unidbg 补环境(类变量,类方法等)

6 篇文章 0 订阅
3 篇文章 1 订阅

unidbg 补环境(类变量,类方法等)

unidbg有时候会遇到补环境的状况

当看到报如下错误的时候基本上就是缺少环境,需要添加代码,添加代码的方式可以根据报错提示的第一行来进行补全,补全的函数名称和报错名称一致。
请添加图片描述

以下为部分补全环境的实例(补完一个运行可能还会报错,接着补就行了,直到没有错位置)

public class hack extends AbstractJni {
    private final AndroidEmulator emulator;
    private final VM vm;
    private final Module module;
    private DvmClass cNative;

    private hack () {
        emulator = AndroidEmulatorBuilder.for32Bit().setProcessName("com.test").build();
        final Memory memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23));
        vm = emulator.createDalvikVM(new File("unidbg-android/src/test/java/com/hack/hack.apk"));
        DalvikModule dm = vm.loadLibrary(new File("unidbg-android/src/test/java/com/hack/libmyjni.so"), true);
        vm.setJni(this);
        vm.setVerbose(true);
        dm.callJNI_OnLoad(emulator);
        module = dm.getModule();

    }

    @Override
    public void setStaticIntField(BaseVM vm, DvmClass dvmClass, String signature, int value) {
        switch (signature) {
            case "com/gdufs/xman/MyApp->m:I":
                System.out.println("> Patched: com/gdufs/xman/MyApp->m:I");
                return;
        }
        super.setStaticIntField(vm, dvmClass, signature, value);
    }

    @Override
    public int getStaticIntField(BaseVM vm, DvmClass dvmClass, String signature) {
        switch (signature) {
            case "com/gdufs/xman/MyApp->m:I":
                System.out.println("> Patched: com/gdufs/xman/MyApp->m:I");
                return 0;
        }
        return super.getStaticIntField(vm, dvmClass, signature);
    }

    @Override
    public DvmObject<?> newObject(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
        switch (signature) {
            case "com/gdufs/xman/MainActivity-><init>()V":
                System.out.println("> Patched: com/gdufs/xman/MainActivity-><init>()V");
                return vm.resolveClass("com/gdufs/xman/MainActivity").newObject(null);
        }
        return super.newObject(vm, dvmClass, signature, varArg);
    }

    @Override
    public void callVoidMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
        switch (signature) {
            case "com/gdufs/xman/MainActivity->work(Ljava/lang/String;)V":
                System.out.println("> Patched: com/gdufs/xman/MainActivity->work(Ljava/lang/String;)V");
                return;
        }
        super.callVoidMethod(vm, dvmObject, signature, varArg);
    }

    public static void main(String[] args) {
        hack test = new hack();
        test.hookPuts();
        test.hookWork();
        test.saveSN();
        test.work();

    }


    private void saveSN() {
        List<Object> list = new ArrayList<>(10);
        list.add(vm.getJNIEnv());
        list.add(0);
        list.add(vm.addLocalObject(new StringObject(vm, "EoPAoY62@ElRD")));   // arg 3

        Number number =  module.callFunction(emulator, 0x000011F8+1, list.toArray());
    }
  • 2
    点赞
  • 2
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值