unidbg学习模拟m团mtgsig

模拟结果：

代码：

package com.test;

import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Emulator;
import com.github.unidbg.LibraryResolver;
import com.github.unidbg.Module;
import com.github.unidbg.file.FileResult;
import com.github.unidbg.file.IOResolver;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.linux.android.dvm.array.ArrayObject;
import com.github.unidbg.linux.android.dvm.array.ByteArray;
import com.github.unidbg.linux.android.dvm.wrapper.DvmInteger;
import com.github.unidbg.memory.Memory;

import java.io.File;
import java.io.IOException;

public class MtGsigTest extends AbstractJni implements IOResolver {
    private final AndroidEmulator emulator;
    private final Module module;
    private final VM vm;
    private final DvmClass NBridge;

    public String apkPath = "xxxxx.apk";
    public String soPath = "xxxxx.so";

    private static LibraryResolver createLibraryResolver() {
        return new AndroidResolver(23);
    }

    private static AndroidEmulator createARMEmulator() {
        return AndroidEmulatorBuilder
                .for32Bit()
                .build();
    }

    MtGsigTest() {
        emulator = AndroidEmulatorBuilder.for32Bit().setProcessName("com.xxxx").build();
        final Memory memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23));
        vm = emulator.createDalvikVM(new File(apkPath));
        vm.setVerbose(true);

        DalvikModule dm = vm.loadLibrary(new File(soPath), true);

        emulator.getSyscallHandler().addIOResolver(this);
        vm.setJni(this);


        module = dm.getModule();

        NBridge = vm.resolveClass("com/meituan/android/common/mtguard/NBridge");
        dm.callJNI_OnLoad(emulator);
    }

    public static void main(String[] args) throws IOException {
        MtGsigTest mtGsig = new MtGsigTest();

        mtGsig.callMain111();
        mtGsig.callMain203();

        mtGsig.destroy();

    }



    private void destroy() throws IOException {
        emulator.close();
    }

    public void callMain111() {
        DvmObject<?> strRc = NBridge.callStaticJniMethodObject(
                emulator, "main(I[Ljava/lang/Object;)[Ljava/lang/Object;",
                111,
                new ArrayObject(vm.resolveClass("java/lang/object").newObject(1))
        );

        System.out.println("callMain111: " + strRc);
    }

    public DvmObject<?> callMain203() {
        DvmObject<?> strRcstrRc = NBridge.callStaticJniMethodObject(
                emulator, "main(I[Ljava/lang/Object;)[Ljava/lang/Object;",
                203,
                new ArrayObject(
                        new StringObject(vm, "9b69f861-e054-4bc4-9daf-d36ae205ed3e"),
                        new ByteArray(vm, "xxxxxx".getBytes()),
                        DvmInteger.valueOf(vm, 2)
                )
        );

        System.out.println("mtgsig: " + ((DvmObject<?>[]) ((ArrayObject) strRcstrRc).getValue())[0]);
        return strRcstrRc;
    }


    @Override
    public int getStaticIntField(BaseVM vm, DvmClass dvmClass, String signature) {
        switch (signature){
            case "android/content/pm/PackageManager->GET_SIGNATURES:I":{
                return 64;
            }
        }
        return super.getStaticIntField(vm, dvmClass, signature);
    }

    @Override
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
        return null;
    }


    @Override
    public int callStaticIntMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
        switch (signature){
            case "com/meituan/android/common/mtguard/NBridge->getMtgVC()I":{
                return 4204;
            }
        };
        return super.callStaticIntMethodV(vm, dvmClass, signature, vaList);
    }

    @Override
    public DvmObject<?> callStaticObjectMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
        switch (signature) {
            case "com/meituan/android/common/mtguard/NBridge->getPicName()Ljava/lang/String;":{
                return new StringObject(vm, "ms_com.sankuai.meituan");
            }
            case "com/meituan/android/common/mtguard/NBridge->getSecName()Ljava/lang/String;":{
                return new StringObject(vm, "ppd_com.sankuai.meituan.xbt");
            }
            case "com/meituan/android/common/mtguard/NBridge->getAppContext()Landroid/content/Context;":{
                return vm.resolveClass("android/content/Context").newObject(null);
            }
            case "com/meituan/android/common/mtguard/NBridge->getMtgVN()Ljava/lang/String;": {
                return new StringObject(vm, "4.2.0.4");
            }
        }
        return super.callStaticObjectMethodV(vm, dvmClass, signature,vaList);
    }

    @Override
    public DvmObject<?> newObjectV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
        switch (signature) {
            case "java/lang/Integer-><init>(I)V":{
                return vm.resolveClass("java/lang/Integer").newObject(new Integer(0));
            }
        }
        return super.newObjectV(vm,dvmClass,signature,vaList);
    }
}

测试结果：

2.3版本：