一、背景
二、整体框架
三、SO保护壳分析
四、DEX保护壳分析
五、Native原理分析
六、总结
一、背景
最近朋友让我帮忙对他们银行APP进行黑盒分析,检测其安全性，探未知程序漏洞与安全性测试，提升业务整体安全能力，我拿到APP后进行安装抓包后发现都是加密传输的，用JEB进行反编译找数据组合的地方，发现APP用某加固了，所以有了此文。
二、整体框架
主要对DEX整体加密、DEX代码分离运行时解密还原，java方法native化，大致框架如下图2-1所示：
图2-1
三、SO保护壳分析
3.1、so层壳流程分析
壳入口点：
LOAD:C5FD5960 EXPORT .init_proc LOAD:C5FD5960 .init_proc LOAD:C5FD5960 LOAD:C5FD5960 var_4= -4 LOAD:C5FD5960 LOAD:C5FD5960 C0 46 NOP LOAD:C5FD5962 FF B5 PUSH {R0-R7,LR} LOAD:C5FD5964 00 A1 18 39 ADRL R1, 0xC5FD5950 LOAD:C5FD5968 0D 1C MOVS R5, R1 LOAD:C5FD596A 0C 68 LDR R4, [R1] ; off_C5FD5950 LOAD:C5FD596C 2D 1B SUBS R5, R5, R4 LOAD:C5FD596E 4B 68 LDR R3, [R1,#(off_C5FD5954 - 0xC5FD5950)] ; ijiami LOAD:C5FD5970 5B 19 ADDS R3, R3, R5 LOAD:C5FD5972 08 93 STR R3, [SP,#0x24+var_4] LOAD:C5FD5974 C8 68 LDR R0, [R1,#(off_C5FD595C - 0xC5FD5950)] LOAD:C5FD5976 40 19 ADDS R0, R0, R5 LOAD:C5FD5976 LOAD:C5FD5978 LOAD:C5FD5978 loc_C5FD5978 ; CODE XREF: sub_C5FD59DE+C↓j LOAD:C5FD5978 8B 68 LDR R3, [R1,#(dword_C5FD5958 - 0xC5FD5950)] LOAD:C5FD597A 5B 19 ADDS R3, R3, R5 LOAD:C5FD597C 18 21 MOVS R1, #0x18 LOAD:C5FD597E 09 18 ADDS R1, R1, R0 LOAD:C5FD5980 08 B4 PUSH {R3} LOAD:C5FD5982 82 B0 SUB SP, SP, #8 LOAD:C5FD5984 00 B5 PUSH {LR} ; sub_C5FD6104 LOAD:C5FD5986 4C 68 LDR R4, [R1,#(loc_C5F927C4 - 0xC5F927C0)] LOAD:C5FD5988 0C 31 ADDS R1, #0xC LOAD:C5FD598A 09 19 ADDS R1, R1, R4 LOAD:C5FD598C 00 F0 A0 F9 BL sub_C5FD5CD0 ; dword_C601B200 LOAD:C5FD598C LOAD:C5FD5990 03 05 LSLS R3, R0, #0x14 LOAD:C5FD5992 1B 0D LSRS R3, R3, #0x14 ; x.35 LOAD:C5FD5994 E4 18 ADDS R4, R4, R3 LOAD:C5FD5996 04 34 ADDS R4, #4 LOAD:C5FD5998 10 B4 PUSH {R4} LOAD:C5FD599A C0 1A SUBS R0, R0, R3 LOAD:C5FD599C 01 B4 PUSH {R0} LOAD:C5FD599E E4 1A SUBS R4, R4, R3 LOAD:C5FD59A0 C0 18 ADDS R0, R0, R3 ; off_C6012420 LOAD:C5FD59A2 9B 08 LSRS R3, R3, #2 LOAD:C5FD59A4 08 B4 PUSH {R3} ; y.36 LOAD:C5FD59A6 00 00 MOVS R0, R0 LOAD:C5FD59A8 00 F0 19 F8 BL sub_C5FD59DE LOAD:C5FD59A8 LOAD:C5FD59AC 1B 06 LSLS R3, R3, #0x18 LOAD:C5FD59AE 89 08 LSRS R1, R1, #2 LOAD:C5FD59B0 1B 0E LSRS R3, R3, #0x18 LOAD:C5FD59B2 89 00 LSLS R1, R1, #2 LOAD:C5FD59B4 50 2B CMP R3, #0x50 ; 'P' LOAD:C5FD59B6 11 D1 BNE locret_C5FD59DC LOAD:C5FD59B6 LOAD:C5FD59B8 0E E0 B loc_C5FD59D8 LOAD:C5FD59B8 LOAD:C5FD59BA LOAD:C5FD59BA loc_C5FD59BA ; CODE XREF: .init_proc+7A↓j LOAD:C5FD59BA 04 39 SUBS R1, #4 LOAD:C5FD59BC 42 58 LDR R2, [R0,R1] LOAD:C5FD59BE 13 01 LSLS R3, R2, #4 LOAD:C5FD59C0 1B 0F LSRS R3, R3, #0x1C LOAD:C5FD59C2 0B 2B CMP R3, #0xB LOAD:C5FD59C4 08 D1 BNE loc_C5FD59D8 LOAD:C5FD59C4 LOAD:C5FD59C6 89 08 LSRS R1, R1, #2 LOAD:C5FD59C8 53 1A SUBS R3, R2, R1 LOAD:C5FD59CA 89 00 LSLS R1, R1, #2 LOAD:C5FD59CC 12 0E LSRS R2, R2, #0x18 LOAD:C5FD59CE 1B 02 LSLS R3, R3, #8 LOAD:C5FD59D0 12 06 LSLS R2, R2, #0x18 LOAD:C5FD59D2 1B 0A LSRS R3, R3, #8 LOAD:C5FD59D4 1A 43 ORRS R2, R3 LOAD:C5FD59D6 42 50 STR R2, [R0,R1] LOAD:C5FD59D6 LOAD:C5FD59D8 LOAD:C5FD59D8 loc_C5FD59D8 ; CODE XREF: .init_proc+58↑j LOAD:C5FD59D8 ; .init_proc+64↑j LOAD:C5FD59D8 00 29 CMP R1, #0 LOAD:C5FD59DA EE D1 BNE loc_C5FD59BA LOAD:C5FD59DA LOAD:C5FD59DC LOAD:C5FD59DC locret_C5FD59DC ; CODE XREF: .init_proc+56↑j LOAD:C5FD59DC 70 47 BX LR ; sub_C5FD6104
从壳入口点特征可以大致判断出是UPX，我尝试通过upx -d进行脱壳出现异常，修改特征为upx!还是不能正常脱壳，应该是被变异了，考虑通过IDA进行动态调试脱壳。
dump so
将断点断在linker中调用壳入口的地方，启动调试，如图3-1所示：
图3-1
壳执行完成将解压完代码在内存中dump出来，如图3-1-2所示
图3-1-2
3.2、so层壳脱壳与修复
修复Elf32_Off、修复shdr、修复phdr、修复重定位，如图3-2所示：
图3-2
修复后可以正常反编译，代码有ollvm混淆，字符串加密，如图3-2-1所示：
图3-2-1
四、DEX保护壳分析
4.1、Jni_onLoad
Jni_onLoad主要就是动态注册几个Native方法，代码如下：
jint JNI_OnLoad(JavaVM *vm, void *reserved) { _BOOL4 v2; // r2 int v3; // r4 int v4; // r3 int v5; // r3 int v6; // r2 v3 = 0; v4 = 0; if ( 2 * *y_21_ptr[0] > 191 ) v3 = 1; if ( *y_21_ptr[0] > 9 ) v4 = 1; v5 = v4 & ((*x_20_ptr[0] - 1) * *x_20_ptr[0]); v2 = (*x_20_ptr[0] ^ *y_21_ptr[0]) < 130; v6 = (v2 & v3 | v5) ^ 1 | v2 & v3 ^ v5; while ( v6 != 1 ) ; return RegisterNatives_sub_5252C((int)vm, reserved); } int __fastcall RegisterNatives_sub_5252C(JNIEnv *a1) { jclass v2; // r8 int v3; // r5 int v4; // r3 void ***v5; // r5 jclass v6; // r6 int v7; // r0 int v8; // r5 int v9; // r6 int v10; // r1 int v11; // r3 int v12; // r1 int v13; // r1 _BOOL4 v14; // r2 _BOOL4 v15; // r6 int v16; // r5 int v17; // r1 int v18; // r3 int v19; // r2 jclass v21; // r8 __int64 v22; // r0 int v23; // r6 __int64 v24; // r2 int v25; // r1 int v26; // r0 int v27; // r6 int v28; // r3 int v29; // r6 int v30; // r6 int v31; // r3 int v32; // r2 int v33; // r0 int v34; // r0 int v35; // r0 const char *funcname; // [sp+4h] [bp-74h] BYREF int *v37; // [sp+8h] [bp-70h] int (__fastcall *v38)(int, int, int, int); // [sp+Ch] [bp-6Ch] void *v39; // [sp+10h] [bp-68h] int *v40; // [sp+14h] [bp-64h] int (__fastcall *v41)(int, int, int, int); // [sp+18h] [bp-60h] int v42; // [sp+1Ch] [bp-5Ch] int *v43; // [sp+20h] [bp-58h] int (*v44)(); // [sp+24h] [bp-54h] int *v45; // [sp+28h] [bp-50h] int *v46; // [sp+2Ch] [bp-4Ch] int (*v47)(); // [sp+30h] [bp-48h] const char *funcname_1; // [sp+34h] [bp-44h] int *v49; // [sp+38h] [bp-40h] bool (*v50)(); // [sp+3Ch] [bp-3Ch] int v51; // [sp+40h] [bp-38h] int v52; // [sp+44h] [bp-34h] int (*v53)(); // [sp+48h] [bp-30h] int v54; // [sp+4Ch] [bp-2Ch] int v55; // [sp+50h] [bp-28h] int (*v56)(int, int, int, int, int); // [sp+54h] [bp-24h] int v57; // [sp+58h] [bp-20h] v57 = *(_DWORD *)_stack_chk_guard_ptr; if ( !(_BYTE)dword_C532E1E0 ) sub_C52A6FA8(10); sub_C52A75BC(a1); sub_C52D37F4(a1); v2 = (*a1)->FindClass(a1, *((_DWORD *)(*off_C5325018)[93] + 1)); if ( !v2 ) { v14 = (*y_239_ptr[0] ^ *x_238_ptr[0]) < 234; v15 = 8 * *y_239_ptr[0] > 268; v16 = v15 ^ v14; v17 = 0; v18 = 0; v19 = !v14 && !v15; if ( *y_239_ptr[0] < 10 ) v17 = 1; if ( !((*x_238_ptr[0] * (*x_238_ptr[0] - 1)) << 31) ) v18 = 1; while ( !(v17 | v18 | v19 | v16) ) ; return 255; } v3 = 0; v4 = 0; if ( *y_239_ptr[0] < 137 ) v3 = 1; if ( !(((*x_238_ptr[0] - 1) * *x_238_ptr[0]) << 31) ) v4 = 1; while ( (v4 | ((*x_238_ptr[0] ^ *y_239_ptr[0]) > 7) | v3) != 1 ) ; v5 = off_C5325018; v6 = (*a1)->FindClass(a1, *(_DWORD *)(*off_C5325018)[93]); (*((void (__fastcall **)(JNIEnv *))(*v5)[4] + 25))(a1); if ( v6 ) { funcname = "l"; v38 = l_sub_3EDA8; v39 = &unk_C531D5EA; v41 = r_sub_40E14; v42 = (int)&dword_C532A248 + 1; v37 = &dword_C532A1F0; v40 = &dword_C532A1F0; v43 = &dword_C532A1F0; v44 = ra_sub_41368; v45 = &dword_C532A24C; v46 = &dword_C532A250; v47 = b2b_sub_416B4; funcname_1 = "m"; v49 = &dword_C532A258; v50 = m_sub_41700; v51 = (int)&dword_C532A26C + 3; v52 = (int)&dword_C532A270 + 2; v53 = sa_nullsub_1; v54 = (int)&dword_C532A298 + 2; v55 = (int)&dword_C532A29C + 1; v56 = al_sub_41750; v7 = (*a1)->RegisterNatives(a1, v2, (const JNINativeMethod *)&funcname, 7); v8 = 0; v9 = 0; v10 = *x_238_ptr[0]; if ( *y_239_ptr[0] < 21 ) v8 = 1; v11 = (*x_238_ptr[0] - 1) * v10; v12 = ((v10 ^ *y_239_ptr[0]) > 80) | v8; if ( !(v11 << 31) ) v9 = 1; v13 = v12 | v9; while ( v13 != 1 ) ; if ( v7 <= -1 ) return 255; } else { funcname = "l"; v38 = l_sub_3EDA8; v39 = &unk_C531D5EA; v41 = r_sub_40E14; v42 = (int)&dword_C532A248 + 1; v37 = &dword_C532A1F0; v40 = &dword_C532A1F0; v43 = &dword_C532A1F0; v44 = ra_sub_41368; v45 = &dword_C532A24C; v46 = &dword_C532A250; v47 = b2b_sub_416B4; funcname_1 = "m"; v49 = &dword_C532A258; v50 = m_sub_41700; v51 = (int)&dword_C532A26C + 3; v52 = (int)&dword_C532A270 + 2; v53 = sa_nullsub_1; if ( (*a1)->RegisterNatives(a1, v2, (const JNINativeMethod *)&funcname, 6) < 0 ) return 255; while ( (*x_238_ptr[0] ^ *y_239_ptr[0]) <= 31 && 2 * *y_239_ptr[0] >= 286 && *y_239_ptr[0] >= 10 && ((*x_238_ptr[0] - 1) * *x_238_ptr[0]) << 31 != 0 ) ; } v21 = (*a1)->FindClass(a1, (char *)&aRr9Pm + 2); HIDWORD(v22) = *y_239_ptr[0]; LODWORD(v22) = 0; v23 = (int)*off_C5325018; if ( *y_239_ptr[0] > 9 ) LODWORD(v22) = 1; if ( 16 * HIDWORD(v22) > 354 && (HIDWORD(v22) ^ *x_238_ptr[0]) <= 19 ) { HIDWORD(v22) = (((unsigned __int8)*x_238_ptr[0] - 1) * (unsigned __int8)*x_238_ptr[0]) & 1; if ( (unsigned int)v22 == HIDWORD(v22) ) { if ( v22 ) goto LABEL_39; } } while ( 1 ) { (*(void (__fastcall **)(JNIEnv *))(*(_DWORD *)(v23 + 0x10) + 100))(a1); LODWORD(v24) = 0; v25 = *y_239_ptr[0]; v26 = *x_238_ptr[0]; if ( *y_239_ptr[0] > 9 ) LODWORD(v24) = 1; if ( 16 * v25 < 121 ) break; if ( (v25 ^ v26) > 195 ) break; HIDWORD(v24) = (((_BYTE)v26 - 1) * (_BYTE)v26) & 1; if ( (unsigned int)v24 != HIDWORD(v24) || !v24 ) break; LABEL_39: (*(void (__fastcall **)(JNIEnv *))(*(_DWORD *)(v23 + 0x10) + 100))(a1); } if ( !v21 ) goto LABEL_47; funcname = (char *)&dword_C532A21C + 3; v37 = (int *)((char *)&dword_C532A220 + 2); v38 = (int (__fastcall *)(int, int, int, int))off_C5325374; if ( (*a1)->RegisterNatives(a1, v21, (const JNINativeMethod *)&funcname, 1) < 0 ) return 255; v27 = 0; v28 = 0; v26 = *x_238_ptr[0]; v25 = *y_239_ptr[0]; if ( *y_239_ptr[0] < 366 ) v27 = 1; v29 = v27 | ((*y_239_ptr[0] ^ *x_238_ptr[0]) > 185); if ( !((*x_238_ptr[0] * (*x_238_ptr[0] - 1)) << 31) ) v28 = 1; while ( (v28 | v29) != 1 ) ; LABEL_47: v30 = 0; v31 = 0; v32 = v26 * (v26 - 1); v33 = v26 ^ v25; if ( v25 <= 294 ) v30 = 1; v34 = (v33 > 137) | v30; if ( !(v32 << 31) ) v31 = 1; v35 = v34 | v31; while ( !v35 ) ; return 1; }
注册的native方法：
l(Landroid/app/Application;Ljava/lang/String;)Z r(Landroid/app/Application;Ljava/lang/String;)Z ra(Landroid/app/Application;Ljava/lang/String;)Z b2b([BI)[B m(Ljava/lang/String;I)V sa(Ljava/lang/String;Ljava/lang/String;)V al(Ljava/lang/ClassLoader;Landroid/content/pm/ApplicationInfo;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/ClassLoader;
4.2、java层到native层
在壳的java层重写了android.app.AppComponentFactory类的几个关键方法，其中instantiateClassLoader是比较核心的，它最终会走到Native方法al中。
@Override // android.app.AppComponentFactory @TargetApi(29) public ClassLoader instantiateClassLoader(ClassLoader arg4, ApplicationInfo arg5) { if(!this.supportInstantiateClassLoader) { File v1 = new File(arg5.dataDir, "files"); if(!v1.exists()) { v1.mkdirs(); } S.p_solutePath = v1.getAbsolutePath(); S.f_PackageCodePath = arg5.sourceDir; S.l(null); arg4 = N.al(arg4, arg5, this.packageName, this.orignAppName); // 调用native方法 arg5.className = this.orignAppName; this.supportInstantiateClassLoader = true; } if(S.l) { this.acf = this.getACF(arg4); return this.acf == null ? super.instantiateClassLoader(arg4, arg5) : this.acf.instantiateClassLoader(arg4, arg5); } return super.instantiateClassLoader(arg4, arg5); }
4.3、反调试
反射调用 isDebuggerConnected
.text&ARM.extab:C52C8060 isDebuggerConnected_sub_C608A060 .text&ARM.extab:C52C8060 ; CODE XREF: l_sub_3EDA8+33C↓p .text&ARM.extab:C52C8060 ; al_sub_41750+324↓p .text&ARM.extab:C52C8060 ; DATA XREF: l_sub_3EDA8+33A↓o .text&ARM.extab:C52C8060 ; al_sub_41750+322↓o .text&ARM.extab:C52C8060 ; .data:C5328140↓o .text&ARM.extab:C52C8060 .text&ARM.extab:C52C8060 var_18= -0x18 .text&ARM.extab:C52C8060 var_C= -0xC .text&ARM.extab:C52C8060 .text&ARM.extab:C52C8060 ; __unwind { .text&ARM.extab:C52C8060 80 B5 PUSH {R7,LR} .text&ARM.extab:C52C8062 6F 46 MOV R7, SP .text&ARM.extab:C52C8064 84 B0 SUB SP, SP, #0x10 .text&ARM.extab:C52C8066 28 48 LDR R0, =(__stack_chk_guard_ptr - 0xC52C806E) .text&ARM.extab:C52C8068 28 49 LDR R1, =(off_C5325018 - 0xC52C8072) .text&ARM.extab:C52C806A 78 44 ADD R0, PC ; __stack_chk_guard_ptr .text&ARM.extab:C52C806C 28 4A LDR R2, =(aAndroidOsDebug - 0xC52C8078) ; "+\x1C\x10I\x1A1\fx3 o\x1B(&/(J" .text&ARM.extab:C52C806E 79 44 ADD R1, PC ; off_C5325018 .text&ARM.extab:C52C8070 28 4B LDR R3, =(byte_C5328846 - 0xC52C807C) .text&ARM.extab:C52C8072 00 68 LDR R0, [R0] .text&ARM.extab:C52C8074 7A 44 ADD R2, PC ; "+\x1C\x10I\x1A1\fx3 o\x1B(&/(J" .text&ARM.extab:C52C8076 09 68 LDR R1, [R1] ; off_C5326004 .text&ARM.extab:C52C8078 7B 44 ADD R3, PC ; byte_C5328846 .text&ARM.extab:C52C807A 00 68 LDR R0, [R0] .text&ARM.extab:C52C807C 03 90 STR R0, [SP,#0x18+var_C] .text&ARM.extab:C52C807E 09 68 LDR R1, [R1] ; off_C532DDC0 .text&ARM.extab:C52C8080 88 68 LDR R0, [R1,#(off_C532DDC8 - 0xC532DDC0)] .text&ARM.extab:C52C8082 09 69 LDR R1, [R1,#(off_C532DDD0 - 0xC532DDC0)] ; off_C53266C4 .text&ARM.extab:C52C8084 D1 F8 38 C0 LDR.W R12, [R1,#0x38] ; CallStaticBooleanMethodV_isDebuggerConnected_sub_C609F484 .text&ARM.extab:C52C8088 23 49 LDR R1, =(aIsdebuggerconn - 0xC52C808E) ; "#\x010^\x17-\x0F09!\x030#*?,>\x17\x10;" .text&ARM.extab:C52C808A 79 44 ADD R1, PC ; "#\x010^\x17-\x0F09!\x030#*?,>\x17\x10;" .text&ARM.extab:C52C808C 00 91 STR R1, [SP,#0x18+var_18] .text&ARM.extab:C52C808E 79 1F SUBS R1, R7, #5 ; isDebuggerConnected .text&ARM.extab:C52C8090 E0 47 BLX R12 ; CallStaticBooleanMethodV .text&ARM.extab:C52C8090 .text&ARM.extab:C52C8092 20 B1 CBZ R0, loc_C52C809E .text&ARM.extab:C52C8092 .text&ARM.extab:C52C8094 17 F8 05 0C LDRB.W R0, [R7,#-5] .text&ARM.extab:C52C8098 08 B1 CBZ R0, loc_C52C809E .text&ARM.extab:C52C8098 .text&ARM.extab:C52C809A 01 20 MOVS R0, #1 .text&ARM.extab:C52C809C 28 E0 B loc_C52C80F0
检测模拟器
.text&ARM.extab:C52C45A0 check_qemu_anitdbg_sub_C60B05A0 .text&ARM.extab:C52C45A0 .text&ARM.extab:C52C45A0 var_40= -0x40 .text&ARM.extab:C52C45A0 var_38= -0x38 .text&ARM.extab:C52C45A0 var_2C= -0x2C .text&ARM.extab:C52C45A0 var_28= -0x28 .text&ARM.extab:C52C45A0 anonymous_0= -0x24 .text&ARM.extab:C52C45A0 var_20= -0x20 .text&ARM.extab:C52C45A0 .text&ARM.extab:C52C45A0 ; __unwind { .text&ARM.extab:C52C45A0 F0 B5 PUSH {R4-R7,LR} .text&ARM.extab:C52C45A2 03 AF ADD R7, SP, #0xC .text&ARM.extab:C52C45A4 2D E9 00 0F PUSH.W {R8-R11} .text&ARM.extab:C52C45A8 89 B0 SUB SP, SP, #0x24 .text&ARM.extab:C52C45AA 80 46 MOV R8, R0 .text&ARM.extab:C52C45AC DF F8 E8 07 LDR.W R0, =(x.196_ptr - 0xC52C45BA) .text&ARM.extab:C52C45B0 DF F8 E8 17 LDR.W R1, =(y.197_ptr - 0xC52C45C4) .text&ARM.extab:C52C45B4 00 24 MOVS R4, #0 .text&ARM.extab:C52C45B6 78 44 ADD R0, PC ; x.196_ptr .text&ARM.extab:C52C45B8 DF F8 E4 27 LDR.W R2, =(__stack_chk_guard_ptr - 0xC52C45C8) .text&ARM.extab:C52C45BC DF F8 E4 37 LDR.W R3, =(off_C5325018 - 0xC52C45CA) .text&ARM.extab:C52C45C0 79 44 ADD R1, PC ; y.197_ptr .text&ARM.extab:C52C45C2 00 68 LDR R0, [R0] ; x.196 .text&ARM.extab:C52C45C4 7A 44 ADD R2, PC ; __stack_chk_guard_ptr .text&ARM.extab:C52C45C6 7B 44 ADD R3, PC ; off_C5325018 .text&ARM.extab:C52C45C8 09 68 LDR R1, [R1] ; y.197 .text&ARM.extab:C52C45CA 12 68 LDR R2, [R2] .text&ARM.extab:C52C45CC 00 25 MOVS R5, #0 .text&ARM.extab:C52C45CE 06 68 LDR R6, [R0] .text&ARM.extab:C52C45D0 18 68 LDR R0, [R3] ; off_C5326004 .text&ARM.extab:C52C45D2 73 1E SUBS R3, R6, #1 .text&ARM.extab:C52C45D4 09 68 LDR R1, [R1] .text&ARM.extab:C52C45D6 73 43 MULS R3, R6 .text&ARM.extab:C52C45D8 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52C45DA 12 68 LDR R2, [R2] .text&ARM.extab:C52C45DC 08 92 STR R2, [SP,#0x40+var_20] .text&ARM.extab:C52C45DE 61 29 CMP R1, #0x61 ; 'a' .text&ARM.extab:C52C45E0 81 EA 06 02 EOR.W R2, R1, R6 .text&ARM.extab:C52C45E4 C8 BF IT GT .text&ARM.extab:C52C45E6 01 24 MOVGT R4, #1 .text&ARM.extab:C52C45E8 62 2A CMP R2, #0x62 ; 'b' .text&ARM.extab:C52C45EA 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52C45EE B8 BF IT LT .text&ARM.extab:C52C45F0 01 26 MOVLT R6, #1 .text&ARM.extab:C52C45F2 09 29 CMP R1, #9 .text&ARM.extab:C52C45F4 C8 BF IT GT .text&ARM.extab:C52C45F6 01 25 MOVGT R5, #1 .text&ARM.extab:C52C45F8 26 40 ANDS R6, R4 .text&ARM.extab:C52C45FA 2B 40 ANDS R3, R5 .text&ARM.extab:C52C45FC 86 EA 03 05 EOR.W R5, R6, R3 .text&ARM.extab:C52C4600 1E 43 ORRS R6, R3 .text&ARM.extab:C52C4602 86 F0 01 06 EOR.W R6, R6, #1 .text&ARM.extab:C52C4606 2E 43 ORRS R6, R5 .text&ARM.extab:C52C4606 .text&ARM.extab:C52C4608 01 2E CMP R6, #1 .text&ARM.extab:C52C460A FD D1 BNE loc_C52C4608 .text&ARM.extab:C52C460A .text&ARM.extab:C52C460C 90 F8 7C 60 LDRB.W R6, [R0,#(dword_C532DE3C - 0xC532DDC0)] .text&ARM.extab:C52C4610 00 2E CMP R6, #0 .text&ARM.extab:C52C4612 00 F0 BD 80 BEQ.W loc_C52C4790 .text&ARM.extab:C52C4612 .text&ARM.extab:C52C4616 88 00 LSLS R0, R1, #2 .text&ARM.extab:C52C4618 16 28 CMP R0, #0x16 .text&ARM.extab:C52C461A 4F F0 00 00 MOV.W R0, #0 .text&ARM.extab:C52C461E 4F F0 00 01 MOV.W R1, #0 .text&ARM.extab:C52C4622 C8 BF IT GT .text&ARM.extab:C52C4624 01 20 MOVGT R0, #1 .text&ARM.extab:C52C4626 EA 2A CMP R2, #0xEA .text&ARM.extab:C52C4628 B8 BF IT LT .text&ARM.extab:C52C462A 01 21 MOVLT R1, #1 .text&ARM.extab:C52C462C 08 40 ANDS R0, R1 .text&ARM.extab:C52C462E 98 42 CMP R0, R3 .text&ARM.extab:C52C4630 02 D1 BNE loc_C52C4638 .text&ARM.extab:C52C4630 .text&ARM.extab:C52C4632 18 43 ORRS R0, R3 .text&ARM.extab:C52C4634 40 F0 E0 80 BNE.W loc_C52C47F8 .text&ARM.extab:C52C4634 .text&ARM.extab:C52C4638 .text&ARM.extab:C52C4638 loc_C52C4638 .text&ARM.extab:C52C4638 DF F8 6C 17 LDR.W R1, =(aDevQemuPipe - 0xC52C4646) ; "e\x16\x11MZ)\r:)\f06=!Z" .text&ARM.extab:C52C463C 00 24 MOVS R4, #0 .text&ARM.extab:C52C463E DF F8 6C 07 LDR.W R0, =(aDevSocketQemud - 0xC52C4648) ; "e\x16\x11MZ+\a4764p<!7:.r" .text&ARM.extab:C52C4642 79 44 ADD R1, PC ; "e\x16\x11MZ)\r:)\f06=!Z" .text&ARM.extab:C52C4644 78 44 ADD R0, PC ; "e\x16\x11MZ+\a4764p<!7:.r" ; name .text&ARM.extab:C52C4646 CD E9 06 01 STRD.W R0, R1, [SP,#0x40+var_28] .text&ARM.extab:C52C464A 00 21 MOVS R1, #0 ; type .text&ARM.extab:C52C464C E1 F7 3A E9 BLX access ; /dev/socket/qemud .text&ARM.extab:C52C464C .text&ARM.extab:C52C4650 01 30 ADDS R0, #1 .text&ARM.extab:C52C4652 00 F0 E6 80 BEQ.W loc_C52C4822 .text&ARM.extab:C52C4652 .text&ARM.extab:C52C4656 .text&ARM.extab:C52C4656 loc_C52C4656 .text&ARM.extab:C52C4656 4F F0 01 0C MOV.W R12, #1 .text&ARM.extab:C52C4656 .text&ARM.extab:C52C465A .text&ARM.extab:C52C465A loc_C52C465A .text&ARM.extab:C52C465A DF F8 54 07 LDR.W R0, =(x.196_ptr - 0xC52C4668) .text&ARM.extab:C52C465E 00 25 MOVS R5, #0 .text&ARM.extab:C52C4660 DF F8 50 17 LDR.W R1, =(y.197_ptr - 0xC52C466A) .text&ARM.extab:C52C4664 78 44 ADD R0, PC ; x.196_ptr .text&ARM.extab:C52C4666 79 44 ADD R1, PC ; y.197_ptr .text&ARM.extab:C52C4668 00 68 LDR R0, [R0] ; x.196 .text&ARM.extab:C52C466A 09 68 LDR R1, [R1] ; y.197 .text&ARM.extab:C52C466C 00 68 LDR R0, [R0] .text&ARM.extab:C52C466E 09 68 LDR R1, [R1] .text&ARM.extab:C52C4670 42 1E SUBS R2, R0, #1 .text&ARM.extab:C52C4672 81 EA 00 03 EOR.W R3, R1, R0 .text&ARM.extab:C52C4676 42 43 MULS R2, R0 .text&ARM.extab:C52C4678 13 2B CMP R3, #0x13 .text&ARM.extab:C52C467A 4F F0 00 00 MOV.W R0, #0 .text&ARM.extab:C52C467E 4F EA 01 16 MOV.W R6, R1,LSL#4 .text&ARM.extab:C52C4682 C8 BF IT GT .text&ARM.extab:C52C4684 01 20 MOVGT R0, #1 .text&ARM.extab:C52C4686 B6 F5 B2 7F CMP.W R6, #0x164 .text&ARM.extab:C52C468A 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52C468E D8 BF IT LE .text&ARM.extab:C52C4690 01 26 MOVLE R6, #1 .text&ARM.extab:C52C4692 0A 29 CMP R1, #0xA .text&ARM.extab:C52C4694 46 EA 00 06 ORR.W R6, R6, R0 .text&ARM.extab:C52C4698 B8 BF IT LT .text&ARM.extab:C52C469A 01 25 MOVLT R5, #1 .text&ARM.extab:C52C469C 12 F0 01 02 ANDS.W R2, R2, #1 .text&ARM.extab:C52C46A0 4F F0 00 00 MOV.W R0, #0 .text&ARM.extab:C52C46A4 08 BF IT EQ .text&ARM.extab:C52C46A6 01 20 MOVEQ R0, #1 .text&ARM.extab:C52C46A8 09 29 CMP R1, #9 .text&ARM.extab:C52C46AA C8 BF IT GT .text&ARM.extab:C52C46AC 01 24 MOVGT R4, #1 .text&ARM.extab:C52C46AE 14 40 ANDS R4, R2 .text&ARM.extab:C52C46B0 94 EA 06 0F TEQ.W R4, R6 .text&ARM.extab:C52C46B4 1E BF ITTT NE .text&ARM.extab:C52C46B6 28 43 ORRNE R0, R5 .text&ARM.extab:C52C46B8 30 40 ANDNE R0, R6 .text&ARM.extab:C52C46BA 01 28 CMPNE R0, #1 .text&ARM.extab:C52C46BC 40 F0 9C 80 BNE.W loc_C52C47F8 .text&ARM.extab:C52C46BC .text&ARM.extab:C52C46C0 E4 2B CMP R3, #0xE4 .text&ARM.extab:C52C46C2 4F F0 00 03 MOV.W R3, #0 .text&ARM.extab:C52C46C6 4F EA 41 06 MOV.W R6, R1,LSL#1 .text&ARM.extab:C52C46CA C8 BF IT GT .text&ARM.extab:C52C46CC 01 23 MOVGT R3, #1 .text&ARM.extab:C52C46CE 86 2E CMP R6, #0x86 .text&ARM.extab:C52C46D0 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52C46D4 B8 BF IT LT .text&ARM.extab:C52C46D6 01 26 MOVLT R6, #1 .text&ARM.extab:C52C46D8 00 20 MOVS R0, #0 .text&ARM.extab:C52C46DA 09 29 CMP R1, #9 .text&ARM.extab:C52C46DC C8 BF IT GT .text&ARM.extab:C52C46DE 01 20 MOVGT R0, #1 .text&ARM.extab:C52C46E0 00 2A CMP R2, #0 .text&ARM.extab:C52C46E2 18 BF IT NE .text&ARM.extab:C52C46E4 01 22 MOVNE R2, #1 .text&ARM.extab:C52C46E6 80 EA 02 01 EOR.W R1, R0, R2 .text&ARM.extab:C52C46EA 10 43 ORRS R0, R2 .text&ARM.extab:C52C46EC 80 F0 01 00 EOR.W R0, R0, #1 .text&ARM.extab:C52C46F0 33 43 ORRS R3, R6 .text&ARM.extab:C52C46F2 08 43 ORRS R0, R1 .text&ARM.extab:C52C46F4 18 43 ORRS R0, R3 .text&ARM.extab:C52C46F4 .text&ARM.extab:C52C46F6 .text&ARM.extab:C52C46F6 loc_C52C46F6 .text&ARM.extab:C52C46F6 01 28 CMP R0, #1 .text&ARM.extab:C52C46F8 FD D1 BNE loc_C52C46F6 .text&ARM.extab:C52C46F8 .text&ARM.extab:C52C46FA BC F1 00 0F CMP.W R12, #0 .text&ARM.extab:C52C46FE 79 D1 BNE loc_C52C47F4 .text&ARM.extab:C52C46FE .text&ARM.extab:C52C4700 DF F8 C0 06 LDR.W R0, =(aProcTtyDrivers - 0xC52C470C) ; "e\x02\x06T\x16w\x1C#%|$-$2?=9r" .text&ARM.extab:C52C4704 DF F8 C0 16 LDR.W R1, =(aR - 0xC52C4712) ; "r" .text&ARM.extab:C52C4708 78 44 ADD R0, PC ; "e\x02\x06T\x16w\x1C#%|$-$2?=9r" ; filename .text&ARM.extab:C52C470A CD F8 14 80 STR.W R8, [SP,#0x40+var_2C] .text&ARM.extab:C52C470E 79 44 ADD R1, PC ; "r" ; modes .text&ARM.extab:C52C4710 E1 F7 BA E8 BLX fopen ; /proc/tty/drivers .text&ARM.extab:C52C4710 .text&ARM.extab:C52C4714 83 46 MOV R11, R0 .text&ARM.extab:C52C4716 BB F1 00 0F CMP.W R11, #0 .text&ARM.extab:C52C471A 2F D0 BEQ loc_C52C477C .text&ARM.extab:C52C471A .text&ARM.extab:C52C471C 42 F2 94 00 MOVW R0, #0x2094 ; size .text&ARM.extab:C52C4720 E1 F7 8E E8 BLX malloc .text&ARM.extab:C52C4720 .text&ARM.extab:C52C4724 06 46 MOV R6, R0 .text&ARM.extab:C52C4726 42 F2 14 00 MOVW R0, #0x2014 .text&ARM.extab:C52C472A 06 EB 00 08 ADD.W R8, R6, R0 .text&ARM.extab:C52C472E 42 F2 04 00 MOVW R0, #0x2004 .text&ARM.extab:C52C4732 06 EB 00 09 ADD.W R9, R6, R0 .text&ARM.extab:C52C4736 06 F5 80 54 ADD.W R4, R6, #0x1000 .text&ARM.extab:C52C473A 06 F5 00 5A ADD.W R10, R6, #0x2000 .text&ARM.extab:C52C473A .text&ARM.extab:C52C473E .text&ARM.extab:C52C473E loc_C52C473E ; CODE XREF: check_qemu_anitdbg_sub_C60B05A0+1CE↓j .text&ARM.extab:C52C473E DF F8 24 17 LDR.W R1, =(byte_C532821D - 0xC52C474C) .text&ARM.extab:C52C4742 58 46 MOV R0, R11 ; stream .text&ARM.extab:C52C4744 32 46 MOV R2, R6 .text&ARM.extab:C52C4746 23 46 MOV R3, R4 .text&ARM.extab:C52C4748 79 44 ADD R1, PC ; byte_C532821D ; format .text&ARM.extab:C52C474A CD E9 00 A9 STRD.W R10, R9, [SP,#0x40+var_40] .text&ARM.extab:C52C474E CD F8 08 80 STR.W R8, [SP,#0x40+var_38] .text&ARM.extab:C52C4752 E1 F7 20 EA BLX fscanf .text&ARM.extab:C52C4752 .text&ARM.extab:C52C4756 DF F8 10 17 LDR.W R1, =(dword_C532822C - 0xC52C4766) .text&ARM.extab:C52C475A 05 46 MOV R5, R0 .text&ARM.extab:C52C475C 30 46 MOV R0, R6 ; s1 .text&ARM.extab:C52C475E 4F F4 80 52 MOV.W R2, #0x1000 ; n .text&ARM.extab:C52C4762 79 44 ADD R1, PC ; dword_C532822C ; s2 .text&ARM.extab:C52C4764 E1 F7 78 E8 BLX strncmp .text&ARM.extab:C52C4764 .text&ARM.extab:C52C4768 00 28 CMP R0, #0 .text&ARM.extab:C52C476A 43 D0 BEQ loc_C52C47F4 .text&ARM.extab:C52C476A .text&ARM.extab:C52C476C 68 1C ADDS R0, R5, #1 .text&ARM.extab:C52C476E E6 D1 BNE loc_C52C473E .text&ARM.extab:C52C476E .text&ARM.extab:C52C4770 30 46 MOV R0, R6 ; ptr .text&ARM.extab:C52C4772 E1 F7 42 E8 BLX free .text&ARM.extab:C52C4772 .text&ARM.extab:C52C4776 58 46 MOV R0, R11 ; stream .text&ARM.extab:C52C4778 E1 F7 9E E8 BLX fclose .text&ARM.extab:C52C4778 .text&ARM.extab:C52C477C .text&ARM.extab:C52C477C loc_C52C477C .text&ARM.extab:C52C477C 01 F0 18 FB BL check_qemu_sub_C60B1DB0 .text&ARM.extab:C52C477C .text&ARM.extab:C52C4780 C0 BB CBNZ R0, loc_C52C47F4 .text&ARM.extab:C52C4780 .text&ARM.extab:C52C4782 DF F8 48 06 LDR.W R0, =(off_C5325018 - 0xC52C478E) .text&ARM.extab:C52C4786 DD F8 14 80 LDR.W R8, [SP,#0x40+var_2C] .text&ARM.extab:C52C478A 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52C478C 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52C478E 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52C478E .text&ARM.extab:C52C4790 .text&ARM.extab:C52C4790 loc_C52C4790 .text&ARM.extab:C52C4790 90 F8 FC 10 LDRB.W R1, [R0,#(dword_C532DEBC - 0xC532DDC0)] .text&ARM.extab:C52C4794 00 29 CMP R1, #0 .text&ARM.extab:C52C4796 00 F0 90 82 BEQ.W loc_C52C4CBA .text&ARM.extab:C52C4796 .text&ARM.extab:C52C479A DF F8 34 16 LDR.W R1, =(x.196_ptr - 0xC52C47A8) .text&ARM.extab:C52C479E 00 26 MOVS R6, #0 .text&ARM.extab:C52C47A0 DF F8 30 26 LDR.W R2, =(y.197_ptr - 0xC52C47AA) .text&ARM.extab:C52C47A4 79 44 ADD R1, PC ; x.196_ptr .text&ARM.extab:C52C47A6 7A 44 ADD R2, PC ; y.197_ptr .text&ARM.extab:C52C47A8 09 68 LDR R1, [R1] ; x.196 .text&ARM.extab:C52C47AA 12 68 LDR R2, [R2] ; y.197 .text&ARM.extab:C52C47AC 09 68 LDR R1, [R1] .text&ARM.extab:C52C47AE 12 68 LDR R2, [R2] .text&ARM.extab:C52C47B0 4B 1E SUBS R3, R1, #1 .text&ARM.extab:C52C47B2 4B 43 MULS R3, R1 .text&ARM.extab:C52C47B4 51 40 EORS R1, R2 .text&ARM.extab:C52C47B6 92 29 CMP R1, #0x92 .text&ARM.extab:C52C47B8 4F F0 00 01 MOV.W R1, #0 .text&ARM.extab:C52C47BC 4F EA C2 05 MOV.W R5, R2,LSL#3 .text&ARM.extab:C52C47C0 C8 BF IT GT .text&ARM.extab:C52C47C2 01 21 MOVGT R1, #1 .text&ARM.extab:C52C47C4 B5 F5 E4 7F CMP.W R5, #0x1C8 .text&ARM.extab:C52C47C8 4F F0 00 05 MOV.W R5, #0 .text&ARM.extab:C52C47CC B8 BF IT LT .text&ARM.extab:C52C47CE 01 25 MOVLT R5, #1 .text&ARM.extab:C52C47D0 0A 2A CMP R2, #0xA .text&ARM.extab:C52C47D2 4F F0 00 02 MOV.W R2, #0 .text&ARM.extab:C52C47D6 41 EA 05 01 ORR.W R1, R1, R5 .text&ARM.extab:C52C47DA B8 BF IT LT .text&ARM.extab:C52C47DC 01 22 MOVLT R2, #1 .text&ARM.extab:C52C47DE DB 07 LSLS R3, R3, #0x1F .text&ARM.extab:C52C47E0 08 BF IT EQ .text&ARM.extab:C52C47E2 01 26 MOVEQ R6, #1 .text&ARM.extab:C52C47E4 32 43 ORRS R2, R6 .text&ARM.extab:C52C47E6 11 43 ORRS R1, R2 .text&ARM.extab:C52C47E6 .text&ARM.extab:C52C47E8 .text&ARM.extab:C52C47E8 loc_C52C47E8 .text&ARM.extab:C52C47E8 01 29 CMP R1, #1 .text&ARM.extab:C52C47EA FD D1 BNE loc_C52C47E8 .text&ARM.extab:C52C47EA .text&ARM.extab:C52C47EC 80 6B LDR R0, [R0,#(off_C532DDF8 - 0xC532DDC0)] ; off_C532812C .text&ARM.extab:C52C47EE 40 6A LDR R0, [R0,#0x24] ; sub_C52C9AF8 .text&ARM.extab:C52C47F0 80 47 BLX R0 .text&ARM.extab:C52C47F0 .text&ARM.extab:C52C47F2 30 B3 CBZ R0, loc_C52C4842 .text&ARM.extab:C52C47F2 .text&ARM.extab:C52C47F4 .text&ARM.extab:C52C47F4 loc_C52C47F4 .text&ARM.extab:C52C47F4 01 20 MOVS R0, #1 .text&ARM.extab:C52C47F6 C1 E2 B loc_C52C4D7C .text&ARM.extab:C52C47F6 .text&ARM.extab:C52C47F8 .text&ARM.extab:C52C47F8 loc_C52C47F8 .text&ARM.extab:C52C47F8 DF F8 BC 15 LDR.W R1, =(aDevQemuPipe - 0xC52C4804) ; "e\x16\x11MZ)\r:)\f06=!Z" .text&ARM.extab:C52C47FC DF F8 BC 05 LDR.W R0, =(aDevSocketQemud - 0xC52C4806) ; "e\x16\x11MZ+\a4764p<!7:.r" .text&ARM.extab:C52C4800 79 44 ADD R1, PC ; "e\x16\x11MZ)\r:)\f06=!Z" .text&ARM.extab:C52C4802 78 44 ADD R0, PC ; "e\x16\x11MZ+\a4764p<!7:.r" ; name .text&ARM.extab:C52C4804 CD E9 06 01 STRD.W R0, R1, [SP,#0x40+var_28] .text&ARM.extab:C52C4808 00 21 MOVS R1, #0 ; type .text&ARM.extab:C52C480A E1 F7 5C E8 BLX access .text&ARM.extab:C52C480A .text&ARM.extab:C52C480E 01 30 ADDS R0, #1 .text&ARM.extab:C52C4810 7F F4 12 AF BNE.W loc_C52C4638 .text&ARM.extab:C52C4810 .text&ARM.extab:C52C4814 DF F8 A8 05 LDR.W R0, =(aDevQemuPipe - 0xC52C481E) ; "e\x16\x11MZ)\r:)\f06=!Z" .text&ARM.extab:C52C4818 00 21 MOVS R1, #0 ; type .text&ARM.extab:C52C481A 78 44 ADD R0, PC ; "e\x16\x11MZ)\r:)\f06=!Z" ; name .text&ARM.extab:C52C481C E1 F7 52 E8 BLX access .text&ARM.extab:C52C481C .text&ARM.extab:C52C4820 0A E7 B loc_C52C4638 .text&ARM.extab:C52C4820 .text&ARM.extab:C52C4822 .text&ARM.extab:C52C4822 loc_C52C4822 .text&ARM.extab:C52C4822 06 AE ADD R6, SP, #0x40+var_28 .text&ARM.extab:C52C4824 01 25 MOVS R5, #1 .text&ARM.extab:C52C4824 .text&ARM.extab:C52C4826 .text&ARM.extab:C52C4826 loc_C52C4826 .text&ARM.extab:C52C4826 01 2D CMP R5, #1 .text&ARM.extab:C52C4828 08 D8 BHI loc_C52C483C .text&ARM.extab:C52C4828 .text&ARM.extab:C52C482A 56 F8 25 00 LDR.W R0, [R6,R5,LSL#2] ; name .text&ARM.extab:C52C482E 00 21 MOVS R1, #0 ; type .text&ARM.extab:C52C4830 E1 F7 48 E8 BLX access ; /dev/qemu_pipe .text&ARM.extab:C52C4830 .text&ARM.extab:C52C4834 01 35 ADDS R5, #1 .text&ARM.extab:C52C4836 01 30 ADDS R0, #1 .text&ARM.extab:C52C4838 F5 D0 BEQ loc_C52C4826 .text&ARM.extab:C52C4838
检测特征:
init.svc.qemud
init.svc.qemu-props
qemu.hw.mainkeys
qemu.sf.fake_camera
qemu.sf.lcd_density
ro.bootloader
ro.bootmode
检测脱壳机与frida
.text&ARM.extab:C52C60B8 check_frida_Youpk_sub_C60B20B8 .text&ARM.extab:C52C60B8 .text&ARM.extab:C52C60B8 var_9C= -0x9C .text&ARM.extab:C52C60B8 var_98= -0x98 .text&ARM.extab:C52C60B8 var_14= -0x14 .text&ARM.extab:C52C60B8 .text&ARM.extab:C52C60B8 ; __unwind { .text&ARM.extab:C52C60B8 F0 B5 PUSH {R4-R7,LR} .text&ARM.extab:C52C60BA 03 AF ADD R7, SP, #0xC .text&ARM.extab:C52C60BC 4D F8 04 BD PUSH.W {R11} .text&ARM.extab:C52C60C0 A4 B0 SUB SP, SP, #0x90 .text&ARM.extab:C52C60C2 98 48 LDR R0, =(__stack_chk_guard_ptr - 0xC52C60CE) .text&ARM.extab:C52C60C4 00 22 MOVS R2, #0 .text&ARM.extab:C52C60C6 98 49 LDR R1, =(aDataDexname - 0xC52C60D0) ; "e\x16\x15O\x14w\f2$=!2(D" .text&ARM.extab:C52C60C8 00 23 MOVS R3, #0 .text&ARM.extab:C52C60CA 78 44 ADD R0, PC ; __stack_chk_guard_ptr .text&ARM.extab:C52C60CC 79 44 ADD R1, PC ; "e\x16\x15O\x14w\f2$=!2(D" .text&ARM.extab:C52C60CE 00 68 LDR R0, [R0] .text&ARM.extab:C52C60D0 00 68 LDR R0, [R0] .text&ARM.extab:C52C60D2 23 90 STR R0, [SP,#0xA0+var_14] .text&ARM.extab:C52C60D4 6F F0 63 00 MOV R0, #0xFFFFFF9C .text&ARM.extab:C52C60D8 80 B4 PUSH {R7} .text&ARM.extab:C52C60DA 40 F2 4E 17 MOVW R7, #0x14E ; __NR_faccessat .text&ARM.extab:C52C60DE 00 DF SVC 0 .text&ARM.extab:C52C60E0 80 BC POP {R7} .text&ARM.extab:C52C60E2 10 F5 80 5F CMN.W R0, #0x1000 .text&ARM.extab:C52C60E6 15 D9 BLS loc_C52C6114 .text&ARM.extab:C52C60E6 .text&ARM.extab:C52C60E8 90 49 LDR R1, =(off_C5325018 - 0xC52C60F0) .text&ARM.extab:C52C60EA 45 42 NEGS R5, R0 .text&ARM.extab:C52C60EC 79 44 ADD R1, PC ; off_C5325018 .text&ARM.extab:C52C60EE 0E 68 LDR R6, [R1] ; off_C5326004 .text&ARM.extab:C52C60F0 DF F7 1E EC BLX __errno .text&ARM.extab:C52C60F0 .text&ARM.extab:C52C60F4 04 46 MOV R4, R0 .text&ARM.extab:C52C60F6 8E 49 LDR R1, =(aCnYoulorUnpack - 0xC52C6100) ; ")\x1C[B\x1A-\x048.|\x151=%9$/\x00t" .text&ARM.extab:C52C60F8 25 60 STR R5, [R4] .text&ARM.extab:C52C60FA 30 68 LDR R0, [R6] ; off_C532DDC0 .text&ARM.extab:C52C60FC 79 44 ADD R1, PC ; ")\x1C[B\x1A-\x048.|\x151=%9$/\x00t" .text&ARM.extab:C52C60FE 80 68 LDR R0, [R0,#(off_C532DDC8 - 0xC532DDC0)] .text&ARM.extab:C52C6100 02 68 LDR R2, [R0] .text&ARM.extab:C52C6102 92 69 LDR R2, [R2,#0x18] .text&ARM.extab:C52C6104 90 47 BLX R2 .text&ARM.extab:C52C6104 .text&ARM.extab:C52C6106 31 68 LDR R1, [R6] ; off_C532DDC0 .text&ARM.extab:C52C6108 05 46 MOV R5, R0 .text&ARM.extab:C52C610A 88 68 LDR R0, [R1,#(off_C532DDC8 - 0xC532DDC0)] .text&ARM.extab:C52C610C 09 69 LDR R1, [R1,#(off_C532DDD0 - 0xC532DDC0)] ; off_C53266C4 .text&ARM.extab:C52C610E 49 6E LDR R1, [R1,#0x64] ; ExceptionClear_sub_C609E948 .text&ARM.extab:C52C6110 88 47 BLX R1 ; off_C5323DD0 .text&ARM.extab:C52C6110 .text&ARM.extab:C52C6112 75 B1 CBZ R5, loc_C52C6132 .text&ARM.extab:C52C6112 .text&ARM.extab:C52C6114 .text&ARM.extab:C52C6114 01 25 MOVS R5, #1 .text&ARM.extab:C52C6114 .text&ARM.extab:C52C6116 .text&ARM.extab:C52C6116 loc_C52C6116 ; CODE XREF: check_frida_Youpk_sub_C60B20B8+9C↓j .text&ARM.extab:C52C6116 ; check_frida_Youpk_sub_C60B20B8+BA↓j .text&ARM.extab:C52C6116 ; check_frida_Youpk_sub_C60B20B8+26A↓j .text&ARM.extab:C52C6116 A1 48 LDR R0, =(__stack_chk_guard_ptr - 0xC52C611E) .text&ARM.extab:C52C6118 23 99 LDR R1, [SP,#0xA0+var_14] .text&ARM.extab:C52C611A 78 44 ADD R0, PC ; __stack_chk_guard_ptr .text&ARM.extab:C52C611C 00 68 LDR R0, [R0] .text&ARM.extab:C52C611E 00 68 LDR R0, [R0] .text&ARM.extab:C52C6120 40 1A SUBS R0, R0, R1 .text&ARM.extab:C52C6122 01 BF ITTTT EQ .text&ARM.extab:C52C6124 28 46 MOVEQ R0, R5 .text&ARM.extab:C52C6126 24 B0 ADDEQ SP, SP, #0x90 .text&ARM.extab:C52C6128 5D F8 04 BB POPEQ.W {R11} .text&ARM.extab:C52C612C F0 BD POPEQ {R4-R7,PC} .text&ARM.extab:C52C612C .text&ARM.extab:C52C612E DF F7 6A EB BLX __stack_chk_fail .text&ARM.extab:C52C612E .text&ARM.extab:C52C6132 .text&ARM.extab:C52C6132 .text&ARM.extab:C52C6132 loc_C52C6132 ; CODE XREF: check_frida_Youpk_sub_C60B20B8+5A↑j .text&ARM.extab:C52C6132 80 48 LDR R0, =(off_C5325018 - 0xC52C6138) .text&ARM.extab:C52C6134 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52C6136 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52C6138 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52C613A 41 6F LDR R1, [R0,#(dword_C532DE34 - 0xC532DDC0)] .text&ARM.extab:C52C613C 18 29 CMP R1, #0x18 .text&ARM.extab:C52C613E 19 DB BLT loc_C52C6174 .text&ARM.extab:C52C613E .text&ARM.extab:C52C6140 00 68 LDR R0, [R0] ; off_C5326504 .text&ARM.extab:C52C6142 01 22 MOVS R2, #1 .text&ARM.extab:C52C6144 7D 49 LDR R1, =(_ZN3art8Unpacker12dumpAllDexesEv - 0xC52C614E) ; "\x15(:\b\x14*\x1Co\t=0>./?={@\x10N\x18("... .text&ARM.extab:C52C6146 01 25 MOVS R5, #1 .text&ARM.extab:C52C6148 C3 68 LDR R3, [R0,#0xC] ; Find_Func_sub_C60985B8 .text&ARM.extab:C52C614A 79 44 ADD R1, PC ; "\x15(:\b\x14*\x1Co\t=0>./?={@\x10N\x18("... .text&ARM.extab:C52C614C 7A 48 LDR R0, =(byte_C5328177 - 0xC52C6152) .text&ARM.extab:C52C614E 78 44 ADD R0, PC ; byte_C5328177 .text&ARM.extab:C52C6150 98 47 BLX R3 ; Find_Func_sub_C60985B8 .text&ARM.extab:C52C6150 .text&ARM.extab:C52C6152 00 28 CMP R0, #0 .text&ARM.extab:C52C6154 DF D1 BNE loc_C52C6116 .text&ARM.extab:C52C6154 .text&ARM.extab:C52C6156 7A 48 LDR R0, =(off_C5325018 - 0xC52C6162) .text&ARM.extab:C52C6158 01 22 MOVS R2, #1 .text&ARM.extab:C52C615A 7B 49 LDR R1, =(aZn3art4aupk13a - 0xC52C6164) ; "\x15(:\b\x14*\x1Cc\x1D&04|w;::\x195I"... .text&ARM.extab:C52C615C 01 25 MOVS R5, #1 .text&ARM.extab:C52C615E 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52C6160 79 44 ADD R1, PC ; "\x15(:\b\x14*\x1Cc\x1D&04|w;::\x195I"... .text&ARM.extab:C52C6162 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52C6164 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52C6166 00 68 LDR R0, [R0] ; off_C5326504 .text&ARM.extab:C52C6168 C3 68 LDR R3, [R0,#0xC] ; Find_Func_sub_C60985B8 .text&ARM.extab:C52C616A 76 48 LDR R0, =(byte_C5328177 - 0xC52C6170) .text&ARM.extab:C52C616C 78 44 ADD R0, PC ; byte_C5328177 .text&ARM.extab:C52C616E 98 47 BLX R3 ; Find_Func_sub_C60985B8 .text&ARM.extab:C52C616E .text&ARM.extab:C52C6170 00 28 CMP R0, #0 .text&ARM.extab:C52C6172 D0 D1 BNE loc_C52C6116 .text&ARM.extab:C52C6172 .text&ARM.extab:C52C6174 .text&ARM.extab:C52C6174 loc_C52C6174 .text&ARM.extab:C52C6174 75 49 LDR R1, =(aDataLocalTmpUn - 0xC52C6182) ; "e\x16\x15O\x14w\x048?2,p9)*`?\x1C\x04Z"... .text&ARM.extab:C52C6176 6F F0 63 00 MOV R0, #0xFFFFFF9C .text&ARM.extab:C52C617A 00 22 MOVS R2, #0 .text&ARM.extab:C52C617C 00 23 MOVS R3, #0 .text&ARM.extab:C52C617E 79 44 ADD R1, PC ; "e\x16\x15O\x14w\x048?2,p9)*`?\x1C\x04Z"... .text&ARM.extab:C52C6180 4F F2 00 05 CF F6 FF 75 MOV R5, #0xFFFFF000 .text&ARM.extab:C52C6188 80 B4 PUSH {R7} .text&ARM.extab:C52C618A 40 F2 4E 17 MOVW R7, #0x14E ; __NR_faccessat .text&ARM.extab:C52C618E 00 DF SVC 0 ; /data/local/tmp/unpacker.config .text&ARM.extab:C52C6190 80 BC POP {R7} .text&ARM.extab:C52C6192 A8 42 CMP R0, R5 .text&ARM.extab:C52C6194 BE D9 BLS loc_C52C6114 .text&ARM.extab:C52C6194 .text&ARM.extab:C52C6196 6E 49 LDR R1, =(aDataLocalTmpAu - 0xC52C61A4) ; "e\x16\x15O\x14w\x048?2,p9)*`+\a\x04P[;"... .text&ARM.extab:C52C6198 40 42 NEGS R0, R0 .text&ARM.extab:C52C619A 20 60 STR R0, [R4] .text&ARM.extab:C52C619C 6F F0 63 00 MOV R0, #0xFFFFFF9C .text&ARM.extab:C52C61A0 79 44 ADD R1, PC ; "e\x16\x15O\x14w\x048?2,p9)*`+\a\x04P[;"... .text&ARM.extab:C52C61A2 00 22 MOVS R2, #0 .text&ARM.extab:C52C61A4 00 23 MOVS R3, #0 .text&ARM.extab:C52C61A6 80 B4 PUSH {R7} .text&ARM.extab:C52C61A8 40 F2 4E 17 MOVW R7, #0x14E ; __NR_faccessat .text&ARM.extab:C52C61AC 00 DF SVC 0 ; /data/local/tmp/aupk.config .text&ARM.extab:C52C61AE 80 BC POP {R7} .text&ARM.extab:C52C61B0 A8 42 CMP R0, R5 .text&ARM.extab:C52C61B2 AF D9 BLS loc_C52C6114 .text&ARM.extab:C52C61B2 .text&ARM.extab:C52C61B4 67 49 LDR R1, =(aDataFart - 0xC52C61C2) ; "e\x16\x15O\x14w\x0E6.'@" .text&ARM.extab:C52C61B6 40 42 NEGS R0, R0 .text&ARM.extab:C52C61B8 20 60 STR R0, [R4] .text&ARM.extab:C52C61BA 6F F0 63 00 MOV R0, #0xFFFFFF9C .text&ARM.extab:C52C61BE 79 44 ADD R1, PC ; "e\x16\x15O\x14w\x0E6.'@" .text&ARM.extab:C52C61C0 00 22 MOVS R2, #0 .text&ARM.extab:C52C61C2 00 23 MOVS R3, #0 .text&ARM.extab:C52C61C4 80 B4 PUSH {R7} .text&ARM.extab:C52C61C6 40 F2 4E 17 MOVW R7, #0x14E ; __NR_faccessat .text&ARM.extab:C52C61CA 00 DF SVC 0 ; /data/fart .text&ARM.extab:C52C61CC 80 BC POP {R7} .text&ARM.extab:C52C61CE A8 42 CMP R0, R5 .text&ARM.extab:C52C61D0 A0 D9 BLS loc_C52C6114 .text&ARM.extab:C52C61D0 .text&ARM.extab:C52C61D2 61 4A LDR R2, =(aDataLocalTmpRe - 0xC52C61DC) ; "e\x16\x15O\x14w\x048?2,p9)*`8\x17Z]\a1"... .text&ARM.extab:C52C61D4 40 42 NEGS R0, R0 .text&ARM.extab:C52C61D6 61 49 LDR R1, =(aReFridaServer - 0xC52C61E0) ; "8\x17Z]\a1\f6r %-;!(O" .text&ARM.extab:C52C61D8 7A 44 ADD R2, PC ; "e\x16\x15O\x14w\x048?2,p9)*`8\x17Z]\a1"... .text&ARM.extab:C52C61DA 20 60 STR R0, [R4] .text&ARM.extab:C52C61DC 79 44 ADD R1, PC ; "8\x17Z]\a1\f6r %-;!(O" ; needle .text&ARM.extab:C52C61DE 10 46 MOV R0, R2 ; haystack .text&ARM.extab:C52C61E0 DF F7 5E EB BLX strstr .text&ARM.extab:C52C61E0 .text&ARM.extab:C52C61E4 00 28 CMP R0, #0 .text&ARM.extab:C52C61E6 95 D0 BEQ loc_C52C6114 .text&ARM.extab:C52C61E6 .text&ARM.extab:C52C61E8 5D 48 LDR R0, =(off_C5325018 - 0xC52C61EE) .text&ARM.extab:C52C61EA 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52C61EC 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52C61EE 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52C61F0 41 6F LDR R1, [R0,#(dword_C532DE34 - 0xC532DDC0)] .text&ARM.extab:C52C61F2 18 29 CMP R1, #0x18 .text&ARM.extab:C52C61F4 08 DB BLT loc_C52C6208 .text&ARM.extab:C52C61F4 .text&ARM.extab:C52C61F6 00 68 LDR R0, [R0] ; off_C5326504 .text&ARM.extab:C52C61F8 00 22 MOVS R2, #0 .text&ARM.extab:C52C61FA 5D 49 LDR R1, =(myfartInvoke - 0xC52C6202) ; "'\v\x12Z\a,!9*<+:M" .text&ARM.extab:C52C61FC C3 68 LDR R3, [R0,#0xC] ; Find_Func_sub_C60985B8 .text&ARM.extab:C52C61FE 79 44 ADD R1, PC ; "'\v\x12Z\a,!9*<+:M" .text&ARM.extab:C52C6200 5A 48 LDR R0, =(byte_C5328177 - 0xC52C6206) .text&ARM.extab:C52C6202 78 44 ADD R0, PC ; byte_C5328177 .text&ARM.extab:C52C6204 98 47 BLX R3 ; Find_Func_sub_C60985B8 .text&ARM.extab:C52C6204 .text&ARM.extab:C52C6206 09 E0 B loc_C52C621C .text&ARM.extab:C52C6206 .text&ARM.extab:C52C6208 .text&ARM.extab:C52C6208 .text&ARM.extab:C52C6208 loc_C52C6208 .text&ARM.extab:C52C6208 56 48 LDR R0, =(byte_C5328177 - 0xC52C6210) .text&ARM.extab:C52C620A 00 21 MOVS R1, #0 ; mode .text&ARM.extab:C52C620C 78 44 ADD R0, PC ; byte_C5328177 ; file .text&ARM.extab:C52C620E DF F7 0C EB BLX dlopen .text&ARM.extab:C52C620E .text&ARM.extab:C52C6212 30 B1 CBZ R0, loc_C52C6222 .text&ARM.extab:C52C6212 .text&ARM.extab:C52C6214 54 49 LDR R1, =(myfartInvoke - 0xC52C621A) ; "'\v\x12Z\a,!9*<+:M" .text&ARM.extab:C52C6216 79 44 ADD R1, PC ; "'\v\x12Z\a,!9*<+:M" ; name .text&ARM.extab:C52C6218 DF F7 0C EB BLX dlsym .text&ARM.extab:C52C6218 .text&ARM.extab:C52C621C .text&ARM.extab:C52C621C loc_C52C621C .text&ARM.extab:C52C621C 00 28 CMP R0, #0 .text&ARM.extab:C52C621E 7F F4 79 AF BNE.W loc_C52C6114 .text&ARM.extab:C52C621E .text&ARM.extab:C52C6222 .text&ARM.extab:C52C6222 loc_C52C6222 .text&ARM.extab:C52C6222 54 48 LDR R0, =(off_C5325018 - 0xC52C6228) .text&ARM.extab:C52C6224 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52C6226 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52C6228 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52C622A 90 F8 FA 10 LDRB.W R1, [R0,#(dword_C532DEB8+2 - 0xC532DDC0)] .text&ARM.extab:C52C622E 00 29 CMP R1, #0 .text&ARM.extab:C52C6230 6D D0 BEQ loc_C52C630E .text&ARM.extab:C52C6230 .text&ARM.extab:C52C6232 02 A8 ADD R0, SP, #0xA0+var_98 .text&ARM.extab:C52C6234 80 21 MOVS R1, #0x80 .text&ARM.extab:C52C6236 DF F7 CE EA BLX __aeabi_memclr8 .text&ARM.extab:C52C6236 .text&ARM.extab:C52C623A 4F 48 LDR R0, =(x.216_ptr - 0xC52C6246) .text&ARM.extab:C52C623C 00 26 MOVS R6, #0 .text&ARM.extab:C52C623E 4F 49 LDR R1, =(y.217_ptr - 0xC52C6248) .text&ARM.extab:C52C6240 00 23 MOVS R3, #0 .text&ARM.extab:C52C6242 78 44 ADD R0, PC ; x.216_ptr .text&ARM.extab:C52C6244 79 44 ADD R1, PC ; y.217_ptr .text&ARM.extab:C52C6246 00 68 LDR R0, [R0] ; x.216 .text&ARM.extab:C52C6248 09 68 LDR R1, [R1] ; y.217 .text&ARM.extab:C52C624A 00 68 LDR R0, [R0] .text&ARM.extab:C52C624C 09 68 LDR R1, [R1] .text&ARM.extab:C52C624E 42 1E SUBS R2, R0, #1 .text&ARM.extab:C52C6250 09 29 CMP R1, #9 .text&ARM.extab:C52C6252 C8 BF IT GT .text&ARM.extab:C52C6254 01 26 MOVGT R6, #1 .text&ARM.extab:C52C6256 42 43 MULS R2, R0 .text&ARM.extab:C52C6258 48 40 EORS R0, R1 .text&ARM.extab:C52C625A 67 28 CMP R0, #0x67 ; 'g' .text&ARM.extab:C52C625C 4F F0 00 00 MOV.W R0, #0 .text&ARM.extab:C52C6260 4F EA 01 11 MOV.W R1, R1,LSL#4 .text&ARM.extab:C52C6264 C8 BF IT GT .text&ARM.extab:C52C6266 01 20 MOVGT R0, #1 .text&ARM.extab:C52C6268 B1 F5 AF 7F CMP.W R1, #0x15E .text&ARM.extab:C52C626C D8 BF IT LE .text&ARM.extab:C52C626E 01 23 MOVLE R3, #1 .text&ARM.extab:C52C6270 02 F0 01 02 AND.W R2, R2, #1 .text&ARM.extab:C52C6274 18 43 ORRS R0, R3 .text&ARM.extab:C52C6276 86 EA 02 05 EOR.W R5, R6, R2 .text&ARM.extab:C52C627A 32 43 ORRS R2, R6 .text&ARM.extab:C52C627C 82 F0 01 02 EOR.W R2, R2, #1 .text&ARM.extab:C52C6280 2A 43 ORRS R2, R5 .text&ARM.extab:C52C6282 10 43 ORRS R0, R2 .text&ARM.extab:C52C6282 .text&ARM.extab:C52C6284 .text&ARM.extab:C52C6284 loc_C52C6284 .text&ARM.extab:C52C6284 01 28 CMP R0, #1 .text&ARM.extab:C52C6286 FD D1 BNE loc_C52C6284 .text&ARM.extab:C52C6286 .text&ARM.extab:C52C6288 3D 48 LDR R0, =(unk_C53284EF - 0xC52C6290) .text&ARM.extab:C52C628A 02 A9 ADD R1, SP, #0xA0+var_98 .text&ARM.extab:C52C628C 78 44 ADD R0, PC ; unk_C53284EF .text&ARM.extab:C52C628E FF F7 51 FE BL system_property_get_sub_C60B1F34 .text&ARM.extab:C52C628E .text&ARM.extab:C52C6292 3C 49 LDR R1, =(x.216_ptr - 0xC52C629C) .text&ARM.extab:C52C6294 00 26 MOVS R6, #0 .text&ARM.extab:C52C6296 3C 4A LDR R2, =(y.217_ptr - 0xC52C629E) .text&ARM.extab:C52C6298 79 44 ADD R1, PC ; x.216_ptr .text&ARM.extab:C52C629A 7A 44 ADD R2, PC ; y.217_ptr .text&ARM.extab:C52C629C 09 68 LDR R1, [R1] ; x.216 .text&ARM.extab:C52C629E 12 68 LDR R2, [R2] ; y.217 .text&ARM.extab:C52C62A0 09 68 LDR R1, [R1] .text&ARM.extab:C52C62A2 12 68 LDR R2, [R2] .text&ARM.extab:C52C62A4 4B 1E SUBS R3, R1, #1 .text&ARM.extab:C52C62A6 4B 43 MULS R3, R1 .text&ARM.extab:C52C62A8 51 40 EORS R1, R2 .text&ARM.extab:C52C62AA 0A 29 CMP R1, #0xA .text&ARM.extab:C52C62AC 4F F0 00 01 MOV.W R1, #0 .text&ARM.extab:C52C62B0 4F EA 42 05 MOV.W R5, R2,LSL#1 .text&ARM.extab:C52C62B4 C8 BF IT GT .text&ARM.extab:C52C62B6 01 21 MOVGT R1, #1 .text&ARM.extab:C52C62B8 E7 2D CMP R5, #0xE7 .text&ARM.extab:C52C62BA 4F F0 00 05 MOV.W R5, #0 .text&ARM.extab:C52C62BE B8 BF IT LT .text&ARM.extab:C52C62C0 01 25 MOVLT R5, #1 .text&ARM.extab:C52C62C2 0A 2A CMP R2, #0xA .text&ARM.extab:C52C62C4 4F F0 00 02 MOV.W R2, #0 .text&ARM.extab:C52C62C8 41 EA 05 01 ORR.W R1, R1, R5 .text&ARM.extab:C52C62CC B8 BF IT LT .text&ARM.extab:C52C62CE 01 22 MOVLT R2, #1 .text&ARM.extab:C52C62D0 DB 07 LSLS R3, R3, #0x1F .text&ARM.extab:C52C62D2 08 BF IT EQ .text&ARM.extab:C52C62D4 01 26 MOVEQ R6, #1 .text&ARM.extab:C52C62D6 32 43 ORRS R2, R6 .text&ARM.extab:C52C62D8 11 43 ORRS R1, R2 .text&ARM.extab:C52C62D8 .text&ARM.extab:C52C62DA .text&ARM.extab:C52C62DA loc_C52C62DA .text&ARM.extab:C52C62DA 01 29 CMP R1, #1 .text&ARM.extab:C52C62DC FD D1 BNE loc_C52C62DA .text&ARM.extab:C52C62DC .text&ARM.extab:C52C62DE 01 28 CMP R0, #1 .text&ARM.extab:C52C62E0 07 DB BLT loc_C52C62F2 .text&ARM.extab:C52C62E0 .text&ARM.extab:C52C62E2 2A 49 LDR R1, =(dword_C5328508+2 - 0xC52C62EA) .text&ARM.extab:C52C62E4 02 A8 ADD R0, SP, #0xA0+var_98 .text&ARM.extab:C52C62E6 79 44 ADD R1, PC ; dword_C5328508 .text&ARM.extab:C52C62E8 1A F0 B3 FC BL strstr_sub_C60AAC52 .text&ARM.extab:C52C62E8 .text&ARM.extab:C52C62EC 00 28 CMP R0, #0 .text&ARM.extab:C52C62EE 7F F4 11 AF BNE.W loc_C52C6114 .text&ARM.extab:C52C62EE .text&ARM.extab:C52C62F2 .text&ARM.extab:C52C62F2 loc_C52C62F2 .text&ARM.extab:C52C62F2 27 48 LDR R0, =(off_C5325018 - 0xC52C62FE) .text&ARM.extab:C52C62F4 00 21 MOVS R1, #0 .text&ARM.extab:C52C62F6 27 4A LDR R2, =(sub_C52C63A0+1 - 0xC52C6300) .text&ARM.extab:C52C62F8 00 23 MOVS R3, #0 .text&ARM.extab:C52C62FA 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52C62FC 7A 44 ADD R2, PC ; sub_C52C63A0 .text&ARM.extab:C52C62FE 04 68 LDR R4, [R0] ; off_C5326004 .text&ARM.extab:C52C6300 20 68 LDR R0, [R4] ; off_C532DDC0 .text&ARM.extab:C52C6302 D0 F8 98 01 LDR.W R0, [R0,#(off_C532DF58 - 0xC532DDC0)] .text&ARM.extab:C52C6306 06 68 LDR R6, [R0] .text&ARM.extab:C52C6308 01 A8 ADD R0, SP, #0xA0+var_9C .text&ARM.extab:C52C630A B0 47 BLX R6 .text&ARM.extab:C52C630A .text&ARM.extab:C52C630C 20 68 LDR R0, [R4] ; off_C532DDC0 .text&ARM.extab:C52C630C .text&ARM.extab:C52C630E .text&ARM.extab:C52C630E loc_C52C630E ; CODE XREF: check_frida_Youpk_sub_C60B20B8+178↑j .text&ARM.extab:C52C630E D0 F8 98 01 LDR.W R0, [R0,#(off_C532DF58 - 0xC532DDC0)] .text&ARM.extab:C52C6312 00 21 MOVS R1, #0 .text&ARM.extab:C52C6314 20 4A LDR R2, =(T2_Check_frida_sub_C6087910+1 - 0xC52C6320) ; POP {R4-R7,PC} .text&ARM.extab:C52C6316 00 23 MOVS R3, #0 .text&ARM.extab:C52C6318 00 25 MOVS R5, #0 .text&ARM.extab:C52C631A 06 68 LDR R6, [R0] .text&ARM.extab:C52C631C 7A 44 ADD R2, PC ; T2_Check_frida_sub_C6087910 ; POP {R4-R7,PC} .text&ARM.extab:C52C631E 01 A8 ADD R0, SP, #0xA0+var_9C .text&ARM.extab:C52C6320 B0 47 BLX R6 ; pthread_create .text&ARM.extab:C52C6320 .text&ARM.extab:C52C6322 F8 E6 B loc_C52C6116
检测特征:
_ZN3art8Unpacker12dumpAllDexesEv
_ZN3art4Aupk13aupkArtMethodE
re.frida.server
/data/local/tmp/re.frida.server
检测调试器进程状态与调试端口
.text&ARM.extab:C52C42EC anitdbg1_sub_2F2EC .text&ARM.extab:C52C42EC .text&ARM.extab:C52C42EC var_120= -0x120 .text&ARM.extab:C52C42EC s= -0xA0 .text&ARM.extab:C52C42EC var_20= -0x20 .text&ARM.extab:C52C42EC .text&ARM.extab:C52C42EC ; __unwind { .text&ARM.extab:C52C42EC F0 B5 PUSH {R4-R7,LR} .text&ARM.extab:C52C42EE 03 AF ADD R7, SP, #0xC .text&ARM.extab:C52C42F0 2D E9 00 0F PUSH.W {R8-R11} .text&ARM.extab:C52C42F4 E1 B0 SUB SP, SP, #0x184 .text&ARM.extab:C52C42F6 7B 48 LDR R0, =(__stack_chk_guard_ptr - 0xC52C42FE) .text&ARM.extab:C52C42F8 80 21 MOVS R1, #0x80 .text&ARM.extab:C52C42FA 78 44 ADD R0, PC ; __stack_chk_guard_ptr .text&ARM.extab:C52C42FC 00 68 LDR R0, [R0] .text&ARM.extab:C52C42FE 00 68 LDR R0, [R0] .text&ARM.extab:C52C4300 60 90 STR R0, [SP,#0x1A0+var_20] .text&ARM.extab:C52C4302 40 A8 ADD R0, SP, #0x1A0+s .text&ARM.extab:C52C4304 E1 F7 66 EA BLX __aeabi_memclr8 .text&ARM.extab:C52C4304 .text&ARM.extab:C52C4308 20 A8 ADD R0, SP, #0x1A0+var_120 .text&ARM.extab:C52C430A 80 21 MOVS R1, #0x80 .text&ARM.extab:C52C430C E1 F7 62 EA BLX __aeabi_memclr8 .text&ARM.extab:C52C430C .text&ARM.extab:C52C4310 68 46 MOV R0, SP .text&ARM.extab:C52C4312 80 21 MOVS R1, #0x80 .text&ARM.extab:C52C4314 E1 F7 5E EA BLX __aeabi_memclr8 .text&ARM.extab:C52C4314 .text&ARM.extab:C52C4318 73 48 LDR R0, =(aProcSelfStatus - 0xC52C4326) ; "e\x02\x06T\x16w\x1B205o,9%.:9r" .text&ARM.extab:C52C431A 00 21 MOVS R1, #0 .text&ARM.extab:C52C431C 4F F4 80 72 MOV.W R2, #0x100 .text&ARM.extab:C52C4320 00 23 MOVS R3, #0 .text&ARM.extab:C52C4322 78 44 ADD R0, PC ; "e\x02\x06T\x16w\x1B205o,9%.:9r" .text&ARM.extab:C52C4324 80 B4 PUSH {R7} .text&ARM.extab:C52C4326 4F F0 05 07 MOV.W R7, #5 ; __NR_open .text&ARM.extab:C52C432A 00 DF SVC 0 .text&ARM.extab:C52C432C 80 BC POP {R7} .text&ARM.extab:C52C432E 04 46 MOV R4, R0 .text&ARM.extab:C52C4330 14 F5 80 5F CMN.W R4, #0x1000 .text&ARM.extab:C52C4334 31 D9 BLS loc_C52C439A .text&ARM.extab:C52C4334 .text&ARM.extab:C52C4336 74 48 LDR R0, =(x.174_ptr - 0xC52C433E) .text&ARM.extab:C52C4338 74 49 LDR R1, =(y.175_ptr - 0xC52C4340) .text&ARM.extab:C52C433A 78 44 ADD R0, PC ; x.174_ptr .text&ARM.extab:C52C433C 79 44 ADD R1, PC ; y.175_ptr .text&ARM.extab:C52C433E 00 68 LDR R0, [R0] ; x.174 .text&ARM.extab:C52C4340 09 68 LDR R1, [R1] ; y.175 .text&ARM.extab:C52C4342 00 68 LDR R0, [R0] .text&ARM.extab:C52C4344 09 68 LDR R1, [R1] .text&ARM.extab:C52C4346 46 1E SUBS R6, R0, #1 .text&ARM.extab:C52C4348 81 EA 00 02 EOR.W R2, R1, R0 .text&ARM.extab:C52C434C 70 43 MULS R0, R6 .text&ARM.extab:C52C434E A3 2A CMP R2, #0xA3 .text&ARM.extab:C52C4350 4F F0 00 02 MOV.W R2, #0 .text&ARM.extab:C52C4354 4F EA 41 06 MOV.W R6, R1,LSL#1 .text&ARM.extab:C52C4358 B8 BF IT LT .text&ARM.extab:C52C435A 01 22 MOVLT R2, #1 .text&ARM.extab:C52C435C B6 F5 A7 7F CMP.W R6, #0x14E .text&ARM.extab:C52C4360 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52C4364 C8 BF IT GT .text&ARM.extab:C52C4366 01 26 MOVGT R6, #1 .text&ARM.extab:C52C4368 09 29 CMP R1, #9 .text&ARM.extab:C52C436A C8 BF IT GT .text&ARM.extab:C52C436C 01 23 MOVGT R3, #1 .text&ARM.extab:C52C436E 00 F0 01 00 AND.W R0, R0, #1 .text&ARM.extab:C52C4372 86 EA 02 05 EOR.W R5, R6, R2 .text&ARM.extab:C52C4376 32 43 ORRS R2, R6 .text&ARM.extab:C52C4378 83 EA 00 01 EOR.W R1, R3, R0 .text&ARM.extab:C52C437C 18 43 ORRS R0, R3 .text&ARM.extab:C52C437E 82 F0 01 02 EOR.W R2, R2, #1 .text&ARM.extab:C52C4382 80 F0 01 00 EOR.W R0, R0, #1 .text&ARM.extab:C52C4386 2A 43 ORRS R2, R5 .text&ARM.extab:C52C4388 08 43 ORRS R0, R1 .text&ARM.extab:C52C438A 10 43 ORRS R0, R2 .text&ARM.extab:C52C438A .text&ARM.extab:C52C438C .text&ARM.extab:C52C438C loc_C52C438C ; CODE XREF: anitdbg1_sub_2F2EC+A2↓j .text&ARM.extab:C52C438C 01 28 CMP R0, #1 .text&ARM.extab:C52C438E FD D1 BNE loc_C52C438C .text&ARM.extab:C52C438E .text&ARM.extab:C52C4390 64 42 NEGS R4, R4 .text&ARM.extab:C52C4392 E1 F7 CE EA BLX __errno .text&ARM.extab:C52C4392 .text&ARM.extab:C52C4396 04 60 STR R4, [R0] .text&ARM.extab:C52C4398 81 E0 B loc_C52C449E .text&ARM.extab:C52C4398 .text&ARM.extab:C52C439A .text&ARM.extab:C52C439A loc_C52C439A ; CODE XREF: anitdbg1_sub_2F2EC+48↑j .text&ARM.extab:C52C439A 00 2C CMP R4, #0 .text&ARM.extab:C52C439C C0 F2 7F 80 BLT.W loc_C52C449E .text&ARM.extab:C52C439C .text&ARM.extab:C52C43A0 40 A9 ADD R1, SP, #0x1A0+s .text&ARM.extab:C52C43A2 20 46 MOV R0, R4 .text&ARM.extab:C52C43A4 80 22 MOVS R2, #0x80 .text&ARM.extab:C52C43A6 FF F7 A1 FA BL read_sub_C60848EC .text&ARM.extab:C52C43A6 .text&ARM.extab:C52C43AA 01 28 CMP R0, #1 .text&ARM.extab:C52C43AC 39 DB BLT loc_C52C4422 .text&ARM.extab:C52C43AC .text&ARM.extab:C52C43AE DF F8 3C 81 LDR.W R8, =(aPoqn1h - 0xC52C43C2) ; ":.POQN1h" .text&ARM.extab:C52C43B2 40 AE ADD R6, SP, #0x1A0+s .text&ARM.extab:C52C43B4 DF F8 38 91 LDR.W R9, =(byte_C532816A - 0xC52C43C8) .text&ARM.extab:C52C43B8 20 AD ADD R5, SP, #0x1A0+var_120 .text&ARM.extab:C52C43BA DF F8 38 A1 LDR.W R10, =(aPoqn1h - 0xC52C43CA) ; ":.POQN1h" .text&ARM.extab:C52C43BE F8 44 ADD R8, PC ; ":.POQN1h" .text&ARM.extab:C52C43C0 DF F8 34 B1 LDR.W R11, =(dword_C532816C+1 - 0xC52C43CC) .text&ARM.extab:C52C43C4 F9 44 ADD R9, PC ; byte_C532816A .text&ARM.extab:C52C43C6 FA 44 ADD R10, PC ; ":.POQN1h" .text&ARM.extab:C52C43C8 FB 44 ADD R11, PC ; dword_C532816C .text&ARM.extab:C52C43C8 .text&ARM.extab:C52C43CA .text&ARM.extab:C52C43CA loc_C52C43CA ; CODE XREF: anitdbg1_sub_2F2EC+134↓j .text&ARM.extab:C52C43CA 30 46 MOV R0, R6 ; s .text&ARM.extab:C52C43CC 41 46 MOV R1, R8 ; delim .text&ARM.extab:C52C43CE E1 F7 28 EB BLX strtok .text&ARM.extab:C52C43CE .text&ARM.extab:C52C43D2 02 46 MOV R2, R0 .text&ARM.extab:C52C43D4 00 2A CMP R2, #0 .text&ARM.extab:C52C43D6 15 D0 BEQ loc_C52C4404 .text&ARM.extab:C52C43D6 .text&ARM.extab:C52C43D8 28 46 MOV R0, R5 ; s .text&ARM.extab:C52C43DA 49 46 MOV R1, R9 ; format .text&ARM.extab:C52C43DC E1 F7 00 EA BLX sprintf .text&ARM.extab:C52C43DC .text&ARM.extab:C52C43E0 00 20 MOVS R0, #0 ; s .text&ARM.extab:C52C43E2 51 46 MOV R1, R10 ; delim .text&ARM.extab:C52C43E4 E1 F7 1C EB BLX strtok .text&ARM.extab:C52C43E4 .text&ARM.extab:C52C43E8 02 46 MOV R2, R0 .text&ARM.extab:C52C43EA 5A B1 CBZ R2, loc_C52C4404 .text&ARM.extab:C52C43EA .text&ARM.extab:C52C43EC 49 49 LDR R1, =(byte_C532816A - 0xC52C43F4) .text&ARM.extab:C52C43EE 68 46 MOV R0, SP ; s .text&ARM.extab:C52C43F0 79 44 ADD R1, PC ; byte_C532816A ; format .text&ARM.extab:C52C43F2 E1 F7 F6 E9 BLX sprintf .text&ARM.extab:C52C43F2 .text&ARM.extab:C52C43F6 28 46 MOV R0, R5 .text&ARM.extab:C52C43F8 59 46 MOV R1, R11 .text&ARM.extab:C52C43FA 80 22 MOVS R2, #0x80 .text&ARM.extab:C52C43FC 1C F0 60 FC BL sub_C52E0CC0 .text&ARM.extab:C52C43FC .text&ARM.extab:C52C4400 00 28 CMP R0, #0 .text&ARM.extab:C52C4402 5A D0 BEQ loc_C52C44BA .text&ARM.extab:C52C4402 .text&ARM.extab:C52C4404 .text&ARM.extab:C52C4404 loc_C52C4404 ; CODE XREF: anitdbg1_sub_2F2EC+EA↑j .text&ARM.extab:C52C4404 ; anitdbg1_sub_2F2EC+FE↑j .text&ARM.extab:C52C4404 30 46 MOV R0, R6 .text&ARM.extab:C52C4406 80 21 MOVS R1, #0x80 .text&ARM.extab:C52C4408 E1 F7 E4 E9 BLX __aeabi_memclr8 .text&ARM.extab:C52C4408 .text&ARM.extab:C52C440C 28 46 MOV R0, R5 .text&ARM.extab:C52C440E 80 21 MOVS R1, #0x80 .text&ARM.extab:C52C4410 E1 F7 E0 E9 BLX __aeabi_memclr8 .text&ARM.extab:C52C4410 .text&ARM.extab:C52C4414 20 46 MOV R0, R4 .text&ARM.extab:C52C4416 31 46 MOV R1, R6 .text&ARM.extab:C52C4418 80 22 MOVS R2, #0x80 .text&ARM.extab:C52C441A FF F7 67 FA BL read_sub_C60848EC .text&ARM.extab:C52C441A .text&ARM.extab:C52C441E 00 28 CMP R0, #0 .text&ARM.extab:C52C4420 D3 DC BGT loc_C52C43CA .text&ARM.extab:C52C4420 .text&ARM.extab:C52C4422 .text&ARM.extab:C52C4422 loc_C52C4422 ; CODE XREF: anitdbg1_sub_2F2EC+C0↑j .text&ARM.extab:C52C4422 00 25 MOVS R5, #0 .text&ARM.extab:C52C4422 .text&ARM.extab:C52C4424 .text&ARM.extab:C52C4424 loc_C52C4424 ; CODE XREF: anitdbg1_sub_2F2EC+1D6↓j .text&ARM.extab:C52C4424 01 2C CMP R4, #1 .text&ARM.extab:C52C4426 A4 BF ITT GE .text&ARM.extab:C52C4428 20 46 MOVGE R0, R4 .text&ARM.extab:C52C442A FF F7 23 FB BLGE close_sub_C6084A74 .text&ARM.extab:C52C442A .text&ARM.extab:C52C442E 01 2D CMP R5, #1 .text&ARM.extab:C52C4430 52 DB BLT loc_C52C44D8 .text&ARM.extab:C52C4430 .text&ARM.extab:C52C4432 32 48 LDR R0, =(off_C5325018 - 0xC52C4438) .text&ARM.extab:C52C4434 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52C4436 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52C4438 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52C443A D0 F8 94 01 LDR.W R0, [R0,#(dword_C532DF54 - 0xC532DDC0)] .text&ARM.extab:C52C443E A8 42 CMP R0, R5 .text&ARM.extab:C52C4440 48 D0 BEQ loc_C52C44D4 .text&ARM.extab:C52C4440 .text&ARM.extab:C52C4442 80 B4 PUSH {R7} .text&ARM.extab:C52C4444 4F F0 14 07 MOV.W R7, #0x14 .text&ARM.extab:C52C4448 00 DF SVC 0 .text&ARM.extab:C52C444A 80 BC POP {R7} .text&ARM.extab:C52C444C 4F F2 00 08 CF F6 FF 78 MOV R8, #0xFFFFF000 .text&ARM.extab:C52C4454 04 46 MOV R4, R0 .text&ARM.extab:C52C4456 44 45 CMP R4, R8 .text&ARM.extab:C52C4458 05 D9 BLS loc_C52C4466 .text&ARM.extab:C52C4458
过反调试的方法就是直接path返回。
4.4、解密指令资源
读取ijiami.ajm
.text&ARM.extab:C52B9E3C Read_ijiami.ajm_sub_C2167E3C .text&ARM.extab:C52B9E3C .text&ARM.extab:C52B9E3C var_128= -0x128 .text&ARM.extab:C52B9E3C var_120= -0x120 .text&ARM.extab:C52B9E3C var_1C= -0x1C .text&ARM.extab:C52B9E3C .text&ARM.extab:C52B9E3C ; __unwind { .text&ARM.extab:C52B9E3C F0 B5 PUSH {R4-R7,LR} .text&ARM.extab:C52B9E3E 03 AF ADD R7, SP, #0xC .text&ARM.extab:C52B9E40 2D E9 00 0B PUSH.W {R8,R9,R11} .text&ARM.extab:C52B9E44 C4 B0 SUB SP, SP, #0x110 .text&ARM.extab:C52B9E46 81 46 MOV R9, R0 .text&ARM.extab:C52B9E48 1D 48 LDR R0, =(__stack_chk_guard_ptr - 0xC52B9E52) .text&ARM.extab:C52B9E4A 02 AC ADD R4, SP, #0x128+var_120 .text&ARM.extab:C52B9E4C 0E 46 MOV R6, R1 .text&ARM.extab:C52B9E4E 78 44 ADD R0, PC ; __stack_chk_guard_ptr .text&ARM.extab:C52B9E50 4F F4 80 71 MOV.W R1, #0x100 .text&ARM.extab:C52B9E54 90 46 MOV R8, R2 .text&ARM.extab:C52B9E56 00 68 LDR R0, [R0] .text&ARM.extab:C52B9E58 00 68 LDR R0, [R0] .text&ARM.extab:C52B9E5A 43 90 STR R0, [SP,#0x128+var_1C] .text&ARM.extab:C52B9E5C 20 46 MOV R0, R4 .text&ARM.extab:C52B9E5E EB F7 BA EC BLX __aeabi_memclr8 .text&ARM.extab:C52B9E5E .text&ARM.extab:C52B9E62 18 48 LDR R0, =(off_C5325018 - 0xC52B9E6A) .text&ARM.extab:C52B9E64 18 49 LDR R1, =(dword_C5326A88 - 0xC52B9E6C) .text&ARM.extab:C52B9E66 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52B9E68 79 44 ADD R1, PC ; dword_C5326A88 ; format .text&ARM.extab:C52B9E6A 05 68 LDR R5, [R0] ; off_C5326004 .text&ARM.extab:C52B9E6C 28 68 LDR R0, [R5] ; off_C532DDC0 .text&ARM.extab:C52B9E6E D0 F8 74 01 LDR.W R0, [R0,#(off_C532DF34 - 0xC532DDC0)] .text&ARM.extab:C52B9E72 82 69 LDR R2, [R0,#0x18] .text&ARM.extab:C52B9E74 20 46 MOV R0, R4 ; s .text&ARM.extab:C52B9E76 EB F7 B4 EC BLX sprintf .text&ARM.extab:C52B9E76 .text&ARM.extab:C52B9E7A 2A 68 LDR R2, [R5] ; off_C532DDC0 .text&ARM.extab:C52B9E7C 92 F8 FE 00 LDRB.W R0, [R2,#(dword_C532DEBC+2 - 0xC532DDC0)] .text&ARM.extab:C52B9E80 30 B1 CBZ R0, loc_C52B9E90 .text&ARM.extab:C52B9E80 .text&ARM.extab:C52B9E82 02 A9 ADD R1, SP, #0x128+var_120 .text&ARM.extab:C52B9E84 48 46 MOV R0, R9 .text&ARM.extab:C52B9E86 32 46 MOV R2, R6 .text&ARM.extab:C52B9E88 43 46 MOV R3, R8 .text&ARM.extab:C52B9E8A 00 F0 21 F8 BL read_apk_sub_C6083ED0 .text&ARM.extab:C52B9E8A .text&ARM.extab:C52B9E8E 0A E0 B loc_C52B9EA6 .text&ARM.extab:C52B9E8E .text&ARM.extab:C52B9E90 .text&ARM.extab:C52B9E90 loc_C52B9E90 .text&ARM.extab:C52B9E90 90 68 LDR R0, [R2,#(off_C532DDC8 - 0xC532DDC0)] .text&ARM.extab:C52B9E92 D2 F8 94 10 LDR.W R1, [R2,#(dword_C532DE54 - 0xC532DDC0)] .text&ARM.extab:C52B9E96 D2 F8 74 21 LDR.W R2, [R2,#(off_C532DF34 - 0xC532DDC0)] .text&ARM.extab:C52B9E9A 93 69 LDR R3, [R2,#0x18] .text&ARM.extab:C52B9E9C 4A 46 MOV R2, R9 .text&ARM.extab:C52B9E9E CD E9 00 68 STRD.W R6, R8, [SP,#0x128+var_128] .text&ARM.extab:C52B9EA2 00 F0 89 F9 BL AAssetManager_read_sub_C52BA1B8 .text&ARM.extab:C52B9EA2 .text&ARM.extab:C52B9EA6 .text&ARM.extab:C52B9EA6 loc_C52B9EA6 .text&ARM.extab:C52B9EA6 09 49 LDR R1, =(__stack_chk_guard_ptr - 0xC52B9EAE) .text&ARM.extab:C52B9EA8 43 9A LDR R2, [SP,#0x128+var_1C] .text&ARM.extab:C52B9EAA 79 44 ADD R1, PC ; __stack_chk_guard_ptr .text&ARM.extab:C52B9EAC 09 68 LDR R1, [R1] .text&ARM.extab:C52B9EAE 09 68 LDR R1, [R1] .text&ARM.extab:C52B9EB0 89 1A SUBS R1, R1, R2 .text&ARM.extab:C52B9EB2 02 BF ITTT EQ .text&ARM.extab:C52B9EB4 44 B0 ADDEQ SP, SP, #0x110 .text&ARM.extab:C52B9EB6 BD E8 00 0B POPEQ.W {R8,R9,R11} .text&ARM.extab:C52B9EBA F0 BD POPEQ {R4-R7,PC}
解密解析指令
.text&ARM.extab:C52E924E 09 9D LDR R5, [SP,#0x48+ptr] .text&ARM.extab:C52E9250 4F F4 80 62 MOV.W R2, #0x400 .text&ARM.extab:C52E9254 05 F1 18 09 ADD.W R9, R5, #0x18 .text&ARM.extab:C52E9258 D5 E9 04 16 LDRD.W R1, R6, [R5,#0x10] .text&ARM.extab:C52E925C 48 46 MOV R0, R9 .text&ARM.extab:C52E925E 00 F0 E5 F8 BL Dec_ijiami.ajm_sub_C219742C ;解密数据 .text&ARM.extab:C52E925E .text&ARM.extab:C52E9262 06 F1 18 00 ADD.W R0, R6, #0x18 .text&ARM.extab:C52E9266 4F F4 80 51 MOV.W R1, #0x1000 .text&ARM.extab:C52E926A F7 F7 C9 FD BL getsize_sub_C218EE00 .text&ARM.extab:C52E926A .text&ARM.extab:C52E926E 01 46 MOV R1, R0 ; len .text&ARM.extab:C52E9270 00 20 MOVS R0, #0 .text&ARM.extab:C52E9272 CD E9 00 40 STRD.W R4, R0, [SP,#0x48+fd] ; fd .text&ARM.extab:C52E9276 00 20 MOVS R0, #0 ; addr .text&ARM.extab:C52E9278 03 22 MOVS R2, #3 ; prot .text&ARM.extab:C52E927A 21 23 MOVS R3, #0x21 ; '!' ; flags .text&ARM.extab:C52E927C BC F7 9A EB BLX mmap .text&ARM.extab:C52E927C .text&ARM.extab:C52E9280 07 96 STR R6, [SP,#0x48+var_2C] .text&ARM.extab:C52E9282 80 46 MOV R8, R0 .text&ARM.extab:C52E9284 2B 69 LDR R3, [R5,#0x10] .text&ARM.extab:C52E9286 08 F1 18 00 ADD.W R0, R8, #0x18 .text&ARM.extab:C52E928A 07 A9 ADD R1, SP, #0x48+var_2C .text&ARM.extab:C52E928C 4A 46 MOV R2, R9 .text&ARM.extab:C52E928E 05 F0 7C EF BLX Dec_Parse_sub_C219D188 ; 解析解密后的指令格式，R0:返回地址，R2:解密后的数据,R3:解密后数据大小 .text&ARM.extab:C52E928E .text&ARM.extab:C52E9292 00 28 CMP R0, #0 .text&ARM.extab:C52E9294 40 F0 A2 80 BNE.W loc_C52E93DC .text&ARM.extab:C52E9294 .text&ARM.extab:C52E9298 09 9C LDR R4, [SP,#0x48+ptr] .text&ARM.extab:C52E929A 40 46 MOV R0, R8 .text&ARM.extab:C52E929C 18 22 MOVS R2, #0x18 .text&ARM.extab:C52E929E 21 46 MOV R1, R4 .text&ARM.extab:C52E92A0 BC F7 94 EB BLX __aeabi_memcpy .text&ARM.extab:C52E92A0 .text&ARM.extab:C52E92A4 24 B1 CBZ R4, loc_C52E92B0 .text&ARM.extab:C52E92A4 .text&ARM.extab:C52E92A6 20 46 MOV R0, R4 ; ptr .text&ARM.extab:C52E92A8 BC F7 A6 EA BLX free .text&ARM.extab:C52E92A8 .text&ARM.extab:C52E92AC 00 20 MOVS R0, #0 .text&ARM.extab:C52E92AE 09 90 STR R0, [SP,#0x48+ptr] .text&ARM.extab:C52E92AE .text&ARM.extab:C52E92B0 .text&ARM.extab:C52E92B0 loc_C52E92B0 .text&ARM.extab:C52E92B0 D8 F8 0C 00 LDR.W R0, [R8,#0xC] .text&ARM.extab:C52E92B4 00 24 MOVS R4, #0 .text&ARM.extab:C52E92B6 00 28 CMP R0, #0 .text&ARM.extab:C52E92B8 00 F0 90 80 BEQ.W loc_C52E93DC .text&ARM.extab:C52E92B8 .text&ARM.extab:C52E92BC 51 48 LDR R0, =(x.49_ptr - 0xC52E92C6) .text&ARM.extab:C52E92BE D8 F8 08 A0 LDR.W R10, [R8,#8] .text&ARM.extab:C52E92C2 78 44 ADD R0, PC ; x.49_ptr .text&ARM.extab:C52E92C4 00 68 LDR R0, [R0] ; x.49 .text&ARM.extab:C52E92C6 06 90 STR R0, [SP,#0x48+var_30] .text&ARM.extab:C52E92C8 4F 48 LDR R0, =(y.50_ptr - 0xC52E92CE) .text&ARM.extab:C52E92CA 78 44 ADD R0, PC ; y.50_ptr .text&ARM.extab:C52E92CC 00 68 LDR R0, [R0] ; y.50 .text&ARM.extab:C52E92CE 05 90 STR R0, [SP,#0x48+var_34] .text&ARM.extab:C52E92D0 4E 48 LDR R0, =(off_C5325018 - 0xC52E92D6) .text&ARM.extab:C52E92D2 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52E92D4 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52E92D6 04 90 STR R0, [SP,#0x48+var_38] .text&ARM.extab:C52E92D8 4D 48 LDR R0, =(off_C5325018 - 0xC52E92DE) .text&ARM.extab:C52E92DA 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52E92DC D0 F8 00 B0 LDR.W R11, [R0] ; off_C5326004 .text&ARM.extab:C52E92E0 4C 48 LDR R0, =(off_C5325018 - 0xC52E92E6) .text&ARM.extab:C52E92E2 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52E92E4 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52E92E6 03 90 STR R0, [SP,#0x48+var_3C] .text&ARM.extab:C52E92E6 .text&ARM.extab:C52E92E8 .text&ARM.extab:C52E92E8 loc_C52E92E8 .text&ARM.extab:C52E92E8 06 98 LDR R0, [SP,#0x48+var_30] .text&ARM.extab:C52E92EA 00 26 MOVS R6, #0 .text&ARM.extab:C52E92EC 00 68 LDR R0, [R0] .text&ARM.extab:C52E92EE 41 1E SUBS R1, R0, #1 .text&ARM.extab:C52E92F0 01 FB 00 F2 MUL.W R2, R1, R0 .text&ARM.extab:C52E92F4 05 99 LDR R1, [SP,#0x48+var_34] .text&ARM.extab:C52E92F6 09 68 LDR R1, [R1] .text&ARM.extab:C52E92F8 09 29 CMP R1, #9 .text&ARM.extab:C52E92FA 02 F0 01 03 AND.W R3, R2, #1 .text&ARM.extab:C52E92FE C8 BF IT GT .text&ARM.extab:C52E9300 01 26 MOVGT R6, #1 .text&ARM.extab:C52E9302 8D 00 LSLS R5, R1, #2 .text&ARM.extab:C52E9304 86 EA 03 02 EOR.W R2, R6, R3 .text&ARM.extab:C52E9308 1E 43 ORRS R6, R3 .text&ARM.extab:C52E930A 86 F0 01 06 EOR.W R6, R6, #1 .text&ARM.extab:C52E930E 16 43 ORRS R6, R2 .text&ARM.extab:C52E9310 81 EA 00 02 EOR.W R2, R1, R0 .text&ARM.extab:C52E9314 8A 2A CMP R2, #0x8A .text&ARM.extab:C52E9316 4F F0 00 00 MOV.W R0, #0 .text&ARM.extab:C52E931A C8 BF IT GT .text&ARM.extab:C52E931C 01 20 MOVGT R0, #1 .text&ARM.extab:C52E931E B5 F5 F8 7F CMP.W R5, #0x1F0 .text&ARM.extab:C52E9322 4F F0 00 05 MOV.W R5, #0 .text&ARM.extab:C52E9326 B8 BF IT LT .text&ARM.extab:C52E9328 01 25 MOVLT R5, #1 .text&ARM.extab:C52E932A 5A F8 08 90 LDR.W R9, [R10,R8] .text&ARM.extab:C52E932E 28 43 ORRS R0, R5 .text&ARM.extab:C52E9330 30 43 ORRS R0, R6 .text&ARM.extab:C52E9332 0A EB 08 06 ADD.W R6, R10, R8 .text&ARM.extab:C52E9332 .text&ARM.extab:C52E9336 .text&ARM.extab:C52E9336 loc_C52E9336 ; CODE XREF: Read_ijiami.ajm_sub_C2197218+120↓j .text&ARM.extab:C52E9336 01 28 CMP R0, #1 .text&ARM.extab:C52E9338 FD D1 BNE loc_C52E9336 .text&ARM.extab:C52E9338 .text&ARM.extab:C52E933A 38 48 LDR R0, =(dword_C532E200 - 0xC52E9340) .text&ARM.extab:C52E933C 78 44 ADD R0, PC ; dword_C532E200 .text&ARM.extab:C52E933E 00 68 LDR R0, [R0] .text&ARM.extab:C52E9340 38 BB CBNZ R0, loc_C52E9392 .text&ARM.extab:C52E9340 .text&ARM.extab:C52E9342 00 2B CMP R3, #0 .text&ARM.extab:C52E9344 4F F0 00 00 MOV.W R0, #0 .text&ARM.extab:C52E9348 08 BF IT EQ .text&ARM.extab:C52E934A 01 20 MOVEQ R0, #1 .text&ARM.extab:C52E934C 0A 29 CMP R1, #0xA .text&ARM.extab:C52E934E 4F F0 00 03 MOV.W R3, #0 .text&ARM.extab:C52E9352 4F EA C1 01 MOV.W R1, R1,LSL#3 .text&ARM.extab:C52E9356 B8 BF IT LT .text&ARM.extab:C52E9358 01 23 MOVLT R3, #1 .text&ARM.extab:C52E935A 10 2A CMP R2, #0x10 .text&ARM.extab:C52E935C 4F F0 00 02 MOV.W R2, #0 .text&ARM.extab:C52E9360 40 EA 03 00 ORR.W R0, R0, R3 .text&ARM.extab:C52E9364 C8 BF IT GT .text&ARM.extab:C52E9366 01 22 MOVGT R2, #1 .text&ARM.extab:C52E9368 70 29 CMP R1, #0x70 ; 'p' .text&ARM.extab:C52E936A 4F F0 00 01 MOV.W R1, #0 .text&ARM.extab:C52E936E B8 BF IT LT .text&ARM.extab:C52E9370 01 21 MOVLT R1, #1 .text&ARM.extab:C52E9372 11 43 ORRS R1, R2 .text&ARM.extab:C52E9374 08 43 ORRS R0, R1 .text&ARM.extab:C52E9374 .text&ARM.extab:C52E9376 .text&ARM.extab:C52E9376 loc_C52E9376 ; CODE XREF: Read_ijiami.ajm_sub_C2197218+160↓j .text&ARM.extab:C52E9376 01 28 CMP R0, #1 .text&ARM.extab:C52E9378 FD D1 BNE loc_C52E9376 .text&ARM.extab:C52E9378 .text&ARM.extab:C52E937A 04 98 LDR R0, [SP,#0x48+var_38] .text&ARM.extab:C52E937C 00 21 MOVS R1, #0 ; char ** .text&ARM.extab:C52E937E 10 22 MOVS R2, #0x10 ; int .text&ARM.extab:C52E9380 00 68 LDR R0, [R0] .text&ARM.extab:C52E9382 D0 F8 B4 00 LDR.W R0, [R0,#0xB4] .text&ARM.extab:C52E9386 1C 30 ADDS R0, #0x1C ; char * .text&ARM.extab:C52E9388 BC F7 CA EC BLX strtol .text&ARM.extab:C52E9388 .text&ARM.extab:C52E938C 24 49 LDR R1, =(dword_C532E200 - 0xC52E9392) .text&ARM.extab:C52E938E 79 44 ADD R1, PC ; dword_C532E200 .text&ARM.extab:C52E9390 08 60 STR R0, [R1] .text&ARM.extab:C52E9390 .text&ARM.extab:C52E9392 .text&ARM.extab:C52E9392 loc_C52E9392 ; CODE XREF: Read_ijiami.ajm_sub_C2197218+128↑j .text&ARM.extab:C52E9392 A9 EB 00 01 SUB.W R1, R9, R0 .text&ARM.extab:C52E9396 31 60 STR R1, [R6] .text&ARM.extab:C52E9398 DB F8 00 00 LDR.W R0, [R11] ; off_C532DDC0 .text&ARM.extab:C52E939C C2 6B LDR R2, [R0,#(off_C532DDFC - 0xC532DDC0)] ; off_C5326420 .text&ARM.extab:C52E939E 21 48 LDR R0, =(dword_C532E200 - 0xC52E93A4) .text&ARM.extab:C52E93A0 78 44 ADD R0, PC ; dword_C532E200 .text&ARM.extab:C52E93A2 12 69 LDR R2, [R2,#0x10] ; getDecCode_sub_C20E39D2 ; R0:解密指令解析格式后地址指针,R1:Debug info .text&ARM.extab:C52E93A4 C0 68 LDR R0, [R0,#(dword_C532E20C - 0xC532E200)] .text&ARM.extab:C52E93A6 90 47 BLX R2 ; getDecCode_sub_C20E39D2 ; R0:解密指令解析格式后地址指针,R1:Debug info .text&ARM.extab:C52E93A6 .text&ARM.extab:C52E93A8 68 B9 CBNZ R0, loc_C52E93C6 .text&ARM.extab:C52E93A8 .text&ARM.extab:C52E93AA 03 98 LDR R0, [SP,#0x48+var_3C] .text&ARM.extab:C52E93AC 31 68 LDR R1, [R6] .text&ARM.extab:C52E93AE 00 68 LDR R0, [R0] .text&ARM.extab:C52E93B0 C2 6B LDR R2, [R0,#0x3C] .text&ARM.extab:C52E93B2 1D 48 LDR R0, =(dword_C532E200 - 0xC52E93B8) .text&ARM.extab:C52E93B4 78 44 ADD R0, PC ; dword_C532E200 .text&ARM.extab:C52E93B6 D3 68 LDR R3, [R2,#0xC] .text&ARM.extab:C52E93B8 32 46 MOV R2, R6 .text&ARM.extab:C52E93BA C0 68 LDR R0, [R0,#(dword_C532E20C - 0xC532E200)] .text&ARM.extab:C52E93BC 98 47 BLX R3 .text&ARM.extab:C52E93BC .text&ARM.extab:C52E93BE B0 68 LDR R0, [R6,#8] .text&ARM.extab:C52E93C0 50 44 ADD R0, R10 .text&ARM.extab:C52E93C2 00 F1 0C 0A ADD.W R10, R0, #0xC .text&ARM.extab:C52E93C2 .text&ARM.extab:C52E93C6 .text&ARM.extab:C52E93C6 loc_C52E93C6 .text&ARM.extab:C52E93C6 D8 F8 0C 00 LDR.W R0, [R8,#0xC] .text&ARM.extab:C52E93CA 01 34 ADDS R4, #1 .text&ARM.extab:C52E93CC 84 42 CMP R4, R0 .text&ARM.extab:C52E93CE 8B D3 BCC loc_C52E92E8 .text&ARM.extab:C52E93CE .text&ARM.extab:C52E93D0 09 98 LDR R0, [SP,#0x48+ptr] ; ptr .text&ARM.extab:C52E93D2 00 28 CMP R0, #0 .text&ARM.extab:C52E93D4 18 BF IT NE .text&ARM.extab:C52E93D6 BC F7 10 EA BLXNE free .text&ARM.extab:C52E93D6
4.5、hook关键方法
hook类加载方法
art::ClassLinker::LoadMethod art::DexFileVerifier::Verify .text&ARM.extab:C52BE1A8 loc_C52BE1A8 .text&ARM.extab:C52BE1A8 01 28 CMP R0, #1 .text&ARM.extab:C52BE1AA FD D1 BNE loc_C52BE1A8 .text&ARM.extab:C52BE1AA .text&ARM.extab:C52BE1AC 2A 48 LDR R0, =(off_C5325018 - 0xC52BE1B2) .text&ARM.extab:C52BE1AE 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52BE1B0 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52BE1B2 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52BE1B4 90 F8 70 10 LDRB.W R1, [R0,#(dword_C532DE30 - 0xC532DDC0)] .text&ARM.extab:C52BE1B8 A1 B1 CBZ R1, loc_C52BE1E4 .text&ARM.extab:C52BE1B8 .text&ARM.extab:C52BE1BA 28 48 LDR R0, =(aDexlibaocSo+3 - 0xC52BE1C2) ; "\x1D1:2*0v\x1E\x1A2" .text&ARM.extab:C52BE1BC 00 21 MOVS R1, #0 ; mode .text&ARM.extab:C52BE1BE 78 44 ADD R0, PC ; "\x1D1:2*0v\x1E\x1A2" ; file .text&ARM.extab:C52BE1C0 E7 F7 32 EB BLX dlopen ; dexlibaoc.so .text&ARM.extab:C52BE1C0 .text&ARM.extab:C52BE1C4 58 B1 CBZ R0, Hook_Func_LoadMethod_loc_C60B21DE .text&ARM.extab:C52BE1C4 .text&ARM.extab:C52BE1C6 E7 F7 DA EC BLX dlclose .text&ARM.extab:C52BE1C6 .text&ARM.extab:C52BE1CA 25 48 LDR R0, =(off_C5325018 - 0xC52BE1D0) .text&ARM.extab:C52BE1CC 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52BE1CE 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52BE1D0 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52BE1D2 40 6F LDR R0, [R0,#(dword_C532DE34 - 0xC532DDC0)] .text&ARM.extab:C52BE1D4 16 28 CMP R0, #0x16 .text&ARM.extab:C52BE1D6 02 DC BGT Hook_Func_LoadMethod_loc_C60B21DE .text&ARM.extab:C52BE1D6 .text&ARM.extab:C52BE1D8 01 F0 5E F9 BL sub_C52BF498 .text&ARM.extab:C52BE1D8 .text&ARM.extab:C52BE1DC 2E E0 B loc_C52BE23C .text&ARM.extab:C52BE1DE .text&ARM.extab:C52BE1DE Hook_Func_LoadMethod_loc_C60B21DE .text&ARM.extab:C52BE1DE FD F7 39 F9 BL Hook_Func_LoadMethod_sub_C60AF454 ;hook类加载方法 .text&ARM.extab:C52BE1DE .text&ARM.extab:C52BE1E2 2B E0 B loc_C52BE23C .text&ARM.extab:C52BE1E2 .text&ARM.extab:C52BE1E4 .text&ARM.extab:C52BE1E4 loc_C52BE1E4 .text&ARM.extab:C52BE1E4 80 6F LDR R0, [R0,#(off_C532DE38 - 0xC532DDC0)] ; sub_C52A9400 .text&ARM.extab:C52BE1E6 80 47 BLX R0 ; dword_C5295000 .text&ARM.extab:C52BE1E6 .text&ARM.extab:C52BE1E8 30 B3 CBZ R0, loc_C52BE238 .text&ARM.extab:C52BE1E8 .text&ARM.extab:C52BE1EA 1E 48 LDR R0, =(off_C5325018 - 0xC52BE1F2) .text&ARM.extab:C52BE1EC 1E 4E LDR R6, =(dword_C5327B64 - 0xC52BE1F8) .text&ARM.extab:C52BE1EE 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52BE1F0 1E 49 LDR R1, =(dword_C5327B74+2 - 0xC52BE1FC) .text&ARM.extab:C52BE1F2 1F 4A LDR R2, =(sub_C52BE944+1 - 0xC52BE200) .text&ARM.extab:C52BE1F4 7E 44 ADD R6, PC ; dword_C5327B64 .text&ARM.extab:C52BE1F6 05 68 LDR R5, [R0] ; off_C5326004 .text&ARM.extab:C52BE1F8 79 44 ADD R1, PC ; dword_C5327B74 .text&ARM.extab:C52BE1FA 1E 4B LDR R3, =(off_C532DFEC - 0xC52BE204) .text&ARM.extab:C52BE1FC 7A 44 ADD R2, PC ; sub_C52BE944 .text&ARM.extab:C52BE1FE 28 68 LDR R0, [R5] ; off_C532DDC0 .text&ARM.extab:C52BE200 7B 44 ADD R3, PC ; off_C532DFEC .text&ARM.extab:C52BE202 00 68 LDR R0, [R0] ; off_C5326504 .text&ARM.extab:C52BE204 04 68 LDR R4, [R0] ; hook_func_sub_C609ABB8 .text&ARM.extab:C52BE206 30 46 MOV R0, R6 .text&ARM.extab:C52BE208 A0 47 BLX R4 ; hook_func_sub_C609ABB8 .text&ARM.extab:C52BE208 .text&ARM.extab:C52BE20A 28 68 LDR R0, [R5] ; off_C532DDC0 .text&ARM.extab:C52BE20C 1A 49 LDR R1, =(dword_C5327B98 - 0xC52BE216) .text&ARM.extab:C52BE20E 1B 4A LDR R2, =(sub_C52BE9A4+1 - 0xC52BE21A) .text&ARM.extab:C52BE210 00 68 LDR R0, [R0] ; off_C5326504 .text&ARM.extab:C52BE212 79 44 ADD R1, PC ; dword_C5327B98 .text&ARM.extab:C52BE214 1A 4B LDR R3, =(off_C532DFF0 - 0xC52BE21E) .text&ARM.extab:C52BE216 7A 44 ADD R2, PC ; sub_C52BE9A4 .text&ARM.extab:C52BE218 04 68 LDR R4, [R0] ; hook_func_sub_C609ABB8 .text&ARM.extab:C52BE21A 7B 44 ADD R3, PC ; off_C532DFF0 .text&ARM.extab:C52BE21C 30 46 MOV R0, R6 .text&ARM.extab:C52BE21E A0 47 BLX R4 ; hook_func_sub_C609ABB8 .text&ARM.extab:C52BE21E .text&ARM.extab:C52BE220 28 68 LDR R0, [R5] ; off_C532DDC0 .text&ARM.extab:C52BE222 18 49 LDR R1, =(dword_C5327BA4+3 - 0xC52BE22C) .text&ARM.extab:C52BE224 18 4A LDR R2, =(sub_C52BE9C0+1 - 0xC52BE230) .text&ARM.extab:C52BE226 00 68 LDR R0, [R0] ; off_C5326504 .text&ARM.extab:C52BE228 79 44 ADD R1, PC ; dword_C5327BA4 .text&ARM.extab:C52BE22A 18 4B LDR R3, =(off_C532DFF4 - 0xC52BE234) .text&ARM.extab:C52BE22C 7A 44 ADD R2, PC ; sub_C52BE9C0 .text&ARM.extab:C52BE22E 05 68 LDR R5, [R0] ; hook_func_sub_C609ABB8 .text&ARM.extab:C52BE230 7B 44 ADD R3, PC ; off_C532DFF4 .text&ARM.extab:C52BE232 30 46 MOV R0, R6 .text&ARM.extab:C52BE234 A8 47 BLX R5 ; hook_func_sub_C609ABB8 .text&ARM.extab:C52BE234 .text&ARM.extab:C52BE236 01 E0 B loc_C52BE23C .text&ARM.extab:C52BE236 .text&ARM.extab:C52BE238 .text&ARM.extab:C52BE238 loc_C52BE238 .text&ARM.extab:C52BE238 FC F7 5E FE BL sub_C52BAEF8 .text&ARM.extab:C52BE238 .text&ARM.extab:C52BE23C .text&ARM.extab:C52BE23C loc_C52BE23C ; CODE XREF: init_proc_sub_C608813C+10↑j .text&ARM.extab:C52BE23C ; init_proc_sub_C608813C+A0↑j .text&ARM.extab:C52BE23C ; init_proc_sub_C608813C+A6↑j .text&ARM.extab:C52BE23C ; init_proc_sub_C608813C+FA↑j .text&ARM.extab:C52BE23C 00 20 MOVS R0, #0 .text&ARM.extab:C52BE23E 5D F8 04 BB POP.W {R11} .text&ARM.extab:C52BE242 F0 BD POP {R4-R7,PC}
4.6、读取DEX资源文件解密并加载DEX
读取ijiami.dat并解密出dex
.text&ARM.extab:C52DA440 read_ijiami.dat_sub_C60CE440 .text&ARM.extab:C52DA440 .text&ARM.extab:C52DA440 .text&ARM.extab:C52DA440 ; __unwind { .text&ARM.extab:C52DA440 F0 B5 PUSH {R4-R7,LR} .text&ARM.extab:C52DA442 03 AF ADD R7, SP, #0xC .text&ARM.extab:C52DA444 2D E9 00 0F PUSH.W {R8-R11} .text&ARM.extab:C52DA448 AD F5 0B 7D SUB.W SP, SP, #0x22C .text&ARM.extab:C52DA44C B0 48 LDR R0, =(__stack_chk_guard_ptr - 0xC52DA458) .text&ARM.extab:C52DA44E 0A AC ADD R4, SP, #0x248+var_220 .text&ARM.extab:C52DA450 4F F4 00 71 MOV.W R1, #0x200 .text&ARM.extab:C52DA454 78 44 ADD R0, PC ; __stack_chk_guard_ptr .text&ARM.extab:C52DA456 00 68 LDR R0, [R0] .text&ARM.extab:C52DA458 00 68 LDR R0, [R0] .text&ARM.extab:C52DA45A 8A 90 STR R0, [SP,#0x248+var_20] .text&ARM.extab:C52DA45C 00 20 MOVS R0, #0 .text&ARM.extab:C52DA45E 07 90 STR R0, [SP,#0x248+var_22C] .text&ARM.extab:C52DA460 20 46 MOV R0, R4 .text&ARM.extab:C52DA462 CB F7 B8 E9 BLX __aeabi_memclr8 .text&ARM.extab:C52DA462 .text&ARM.extab:C52DA466 AB 48 LDR R0, =(off_C5325018 - 0xC52DA46E) .text&ARM.extab:C52DA468 AB 49 LDR R1, =(dword_C532B01C+2 - 0xC52DA470) .text&ARM.extab:C52DA46A 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52DA46C 79 44 ADD R1, PC ; dword_C532B01C ; format .text&ARM.extab:C52DA46E 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52DA470 00 68 LDR R0, [R0] ; off_C532DDC0 .text&ARM.extab:C52DA472 D0 F8 80 20 LDR.W R2, [R0,#(dword_C532DE40 - 0xC532DDC0)] .text&ARM.extab:C52DA476 D0 F8 B4 00 LDR.W R0, [R0,#(off_C532DE74 - 0xC532DDC0)] .text&ARM.extab:C52DA47A 00 F1 10 03 ADD.W R3, R0, #0x10 .text&ARM.extab:C52DA47E 20 46 MOV R0, R4 ; s .text&ARM.extab:C52DA480 CB F7 AE E9 BLX sprintf .text&ARM.extab:C52DA480 .text&ARM.extab:C52DA484 08 A9 ADD R1, SP, #0x248+var_228 .text&ARM.extab:C52DA486 09 AA ADD R2, SP, #0x248+var_224 .text&ARM.extab:C52DA488 07 AB ADD R3, SP, #0x248+var_22C .text&ARM.extab:C52DA48A 20 46 MOV R0, R4 .text&ARM.extab:C52DA48C 00 F0 58 F9 BL read_ijiami.dat_sub_C60CE740 .text&ARM.extab:C52DA48C .text&ARM.extab:C52DA490 00 28 CMP R0, #0 .text&ARM.extab:C52DA492 00 F0 08 81 BEQ.W loc_C52DA6A6 .text&ARM.extab:C52DA492 .text&ARM.extab:C52DA496 DD F8 24 80 LDR.W R8, [SP,#0x248+var_224] .text&ARM.extab:C52DA49A DD E9 07 10 LDRD.W R1, R0, [SP,#0x248+var_22C] .text&ARM.extab:C52DA49E 00 F1 28 05 ADD.W R5, R0, #0x28 ; '(' .text&ARM.extab:C52DA4A2 00 20 MOVS R0, #0 .text&ARM.extab:C52DA4A4 A8 F1 28 04 SUB.W R4, R8, #0x28 ; '(' .text&ARM.extab:C52DA4A8 03 29 CMP R1, #3 .text&ARM.extab:C52DA4AA 08 95 STR R5, [SP,#0x248+var_228] .text&ARM.extab:C52DA4AC 09 94 STR R4, [SP,#0x248+var_224] .text&ARM.extab:C52DA4AE 08 BF IT EQ .text&ARM.extab:C52DA4B0 01 20 MOVEQ R0, #1 .text&ARM.extab:C52DA4B2 02 29 CMP R1, #2 .text&ARM.extab:C52DA4B4 4F F0 00 01 MOV.W R1, #0 .text&ARM.extab:C52DA4B8 08 BF IT EQ .text&ARM.extab:C52DA4BA 01 21 MOVEQ R1, #1 .text&ARM.extab:C52DA4BC 91 EA 00 0F TEQ.W R1, R0 .text&ARM.extab:C52DA4C0 04 D1 BNE loc_C52DA4CC .text&ARM.extab:C52DA4C0 .text&ARM.extab:C52DA4C2 08 A8 ADD R0, SP, #0x248+var_228 .text&ARM.extab:C52DA4C4 21 46 MOV R1, R4 .text&ARM.extab:C52DA4C6 01 22 MOVS R2, #1 .text&ARM.extab:C52DA4C8 00 F0 72 FA BL DecDex_sub_C60CE9B0 ; 解密出dex明文 .text&ARM.extab:C52DA4C8 .text&ARM.extab:C52DA4CC .text&ARM.extab:C52DA4CC loc_C52DA4CC .text&ARM.extab:C52DA4CC 93 48 LDR R0, =(x.304_ptr - 0xC52DA4D8) .text&ARM.extab:C52DA4CE 00 26 MOVS R6, #0 .text&ARM.extab:C52DA4D0 93 49 LDR R1, =(y.305_ptr - 0xC52DA4DA) .text&ARM.extab:C52DA4D2 00 23 MOVS R3, #0 .text&ARM.extab:C52DA4D4 78 44 ADD R0, PC ; x.304_ptr .text&ARM.extab:C52DA4D6 79 44 ADD R1, PC ; y.305_ptr .text&ARM.extab:C52DA4D8 00 68 LDR R0, [R0] ; x.304 .text&ARM.extab:C52DA4DA 09 68 LDR R1, [R1] ; y.305 .text&ARM.extab:C52DA4DC 00 68 LDR R0, [R0] .text&ARM.extab:C52DA4DE 09 68 LDR R1, [R1] .text&ARM.extab:C52DA4E0 42 1E SUBS R2, R0, #1 .text&ARM.extab:C52DA4E2 B1 F5 95 7F CMP.W R1, #0x12A .text&ARM.extab:C52DA4E6 B8 BF IT LT .text&ARM.extab:C52DA4E8 01 26 MOVLT R6, #1 .text&ARM.extab:C52DA4EA 42 43 MULS R2, R0 .text&ARM.extab:C52DA4EC 48 40 EORS R0, R1 .text&ARM.extab:C52DA4EE 3B 28 CMP R0, #0x3B ; ';' .text&ARM.extab:C52DA4F0 4F F0 00 00 MOV.W R0, #0 .text&ARM.extab:C52DA4F4 C8 BF IT GT .text&ARM.extab:C52DA4F6 01 20 MOVGT R0, #1 .text&ARM.extab:C52DA4F8 30 43 ORRS R0, R6 .text&ARM.extab:C52DA4FA D1 07 LSLS R1, R2, #0x1F .text&ARM.extab:C52DA4FC 08 BF IT EQ .text&ARM.extab:C52DA4FE 01 23 MOVEQ R3, #1 .text&ARM.extab:C52DA500 18 43 ORRS R0, R3 .text&ARM.extab:C52DA500 .text&ARM.extab:C52DA502 .text&ARM.extab:C52DA502 loc_C52DA502 .text&ARM.extab:C52DA502 01 28 CMP R0, #1 .text&ARM.extab:C52DA504 FD D1 BNE loc_C52DA502 .text&ARM.extab:C52DA504 .text&ARM.extab:C52DA506 87 48 LDR R0, =(off_C5325018 - 0xC52DA50C) .text&ARM.extab:C52DA508 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52DA50A 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52DA50C D0 F8 00 A0 LDR.W R10, [R0] ; off_C532DDC0 .text&ARM.extab:C52DA510 08 EB 05 00 ADD.W R0, R8, R5 .text&ARM.extab:C52DA514 50 F8 2C 6C LDR.W R6, [R0,#-0x2C] .text&ARM.extab:C52DA518 CA F8 D4 60 STR.W R6, [R10,#(dword_C532DE94 - 0xC532DDC0)] .text&ARM.extab:C52DA51C 01 2E CMP R6, #1 .text&ARM.extab:C52DA51E C0 F2 C2 80 BLT.W loc_C52DA6A6 .text&ARM.extab:C52DA51E .text&ARM.extab:C52DA522 81 48 LDR R0, =(x.306_ptr - 0xC52DA52C) .text&ARM.extab:C52DA524 A4 EB C6 02 SUB.W R2, R4, R6,LSL#3 .text&ARM.extab:C52DA528 78 44 ADD R0, PC ; x.306_ptr .text&ARM.extab:C52DA52A 00 68 LDR R0, [R0] ; x.306 .text&ARM.extab:C52DA52C 01 90 STR R0, [SP,#0x248+var_244] .text&ARM.extab:C52DA52E 7F 48 LDR R0, =(y.307_ptr - 0xC52DA534) .text&ARM.extab:C52DA530 78 44 ADD R0, PC ; y.307_ptr .text&ARM.extab:C52DA532 00 68 LDR R0, [R0] ; y.307 .text&ARM.extab:C52DA534 00 90 STR R0, [SP,#0x248+var_248] .text&ARM.extab:C52DA536 7E 48 LDR R0, =(off_C5325018 - 0xC52DA53C) .text&ARM.extab:C52DA538 78 44 ADD R0, PC ; off_C5325018 .text&ARM.extab:C52DA53A 00 68 LDR R0, [R0] ; off_C5326004 .text&ARM.extab:C52DA53C 03 90 STR R0, [SP,#0x248+var_23C] .text&ARM.extab:C52DA53C .text&ARM.extab:C52DA53E .text&ARM.extab:C52DA53E loc_C52DA53E .text&ARM.extab:C52DA53E 51 59 LDR R1, [R2,R5] .text&ARM.extab:C52DA540 DA F8 98 00 LDR.W R0, [R10,#0x98] .text&ARM.extab:C52DA544 06 92 STR R2, [SP,#0x248+var_230] .text&ARM.extab:C52DA546 01 EB 05 0B ADD.W R11, R1, R5 .text&ARM.extab:C52DA54A 08 B1 CBZ R0, loc_C52DA550 .text&ARM.extab:C52DA54A .text&ARM.extab:C52DA54C 84 6D LDR R4, [R0,#0x58] .text&ARM.extab:C52DA54E 12 E0 B loc_C52DA576 .text&ARM.extab:C52DA54E .text&ARM.extab:C52DA550 .text&ARM.extab:C52DA550 loc_C52DA550 .text&ARM.extab:C52DA550 01 98 LDR R0, [SP,#0x248+var_244] .text&ARM.extab:C52DA552 00 9A LDR R2, [SP,#0x248+var_248] .text&ARM.extab:C52DA554 02 96 STR R6, [SP,#0x248+var_240] .text&ARM.extab:C52DA556 00 68 LDR R0, [R0] .text&ARM.extab:C52DA558 D2 F8 00 90 LDR.W R9, [R2] .text&ARM.extab:C52DA55C 41 1E SUBS R1, R0, #1 .text&ARM.extab:C52DA55E 89 EA 00 04 EOR.W R4, R9, R0 .text&ARM.extab:C52DA562 41 43 MULS R1, R0 .text&ARM.extab:C52DA564 11 F0 01 08 ANDS.W R8, R1, #1 .text&ARM.extab:C52DA568 1C D0 BEQ loc_C52DA5A4 .text&ARM.extab:C52DA568 .text&ARM.extab:C52DA56A B9 F1 1D 0F CMP.W R9, #0x1D .text&ARM.extab:C52DA56E 19 DB BLT loc_C52DA5A4 .text&ARM.extab:C52DA56E .text&ARM.extab:C52DA570 99 2C CMP R4, #0x99 .text&ARM.extab:C52DA572 29 DB BLT loc_C52DA5C8 .text&ARM.extab:C52DA572 .text&ARM.extab:C52DA574 16 E0 B loc_C52DA5A4 .text&ARM.extab:C52DA574 .text&ARM.extab:C52DA576 .text&ARM.extab:C52DA576 loc_C52DA576 .text&ARM.extab:C52DA576 85 6C LDR R5, [R0,#0x48] .text&ARM.extab:C52DA578 69 1C ADDS R1, R5, #1 .text&ARM.extab:C52DA57A 81 64 STR R1, [R0,#0x48] .text&ARM.extab:C52DA57C 60 20 MOVS R0, #0x60 ; '`' ; size .text&ARM.extab:C52DA57E CB F7 60 E9 BLX malloc .text&ARM.extab:C52DA57E .text&ARM.extab:C52DA582 02 2E CMP R6, #2 .text&ARM.extab:C52DA584 4F F0 00 01 MOV.W R1, #0 .text&ARM.extab:C52DA588 44 F8 25 00 STR.W R0, [R4,R5,LSL#2] .text&ARM.extab:C52DA58C C0 E9 0A B1 STRD.W R11, R1, [R0,#0x28] .text&ARM.extab:C52DA590 C0 F2 89 80 BLT.W loc_C52DA6A6 .text&ARM.extab:C52DA590 .text&ARM.extab:C52DA594 03 98 LDR R0, [SP,#0x248+var_23C] .text&ARM.extab:C52DA596 01 3E SUBS R6, #1 .text&ARM.extab:C52DA598 06 9A LDR R2, [SP,#0x248+var_230] .text&ARM.extab:C52DA59A 08 9D LDR R5, [SP,#0x248+var_228] .text&ARM.extab:C52DA59C 08 32 ADDS R2, #8 .text&ARM.extab:C52DA59E D0 F8 00 A0 LDR.W R10, [R0] .text&ARM.extab:C52DA5A2 CC E7 B loc_C52DA53E .text&ARM.extab:C52DA5A2 .text&ARM.extab:C52DA5A4 .text&ARM.extab:C52DA5A4 loc_C52DA5A4 .text&ARM.extab:C52DA5A4 60 20 MOVS R0, #0x60 ; '`' ; size .text&ARM.extab:C52DA5A6 CB F7 4C E9 BLX malloc .text&ARM.extab:C52DA5A6 .text&ARM.extab:C52DA5AA 4F EA 89 01 MOV.W R1, R9,LSL#2 .text&ARM.extab:C52DA5AE B1 F5 F5 7F CMP.W R1, #0x1EA .text&ARM.extab:C52DA5B2 CA F8 98 00 STR.W R0, [R10,#0x98] .text&ARM.extab:C52DA5B6 0D DB BLT loc_C52DA5D4 .text&ARM.extab:C52DA5B6 .text&ARM.extab:C52DA5B8 E0 2C CMP R4, #0xE0 .text&ARM.extab:C52DA5BA 0B DC BGT loc_C52DA5D4 .text&ARM.extab:C52DA5BA .text&ARM.extab:C52DA5BC B9 F1 0A 0F CMP.W R9, #0xA .text&ARM.extab:C52DA5C0 08 DB BLT loc_C52DA5D4 .text&ARM.extab:C52DA5C0 .text&ARM.extab:C52DA5C2 B8 F1 00 0F CMP.W R8, #0 .text&ARM.extab:C52DA5C6 05 D0 BEQ loc_C52DA5D4 .text&ARM.extab:C52DA5C6 .text&ARM.extab:C52DA5C8 .text&ARM.extab:C52DA5C8 loc_C52DA5C8 ; CODE XREF: read_ijiami.dat_sub_C60CE440+132↑j .text&ARM.extab:C52DA5C8 60 20 MOVS R0, #0x60 ; '`' ; size .text&ARM.extab:C52DA5CA CB F7 3A E9 BLX malloc .text&ARM.extab:C52DA5CA .text&ARM.extab:C52DA5CE CA F8 98 00 STR.W R0, [R10,#0x98] .text&ARM.extab:C52DA5D2 E7 E7 B loc_C52DA5A4
这时候dump出内存中的dex大部分的方法指令被抽了，还有部分是被native。如图4-6-1所示:
图4-6-1
内存中加载dex
int __fastcall sub_C60E5120(int a1, int a2) { v4 = *y_156_ptr[0]; v5 = *x_155_ptr[0]; v91 = *_stack_chk_guard_ptr[0]; v6 = (v4 ^ v5) < 177; v7 = 4 * v4 > 198; if ( v4 >= 10 && (((_BYTE)v5 * ((_BYTE)v5 - 1)) & 1) != 0 && v7 == v6 && v6 | v7 ) goto LABEL_8; while ( 1 ) { v85 = 0; v8 = (*(int (__fastcall **)(int, char *))(*(_DWORD *)a1 + 24))(a1, (char *)&MEMORY[0xC532C1A8] + 3); ((void (__fastcall *)(void **))(*off_C5325018)[4][25])((*off_C5325018)[2]); v9 = *y_156_ptr[0]; v10 = *y_156_ptr[0] ^ *x_155_ptr[0]; v11 = ((*x_155_ptr[0] - 1) * *x_155_ptr[0]) & 1; if ( !v11 || v9 < 130 || v10 >= 172 ) break; LABEL_8: (*(void (__fastcall **)(int, char *))(*(_DWORD *)a1 + 24))(a1, (char *)&MEMORY[0xC532C1A8] + 3); ((void (__fastcall *)(void **))(*off_C5325018)[4][25])((*off_C5325018)[2]); } if ( !v8 ) { v16 = v10 > 149; v17 = v9 < 141; v18 = 0; v19 = 0; if ( v17 ) v18 = 1; v20 = v18 | v16; if ( !v11 ) v19 = 1; while ( !(v19 | v20) ) ; return 0; } v12 = off_C5325018; v13 = NewObjectArray_sub_C60E4734(a1, (*off_C5325018)[53], v8, 0); v14 = (void (__fastcall *)(char *))(*v12)[4][24]; v90 = v13; v14((char *)&MEMORY[0xC532C1BC] + 3); v15 = *y_156_ptr[0]; if ( 2 * *y_156_ptr[0] >= 211 && (v15 ^ *x_155_ptr[0]) <= 89 && v15 >= 10 && ((((unsigned __int8)*x_155_ptr[0] - 1) * (unsigned __int8)*x_155_ptr[0]) & 1) != 0 ) { goto LABEL_27; } while ( 1 ) { v22 = ((int (__fastcall *)(int))(*off_C5325018)[4][21])(a1); v23 = 0; v24 = *y_156_ptr[0]; v25 = *x_155_ptr[0] ^ *y_156_ptr[0]; if ( *y_156_ptr[0] > 9 ) v23 = 1; v26 = ((*x_155_ptr[0] - 1) * *x_155_ptr[0]) & 1; if ( 2 * v24 <= 444 || v25 > 204 || v23 != v26 || !(v23 | v26) ) break; LABEL_27: ((void (__fastcall *)(int))(*off_C5325018)[4][21])(a1); } v27 = 0; v28 = 0; if ( !v26 ) v27 = 1; if ( v24 < 10 ) v28 = 1; v29 = v27 | v28; v30 = v25 > 65; v31 = 0; v32 = 0; if ( 8 * v24 < 23 ) v31 = 1; if ( v24 > 9 ) v32 = 1; v33 = (v26 != 0) & (unsigned __int8)v32 ^ (v30 | v31) ^ 1 | v29 & (v30 | v31); while ( v33 != 1 ) ; if ( !v22 ) return 0; ((void (__fastcall *)(void **))(*off_C5325018)[4][25])((*off_C5325018)[2]); if ( !v90 ) { v48 = 0; v49 = 0; v50 = *x_155_ptr[0]; v51 = *y_156_ptr[0]; if ( *y_156_ptr[0] > 9 ) v48 = 1; v52 = (*x_155_ptr[0] - 1) * v50; v17 = (v50 ^ v51) <= 196; v53 = 0; v54 = 16 * v51; if ( !v17 ) v53 = 1; if ( v54 <= 260 ) v49 = 1; v55 = v53 | v49 | (v52 & 1 | v48) ^ 1 | v48 ^ v52 & 1; while ( !v55 ) ; return 0; } v34 = 0; v86 = &v85; v87 = v22; v88 = a2; v89 = v8; v35 = x_155_ptr[0]; v36 = y_156_ptr[0]; v37 = off_C5325018; while ( 1 ) { v39 = *v35; v40 = 0; v41 = *v36; if ( *v36 <= 410 ) v40 = 1; v42 = v41 ^ v39; v43 = v40 | ((v41 ^ v39) > 88); v44 = ((*v35 - 1) * v39) & 1; while ( ((v44 == 0) | v43) != 1 ) ; v45 = *v37; if ( v34 >= (int)(*v37)[53] ) break; v38 = NewDirectByteBuffer_sub_C60E46A8(a1); SetObjectArrayElement_sub_C60E57B4(a1, v90, v34, v38); (*(void (__fastcall **)(int, int))(*(_DWORD *)a1 + 92))(a1, v38); ++v34; } v46 = v41 > 9; v47 = v44 != 0; if ( 8 * v41 >= 360 && v42 <= 84 && v46 == v47 && v47 | v46 ) goto LABEL_80; while ( 1 ) { ((void (__fastcall *)(char *))v45[4][24])((char *)&MEMORY[0xC532C1BC] + 3); v56 = (*x_155_ptr[0] ^ *y_156_ptr[0]) > 149 || *y_156_ptr[0] <= 486; v57 = ((*(_BYTE *)x_155_ptr[0] - 1) * *(_BYTE *)x_155_ptr[0]) & 1; v58 = (*y_156_ptr[0] > 9) & v57; v59 = v58 == v56; if ( v58 != v56 ) v59 = ((unsigned __int8)v56 & (*y_156_ptr[0] < 10 || v57 == 0)) == 1; if ( v59 ) break; LABEL_80: ((void (__fastcall *)(char *))v45[4][24])((char *)&MEMORY[0xC532C1BC] + 3); } v60 = v86; v61 = v87; v62 = ((int (__fastcall *)(int, int *, char *, char *, int *))(*off_C5325018)[4][16])( a1, v86, (char *)&MEMORY[0xC532C1E0] + 1, (char *)&MEMORY[0xC532C1F8] + 3, &makeInMemoryDexElements); v63 = v89; if ( v62 == 1 && *v60 && dexElements_sub_C84EA7C0(a1, v88) != 1 ) return 0; v64 = 0; v65 = 0; v66 = 0; v67 = *x_155_ptr[0]; v68 = *y_156_ptr[0]; if ( *y_156_ptr[0] >= 496 ) v64 = 1; v69 = (*x_155_ptr[0] - 1) * v67; v70 = v67 ^ v68; if ( v70 < 60 ) v65 = 1; v71 = v64 ^ v65 | (v64 | v65) ^ 1; if ( (v69 & 1) == 0 ) v66 = 1; v72 = v66 | (v68 < 10) | v71; while ( v72 != 1 ) ; v73 = (*off_C5325018)[2]; if ( (v69 & 1) != 0 && v68 >= 73 && v70 < 195 ) goto LABEL_92; while ( 1 ) { (*((void (__fastcall **)(void **, int))*v73 + 23))(v73, v63); v74 = 0; v75 = (*x_155_ptr[0] ^ *y_156_ptr[0]) > 176 || 16 * *y_156_ptr[0] < 51; v76 = ((*(_BYTE *)x_155_ptr[0] - 1) * *(_BYTE *)x_155_ptr[0]) & 1; v77 = (*y_156_ptr[0] > 9) & v76; v78 = v77 == v75; if ( v77 != v75 ) v78 = ((unsigned __int8)v75 & (*y_156_ptr[0] < 10 || v76 == 0)) == 1; if ( v78 ) break; LABEL_92: (*((void (__fastcall **)(void **, int))*v73 + 23))(v73, v63); } v79 = off_C5325018; (*((void (__fastcall **)(void **, int))*(*off_C5325018)[2] + 23))((*off_C5325018)[2], v90); (*((void (__fastcall **)(void **, int))*(*v79)[2] + 23))((*v79)[2], v61); v80 = 0; v81 = *y_156_ptr[0]; v83 = ((*x_155_ptr[0] - 1) * *x_155_ptr[0]) & 1; if ( !v83 ) v80 = 1; if ( v81 > 9 ) v74 = 1; v82 = (*x_155_ptr[0] ^ *y_156_ptr[0]) > 57 || 16 * *y_156_ptr[0] < 386; v84 = v82 ^ v74 & v83 ^ 1 | ((v81 < 10) | v80) & v82; while ( v84 != 1 ) ; return 1; }
4.7、方法指令还原
判断是否为要修复
.text&ARM.extab:C52BDA04 hook_ClassLinker_LoadMethod_sub_C52BDA04 .text&ARM.extab:C52BDA04 .text&ARM.extab:C52BDA04 var_28= -0x28 .text&ARM.extab:C52BDA04 var_24= -0x24 .text&ARM.extab:C52BDA04 var_20= -0x20 .text&ARM.extab:C52BDA04 .text&ARM.extab:C52BDA04 ; __unwind { .text&ARM.extab:C52BDA04 F0 B5 PUSH {R4-R7,LR} .text&ARM.extab:C52BDA06 03 AF ADD R7, SP, #0xC .text&ARM.extab:C52BDA08 2D E9 00 0F PUSH.W {R8-R11} .text&ARM.extab:C52BDA0C 83 B0 SUB SP, SP, #0xC .text&ARM.extab:C52BDA0E 83 46 MOV R11, R0 .text&ARM.extab:C52BDA10 4E 48 LDR R0, =(__stack_chk_guard_ptr - 0xC52BDA1A) .text&ARM.extab:C52BDA12 01 AA ADD R2, SP, #0x28+var_24 .text&ARM.extab:C52BDA14 00 26 MOVS R6, #0 .text&ARM.extab:C52BDA16 78 44 ADD R0, PC ; __stack_chk_guard_ptr .text&ARM.extab:C52BDA18 00 68 LDR R0, [R0] .text&ARM.extab:C52BDA1A 00 68 LDR R0, [R0] .text&ARM.extab:C52BDA1C 02 90 STR R0, [SP,#0x28+var_20] .text&ARM.extab:C52BDA1E 58 46 MOV R0, R11 .text&ARM.extab:C52BDA20 01 96 STR R6, [SP,#0x28+var_24] .text&ARM.extab:C52BDA22 00 F0 A3 F8 BL GetMothedAddress_sub_C84B7B6C .text&ARM.extab:C52BDA22 .text&ARM.extab:C52BDA26 04 46 MOV R4, R0 .text&ARM.extab:C52BDA28 00 2C CMP R4, #0 .text&ARM.extab:C52BDA2A 00 F0 82 80 BEQ.W loc_C52BDB32 .text&ARM.extab:C52BDA2A .text&ARM.extab:C52BDA2E A0 46 MOV R8, R4 .text&ARM.extab:C52BDA30 00 20 MOVS R0, #0 .text&ARM.extab:C52BDA32 58 F8 08 5F LDR.W R5, [R8,#8]! ; Debug info .text&ARM.extab:C52BDA36 B5 F1 82 6F CMP.W R5, #0x4100000 .text&ARM.extab:C52BDA3A C8 BF IT GT .text&ARM.extab:C52BDA3C 01 20 MOVGT R0, #1 .text&ARM.extab:C52BDA3E B5 F1 40 7F CMP.W R5, #0x3000000 .text&ARM.extab:C52BDA42 B8 BF IT LT .text&ARM.extab:C52BDA44 01 26 MOVLT R6, #1 .text&ARM.extab:C52BDA46 96 EA 00 0F TEQ.W R6, R0 .text&ARM.extab:C52BDA4A 72 D1 BNE loc_C52BDB32
修复指令
根据Debug info定位到指令，获取指令解密
.text&ARM.extab:C52AA9D2 getDecCode_sub_C20E39D2 .text&ARM.extab:C52AA9D2 ; __unwind { .text&ARM.extab:C52AA9D2 F0 B5 PUSH {R4-R7,LR} .text&ARM.extab:C52AA9D4 03 AF ADD R7, SP, #0xC .text&ARM.extab:C52AA9D6 4D F8 04 8D PUSH.W {R8} .text&ARM.extab:C52AA9DA 80 46 MOV R8, R0 .text&ARM.extab:C52AA9DC 0C 46 MOV R4, R1 .text&ARM.extab:C52AA9DE D8 F8 08 10 LDR.W R1, [R8,#8] .text&ARM.extab:C52AA9E2 20 46 MOV R0, R4 .text&ARM.extab:C52AA9E4 88 47 BLX R1 .text&ARM.extab:C52AA9E4 .text&ARM.extab:C52AA9E6 6F EA 40 23 MVN.W R3, R0,LSL#9 ; Debug info .text&ARM.extab:C52AA9EA 18 44 ADD R0, R3 ; Debuginfo+Debuginfo<<9 .text&ARM.extab:C52AA9EC D8 E9 00 12 LDRD.W R1, R2, [R8] .text&ARM.extab:C52AA9F0 80 EA 90 30 EOR.W R0, R0, R0,LSR#14 .text&ARM.extab:C52AA9F4 00 EB 00 10 ADD.W R0, R0, R0,LSL#4 .text&ARM.extab:C52AA9F8 80 EA 90 26 EOR.W R6, R0, R0,LSR#10 .text&ARM.extab:C52AA9FC 50 1E SUBS R0, R2, #1 .text&ARM.extab:C52AA9FE 30 40 ANDS R0, R6 .text&ARM.extab:C52AAA00 51 F8 20 50 LDR.W R5, [R1,R0,LSL#2] .text&ARM.extab:C52AAA04 0C E0 B loc_C52AAA20 .text&ARM.extab:C52AAA04 .text&ARM.extab:C52AAA06 .text&ARM.extab:C52AAA06 loc_C52AAA06 ; CODE XREF: getDecCode_sub_C20E39D2+50↓j .text&ARM.extab:C52AAA06 28 68 LDR R0, [R5] ; 取解密后指令中的Debug info .text&ARM.extab:C52AAA08 A0 42 CMP R0, R4 ; 判断被抽取指令与解密后指令中的Debug info是否相同 .text&ARM.extab:C52AAA0A 0D D0 BEQ loc_C52AAA28 ; 取解密后指令地址 .text&ARM.extab:C52AAA0A .text&ARM.extab:C52AAA0C 69 68 LDR R1, [R5,#4] .text&ARM.extab:C52AAA0E B1 42 CMP R1, R6 .text&ARM.extab:C52AAA10 05 D1 BNE loc_C52AAA1E .text&ARM.extab:C52AAA10 .text&ARM.extab:C52AAA12 D8 F8 0C 20 LDR.W R2, [R8,#0xC] .text&ARM.extab:C52AAA16 21 46 MOV R1, R4 .text&ARM.extab:C52AAA18 90 47 BLX R2 .text&ARM.extab:C52AAA18 .text&ARM.extab:C52AAA1A 01 28 CMP R0, #1 .text&ARM.extab:C52AAA1C 04 D0 BEQ loc_C52AAA28 ; 取解密后指令地址 .text&ARM.extab:C52AAA1C .text&ARM.extab:C52AAA1E .text&ARM.extab:C52AAA1E loc_C52AAA1E .text&ARM.extab:C52AAA1E ED 68 LDR R5, [R5,#0xC] .text&ARM.extab:C52AAA1E .text&ARM.extab:C52AAA20 .text&ARM.extab:C52AAA20 loc_C52AAA20 .text&ARM.extab:C52AAA20 00 2D CMP R5, #0 .text&ARM.extab:C52AAA22 F0 D1 BNE loc_C52AAA06 ; 取解密后指令中的Debug info .text&ARM.extab:C52AAA22 .text&ARM.extab:C52AAA24 00 20 MOVS R0, #0 .text&ARM.extab:C52AAA26 00 E0 B loc_C52AAA2A .text&ARM.extab:C52AAA26 .text&ARM.extab:C52AAA28 .text&ARM.extab:C52AAA28 loc_C52AAA28 .text&ARM.extab:C52AAA28 ; getDecCode_sub_C20E39D2+4A↑j .text&ARM.extab:C52AAA28 A8 68 LDR R0, [R5,#8] ; 取解密后指令地址 .text&ARM.extab:C52AAA28 .text&ARM.extab:C52AAA2A .text&ARM.extab:C52AAA2A loc_C52AAA2A .text&ARM.extab:C52AAA2A 5D F8 04 8B POP.W {R8} .text&ARM.extab:C52AAA2E F0 BD POP {R4-R7,PC}
修复指令
.text&ARM.extab:C52E7F34 ; r0:解密后方法指令,R1:方法地址 .text&ARM.extab:C52E7F34 Fix_Method_sub_C2195F34 .text&ARM.extab:C52E7F34 .text&ARM.extab:C52E7F34 var_20= -0x20 .text&ARM.extab:C52E7F34 .text&ARM.extab:C52E7F34 ; __unwind { .text&ARM.extab:C52E7F34 F0 B5 PUSH {R4-R7,LR} .text&ARM.extab:C52E7F36 03 AF ADD R7, SP, #0xC .text&ARM.extab:C52E7F38 2D E9 00 0F PUSH.W {R8-R11} .text&ARM.extab:C52E7F3C 81 B0 SUB SP, SP, #4 .text&ARM.extab:C52E7F3E 8F 4A LDR R2, =(x.27_ptr - 0xC52E7F4A) .text&ARM.extab:C52E7F40 00 25 MOVS R5, #0 .text&ARM.extab:C52E7F42 8F 4B LDR R3, =(y.28_ptr - 0xC52E7F4C) .text&ARM.extab:C52E7F44 00 24 MOVS R4, #0 .text&ARM.extab:C52E7F46 7A 44 ADD R2, PC ; x.27_ptr .text&ARM.extab:C52E7F48 7B 44 ADD R3, PC ; y.28_ptr .text&ARM.extab:C52E7F4A 12 68 LDR R2, [R2] ; x.27 .text&ARM.extab:C52E7F4C 1B 68 LDR R3, [R3] ; y.28 .text&ARM.extab:C52E7F4E 16 68 LDR R6, [R2] .text&ARM.extab:C52E7F50 1A 68 LDR R2, [R3] .text&ARM.extab:C52E7F52 73 1E SUBS R3, R6, #1 .text&ARM.extab:C52E7F54 82 EA 06 0E EOR.W LR, R2, R6 .text&ARM.extab:C52E7F58 03 FB 06 FC MUL.W R12, R3, R6 .text&ARM.extab:C52E7F5C 13 01 LSLS R3, R2, #4 .text&ARM.extab:C52E7F5E A1 2B CMP R3, #0xA1 .text&ARM.extab:C52E7F60 C8 BF IT GT .text&ARM.extab:C52E7F62 01 25 MOVGT R5, #1 .text&ARM.extab:C52E7F64 BE F1 6E 0F CMP.W LR, #0x6E ; 'n' .text&ARM.extab:C52E7F68 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52E7F6C B8 BF IT LT .text&ARM.extab:C52E7F6E 01 26 MOVLT R6, #1 .text&ARM.extab:C52E7F70 09 2A CMP R2, #9 .text&ARM.extab:C52E7F72 06 EA 05 06 AND.W R6, R6, R5 .text&ARM.extab:C52E7F76 4F F0 00 05 MOV.W R5, #0 .text&ARM.extab:C52E7F7A C8 BF IT GT .text&ARM.extab:C52E7F7C 01 25 MOVGT R5, #1 .text&ARM.extab:C52E7F7E 0C F0 01 03 AND.W R3, R12, #1 .text&ARM.extab:C52E7F82 1D 40 ANDS R5, R3 .text&ARM.extab:C52E7F84 0A 2A CMP R2, #0xA .text&ARM.extab:C52E7F86 86 EA 05 0C EOR.W R12, R6, R5 .text&ARM.extab:C52E7F8A 45 EA 06 05 ORR.W R5, R5, R6 .text&ARM.extab:C52E7F8E 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52E7F92 85 F0 01 05 EOR.W R5, R5, #1 .text&ARM.extab:C52E7F96 B8 BF IT LT .text&ARM.extab:C52E7F98 01 26 MOVLT R6, #1 .text&ARM.extab:C52E7F9A 00 2B CMP R3, #0 .text&ARM.extab:C52E7F9C 08 BF IT EQ .text&ARM.extab:C52E7F9E 01 24 MOVEQ R4, #1 .text&ARM.extab:C52E7FA0 45 EA 0C 05 ORR.W R5, R5, R12 .text&ARM.extab:C52E7FA4 26 43 ORRS R6, R4 .text&ARM.extab:C52E7FA4 .text&ARM.extab:C52E7FA6 .text&ARM.extab:C52E7FA6 loc_C52E7FA6 .text&ARM.extab:C52E7FA6 01 2D CMP R5, #1 .text&ARM.extab:C52E7FA8 FD D1 BNE loc_C52E7FA6 .text&ARM.extab:C52E7FA8 .text&ARM.extab:C52E7FAA BE F1 B9 0F CMP.W LR, #0xB9 .text&ARM.extab:C52E7FAE 4F F0 00 05 MOV.W R5, #0 .text&ARM.extab:C52E7FB2 4F F0 00 03 MOV.W R3, #0 .text&ARM.extab:C52E7FB6 C8 BF IT GT .text&ARM.extab:C52E7FB8 01 25 MOVGT R5, #1 .text&ARM.extab:C52E7FBA D2 00 LSLS R2, R2, #3 .text&ARM.extab:C52E7FBC E4 2A CMP R2, #0xE4 .text&ARM.extab:C52E7FBE B8 BF IT LT .text&ARM.extab:C52E7FC0 01 23 MOVLT R3, #1 .text&ARM.extab:C52E7FC2 43 EA 05 02 ORR.W R2, R3, R5 .text&ARM.extab:C52E7FC6 32 43 ORRS R2, R6 .text&ARM.extab:C52E7FC6 .text&ARM.extab:C52E7FC8 .text&ARM.extab:C52E7FC8 loc_C52E7FC8 .text&ARM.extab:C52E7FC8 01 2A CMP R2, #1 .text&ARM.extab:C52E7FCA FD D1 BNE loc_C52E7FC8 .text&ARM.extab:C52E7FCA .text&ARM.extab:C52E7FCC 82 68 LDR R2, [R0,#8] ; 取解密后的方法指令长度 .text&ARM.extab:C52E7FCE 00 2A CMP R2, #0 .text&ARM.extab:C52E7FD0 00 F0 CE 80 BEQ.W loc_C52E8170 .text&ARM.extab:C52E7FD0 .text&ARM.extab:C52E7FD4 6B 4B LDR R3, =(x.27_ptr - 0xC52E7FDC) .text&ARM.extab:C52E7FD6 00 22 MOVS R2, #0 .text&ARM.extab:C52E7FD8 7B 44 ADD R3, PC ; x.27_ptr .text&ARM.extab:C52E7FDA 1B 68 LDR R3, [R3] ; x.27 .text&ARM.extab:C52E7FDC 00 93 STR R3, [SP,#0x20+var_20] .text&ARM.extab:C52E7FDE 6A 4B LDR R3, =(y.28_ptr - 0xC52E7FE4) .text&ARM.extab:C52E7FE0 7B 44 ADD R3, PC ; y.28_ptr .text&ARM.extab:C52E7FE2 D3 F8 00 E0 LDR.W LR, [R3] ; y.28 .text&ARM.extab:C52E7FE2 .text&ARM.extab:C52E7FE6 .text&ARM.extab:C52E7FE6 loc_C52E7FE6 .text&ARM.extab:C52E7FE6 83 18 ADDS R3, R0, R2 ; base++ .text&ARM.extab:C52E7FE8 93 F8 0C A0 LDRB.W R10, [R3,#0xC] ; 取指令 .text&ARM.extab:C52E7FEC BA F1 00 0F CMP.W R10, #0 .text&ARM.extab:C52E7FF0 67 D0 BEQ loc_C52E80C2 .text&ARM.extab:C52E7FF0 .text&ARM.extab:C52E7FF2 00 9B LDR R3, [SP,#0x20+var_20] .text&ARM.extab:C52E7FF4 00 26 MOVS R6, #0 .text&ARM.extab:C52E7FF6 DE F8 00 50 LDR.W R5, [LR] .text&ARM.extab:C52E7FFA 1B 68 LDR R3, [R3] .text&ARM.extab:C52E7FFC 09 2D CMP R5, #9 .text&ARM.extab:C52E7FFE C8 BF IT GT .text&ARM.extab:C52E8000 01 26 MOVGT R6, #1 .text&ARM.extab:C52E8002 AA 2D CMP R5, #0xAA .text&ARM.extab:C52E8004 A3 F1 01 04 SUB.W R4, R3, #1 .text&ARM.extab:C52E8008 85 EA 03 0C EOR.W R12, R5, R3 .text&ARM.extab:C52E800C 4F EA C5 08 MOV.W R8, R5,LSL#3 .text&ARM.extab:C52E8010 03 FB 04 F4 MUL.W R4, R3, R4 .text&ARM.extab:C52E8014 4F F0 00 03 MOV.W R3, #0 .text&ARM.extab:C52E8018 04 F0 01 0B AND.W R11, R4, #1 .text&ARM.extab:C52E801C 86 EA 0B 04 EOR.W R4, R6, R11 .text&ARM.extab:C52E8020 46 EA 0B 06 ORR.W R6, R6, R11 .text&ARM.extab:C52E8024 86 F0 01 06 EOR.W R6, R6, #1 .text&ARM.extab:C52E8028 44 EA 06 04 ORR.W R4, R4, R6 .text&ARM.extab:C52E802C 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52E8030 B8 BF IT LT .text&ARM.extab:C52E8032 01 26 MOVLT R6, #1 .text&ARM.extab:C52E8034 BC F1 E6 0F CMP.W R12, #0xE6 .text&ARM.extab:C52E8038 C8 BF IT GT .text&ARM.extab:C52E803A 01 23 MOVGT R3, #1 .text&ARM.extab:C52E803C 0A 2D CMP R5, #0xA .text&ARM.extab:C52E803E 43 EA 06 03 ORR.W R3, R3, R6 .text&ARM.extab:C52E8042 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52E8046 43 EA 04 03 ORR.W R3, R3, R4 .text&ARM.extab:C52E804A 4F F0 00 04 MOV.W R4, #0 .text&ARM.extab:C52E804E B8 BF IT LT .text&ARM.extab:C52E8050 01 24 MOVLT R4, #1 .text&ARM.extab:C52E8052 BB F1 00 0F CMP.W R11, #0 .text&ARM.extab:C52E8056 08 BF IT EQ .text&ARM.extab:C52E8058 01 26 MOVEQ R6, #1 .text&ARM.extab:C52E805A 44 EA 06 09 ORR.W R9, R4, R6 .text&ARM.extab:C52E805A .text&ARM.extab:C52E805E .text&ARM.extab:C52E805E loc_C52E805E .text&ARM.extab:C52E805E 01 2B CMP R3, #1 .text&ARM.extab:C52E8060 FD D1 BNE loc_C52E805E .text&ARM.extab:C52E8060 .text&ARM.extab:C52E8062 BA F1 FF 0F CMP.W R10, #0xFF ; 判断指令是否为0xFF .text&ARM.extab:C52E8066 2E D0 BEQ loc_C52E80C6 .text&ARM.extab:C52E8066 .text&ARM.extab:C52E8068 BC F1 BF 0F CMP.W R12, #0xBF .text&ARM.extab:C52E806C 4F F0 00 04 MOV.W R4, #0 .text&ARM.extab:C52E8070 C8 BF IT GT .text&ARM.extab:C52E8072 01 24 MOVGT R4, #1 .text&ARM.extab:C52E8074 6B 00 LSLS R3, R5, #1 .text&ARM.extab:C52E8076 B3 F5 B2 7F CMP.W R3, #0x164 .text&ARM.extab:C52E807A 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52E807E B8 BF IT LT .text&ARM.extab:C52E8080 01 26 MOVLT R6, #1 .text&ARM.extab:C52E8082 34 43 ORRS R4, R6 .text&ARM.extab:C52E8084 44 EA 09 04 ORR.W R4, R4, R9 .text&ARM.extab:C52E8084 .text&ARM.extab:C52E8088 .text&ARM.extab:C52E8088 loc_C52E8088 .text&ARM.extab:C52E8088 01 2C CMP R4, #1 .text&ARM.extab:C52E808A FD D1 BNE loc_C52E8088 .text&ARM.extab:C52E808A .text&ARM.extab:C52E808C BC F1 A6 0F CMP.W R12, #0xA6 .text&ARM.extab:C52E8090 4F F0 00 04 MOV.W R4, #0 .text&ARM.extab:C52E8094 B8 BF IT LT .text&ARM.extab:C52E8096 01 24 MOVLT R4, #1 .text&ARM.extab:C52E8098 B3 F5 F8 7F CMP.W R3, #0x1F0 .text&ARM.extab:C52E809C 4F F0 00 03 MOV.W R3, #0 .text&ARM.extab:C52E80A0 C8 BF IT GT .text&ARM.extab:C52E80A2 01 23 MOVGT R3, #1 .text&ARM.extab:C52E80A4 83 EA 04 06 EOR.W R6, R3, R4 .text&ARM.extab:C52E80A8 23 43 ORRS R3, R4 .text&ARM.extab:C52E80AA 83 F0 01 03 EOR.W R3, R3, #1 .text&ARM.extab:C52E80AE 33 43 ORRS R3, R6 .text&ARM.extab:C52E80B0 43 EA 09 03 ORR.W R3, R3, R9 .text&ARM.extab:C52E80B0 .text&ARM.extab:C52E80B4 .text&ARM.extab:C52E80B4 loc_C52E80B4 .text&ARM.extab:C52E80B4 01 2B CMP R3, #1 .text&ARM.extab:C52E80B6 FD D1 BNE loc_C52E80B4 .text&ARM.extab:C52E80B6 .text&ARM.extab:C52E80B8 BA F1 23 0F CMP.W R10, #0x23 ; '#' ; 判断指令是否为0x23 .text&ARM.extab:C52E80BC 05 D1 BNE loc_C52E80CA .text&ARM.extab:C52E80BC .text&ARM.extab:C52E80BE 23 23 MOVS R3, #0x23 ; '#' .text&ARM.extab:C52E80C0 50 E0 B loc_C52E8164 ; 写指令 .text&ARM.extab:C52E80C0 .text&ARM.extab:C52E80C2 .text&ARM.extab:C52E80C2 loc_C52E80C2 .text&ARM.extab:C52E80C2 00 23 MOVS R3, #0 .text&ARM.extab:C52E80C4 4E E0 B loc_C52E8164 ; 写指令 .text&ARM.extab:C52E80C4 .text&ARM.extab:C52E80C6 .text&ARM.extab:C52E80C6 loc_C52E80C6 .text&ARM.extab:C52E80C6 FF 23 MOVS R3, #0xFF .text&ARM.extab:C52E80C8 4C E0 B loc_C52E8164 ; 写指令 .text&ARM.extab:C52E80C8 .text&ARM.extab:C52E80CA .text&ARM.extab:C52E80CA loc_C52E80CA .text&ARM.extab:C52E80CA BC F1 46 0F CMP.W R12, #0x46 ; 'F' .text&ARM.extab:C52E80CE 4F F0 00 03 MOV.W R3, #0 .text&ARM.extab:C52E80D2 C8 BF IT GT .text&ARM.extab:C52E80D4 01 23 MOVGT R3, #1 .text&ARM.extab:C52E80D6 B8 F5 FA 7F CMP.W R8, #0x1F4 .text&ARM.extab:C52E80DA 4F F0 00 04 MOV.W R4, #0 .text&ARM.extab:C52E80DE B8 BF IT LT .text&ARM.extab:C52E80E0 01 24 MOVLT R4, #1 .text&ARM.extab:C52E80E2 23 43 ORRS R3, R4 .text&ARM.extab:C52E80E4 43 EA 09 03 ORR.W R3, R3, R9 .text&ARM.extab:C52E80E4 .text&ARM.extab:C52E80E8 .text&ARM.extab:C52E80E8 loc_C52E80E8 .text&ARM.extab:C52E80E8 01 2B CMP R3, #1 .text&ARM.extab:C52E80EA FD D1 BNE loc_C52E80E8 .text&ARM.extab:C52E80EA .text&ARM.extab:C52E80EC BC F1 13 0F CMP.W R12, #0x13 .text&ARM.extab:C52E80F0 4F F0 00 03 MOV.W R3, #0 .text&ARM.extab:C52E80F4 4F EA 05 14 MOV.W R4, R5,LSL#4 .text&ARM.extab:C52E80F8 C8 BF IT GT .text&ARM.extab:C52E80FA 01 23 MOVGT R3, #1 .text&ARM.extab:C52E80FC B4 F5 95 7F CMP.W R4, #0x12A .text&ARM.extab:C52E8100 4F F0 00 04 MOV.W R4, #0 .text&ARM.extab:C52E8104 B8 BF IT LT .text&ARM.extab:C52E8106 01 24 MOVLT R4, #1 .text&ARM.extab:C52E8108 23 43 ORRS R3, R4 .text&ARM.extab:C52E810A 43 EA 09 03 ORR.W R3, R3, R9 .text&ARM.extab:C52E810A .text&ARM.extab:C52E810E .text&ARM.extab:C52E810E loc_C52E810E .text&ARM.extab:C52E810E 01 2B CMP R3, #1 .text&ARM.extab:C52E8110 FD D1 BNE loc_C52E810E .text&ARM.extab:C52E8110 .text&ARM.extab:C52E8112 BA F1 DC 0F CMP.W R10, #0xDC ; 判断指令是否为0xDC .text&ARM.extab:C52E8116 01 D1 BNE loc_C52E811C .text&ARM.extab:C52E8116 .text&ARM.extab:C52E8118 DC 23 MOVS R3, #0xDC .text&ARM.extab:C52E811A 23 E0 B loc_C52E8164 ; 写指令 .text&ARM.extab:C52E811A .text&ARM.extab:C52E811C .text&ARM.extab:C52E811C loc_C52E811C .text&ARM.extab:C52E811C B8 F1 71 0F CMP.W R8, #0x71 ; 'q' .text&ARM.extab:C52E8120 4F F0 00 03 MOV.W R3, #0 .text&ARM.extab:C52E8124 C8 BF IT GT .text&ARM.extab:C52E8126 01 23 MOVGT R3, #1 .text&ARM.extab:C52E8128 BC F1 D8 0F CMP.W R12, #0xD8 .text&ARM.extab:C52E812C 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52E8130 B8 BF IT LT .text&ARM.extab:C52E8132 01 26 MOVLT R6, #1 .text&ARM.extab:C52E8134 09 2D CMP R5, #9 .text&ARM.extab:C52E8136 03 EA 06 03 AND.W R3, R3, R6 .text&ARM.extab:C52E813A 4F F0 00 06 MOV.W R6, #0 .text&ARM.extab:C52E813E C8 BF IT GT .text&ARM.extab:C52E8140 01 26 MOVGT R6, #1 .text&ARM.extab:C52E8142 BB F1 00 0F CMP.W R11, #0 .text&ARM.extab:C52E8146 18 BF IT NE .text&ARM.extab:C52E8148 4F F0 01 0B MOVNE.W R11, #1 .text&ARM.extab:C52E814C 06 EA 0B 06 AND.W R6, R6, R11 .text&ARM.extab:C52E8150 83 EA 06 05 EOR.W R5, R3, R6 .text&ARM.extab:C52E8154 33 43 ORRS R3, R6 .text&ARM.extab:C52E8156 83 F0 01 03 EOR.W R3, R3, #1 .text&ARM.extab:C52E815A 2B 43 ORRS R3, R5 .text&ARM.extab:C52E815A .text&ARM.extab:C52E815C .text&ARM.extab:C52E815C loc_C52E815C .text&ARM.extab:C52E815C 01 2B CMP R3, #1 .text&ARM.extab:C52E815E FD D1 BNE loc_C52E815C .text&ARM.extab:C52E815E .text&ARM.extab:C52E8160 6F EA 0A 03 MVN.W R3, R10 ; 解密指令 R10按位取反 .text&ARM.extab:C52E8160 .text&ARM.extab:C52E8164 .text&ARM.extab:C52E8164 loc_C52E8164 .text&ARM.extab:C52E8164 8B 54 STRB R3, [R1,R2] ; 写指令 .text&ARM.extab:C52E8166 01 32 ADDS R2, #1 .text&ARM.extab:C52E8168 83 68 LDR R3, [R0,#8] ; 取指令长度 .text&ARM.extab:C52E816A 9A 42 CMP R2, R3 ; 判断是否结束 .text&ARM.extab:C52E816C FF F4 3B AF BCC.W loc_C52E7FE6 ; base++ .text&ARM.extab:C52E816C .text&ARM.extab:C52E8170 .text&ARM.extab:C52E8170 loc_C52E8170 .text&ARM.extab:C52E8170 01 20 MOVS R0, #1 .text&ARM.extab:C52E8172 01 B0 ADD SP, SP, #4 .text&ARM.extab:C52E8174 BD E8 00 0F POP.W {R8-R11} .text&ARM.extab:C52E8178 F0 BD POP {R4-R7,PC}
被抽走后的指令存储格式：
6C C6 FF 03 37 1E 38 00 08 00 00 00 xxxxxxx Debug info 指令长度 指令
五、Native原理分析
主要是通过解析smali代码进行了通过JNI反射调用等价的语义转换,转为了C代码，执行时通过FindClass、GetStaticMethodID、GetMethodID、CallxxxMethod。
我是通过JNItrace来分析，如图5-1所示：
图5-1
六、总结
壳整体是指令抽取加方法native化二者结合，所有被抽走的指令还原后dump出来也能分析出80%左右的代码，其它被native化的用JNItrace配合分析，所以用该加固方案客户端代码安全性一般。接下来就可以继续进行APP渗透分析。
欢迎关注公众号
文章来源: https://www.cnblogs.com/2014asm/p/16120746.html
如有侵权请联系:admin#unsafe.sh
如有侵权请联系:admin#unsafe.sh