android so文件脱壳,安卓逆向ida脱dex so壳内存脱壳教程

idc脚本：

static main(void)

{

auto fp, dexAddress, end, size;

dexAddress = 0xA644C008;

size = 0x0086CAB0;

end = dexAddress + size;

fp = fopen("D:\\classes.dex", "wb");

for ( ; dexAddress < end; dexAddress++ )

fputc(Byte(dexAddress), fp);

}

脱so文件脚本：

static main(void)

{

auto fp, dexAddress, end, size;

dexAddress = 0xA644C008;

size = 0x0086CAB0;

end = dexAddress + size;

fp = fopen("D:\\xxx.so", "wb");

for ( ; dexAddress < end; dexAddress++ )

fputc(Byte(dexAddress), fp);

}

ida操作教程：

adb push d:\as /data/local/tmp/as

adb shell

su  获取root权限

chmod 777 给文件777权限

cd data/local/tmp 进入这个目录

./as    启动android_server 我这边改名为as

再开一个cmd窗口

adb forward tcp:23946 tcp:23946  默认23946端口转发

adb forward tcp:15923 tcp:15923  -p修改端口转发

adb shell am start -D -n com.example.protectapp/org.isclab.shh.protectapp.MainActivity 调式模式启动

jdb -connect com.sun.jdi.SocketAttach:hostname=127.0.0.1,port=8614  jdb恢复程序运行

5.1下断点位置: dvmdexfileparse   libdvmso: dvmDexFileOpenPartial  libart.so: Openmemory