public final Number[] callFunction(Emulator<?> emulator, String symbolName, Object... args) {    Symbol symbol = findSymbolByName(symbolName, false);    if (symbol == null) {        throw new IllegalStateException("find symbol failed: " + symbolName);    }    if (symbol.isUndef()) {        throw new IllegalStateException(symbolName + " is NOT defined");    }     return symbol.call(emulator, args);}

  emulator = createARMEmulator();

private static void CallVMPFunc(Module module,AndroidEmulator emulator){    try {         Symbol malloc = module.findSymbolByName("malloc");        Symbol free = module.findSymbolByName("free");        MemoryBlock block = MemoryAllocBlock.malloc(emulator,malloc,free,0x1000);        MemoryBlock namebyte = MemoryAllocBlock.malloc(emulator,malloc,free,0x1000);        UnidbgPointer blockpoint = block.getPointer();        UnidbgPointer namepoint = namebyte.getPointer();         String name = "magicillusion";        String data = "hello worid";         namepoint.write(name.getBytes());        blockpoint.write(data.getBytes());      Number[] ret = module.callFunction(emulator,0x13B30+1,namepoint,blockpoint,2);      UnidbgPointer ret1 = new UnidbgPointer(emulator,ret[0].intValue(),4);        String string = ret1.getString(0);    System.out.println("Number => " +  (string));      } finally {     }  }

// 1. 获取HookZz对象IHookZz hookZz = HookZz.getInstance(emulator); // 加载HookZz，支持inline hook，文档看https://github.com/jmpews/HookZz// 2. enable hookhookZz.enable_arm_arm64_b_branch(); // 测试enable_arm_arm64_b_branch，可有可无index = 0; hookZz.replace(module.findSymbolByName("lrand48"), new ReplaceCallback() {    @Override    public void postCall(Emulator<?> emulator, HookContext context) {             ((EditableArm32RegisterContext)context).setR0(0x12345678);         int ptrace_args0 = context.getIntArg(0);        System.out.println("lrand48=" + ptrace_args0);     }  },true);  //aesdecode hookhookZz.wrap((module.base)+0x39634+1, new WrapCallback<RegisterContext>() { // inline wrap导出函数    UnidbgPointer addr = null;     @Override    // 4. 方法执行前    public void preCall(Emulator<?> emulator, RegisterContext ctx, HookEntryInfo info) {        addr= ctx.getPointerArg(0);        UnidbgPointer pointerArg = ctx.getPointerArg(1);        UnidbgPointer pointer = pointerArg.getPointer(12);        int anInt = pointerArg.getInt(8);        byte[] byteArray = pointer.getByteArray(0, anInt);        String s =xuzi1(byteArray);        System.out.println("aes aesdecode= " + s);     }     @Override    // 5. 方法执行后    public void postCall(Emulator<?> emulator, RegisterContext ctx, HookEntryInfo info) {         byte[] aaaa = addr.getPointer(0).getPointer(12).getByteArray(0,0x30);        String s =xuzi1(aaaa);        System.out.println("aes aesdecode1= " + s);    } });

# 往期推荐

1.分析一个安卓简单CrackMe

2. NtSockets - 直接与驱动通信实现sockets

3.JLink固件漏洞

4. CVE-2022-0995分析（内核越界 watch_queue_set_filter）

5.ZJCTF2021 Reverse-Triple Language

6. Docker-remoter-api渗透