逆向之unidbg补环境之各种出错集合锦囊

云霄IT

已于 2024-05-17 17:22:22 修改

阅读量1.3k

点赞数 1

分类专栏： unidbg系列专属文章标签： java 算法 servlet

于 2023-06-21 18:42:16 首次发布

本文链接：https://blog.csdn.net/weixin_51111267/article/details/131332891

版权

unidbg系列专属专栏收录该内容

6 篇文章 3 订阅

订阅专栏

出错一：

Exception in thread "main" java.lang.IllegalStateException: Unsupported arg: false

解决：传参数 false 的时候替换成传0

在这里插入图片描述

出错二：

[main]W/libc: pthread_create failed: clone failed: Out of memory

解决：增加代码

emulator.getSyscallHandler().setEnableThreadDispatcher(true);

在这里插入图片描述

出错三：

Exception in thread "main" java.lang.NullPointerException

解决：搭建unidbg框架初始化时增加这两行代码

final Memory memory = emulator.getMemory();
 memory.setLibraryResolver(new AndroidResolver(23));
 vm = emulator.createDalvikVM(new File("E:\\JavaApp\\unidbg-master\\unidbg-android\\src\\test\\resources\\MySo\\xxx.apk"));
 // 增加下面这两行代码
 new JniGraphics(emulator, vm).register(memory);
 new AndroidModule(emulator, vm).register(memory);

出错四：

Exception in thread "main" java.lang.IllegalStateException: Unsupported arg:...

解决：入参代码错误，应采用下面方法入参

List<Object> arg_list = new ArrayList<>(10);
arg_list.add(vm.getJNIEnv());
arg_list.add(0);
StringObject appkey = new StringObject(vm,"xxxxxxx");
arg_list.add(vm.addLocalObject(appkey));
ArrayObject arrayObject = new ArrayObject(null, new StringObject(vm, "xxxxxx"),null,null,null,null,null);
arg_list.add(vm.addLocalObject(arrayObject));
arg_list.add(10412);
Number number = module.callFunction(emulator, 0x53129, arg_list.toArray());
System.out.println(vm.getObject(number.intValue()).getValue());

出错五

java.security.NoSuchAlgorithmException: SHA256 MessageDigest not available

解决：补环境

@Override
    public DvmObject<?> callStaticObjectMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
        switch (signature) {
            case "java/security/MessageDigest->getInstance(Ljava/lang/String;)Ljava/security/MessageDigest;":
                StringObject type = vaList.getObjectArg(0);
                String name = "";
                if ("\"SHA256\"".equals(type.toString())) {
                    name = "SHA-256";
                }
                else {
                    name = type.toString();
                    System.out.println("else name: " + name);
                }
                try {
                    return vm.resolveClass("java/security/MessageDigest").newObject(MessageDigest.getInstance(name));
                } catch (NoSuchAlgorithmException e) {
                    throw new IllegalStateException(e);
                }
           
        }
        return super.callStaticObjectMethodV(vm, dvmClass, signature, vaList);
    }

出错六

libxxxso load dependency libxxx.so failed
libxxxso load dependency libxxx.so failed
libxxxso load dependency libxxx.so failed
unicorn.UnicornException: Invalid memory fetch (UC_ERR_FETCH_UNMAPPED)

解决办法：so文件调用了其他so文件，缺少依赖。找到缺少的so文件放到调用so文件同个文件夹，或者太复杂的unidbg估计处理不了，需要在关键逻辑patch。或者使用以下方法

 vm = emulator.createDalvikVM(new File("E:\\MyApp\\AndroidNX\\unidbg-0.9.7\\unidbg-android\\src\\test\\resources\\MySo\\xxx.apk"));
DalvikModule dm = vm.loadLibrary("abc_xx",true);