Android逆向- 运行时修改字节码

2019-09-26

之前的笔记搬运

动态修改字节码的实现原理:

1. 先获取指定函数地址
2. 再获取通过Method结构, 获取指令
3. 再Hook虚拟机的 dvmResolveClass, 这个函数是解释字节码并执行的函数, 参数中记录了被调用的Class信息, 根据这些信息去动态修改指定类还原指令;


ps:
脱壳时一般可以看看dvmResolveClass有没有被hook, 被Hook了一般就可以得到解密代码;

修改字节码部分

#include <jni.h>
#include <stdio.h>
#include <android/log.h>
#include <sys/mman.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
#include <limits.h>


typedef unsigned char u1;
typedef unsigned short u2;
typedef unsigned int u4;
typedef unsigned long long u8;

#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG, "pack2", __VA_ARGS__)


struct DexProto {
    const void* dexFile;
    u4 protoIdx;
};

struct Method {
    void*    		clazz;
    u4              accessFlags;
    u2             methodIndex;
    u2              registersSize;  /* ins + locals */
    u2              outsSize;
    u2              insSize;
    const char*     name;
    DexProto        prototype;
    const char*     shorty;
    const u2*       insns;          /* instructions, in memory-mapped .dex */
    int             jniArgInfo;
    void* 			nativeFunc;
    bool 			fastJni;
    bool 			noRef;
    bool 			shouldTrace;
    const void* 	registerMap;
    bool            inProfile;
};


JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM* vm, void* reserved)
{
	JNIEnv *pEnv = NULL;
	vm->GetEnv((void**)&pEnv, JNI_VERSION_1_6);

	LOGD("JNI_OnLoad");

	//动态修改字节码

	//1.定位Add函数代码内存位置
	jclass cls = pEnv->FindClass("cr25/pack2/MainActivity");
	jmethodID AddMethod = pEnv->GetMethodID(cls, "Add", "(II)I");
	Method *pMethod = (Method*)AddMethod;
	LOGD("name:%s shorty:%s insns=%p", pMethod->name, pMethod->shorty, pMethod->insns);
	LOGD("insns:");
	for (int i = 0; i < 6; i++)
	{
	    LOGD("%02X", *((u1*)pMethod->insns + i));
	}


	//修改内存保护属性
	int PageSize = sysconf(_SC_PAGE_SIZE);
	if (mprotect((u1*)((u4)pMethod->insns & (~(PageSize - 1))), PageSize, PROT_READ | PROT_WRITE) < 0)
	{
	    LOGD("mprotect error:%s", strerror(errno));
	}


	*((u1*)pMethod->insns) = 0x91;

	return JNI_VERSION_1_6;
}