android cydia框架,Android.Hook框架Cydia篇(脱壳机制作)

return fromZip(argc, argv);

else if (strcmp(argv[1], "--dex") == 0)

return fromDex(argc, argv);

else if (strcmp(argv[1], "--preopt") == 0)

return preopt(argc, argv);

}

...

return 1;

}

可以看到,这里会分别对3中类型的文件做不同处理,我们关心的是dex文件,所以接下来看看fromDex函数：

static int fromDex(int argc, char* const argv[])

{

...

if (dvmPrepForDexOpt(bootClassPath, dexOptMode, verifyMode, flags) != 0) {

ALOGE("VM init failed");

goto bail;

}

vmStarted = true;

/* do the optimization */

if (!dvmContinueOptimization(fd, offset, length, debugFileName,

modWhen, crc, (flags & DEXOPT_IS_BOOTSTRAP) != 0))

{

ALOGE("Optimization failed");

goto bail;

}

...

}

这个函数先初始化了一个虚拟机,然后调用dvmContinueOptimization函数/dalvik/vm/analysis/DexPrepare.cpp,进入这个函数：

bool dvmContinueOptimization(int fd, off_t dexOffset, long dexLength,

const char* fileName, u4 modWhen, u4 crc, bool isBootstrap)

{

...

/*

* Rewrite the file.  Byte reordering, structure realigning,

* class verification, and bytecode optimization are all performed

* here.

*

* In theory the file could change size and bits could shift around.

* In practice this would be annoying to deal with, so the file

* layout is designed so that it can always be rewritten in place.

*

* This creates the class lookup table as part of doing the processing.

*/

success = rewriteDex(((u1*) mapAddr) + dexOffset, dexLength,

doVerify, doOpt, &pClassLookup, NULL);

if (success) {

DvmDex* pDvmDex = NULL;

u1* dexAddr = ((u1*) mapAddr) + dexOffset;

if (dvmDexFileOpenPartial(dexAddr, dexLength, &pDvmDex) != 0) {

ALOGE("Unable to create DexFile");

success = false;

} else {

...

}

这个函数中对Dex文件做了一些优化(如字节重排序,结构对齐等),然后重新写入Dex文件.如果优化成功的话接下来调用dvmDexFileOpenPartial,而这个函数中调用了真正的Dex文件.在具体看看这个函数/dalvik/vm/DvmDex.cpp

/*

* Create a DexFile structure for a "partial" DEX.  This is one that is in

* the process of being optimized.  The optimization header isn't finished

* and we won't have any of the auxillary data tables, so we have to do

* the initialization slightly differently.

*

* Returns nonzero on error.

*/

int dvmDexFileOpenPartial(const void* addr, int len, DvmDex** ppDvmDex)

{

DvmDex* pDvmDex;

DexFile* pDexFile;

int parseFlags = kDexParseDefault;

int result = -1;

/* -- file is incomplete, new checksum has not yet been calculated

if (gDvm.verifyDexChecksum)

parseFlags |= kDexParseVerifyChecksum;

*/

pDexFile = dexFileParse((u1*)addr, len, parseFlags);

if (pDexFile == NULL) {

ALOGE("DEX parse failed");

goto bail;