4: void com.example.atry.MainActivity.onClick(android.view.View) (dex_method_idx=18) DEX CODE: 0x0000: const/4 v0, #+2 0x0001: const-wide/16 v2, #+5 0x0003: invoke-virtual {v4, v0, v2, v3}, void com.example.atry.MainActivity.nativeTest(int, long) // method@17 0x0006: return-void OAT DATA: frame_size_in_bytes: 64 core_spill_mask: 0x00008060 (r5, r6, r15) fp_spill_mask: 0x00000000 vmap_table: 0xf722d58a (offset=0x0000258a) v3/r5, v4/r6, v65535/r15 mapping_table: 0xf722d584 (offset=0x00002584) gc_map: 0xf722d590 (offset=0x00002590) CODE: 0xf722d51d (offset=0x0000251d size=104)... 0xf722d51c: f8d9c010 ldr.w r12, [r9, #16] ; stack_end_ 0xf722d520: e92d4060 push {r5, r6, lr} 0xf722d524: f2ad0e34 subw lr, sp, #52 0xf722d528: 45e6 cmp lr, r12 0xf722d52a: f0c08024 bcc.w +72 (0xf722d576) 0xf722d52e: 46f5 mov sp, lr 0xf722d530: 9000 str r0, [sp, #0] 0xf722d532: 1c0e mov r6, r1 0xf722d534: 9212 str r2, [sp, #72] 0xf722d536: 2202 movs r2, #2 0xf722d538: 9208 str r2, [sp, #32] 0xf722d53a: 2305 movs r3, #5 0xf722d53c: f04f0c00 mov.w r12, ThumbExpand(0) 0xf722d540: e9cd3c0a 0xf722d544: 9b0b ldr r3, [sp, #44] 0xf722d546: 1c31 mov r1, r6 0xf722d548: f8d1e000 ldr.w lr, [r1, #0] 0xf722d54c: 9304 str r3, [sp, #16] 0xf722d54e: 9304 str r3, [sp, #16] 0xf722d550: f8dee034 ldr.w lr, [lr, #52] 0xf722d554: 9b0a ldr r3, [sp, #40] 0xf722d556: 2202 movs r2, #2 0xf722d558: f8de0544 ldr.w r0, [lr, #1348] 0xf722d55c: f8d0e028 ldr.w lr, [r0, #40] 0xf722d560: 47f0 blx lr suspend point dex PC: 0x0003 GC map objects: v4 (r6), v5 ([sp + #72]) 0xf722d562: 3c01 subs r4, #1 0xf722d564: f0008003 beq.w +6 (0xf722d56e) 0xf722d568: b00d add sp, sp, #52 0xf722d56a: e8bd8060 pop {r5, r6, pc} 0xf722d56e: f8d9e25c ldr.w lr, [r9, #604] ; pTestSuspend 0xf722d572: 47f0 blx lr suspend point dex PC: 0x0006 0xf722d574: e7f8 b -16 (0xf722d568) 0xf722d576: f8dde008 ldr.w lr, [sp, #8] 0xf722d57a: b003 add sp, sp, #12 0xf722d57c: f8d9c274 ldr.w r12, [r9, #628] ; pThrowStackOverflow 0xf722d580: 4760 bx r12 0xf722d582: 0000 lsls r0, r0, #0
class MANAGED ArtMethod : public Object {…protected: Class* declaring_class_; uint32_t access_flags_; uint32_t code_item_offset_; const void* entry_point_from_compiled_code_; EntryPointFromInterpreter* entry_point_from_interpreter_;….}
ENTRY art_quick_to_interpreter_bridge SETUP_REF_AND_ARGS_CALLEE_SAVE_FRAME mov r1, r9 @ pass Thread::Current mov r2, sp @ pass SP blx artQuickToInterpreterBridge @ (Method* method, Thread*, SP) ldr r2, [r9, #THREAD_EXCEPTION_OFFSET] @ load Thread::Current()->exception_ ldr lr, [sp, #44] @ restore lr add sp, #48 @ pop frame .cfi_adjust_cfa_offset -48 cbnz r2, 1f @ success if no exception is pending bx lr @ return on success1: DELIVER_PENDING_EXCEPTIONEND art_quick_to_interpreter_bridge
4: void com.example.atry.MainActivity.onClick(android.view.View) (dex_method_idx=18) DEX CODE: 0x0000: const/4 v0, #+2 0x0001: const-wide/16 v2, #+5 0x0003: invoke-virtual {v4, v0, v2, v3}, void com.example.atry.MainActivity.nativeTest(int, long) // method@17 0x0006: return-void CODE: 0xf722d51d (offset=0x0000251d size=104)... 0xf722d51c: f8d9c010 ldr.w r12, [r9, #16] ; stack_end_ 0xf722d520: e92d4060 push {r5, r6, lr} 0xf722d524: f2ad0e34 subw lr, sp, #52 0xf722d528: 45e6 cmp lr, r12 0xf722d52a: f0c08024 bcc.w +72 (0xf722d576) //上面都是检查是否调用函数层数太多,防止栈溢出。 0xf722d52e: 46f5 mov sp, lr 0xf722d530: 9000 str r0, [sp, #0] 0xf722d532: 1c0e mov r6, r1 0xf722d534: 9212 str r2, [sp, #72] 0xf722d536: 2202 movs r2, #2 0xf722d538: 9208 str r2, [sp, #32] 0xf722d53a: 2305 movs r3, #5 0xf722d53c: f04f0c00 mov.w r12, ThumbExpand(0) 0xf722d540: e9cd3c0a 0xf722d544: 9b0b ldr r3, [sp, #44] 0xf722d546: 1c31 mov r1, r6 0xf722d548: f8d1e000 ldr.w lr, [r1, #0] 0xf722d54c: 9304 str r3, [sp, #16] 0xf722d54e: 9304 str r3, [sp, #16] 0xf722d550: f8dee034 ldr.w lr, [lr, #52] 0xf722d554: 9b0a ldr r3, [sp, #40] 0xf722d556: 2202 movs r2, #2//上面都是在构造参数,准备调用下个函数 0xf722d558: f8de0544 ldr.w r0, [lr, #1348] //找到了被调用函数nativeTest 0xf722d55c: f8d0e028 ldr.w lr, [r0, #40]//取出被调用函数首地址偏移40的地址 0xf722d560: 47f0 blx lr//跳转到偏移40处的地址 …
static jint hook_zposed_method(JNIEnv* env, jobject thiz, jobject method) { jmethodID methid = (*env)->FromReflectedMethod(env, method); int artmeth = (int) methid; int* quick_entry_32 = (int*) (artmeth + 40); jint ptr = (jint)* quick_entry_32; *quick_entry_32 = (int) (&art_quick_proxy);/* int* access_flag = (int*) (artmeth + METHOD_ACCESS_FLAG); *access_flag = *access_flag | kAccNative; int* mapping_table = (int*) (artmeth + METHOD_MAPPING_TABLE); *mapping_table = 0;*/ return ptr;}
ENTRY art_quick_dispatcher push {r4, r5, lr} @ sp - 12 …blx artQuickToDispatcher pop {r4, r5, pc} @ success, r0 and r1 hold the resultEND art_quick_dispatcher
ENTRY art_quick_proxy push {r0-r7} mov r7, lr mov r0, #9//标号为9的函数是我预写的java函数 bl exe_switch_entry//执行这个java函数,exe_switch_entry也是我写的一段汇编代码… mov lr, r7 pop {r0-r7}…
#define METHOD_ACCESS_FLAG 20#define METHOD_MAPPING_TABLE 60#define kAccNative 0x0100#define kAccStatic 0x0008… int* access_flag = (int*) (artmeth + METHOD_ACCESS_FLAG); *access_flag = *access_flag | kAccNative; int* mapping_table = (int*) (artmeth + METHOD_MAPPING_TABLE); *mapping_table = 0;…
private static int onHookInt(Object artmethod, Object receiver, Object[] args) { return (Integer) HookManager.onHooked(artmethod, receiver, args); } private static long onHookLong(Object artmethod, Object receiver, Object[] args) { return (Long) HookManager.onHooked(artmethod, receiver, args); } private static double onHookDouble(Object artmethod, Object receiver, Object[] args) { return (Double) HookManager.onHooked(artmethod, receiver, args); } private static char onHookChar(Object artmethod, Object receiver, Object[] args) { return (Character) HookManager.onHooked(artmethod, receiver, args); } private static short onHookShort(Object artmethod, Object receiver, Object[] args) { return (Short) HookManager.onHooked(artmethod, receiver, args); } private static float onHookFloat(Object artmethod, Object receiver, Object[] args) { return (Float) HookManager.onHooked(artmethod, receiver, args); } private static Object onHookObject(Object artmethod, Object receiver, Object[] args) { return HookManager.onHooked(artmethod, receiver, args); } private static boolean onHookBoolean(Object artmethod, Object receiver, Object[] args) { return (Boolean) HookManager.onHooked(artmethod, receiver, args); } private static byte onHookByte(Object artmethod, Object receiver, Object[] args) { return (Byte) HookManager.onHooked(artmethod, receiver, args);}
联系客服