hookZz,Dobby,xHook,consoleDebugger

//简单的需求可以调用Unicorn对虚拟内存进行修改
public void patchVerify(){
     int patchCode = 0x4FF00100; //
     emulator.getMemory().pointer(module.base + 0x1E86).setInt(0,patchCode);
 }


//HOOZZ

public void HookMDStringold(){
  // 加载HookZz
  IHookZz hookZz = HookZz.getInstance(emulator);

  hookZz.wrap(module.base + 0x1BD0 + 1, new WrapCallback<HookZzArm32RegisterContext>() { // inline wrap导出函数
      @Override
      // 类似于 frida onEnter
      public void preCall(Emulator<?> emulator, HookZzArm32RegisterContext ctx, HookEntryInfo info) {
          // 类似于Frida args[0]
          Pointer input = ctx.getPointerArg(0);
          System.out.println("input:" + input.getString(0));
      };

      @Override
      // 类似于 frida onLeave
      public void postCall(Emulator<?> emulator, HookZzArm32RegisterContext ctx, HookEntryInfo info) {
          Pointer result = ctx.getPointerArg(0);
          System.out.println("input:" + result.getString(0));
      }
  });
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

package com.dta.lesson2;

import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Emulator;
import com.github.unidbg.Module;
import com.github.unidbg.arm.HookStatus;
import com.github.unidbg.arm.backend.DynarmicFactory;
import com.github.unidbg.arm.context.RegisterContext;
import com.github.unidbg.debugger.BreakPointCallback;
import com.github.unidbg.debugger.DebuggerType;
import com.github.unidbg.hook.HookContext;
import com.github.unidbg.hook.ReplaceCallback;
import com.github.unidbg.hook.hookzz.*;
import com.github.unidbg.hook.xhook.IxHook;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.XHookImpl;
import com.github.unidbg.linux.android.dvm.DalvikModule;
import com.github.unidbg.linux.android.dvm.DvmObject;
import com.github.unidbg.linux.android.dvm.StringObject;
import com.github.unidbg.linux.android.dvm.VM;
import com.github.unidbg.linux.android.dvm.jni.ProxyDvmObject;
import com.github.unidbg.memory.Memory;
import com.github.unidbg.pointer.UnidbgPointer;
import com.github.unidbg.utils.Inspector;
import com.sun.jna.Pointer;
import net.dongliu.apk.parser.Main;
import unicorn.ArmConst;

import java.io.File;
import java.util.ArrayList;
import java.util.List;

import static com.dta.lesson2.AesKeyFinder.readFuncFromIDA;

public class MainActivity {
    private final AndroidEmulator emulator;
    private final VM vm;
    private final Memory memory;
    private final Module module;

    public MainActivity(){
        emulator = AndroidEmulatorBuilder
                .for32Bit()
                //.setProcessName()
                //.setRootDir()
                //.setRootDir(new File("target/rootfs/default"))
                //.addBackendFactory(new DynarmicFactory(true))
                .build();

        vm = emulator.createDalvikVM();

        memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23));

        DalvikModule dalvikModule = vm.loadLibrary(new File("unidbg-android/src/test/java/com/dta/lesson2/libtest-lib.so"), true);
        module = dalvikModule.getModule();

        vm.callJNI_OnLoad(emulator,module);
    }

    public void callAes(){
        //emulator.traceCode();
        DvmObject obj = ProxyDvmObject.createObject(vm,this);
        obj.callJniMethod(emulator, "aes(II)V");
    }

    public static void main(String[] args) {
        long start = System.currentTimeMillis();
        MainActivity mainActivity = new MainActivity();
        mainActivity.keyFinder();
        //mainActivity.hookZz();
        //mainActivity.consoleDebugger();

        System.out.println("load the vm "+( System.currentTimeMillis() - start )+ "ms");
        mainActivity.callAes();
    }

    private void consoleDebugger() {
        emulator.attach().addBreakPoint(module.base + 0x20ad, new BreakPointCallback() {
            @Override
            public boolean onHit(Emulator<?> emulator, long address) {
                //xx
                return false;
            }
        });
    }

    private void hookZz() {
        HookZz hookZz = HookZz.getInstance(emulator);
        hookZz.wrap(module.base + 0x20ad, new WrapCallback<HookZzArm32RegisterContextImpl>() {
            @Override
            public void preCall(Emulator<?> emulator, HookZzArm32RegisterContextImpl ctx, HookEntryInfo info) {
                UnidbgPointer arg0 = ctx.getPointerArg(0);
                UnidbgPointer arg1 = ctx.getPointerArg(1);
                System.out.println("0x20ad_OnEnter: arg0=>"+arg0.getString(0));
                //System.out.println("0x20ad_OnEnter: arg1=>"+);
                Inspector.inspect(arg1.getByteArray(0,200),"0x20ad_OnEnter_arg1");
                ctx.push(arg1);
            }

            @Override
            public void postCall(Emulator<?> emulator, HookZzArm32RegisterContextImpl ctx, HookEntryInfo info) {
                UnidbgPointer arg1 = ctx.pop();
                Inspector.inspect(arg1.getByteArray(0,200),"0x20ad_OnLeave_arg1");
                super.postCall(emulator, ctx, info);
            }
        });
//        hookZz.replace(module.base + 0x20ad, new ReplaceCallback() {
//            @Override
//            public HookStatus onCall(Emulator emulator, HookContext context, long originFunction) {
//                emulator.getBackend().reg_write(ArmConst.UC_ARM_REG_R0,1);
//                return super.onCall(emulator, context, context.getLR());
//            }
//
//            @Override
//            public void postCall(Emulator emulator, HookContext context) {
//                super.postCall(emulator, context);
//            }
//        },true);
//        Dobby dobby = Dobby.getInstance(emulator);
//        dobby.replace(module.base + 0x20ad, new ReplaceCallback() {
//            @Override
//            public HookStatus onCall(Emulator emulator, HookContext context, long originFunction) {
//                //HookStatus.RET(emulator,originFunction);
//                return super.onCall(emulator, context, originFunction);
//            }
//
//            @Override
//            public void postCall(Emulator emulator, HookContext context) {
//                super.postCall(emulator, context);
//            }
//        },true);
//
//        IxHook ixHook = XHookImpl.getInstance(emulator);
//        ixHook.register("libtest-lib.so", "_Z17aes_key_expansionPhS_", new ReplaceCallback() {
//            @Override
//            public HookStatus onCall(Emulator emulator, HookContext context, long originFunction) {
//                return super.onCall(emulator, context, originFunction);
//            }
//
//            @Override
//            public void postCall(Emulator emulator, HookContext context) {
//                super.postCall(emulator, context);
//            }
//        });
//        ixHook.refresh();


    }

    private void keyFinder() {
        List<String> funclist = readFuncFromIDA("unidbg-android/src/test/java/com/dta/lesson2/libtest-lib_functionlist_1636779320.txt");
        AesKeyFinder aesKeyFinder = new AesKeyFinder(emulator);
        aesKeyFinder.searchEveryFunction(module.base, funclist);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158