unidbg直接調用so文件內方法

參考文檔https://blog.csdn.net/weixin_43582101/article/details/108012579

1.環境安裝

Maven https://www.jianshu.com/p/eddcc16dd9af

Jdk

2.unidbg的安裝

unidbg下載鏈接： https://github.com/zhkl0228/unidbg

3.調用模板以及介紹

package com.bytedance.frameworks.core.encrypt;

import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Module;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.DalvikModule;
import com.github.unidbg.linux.android.dvm.DvmClass;
import com.github.unidbg.linux.android.dvm.VM;
import com.github.unidbg.linux.android.dvm.array.ByteArray;
import com.github.unidbg.memory.Memory;
import com.github.unidbg.linux.android.dvm.DvmClass;
import java.util.Arrays;
import java.io.File;

public class test {
    public static void main(String[] args) {
        AndroidEmulator emulator = AndroidEmulatorBuilder.for32Bit().setProcessName("com.fuck.you").build(); // 創建模擬器實例，要模擬32位或者64位，在這裏區分
        final Memory memory = emulator.getMemory(); // 模擬器的內存操作接口
        memory.setLibraryResolver(new AndroidResolver(23)); // 設置系統類庫解析
        VM vm = emulator.createDalvikVM(); // 創建Android虛擬機
        vm.setVerbose(true); // 設置是否打印Jni調用細節
        DalvikModule dm = vm.loadLibrary(new File("/Users/a3530/Desktop/unidbg-master/unidbg-android/target/test-classes/example_binaries/libttEncrypt_2.so"), false); // 加載libttEncrypt.so到unicorn虛擬內存，加載成功以後會默認調用init_array等函數
        dm.callJNI_OnLoad(emulator); // 手動執行JNI_OnLoad函數
        Module module = dm.getModule(); // 加載好的libttEncrypt.so對應爲一個模塊
        DvmClass TTEncryptUtils = vm.resolveClass("com/bytedance/frameworks/core/encrypt/TTEncryptUtils");  //java中方法
        System.out.println("開始");
        byte[] data = {31, -117, 8, 0, 40, 38, 55, 97, 2, -1, 21, -54, 77, 10, -128, 32, 16, 64, -31, -85, -60, -84, 91, 56, 26, 17, 93, 102, -112, 28, 76, -56, -97, -46, 32, 18, -17, -98, 109, -33, -5, 42, 120, 109, -35, 70, 69, 91, 88, 7, -56, -103, 116, 74, 116, 68, 11, -29, 0, 59, 107, -61, 87, -17, 21, 98, -30, 112, 27, 103, 126, -12, -68, -26, -108, 10, -95, 117, 66, -106, 3, 21, -25, -71, 15, -100, 21, 10, 49, 73, 33, 22, -60, -10, 1, -18, -112, -23, 113, 90, 0, 0, 0};
        System.out.println(convertByteToHexString(data));
        ByteArray result_list =TTEncryptUtils.callStaticJniMethodObject(emulator,"handleData([BI)[B",data,data.length);  //其中handleData([BI)[B是smail語法,方法名(入參數據類型1入參數據類型2)出參 [B數組 I數字
        System.out.println(result_list.getValue());  //看情況
    }
}