• unidbg-补文件环境(二)


    通过signature标识来确定文件标识;
    补环境sd卡及根目录

    package com.dta.lesson34;
    
    import com.github.unidbg.AndroidEmulator;
    import com.github.unidbg.Module;
    import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
    import com.github.unidbg.linux.android.AndroidResolver;
    import com.github.unidbg.linux.android.dvm.*;
    import com.github.unidbg.memory.Memory;
    
    import java.io.File;
    import java.util.Arrays;
    
    
    
    public class MainActivity2 extends AbstractJni {
        private final AndroidEmulator emulator;
        private final VM vm;
        private final Memory memory;
        private final Module module;
        private final DvmObject<?> obj;
    
        public MainActivity2(){
            emulator = AndroidEmulatorBuilder
                    .for32Bit()
                    //.setRootDir(new File("target/rootfs/default"))
                    //.addBackendFactory(new DynarmicFactory(true))
                    .build();
    
            memory = emulator.getMemory();
            memory.setLibraryResolver(new AndroidResolver(23));
    
            vm = emulator.createDalvikVM(new File("unidbg-android/src/test/java/com/dta/lesson34/DogLite.apk"));
            vm.setVerbose(true);
            vm.setJni(this);
    
            DalvikModule dalvikModule = vm.loadLibrary(new File("unidbg-android/src/test/java/com/dta/lesson34/libdoglite.so"), false);
            module = dalvikModule.getModule();
    
            vm.callJNI_OnLoad(emulator,module);
    
            obj = vm.resolveClass("com/example/doglite/MainActivity").newObject(null);
        }
    
    
    
        public static void main(String[] args) {
            long start = System.currentTimeMillis();
            MainActivity2 mainActivity = new MainActivity2();
            System.out.println("load the vm "+( System.currentTimeMillis() - start )+ "ms");
    //        mainActivity.SysInfo();
    //        mainActivity.getAppFilesDir();
            mainActivity.base64result();
        }
        //public native void base64result(String str);
        private void base64result() {
            String input = "12345";
            obj.callJniMethod(emulator,"base64result(Ljava/lang/String;)V",input);
        }
    
    
        private void getAppFilesDir() {
            obj.callJniMethod(emulator,"getAppFilesDir()V");
        }
    
        private void SysInfo() {
            obj.callJniMethod(emulator,"SysInfo()V");
        }
    
        @Override
        public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
            if (signature.equals("android/app/ActivityThread->getApplication()Landroid/app/Application;")){
                return vm.resolveClass("android/app/Application").newObject(null);
            }
            if (signature.equals("java/io/File->getAbsolutePath()Ljava/lang/String;")){
                String tag = dvmObject.getValue().toString();
                if (tag.equals("android/os/Environment->getExternalStorageDirectory()Ljava/io/File;")){
                    return new StringObject(vm,"/sdcard/");
                }else if (tag.equals("android/os/Environment->getStorageDirectory()Ljava/io/File;")){
                    return new StringObject(vm, "/");
                }
            }
            return super.callObjectMethodV(vm, dvmObject, signature, vaList);
        }
    
        @Override
        public DvmObject<?> callStaticObjectMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
            if (signature.equals("android/provider/Settings$Secure->getString(Landroid/content/ContentResolver;Ljava/lang/String;)Ljava/lang/String;")){
                String arg1 = vaList.getObjectArg(1).getValue().toString();
                System.err.println("getString() arg1:"+arg1);
                return new StringObject(vm, "123456789");
            }
            if (signature.equals("android/os/Environment->getExternalStorageDirectory()Ljava/io/File;")){
                return vm.resolveClass("java/io/File").newObject(signature);
            }
            if (signature.equals("android/os/Environment->getStorageDirectory()Ljava/io/File;")){
                return vm.resolveClass("java/io/File").newObject(signature);
            }
            if (signature.equals("android/util/Base64->encodeToString([BI)Ljava/lang/String;")){
                byte[] input = (byte[]) vaList.getObjectArg(0).getValue();
                int flag = vaList.getIntArg(1);
                String s = Base64.encodeToString(input, flag);
                return new StringObject(vm, s);
            }
            return super.callStaticObjectMethodV(vm, dvmClass, signature, vaList);
        }
    
    
    }
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23
    • 24
    • 25
    • 26
    • 27
    • 28
    • 29
    • 30
    • 31
    • 32
    • 33
    • 34
    • 35
    • 36
    • 37
    • 38
    • 39
    • 40
    • 41
    • 42
    • 43
    • 44
    • 45
    • 46
    • 47
    • 48
    • 49
    • 50
    • 51
    • 52
    • 53
    • 54
    • 55
    • 56
    • 57
    • 58
    • 59
    • 60
    • 61
    • 62
    • 63
    • 64
    • 65
    • 66
    • 67
    • 68
    • 69
    • 70
    • 71
    • 72
    • 73
    • 74
    • 75
    • 76
    • 77
    • 78
    • 79
    • 80
    • 81
    • 82
    • 83
    • 84
    • 85
    • 86
    • 87
    • 88
    • 89
    • 90
    • 91
    • 92
    • 93
    • 94
    • 95
    • 96
    • 97
    • 98
    • 99
    • 100
    • 101
    • 102
    • 103
    • 104
    • 105
    • 106
    • 107
    • 108
  • 相关阅读:
    爬虫入门教程:爬虫概述
    G1垃圾收集器
    基于监督学习的多模态MRI脑肿瘤分割,使用来自超体素的纹理特征(Matlab代码实现)
    CentOS7---部署Tomcat和安装Jpress
    strings.xml补充知识
    LeetCode 面试题 16.21. 交换和
    如何看待AIGC技术?
    GitHub标星75k,阿里15W字的Spring高级文档(全彩版),真的太香了
    初识Matter协议
    企业微信hook接口协议,ipad协议http,外部联系人图片视频文件下载
  • 原文地址:https://blog.csdn.net/weixin_38927522/article/details/127909506