hookZz,Dobby,xHook,consoleDebugger


//简单的需求可以调用Unicorn对虚拟内存进行修改
public void patchVerify(){int patchCode = 0x4FF00100; //emulator.getMemory().pointer(module.base + 0x1E86).setInt(0,patchCode);}//HOOZZpublic void HookMDStringold(){// 加载HookZzIHookZz hookZz = HookZz.getInstance(emulator);hookZz.wrap(module.base + 0x1BD0 + 1, new WrapCallback<HookZzArm32RegisterContext>() { // inline wrap导出函数@Override// 类似于 frida onEnterpublic void preCall(Emulator<?> emulator, HookZzArm32RegisterContext ctx, HookEntryInfo info) {// 类似于Frida args[0]Pointer input = ctx.getPointerArg(0);System.out.println("input:" + input.getString(0));};@Override// 类似于 frida onLeavepublic void postCall(Emulator<?> emulator, HookZzArm32RegisterContext ctx, HookEntryInfo info) {Pointer result = ctx.getPointerArg(0);System.out.println("input:" + result.getString(0));}});
}

package com.dta.lesson2;import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Emulator;
import com.github.unidbg.Module;
import com.github.unidbg.arm.HookStatus;
import com.github.unidbg.arm.backend.DynarmicFactory;
import com.github.unidbg.arm.context.RegisterContext;
import com.github.unidbg.debugger.BreakPointCallback;
import com.github.unidbg.debugger.DebuggerType;
import com.github.unidbg.hook.HookContext;
import com.github.unidbg.hook.ReplaceCallback;
import com.github.unidbg.hook.hookzz.*;
import com.github.unidbg.hook.xhook.IxHook;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.XHookImpl;
import com.github.unidbg.linux.android.dvm.DalvikModule;
import com.github.unidbg.linux.android.dvm.DvmObject;
import com.github.unidbg.linux.android.dvm.StringObject;
import com.github.unidbg.linux.android.dvm.VM;
import com.github.unidbg.linux.android.dvm.jni.ProxyDvmObject;
import com.github.unidbg.memory.Memory;
import com.github.unidbg.pointer.UnidbgPointer;
import com.github.unidbg.utils.Inspector;
import com.sun.jna.Pointer;
import net.dongliu.apk.parser.Main;
import unicorn.ArmConst;import java.io.File;
import java.util.ArrayList;
import java.util.List;import static com.dta.lesson2.AesKeyFinder.readFuncFromIDA;public class MainActivity {private final AndroidEmulator emulator;private final VM vm;private final Memory memory;private final Module module;public MainActivity(){emulator = AndroidEmulatorBuilder.for32Bit()//.setProcessName()//.setRootDir()//.setRootDir(new File("target/rootfs/default"))//.addBackendFactory(new DynarmicFactory(true)).build();vm = emulator.createDalvikVM();memory = emulator.getMemory();memory.setLibraryResolver(new AndroidResolver(23));DalvikModule dalvikModule = vm.loadLibrary(new File("unidbg-android/src/test/java/com/dta/lesson2/libtest-lib.so"), true);module = dalvikModule.getModule();vm.callJNI_OnLoad(emulator,module);}public void callAes(){//emulator.traceCode();DvmObject obj = ProxyDvmObject.createObject(vm,this);obj.callJniMethod(emulator, "aes(II)V");}public static void main(String[] args) {long start = System.currentTimeMillis();MainActivity mainActivity = new MainActivity();mainActivity.keyFinder();//mainActivity.hookZz();//mainActivity.consoleDebugger();System.out.println("load the vm "+( System.currentTimeMillis() - start )+ "ms");mainActivity.callAes();}private void consoleDebugger() {emulator.attach().addBreakPoint(module.base + 0x20ad, new BreakPointCallback() {@Overridepublic boolean onHit(Emulator<?> emulator, long address) {//xxreturn false;}});}private void hookZz() {HookZz hookZz = HookZz.getInstance(emulator);hookZz.wrap(module.base + 0x20ad, new WrapCallback<HookZzArm32RegisterContextImpl>() {@Overridepublic void preCall(Emulator<?> emulator, HookZzArm32RegisterContextImpl ctx, HookEntryInfo info) {UnidbgPointer arg0 = ctx.getPointerArg(0);UnidbgPointer arg1 = ctx.getPointerArg(1);System.out.println("0x20ad_OnEnter: arg0=>"+arg0.getString(0));//System.out.println("0x20ad_OnEnter: arg1=>"+);Inspector.inspect(arg1.getByteArray(0,200),"0x20ad_OnEnter_arg1");ctx.push(arg1);}@Overridepublic void postCall(Emulator<?> emulator, HookZzArm32RegisterContextImpl ctx, HookEntryInfo info) {UnidbgPointer arg1 = ctx.pop();Inspector.inspect(arg1.getByteArray(0,200),"0x20ad_OnLeave_arg1");super.postCall(emulator, ctx, info);}});
//        hookZz.replace(module.base + 0x20ad, new ReplaceCallback() {//            @Override
//            public HookStatus onCall(Emulator<?> emulator, HookContext context, long originFunction) {//                emulator.getBackend().reg_write(ArmConst.UC_ARM_REG_R0,1);
//                return super.onCall(emulator, context, context.getLR());
//            }
//
//            @Override
//            public void postCall(Emulator<?> emulator, HookContext context) {//                super.postCall(emulator, context);
//            }
//        },true);
//        Dobby dobby = Dobby.getInstance(emulator);
//        dobby.replace(module.base + 0x20ad, new ReplaceCallback() {//            @Override
//            public HookStatus onCall(Emulator<?> emulator, HookContext context, long originFunction) {//                //HookStatus.RET(emulator,originFunction);
//                return super.onCall(emulator, context, originFunction);
//            }
//
//            @Override
//            public void postCall(Emulator<?> emulator, HookContext context) {//                super.postCall(emulator, context);
//            }
//        },true);
//
//        IxHook ixHook = XHookImpl.getInstance(emulator);
//        ixHook.register("libtest-lib.so", "_Z17aes_key_expansionPhS_", new ReplaceCallback() {//            @Override
//            public HookStatus onCall(Emulator<?> emulator, HookContext context, long originFunction) {//                return super.onCall(emulator, context, originFunction);
//            }
//
//            @Override
//            public void postCall(Emulator<?> emulator, HookContext context) {//                super.postCall(emulator, context);
//            }
//        });
//        ixHook.refresh();}private void keyFinder() {List<String> funclist = readFuncFromIDA("unidbg-android/src/test/java/com/dta/lesson2/libtest-lib_functionlist_1636779320.txt");AesKeyFinder aesKeyFinder = new AesKeyFinder(emulator);aesKeyFinder.searchEveryFunction(module.base, funclist);}
}

hookZz,Dobby,xHook,consoleDebugger相关推荐

SO逆向之x博国际版登陆分析
篇幅有限完整内容及源码关注公众号:ReverseCode,发送冲抓包 Charles本地证书安卓8 cd /data/misc/user/0/cacerts-added/ mount -o r ...
口袋无人机DOBBY：我的“人脸识别”已上线
堪称拍照.录像神器! 前脚,零度智控的DOBBY无人机刚在IFA2016上惊爆欧洲人的眼球,后脚它又更新了新一版的APP. 在这一最新版本中,曾出现在宣传片中的"人脸识别"功能上线 ...
电子增稳云台_揭秘Dobby自拍无人机，电子增稳是黑科技？
揭秘Dobby自拍无人机,电子增稳是黑科技? 2016年07月27日 10:47作者:广州分站文章出处:泡泡网原创分享最近零度智控的Dobby自拍无人机横空出世,主打「便携」「自拍」两大特色,一经 ...
vulnhub-HOGWARTS: DOBBY
地址:https://www.vulnhub.com/entry/hogwarts-dobby,597/ 难度:容易信息收集通过Mac地址找出IP 端口扫描发现只开了个80端口↓ 通过浏览器访问 ...
android命令抹机原理,[原创]利用xhook安卓系统底层抹机原理
大概原理是:先读取/proc/self/maps文件内容正则匹配找到so文件路径和加载基址, 解析elf格式找到要hook的函数的地址替换成自己指定的函数地址//xh_core.c static v ...
unidbg第二讲例子讲解com.sun.jna.JniDispatch32
讲解例子 com.sun.jna.JniDispatch32 代码位置为:{unidbg_project}\unidbg-android\src\test\java\com\sun\jna 需求 1: ...
Anroid 逆向工具
Anroid 逆向工具静态分析 JEB - The Interactive Android Decompiler. GDA - GGJoy Dex Analysizer(GDA),国内第一款也是唯一 ...
修复金山云KSYStreamer 在Android P以上机型Native Crash
问题在升级了Target API28之后,发现我们一直使用的金山云的推流SDK在部分Android 9以上的手机离开开播页的时候会不明的出现Crash,我的小米8上面是固定第二次的时候Crash,一 ...
unidbg 简介、基本使用、调用so中方法、unidbg-web
逆向调试时还是 IDA 的图形化界面更方便,一般首选 IDA 调试分析,后期要在生产线上生成 sign 字段,这时再用 unidbg 就更合适了! 1.调用 so 库中函数的一些方式 frida 的 ...

hookZz,Dobby,xHook,consoleDebugger

hookZz,Dobby,xHook,consoleDebugger相关推荐

最新文章

热门文章