import idaapi global_table = 0x78D05D8E80 fun_id = 158 fun_addr_ref = 0x0 instr_fun_table = 0x0 # 0x1b4 translator_8_12 = [ 3 , 2 , 1 , 0 , 7 , 6 , 5 , 4 , 0xb , 0xA , 9 , 8 , 0xF , 0xE , 0xD , 0xC ] translator_12_16 = [ 0xB , 0xA , 9 , 8 , 0xF , 0xE , 0xD , 0xC , 3 , 2 , 1 , 0 , 7 , 6 , 5 , 4 ] def aget(instr_addr,x10): print ( "aget" , "arg:" ) return 4 def const_4(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) arg0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] arg1 = translator_12_16[instr_0_2 >> 12 ] print ( "const/4 v%d, %d" % (arg0,arg1)) return 2 def const_16(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) arg0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) print ( "const/16 v%d, %d" % (arg0,instr_2_4)) return 4 def const(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) arg0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) print ( "const v%d, %d" % (arg0,instr_2_4)) return 6 def const_string(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) v60 = instr_0_2 >> 12 v61 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF v63 = 16 * (translator_12_16[v60] & 0xF ) v75 = v63 | v61 # a38_index_11 = read_mem_to_Int(x10 + 0x58 , 8 ) a38_index_2 = read_mem_to_Int(x10 + 0x10 , 8 ) v3 = read_mem_to_Int(instr_2_4 * 4 + a38_index_2, 4 ) string = v3 + a38_index_11 # print("string addr",hex(string),hex(instr_addr)) # cla_len = read_mem_to_Int(string, 1) # return_type = idaapi.dbg_read_memory(string+1, cla_len).decode('utf-8') # # print("const-string ",v75,return_type) print ( "const-string v%d, %s" % (v75, hex (string))) return 4 def xor(instr_addr,x10): print ( "xor" , "arg:" ) return 4 def move_16(instr_addr,x10): print ( "move-16" , "arg:" ) return 2 def iput_object(instr_addr,x10): print ( "iput_object" , "arg:" ) return 4 def aput_object(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v37 = (instr_0_2 >> 8 ) & 0xF v38 = instr_0_2 >> 12 v40 = translator_8_12[v37]; v41 = translator_12_16[v38]; arg_v1 = v40 & 0xF | ( 16 * (v41 & 0xF )) arg_v2 = read_mem_to_Int(instr_addr + 2 , 1 ) arg_v3 = read_mem_to_Int(instr_addr + 3 , 1 ) print ( "aput-object v%d, v%d, v%d" % (arg_v1,arg_v2,arg_v3)) return 4 def goto(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v3 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) if v3 > = 128 : int_num = (v3 - 256 ) * 2 else : int_num = v3 * 2 print ( "goto" , "arg:" , hex (instr_addr + int_num),int_num) return 2 def rsub(instr_addr,x10): print ( "rsub" , "arg:" ) return 4 def cmp (instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v1 = read_mem_to_Int(instr_addr + 2 , 1 ) v2 = read_mem_to_Int(instr_addr + 3 , 1 ) v3 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) print ( "cmp" , "arg:" ,v3,v1,v2) return 4 def invoke_super(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_add_4 = read_mem_to_Int(instr_addr + 4 , 2 ) v63 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )); #处理一个字节(8 bit)的 数据,作为寄存器转换 register_size = v63 >> 4 arg1 = instr_add_4 & 0xF arg2 = instr_add_4 >> 4 & 0xF arg3 = (instr_add_4 >> 8 ) & 0xf arg4 = instr_add_4 >> 12 arg5 = v63 & 0xF ref_index = read_mem_to_Int(instr_addr + 2 , 2 ) classname_str = get_class_name(x10,ref_index) method_name_str = get_method_name(x10,ref_index) type_name_str = get_proto_type_name(x10, ref_index) # arg_name_str = get_method_arg(x10,ref_index) # print("invoke_direct class:",classname_str,"method:",method_name_str,"method_ref_index",hex(ref_index),"type:",type_name_str,"register:",register_size,"arg1:",arg1,"arg2:",arg2,"arg3:",arg3,"arg4:",arg4,"arg5:",arg5) print ( "invoke-super " ,classname_str + "->" + method_name_str + type_name_str, "method_ref_index" , hex (ref_index), "register:" ,register_size, "arg1:" ,arg1, "arg2:" ,arg2, "arg3:" ,arg3, "arg4:" ,arg4, "arg5:" ,arg5) return 6 def invoke_direct(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_add_4 = read_mem_to_Int(instr_addr + 4 , 2 ) v63 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )); #处理一个字节(8 bit)的 数据,作为寄存器转换 register_size = v63 >> 4 arg1 = instr_add_4 & 0xF arg2 = instr_add_4 >> 4 & 0xF arg3 = (instr_add_4 >> 8 ) & 0xf arg4 = instr_add_4 >> 12 arg5 = v63 & 0xF ref_index = read_mem_to_Int(instr_addr + 2 , 2 ) classname_str = get_class_name(x10,ref_index) method_name_str = get_method_name(x10,ref_index) type_name_str = get_proto_type_name(x10, ref_index) # arg_name_str = get_method_arg(x10,ref_index) # print("invoke-direct class:",classname_str,"method:",method_name_str,"method_ref_index",hex(ref_index),"type:",type_name_str,"register:",register_size,"arg1:",arg1,"arg2:",arg2,"arg3:",arg3,"arg4:",arg4,"arg5:",arg5) print ( "invoke-direct " ,classname_str + "->" + method_name_str + type_name_str, "method_ref_index" , hex (ref_index), "register:" ,register_size, "arg1:" ,arg1, "arg2:" ,arg2, "arg3:" ,arg3, "arg4:" ,arg4, "arg5:" ,arg5) return 6 def invoke_static(instr_addr, x10): # 第一个字节是指令,主导函数偏移,第二个字节是寄存器,三四字节是方法偏移 instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_add_4 = read_mem_to_Int(instr_addr + 4 , 2 ) v63 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )); #处理一个字节(8 bit)的 数据,作为寄存器转换 register_size = v63 >> 4 arg1 = instr_add_4 & 0xF arg2 = instr_add_4 >> 4 & 0xF arg3 = (instr_add_4 >> 8 ) & 0xf arg4 = instr_add_4 >> 12 arg5 = v63 & 0xF ref_index = read_mem_to_Int(instr_addr + 2 , 2 ) classname_str = get_class_name(x10,ref_index) method_name_str = get_method_name(x10,ref_index) type_name_str = get_proto_type_name(x10, ref_index) # arg_name_str = get_method_arg(x10,ref_index) # print("invoke-static class:",classname_str,"method:",method_name_str,"method_ref_index",hex(ref_index),"type:",type_name_str,"register:",register_size,"arg1:",arg1,"arg2:",arg2,"arg3:",arg3,"arg4:",arg4,"arg5:",arg5) print ( "invoke-static " ,classname_str + "->" + method_name_str + type_name_str, "method_ref_index" , hex (ref_index), "register:" ,register_size, "arg1:" ,arg1, "arg2:" ,arg2, "arg3:" ,arg3, "arg4:" ,arg4, "arg5:" ,arg5) # print("CallStaticVoidMethod arg_name_str:",arg_name_str) return 6 def invoke_interface(instr_addr,x10): # 第一个字节是指令,主导函数偏移,第二个字节是寄存器,三四字节是方法偏移 instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_add_4 = read_mem_to_Int(instr_addr + 4 , 2 ) v63 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )); #处理一个字节(8 bit)的 数据,作为寄存器转换 register_size = v63 >> 4 arg1 = instr_add_4 & 0xF arg2 = instr_add_4 >> 4 & 0xF arg3 = (instr_add_4 >> 8 ) & 0xf arg4 = instr_add_4 >> 12 arg5 = v63 & 0xF ref_index = read_mem_to_Int(instr_addr + 2 , 2 ) classname_str = get_class_name(x10,ref_index) method_name_str = get_method_name(x10,ref_index) type_name_str = get_proto_type_name(x10, ref_index) # arg_name_str = get_method_arg(x10,ref_index) print ( "invoke-interface " ,classname_str + "->" + method_name_str + type_name_str, "method_ref_index" , hex (ref_index), "register:" ,register_size, "arg1:" ,arg1, "arg2:" ,arg2, "arg3:" ,arg3, "arg4:" ,arg4, "arg5:" ,arg5) # print("CallStaticVoidMethod arg_name_str:",arg_name_str) return 6 def invoke_virutal(instr_addr,x10): # 第一个字节是指令,主导函数偏移,第二个字节是寄存器,三四字节是方法偏移 instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_add_4 = read_mem_to_Int(instr_addr + 4 , 2 ) v63 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )); #处理一个字节(8 bit)的 数据,作为寄存器转换 register_size = v63 >> 4 arg1 = instr_add_4 & 0xF arg2 = instr_add_4 >> 4 & 0xF arg3 = (instr_add_4 >> 8 ) & 0xf arg4 = instr_add_4 >> 12 arg5 = v63 & 0xF ref_index = read_mem_to_Int(instr_addr + 2 , 2 ) classname_str = get_class_name(x10,ref_index) method_name_str = get_method_name(x10,ref_index) type_name_str = get_proto_type_name(x10, ref_index) # arg_name_str = get_method_arg(x10,ref_index) print ( "invoke-virtual " ,classname_str + "->" + method_name_str + type_name_str, "method_ref_index" , hex (ref_index), "register:" ,register_size, "arg1:" ,arg1, "arg2:" ,arg2, "arg3:" ,arg3, "arg4:" ,arg4, "arg5:" ,arg5) # print("CallStaticVoidMethod arg_name_str:",arg_name_str) return 6 def rem_doule(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) print ( "rem-doule" , hex (v_arg_0), hex (instr_2_4)) return 4 def move_result_object(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) print ( "move-result-object v%d" % v_arg_0) return 2 def MonitorEnter(instr_addr,x10): print ( "MonitorEnter" , "arg:" ) return 2 def return_object(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) print ( "return-object v%d" % v_arg_0) return 2 def move_object(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ]; v_arg_1 = translator_12_16[instr_0_2 >> 12 ] print ( "move-object v%d, v%d" % (v_arg_0,v_arg_1)) return 2 def new_instance(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) ref_index = read_mem_to_Int(instr_addr + 2 , 2 ) dex_base_addr = read_mem_to_Int(x10 + 0x58 , 8 ) dex_type_off = read_mem_to_Int(x10 + 0x18 , 8 ) dex_string_list_off = read_mem_to_Int(x10 + 0x10 , 8 ) classname_str = byIndexGet_dex_type_name(dex_base_addr,dex_type_off,dex_string_list_off,ref_index) print ( "new-instance v%d, %s" % (v_arg_0,classname_str)) return 4 def move_result(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) print ( "move-result v%d" % v_arg_0) return 2 def new_array(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg_size = translator_12_16[instr_0_2 >> 12 ] v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ]; ref_index = read_mem_to_Int(instr_addr + 2 , 2 ) dex_base_addr = read_mem_to_Int(x10 + 0x58 , 8 ) dex_type_off = read_mem_to_Int(x10 + 0x18 , 8 ) dex_string_list_off = read_mem_to_Int(x10 + 0x10 , 8 ) classname_str = byIndexGet_dex_type_name(dex_base_addr,dex_type_off,dex_string_list_off,ref_index) print ( "new-array v%d, v%d, %s" % (v_arg_0,v_arg_size,classname_str)) return 4 def if_ne(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) arg1 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ]; arg2 = translator_12_16[instr_0_2 >> 12 ]; print ( "if-ne v%d, v%x, %x" % (arg1,arg2,instr_addr + instr_2_4 * 2 )) return 4 def if_eqz(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) v63 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )); #处理一个字节(8 bit)的 数据,作为寄存器转换 print ( "if-eqz v%d, %x" % (v63,instr_addr + instr_2_4 * 2 )) return 4 def if_gt(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) arg1 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ]; arg2 = translator_12_16[instr_0_2 >> 12 ]; print ( "if-gt v%d, v%x, %x" % (arg1,arg2,instr_addr + instr_2_4 * 2 )) return 4 def if_lt(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) arg1 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ]; arg2 = translator_12_16[instr_0_2 >> 12 ]; print ( "if-lt v%d, v%x, %x" % (arg1,arg2,instr_addr + instr_2_4 * 2 )) return 4 def if_lez(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) v63 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )); #处理一个字节(8 bit)的 数据,作为寄存器转换 print ( "if-lez v%d, %x" % (v63,instr_addr + instr_2_4 * 2 )) return 4 def if_nez(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) instr_2_4 = read_mem_to_Int(instr_addr + 2 , 2 ) v63 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )); #处理一个字节(8 bit)的 数据,作为寄存器转换 print ( "if-nez v%d, %x" % (v63,instr_addr + instr_2_4 * 2 )) return 4 def iput(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) filed_index = read_mem_to_Int(instr_addr + 2 , 2 ) v_arg_0 = translator_12_16[instr_0_2 >> 12 ] v_arg_1 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] dex_filed_off = read_mem_to_Int(x10 + 0x20 , 8 ) class_index = read_mem_to_Int( 8 * filed_index + dex_filed_off, 2 ) filed_type_index = read_mem_to_Int( 8 * filed_index + dex_filed_off + 2 , 2 ) name_string_index = read_mem_to_Int( 8 * filed_index + dex_filed_off + 4 , 2 ) dex_base_addr = read_mem_to_Int(x10 + 0x58 , 8 ) dex_type_off = read_mem_to_Int(x10 + 0x18 , 8 ) dex_string_list_off = read_mem_to_Int(x10 + 0x10 , 8 ) class_type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, class_index) filed_type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, filed_type_index) name_string = byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,name_string_index) # print("iput-object ",v_arg_0,v_arg_1,class_type_string,"->",name_string,";",filed_type_string,"filed_index:",filed_index) print ( "iput-object v%d, v%d, %s" % (v_arg_1,v_arg_0,class_type_string + "->" + name_string + ":" + filed_type_string + " filed_index: " + filed_index)) return 4 def aget_object(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) arg_1 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) arg_v2 = read_mem_to_Int(instr_addr + 2 , 1 ) arg_v3 = read_mem_to_Int(instr_addr + 3 , 1 ) print ( "aget-object v%d, v%d, v%d" % (arg_1,arg_v2,arg_v3)) return 4 def iget_object(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) filed_index = read_mem_to_Int(instr_addr + 2 , 2 ) v_arg_0 = translator_12_16[instr_0_2 >> 12 ] v_arg_1 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] dex_filed_off = read_mem_to_Int(x10 + 0x20 , 8 ) class_index = read_mem_to_Int( 8 * filed_index + dex_filed_off, 2 ) filed_type_index = read_mem_to_Int( 8 * filed_index + dex_filed_off + 2 , 2 ) name_string_index = read_mem_to_Int( 8 * filed_index + dex_filed_off + 4 , 2 ) dex_base_addr = read_mem_to_Int(x10 + 0x58 , 8 ) dex_type_off = read_mem_to_Int(x10 + 0x18 , 8 ) dex_string_list_off = read_mem_to_Int(x10 + 0x10 , 8 ) class_type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, class_index) filed_type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, filed_type_index) name_string = byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,name_string_index) print ( "iget-object v%d, v%d, %s" % (v_arg_1,v_arg_0,class_type_string + "->" + name_string + ":" + filed_type_string + " filed_index: " + filed_index)) return 4 def check_cast(instr_addr,x10): type_index = read_mem_to_Int(instr_addr + 2 , 2 ) dex_base_addr = read_mem_to_Int(x10 + 0x58 , 8 ) dex_type_off = read_mem_to_Int(x10 + 0x18 , 8 ) dex_string_list_off = read_mem_to_Int(x10 + 0x10 , 8 ) type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, type_index) instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) print ( "check-cast v%d, %s" % (v_arg,type_string)) return 4 def sget_object(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) filed_index = read_mem_to_Int(instr_addr + 2 , 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) dex_filed_off = read_mem_to_Int(x10 + 0x20 , 8 ) class_index = read_mem_to_Int( 8 * filed_index + dex_filed_off, 2 ) filed_type_index = read_mem_to_Int( 8 * filed_index + dex_filed_off + 2 , 2 ) name_string_index = read_mem_to_Int( 8 * filed_index + dex_filed_off + 4 , 2 ) dex_base_addr = read_mem_to_Int(x10 + 0x58 , 8 ) dex_type_off = read_mem_to_Int(x10 + 0x18 , 8 ) dex_string_list_off = read_mem_to_Int(x10 + 0x10 , 8 ) class_type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, class_index) filed_type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, filed_type_index) name_string = byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,name_string_index) print ( "sget-object v%d, %s" % (v_arg_0,class_type_string + "->" + name_string + ":" + filed_type_string)) return 4 def sget_boolean(instr_addr, x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) filed_index = read_mem_to_Int(instr_addr + 2 , 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) dex_filed_off = read_mem_to_Int(x10 + 0x20 , 8 ) class_index = read_mem_to_Int( 8 * filed_index + dex_filed_off, 2 ) filed_type_index = read_mem_to_Int( 8 * filed_index + dex_filed_off + 2 , 2 ) name_string_index = read_mem_to_Int( 8 * filed_index + dex_filed_off + 4 , 2 ) dex_base_addr = read_mem_to_Int(x10 + 0x58 , 8 ) dex_type_off = read_mem_to_Int(x10 + 0x18 , 8 ) dex_string_list_off = read_mem_to_Int(x10 + 0x10 , 8 ) class_type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, class_index) filed_type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, filed_type_index) name_string = byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,name_string_index) print ( "sget-boolean v%d, %s" % (v_arg_0,class_type_string + "->" + name_string + ":" + filed_type_string)) return 4 def nop(instr_addr,x10): print ( "nop" ) return 2 def return_void(instr_addr,x10): print ( "return-void" ) return 2 def throw(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) print ( "throw v%d" % v_arg_0) return 2 def throw_2(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) v_arg_0 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] & 0xF | ( 16 * (translator_12_16[instr_0_2 >> 12 ] & 0xF )) print ( "move-exception v%d" % v_arg_0) return 2 def array_length(instr_addr,x10): instr_0_2 = read_mem_to_Int(instr_addr, 2 ) arg_0 = translator_12_16[instr_0_2 >> 12 ] arg_1 = translator_8_12[(instr_0_2 >> 8 ) & 0xF ] print ( "array-length v%d, v%d" % (arg_1,arg_0)) return 2 switch = { 0x0 :iput, 0x1 :invoke_super, 0x2 :aget, 0x3 :xor, 0x4 :move_16, 0x5 :iput_object, 0x5a :nop, 0xd :goto, 0xda :aput_object , 0x7 :rsub, 0x8 : cmp , 0x1e :if_lez, 0x2b :if_nez, 0x3e :if_eqz, 0x3c :if_gt, 0x21 :if_lt, 0x44 :const_16, 0xc3 :const, 0x5e :move_result , 0x68 :invoke_direct, 0xA6 :invoke_virutal, 0xAA :new_instance, 0xc7 :move_result_object, 0xbb :return_object, 0x92 :return_void, 0xfc :move_object, 0x79 :invoke_interface, 0xf9 :check_cast, 0xf0 :const_4, 0xfa :if_ne, 0x93 :sget_object, 0xc2 :sget_boolean, 0x9a :invoke_static, 0x9b :const_string, 0x1f :new_array, 0x19 :iget_object, 0x9d :MonitorEnter, 0xc4 :array_length, 0x6b :aget_object, 0xf5 :throw, 0xee :throw_2} def ByFunIDgetFunAddr( id ): offset_mem = int .from_bytes(idaapi.dbg_read_memory( 4 * id + global_table, 4 ),byteorder = 'little' ) method_addr = global_table + offset_mem print ( "fun_id:" , hex ( id ), "method_addr:" , hex (offset_mem), "method_addr:" , hex (method_addr)) return method_addr def read_mem_to_String(addr,size): mem = idaapi.dbg_read_memory(addr,size) return mem def read_mem_to_Int(addr, size): mem = int .from_bytes(idaapi.dbg_read_memory(addr,size),byteorder = 'little' ) return mem def get_proto_type_name(x10, type_index): dex_method_off = read_mem_to_Int(x10 + 0x28 , 8 ) dex_string_list_off = read_mem_to_Int(x10 + 0x10 , 8 ) dex_type_off = read_mem_to_Int(x10 + 0x18 , 8 ) dex_base_addr = read_mem_to_Int(x10 + 0x58 , 8 ) dex_proto_off = read_mem_to_Int(x10 + 0x30 , 8 ) proto_index = read_mem_to_Int( 8 * type_index + dex_method_off + 2 , 2 ) return_type_index = read_mem_to_Int(dex_proto_off + 12 * proto_index + 4 , 4 ) pararm_off = read_mem_to_Int(dex_proto_off + 12 * proto_index + 8 , 4 ) sign_type_string_list = "(" if pararm_off ! = 0 : pararm_size = read_mem_to_Int(dex_base_addr + pararm_off, 4 ) # pararm_mem_total = pararm_size * 2 # for i in pararm_size: for i in range (pararm_size): pararm_type_index = read_mem_to_Int(dex_base_addr + pararm_off + 4 + i * 2 , 2 ) pararm_type_string = byIndexGet_dex_type_name(dex_base_addr, dex_type_off, dex_string_list_off, pararm_type_index) sign_type_string_list = sign_type_string_list + pararm_type_string return_type_string = byIndexGet_dex_type_name(dex_base_addr,dex_type_off,dex_string_list_off,return_type_index) sign_type_string_list = sign_type_string_list + ")" + return_type_string return sign_type_string_list def byIndexGet_dex_type_name(dex_base_addr,dex_type_off,dex_string_list_off,pararm_type_index): string_index = read_mem_to_Int(pararm_type_index * 4 + dex_type_off, 4 ) type_string = byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,string_index) return type_string def byIndexGet_dex_string_name(dex_base_addr,dex_string_list_off,string_index): v3 = read_mem_to_Int(string_index * 4 + dex_string_list_off, 4 ) cla_len = read_mem_to_Int(dex_base_addr + v3, 1 ) class_str = idaapi.dbg_read_memory(dex_base_addr + v3 + 1 , cla_len).decode( 'utf-8' ) print ( "byIndexGet_dex_string_name:" , hex (dex_base_addr + v3)) return class_str def get_class_name(x10,class_index): a38_index_5 = read_mem_to_Int(x10 + 0x28 , 8 ) a38_index_2 = read_mem_to_Int(x10 + 0x10 , 8 ) a38_index_3 = read_mem_to_Int(x10 + 0x18 , 8 ) a38_index_11 = read_mem_to_Int(x10 + 0x58 , 8 ) v1 = read_mem_to_Int( 8 * class_index + a38_index_5, 2 ) v2 = read_mem_to_Int(v1 * 4 + a38_index_3, 4 ) v3 = read_mem_to_Int(v2 * 4 + a38_index_2, 4 ) class_str_addr = v3 + a38_index_11 cla_len = read_mem_to_Int(class_str_addr, 1 ) class_str = idaapi.dbg_read_memory(class_str_addr + 1 , cla_len).decode( 'utf-8' ) # print("classname len:",cla_len) return class_str def get_method_name(x10, method_index): a38_index_5 = read_mem_to_Int(x10 + 0x28 , 8 ) a38_index_2 = read_mem_to_Int(x10 + 0x10 , 8 ) a38_index_3 = read_mem_to_Int(x10 + 0x18 , 8 ) a38_index_11 = read_mem_to_Int(x10 + 0x58 , 8 ) v1 = read_mem_to_Int( 8 * method_index + a38_index_5 + 4 , 2 ) v3 = read_mem_to_Int(v1 * 4 + a38_index_2, 4 ) method_name_str_addr = v3 + a38_index_11 method_name_str_len = read_mem_to_Int(method_name_str_addr, 1 ) method_name_str = idaapi.dbg_read_memory(method_name_str_addr + 1 , method_name_str_len).decode( 'utf-8' ) return method_name_str def get_method_arg(x10, index): # (v70 + * (v69 + 4LL * * (v68 + 4LL * * (v81 + v84 + 2)))); a38_index_5 = read_mem_to_Int(x10 + 0x28 , 8 ) a38_index_2 = read_mem_to_Int(x10 + 0x10 , 8 ) a38_index_3 = read_mem_to_Int(x10 + 0x18 , 8 ) a38_index_11 = read_mem_to_Int(x10 + 0x58 , 8 ) a38_index_6 = read_mem_to_Int(x10 + 0x30 , 8 ) v0 = read_mem_to_Int( 8 * index + a38_index_5 + 2 , 2 ) v80 = read_mem_to_Int(a38_index_6 + 12 * v0 + 8 , 4 ) print ( "arg_addr a38_index_5:" , hex (a38_index_5)) print ( "arg_addr a38_index_2:" , hex (a38_index_2)) print ( "arg_addr a38_index_3:" , hex (a38_index_3)) print ( "arg_addr a38_index_11:" , hex (a38_index_11)) print ( "arg_addr a38_index_6:" , hex (a38_index_6)) print ( "arg_addr v80:" ,v80) v81 = v80 + a38_index_11 # print("arg_addr v81:",v81) v1 = read_mem_to_Int(v81 + 2 , 4 ) v2 = read_mem_to_Int(v1 * 4 + a38_index_3, 4 ) v3 = read_mem_to_Int(v2 * 4 + a38_index_2, 4 ) return_type = v3 + a38_index_11 # cla_len = read_mem_to_Int(return_type, 1) # return_type = idaapi.dbg_read_memory(return_type+1, cla_len).decode('utf-8') print ( "arg_addr:" ,return_type) return return_type # def instr_handle(instr_addr,x10): # offset_mem = read_mem(instr_addr,2) & 0xff # instr_len = dexinstr[offset_mem](instr_addr,x10) # # return instr_len def get_segment_address(segment_name): seg = idaapi.get_segm_by_name(segment_name) if seg is not None : return seg.start_ea, seg.end_ea else : return None # 使用方法 def main(): method_addr = ByFunIDgetFunAddr(fun_id) register_size = read_mem_to_Int(method_addr, 2 ) ins_size = read_mem_to_Int(method_addr + 2 , 2 ) insns_size = read_mem_to_Int(method_addr + 12 , 4 ) print ( "method registers_size:" , hex (register_size)) print ( "method ins_size:" , hex (ins_size)) print ( "method insns_size:" , hex (insns_size)) method_addr_2 = ByFunIDgetFunAddr(fun_id + 1 ) funSize = method_addr_2 - method_addr print ( "method_size:" , hex (funSize)) instr_addr = method_addr + 0x10 print ( "method_end:" , hex (instr_addr + insns_size * 2 )) while ( 1 ): offset = read_mem_to_Int(instr_addr, 2 ) & 0xff #第一个字节 instr_fun_addr = instr_fun_table + offset * 8 print ( "-----------------------------------" ) print ( "instr_fun_addr:" , hex (instr_fun_addr), hex (offset)) instr_handle = switch[offset] print ( "instr_addr:" , hex (instr_addr)) print ( hex (offset)) if (instr_handle = = None ): break instr_len = instr_handle(instr_addr, fun_addr_ref) instr_addr = instr_addr + instr_len print ( hex (offset)) def init_var(): global global_table global instr_fun_table global fun_addr_ref bss_start, bss_end = get_segment_address( ".bss" ) qword_78B9BFCDC8 = read_mem_to_Int(bss_start + 0x2B8 , 8 ) global_table = read_mem_to_Int(bss_start + 0x270 , 8 ) yaq2__sec = read_mem_to_Int(bss_start + 0x2B0 , 8 ) v6 = yaq2__sec + fun_id * 12 v6_index_1 = read_mem_to_Int(v6 + 4 , 4 ) v6_index_2 = read_mem_to_Int(v6 + 8 , 4 ) fun_addr_ref = read_mem_to_Int( 8 * (v6_index_2 - 1 ) + qword_78B9BFCDC8, 8 ) instr_fun_table, data_rel_end = get_segment_address( ".data.rel.ro" ) print ( "qword_78B9BFCDC8" , hex (qword_78B9BFCDC8)) print ( "global_table" , hex (global_table)) print ( "v6_index_1" , hex (v6_index_1)) print ( "v6_index_2" , hex (v6_index_2)) print ( "fun_addr_ref" , hex (fun_addr_ref)) if __name__ = = '__main__' : init_var() main() |