 10 into v0 and v1 registers.
17	const-wide/32 vx, lit32	Puts the 32 bit constant into vx and vx+1 registers, expanding the integer constant into a long constant.	1702 4e61 bc00 - const-wide/32 v2, #long 12345678 // #00bc614e Puts #12345678 into v2 and v3 registers.
18	const-wide vx, lit64	Puts the 64 bit constant into vx and vx+1 registers.	1802 874b 6b5d 54dc 2b00- const-wide v2, #long 12345678901234567 // #002bdc545d6b4b87 Puts #12345678901234567 into v2 and v3 registers.
19	const-wide/high16 vx,lit16	Puts the 16 bit constant into the highest 16 bit of vx and vx+1 registers. Used to initialize double values.	1900 2440 - const-wide/high16 v0, #double 10.0 // #402400000 Puts the double constant of 10.0 into v0 register.
1A	const-string vx,string_id	Puts reference to a string constant identified by string_id into vx.	1A08 0000 - const-string v8, "" // string@0000 Puts reference to string@0000 (entry #0 in the string table) into v8.
1B	const-string-jumbo
1C	const-class vx,type_id	Moves the class object of a class identified by type_id (e.g. Object.class) into vx.	1C00 0100 - const-class v0, Test3 // type@0001 Moves reference to Test3.class (entry#1 in the type id table) into
1D	monitor-enter vx	Obtains the monitor of the object referenced by vx.	1D03 - monitor-enter v3 Obtains the monitor of the object referenced by v3.
1E	monitor-exit	Releases the monitor of the object referenced by vx.	1E03 - monitor-exit v3 Releases the monitor of the object referenced by v3.
1F	check-cast vx, type_id	Checks whether the object reference in vx can be cast to an instance of a class referenced by type_id. Throws ClassCastException if the cast is not possible, continues execution otherwise.	1F04 0100 - check-cast v4, Test3 // type@0001 Checks whether the object reference in v4 can be cast to type@0001 (entry #1 in the type id table)
20	instance-of vx,vy,type_id	Checks whether vy is instance of a class identified by type_id. Sets vx non-zero if it is, 0 otherwise.	2040 0100 - instance-of v0, v4, Test3 // type@0001 Checks whether the object reference in v4 is an instance of type@0001 (entry #1 in the type id table). Sets v0 to non-zero if v4 is instance of Test3, 0 otherwise.
21	array-length vx,vy	Calculates the number of elements of the array referenced by vy and puts the length value into vx.	2111 - array-length v1, v1 Calculates the number of elements of the array referenced by v1 and puts the result into v1.
22	new-instance vx,type	Instantiates an object type and puts the reference of the newly created instance into vx.	2200 1500 - new-instance v0, java.io.FileInputStream // type@0015 Instantiates type@0015 (entry #15H in the type table) and puts its reference into v0.
23	new-array vx,vy,type_id	Generates a new array of type_id type and vy element size and puts the reference to the array into vx.	2312 2500 - new-array v2, v1, char[] // type@0025 Generates a new array of type@0025 type and v1 size and puts the reference to the new array into v2.
24	filled-new-array {parameters},type_id	Generates a new array of type_id and fills it with the parameters5. Reference to the newly generated array can be obtained by a move-result-object instruction, immediately following the filled-new-array instruction.	2420 530D 0000 - filled-new-array {v0,v0},[I // type@0D53 Generates a new array of type@0D53. The array's size will be 2 and both elements will be filled with the contents of v0 register.
25	filled-new-array-range {vx..vy},type_id	Generates a new array of type_id and fills it with a range of parameters. Reference to the newly generated array can be obtained by a move-result-object instruction, immediately following the filled-new-array instruction.	2503 0600 1300 - filled-new-array/range {v19..v21}, [B // type@0006 Generates a new array of type@0D53. The array's size will be 3 and the elements will be filled using the v19,v20 and v21 registers4.
26	fill-array-data vx,array_data_offset	Fills the array referenced by vx with the static data. The location of the static data is the sum of  the position of the current instruction and the offset	2606 2500 0000 - fill-array-data v6, 00e6 // +0025 Fills the array referenced by v0 with the static data at current instruction+25H words location. The offset is expressed as a 32-bit number. The static data is stored in the following format: 0003 // Table type: static array data 0400 // Byte per array element (in this case, 4 byte integers) 0300 0000 // Number of elements in the table 0100 0000  // Element #0: integer 1 0200 0000 // Element #1: integer 2 0300 0000 // Element #2: integer3
27	throw vx	Throws an exception object. The reference of the exception object is in vx.	2700 - throw v0 Throws an exception. The exception object reference is in v0.
28	goto target	Unconditional jump by short offset2.	28F0 - goto 0005 // -0010 Jumps to current position-16 words (hex 10). 0005 is the label of the target instruction.
29	goto/16 target	Unconditional jump by 16 bit offset2.	2900 0FFE - goto/16 002f // -01f1 Jumps to the current position-1F1H words. 002F is the label of the target instruction.
2A	goto/32 target
2B	packed-switch vx,table	Implements a switch statement where the case constants are close to each other. The instruction uses an index table. vx indexes into this table to find the offset of the instruction for a particular case. If vx falls out of the index table, the execution continues on the next instruction (default case).	2B02 0C00 0000 - packed-switch v2, 000c // +000c Execute a packed switch according to the switch argument in v2. The position of the index table is at current instruction+0CH words. The table looks like the following: 0001 // Table type: packed switch table 0300 // number of elements 0000 0000 // element base 0500 0000  0: 00000005 // case 0: +00000005 0700 0000  1: 00000007 // case 1: +00000007 0900 0000  2: 00000009 // case 2: +00000009
2C	sparse-switch vx,table	Implements a switch statement with sparse case table. The instruction uses a lookup table with case constants and offsets for each case constant. If there is no match in the table, execution continues on the next instruction (default case).	2C02 0c00 0000 - sparse-switch v2, 000c // +000c Execute a sparse switch according to the switch argument in v2. The position of the lookup table is at current instruction+0CH words. The table looks like the following. 0002 // Table type: sparse switch table 0300 // number of elements 9cff ffff // first case: -100 fa00 0000 // second case constant: 250 e803 0000 // third case constant: 1000 0500 0000 // offset for the first case constant: +5 0700 0000 // offset for the second case constant: +7 0900 0000 // offset for the third case constant: +9
2D	cmpl-float	Compares the float values in vy and vz and sets the integer value in vx accordingly3	2D00 0607 - cmpl-float v0, v6, v7 Compares the float values in v6 and v7 then sets v0 accordingly. NaN bias is less-than, the instruction will return -1 if any of the parameters is NaN.
2E	cmpg-float vx, vy, vz	Compares the float values in vy and vz and sets the integer value in vx accordingly3