前言

继续上一篇分享，本文主要分享下怎么使用 unidbg 跑起来。话不多说直接开干

unidbg

老规矩，先搭架子

package com.xiayu.meituxiuxiu;

import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Emulator;
import com.github.unidbg.Module;
import com.github.unidbg.debugger.BreakPointCallback;
import com.github.unidbg.debugger.Debugger;
import com.github.unidbg.debugger.DebuggerType;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.linux.android.dvm.array.ArrayObject;
import com.github.unidbg.linux.android.dvm.array.ByteArray;
import com.github.unidbg.memory.Memory;
import unicorn.ArmConst;

import java.io.File;
import java.io.IOException;
import java.security.MessageDigest;

public class GetSig_v9080Test extends AbstractJni {
    private final AndroidEmulator emulator;
    private final Module module;
    private final VM vm;

    public String apkPath = "/Volumes/T7/android/android-file/meituxiuxiu-9.0.8.0.apk";
    public String soPath2 = "unidbg-android/src/test/resources/test_so/meituxiuxiu/librelease_sig-9.0.8.0.so";

    GetSig_v9080Test() {
        emulator = AndroidEmulatorBuilder.for32Bit().build();
        final Memory memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23));
        vm = emulator.createDalvikVM(new File(apkPath));
        vm.setVerbose(true);
        vm.setJni(this);

        DalvikModule dm2 = vm.loadLibrary(new File(soPath2), true);
        dm2.callJNI_OnLoad(emulator);
        module = dm2.getModule();

    }

    public static void main(String[] args) {
        GetSig_v9080Test getSig = new GetSig_v9080Test();
        getSig.destroy();
    }

    private void destroy() {
        try {
            emulator.close();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

又是熟悉的 bug，这里依赖了 libgnustl_shared.so 我们给他加上

跑起来，发现啥都没有输出，这没啥事，只要没报错就是好事。下面直接 call 函数

注意这里的 byte[][] 类型，千万不要直接 vm.resolveClass("[[B") 这样在后面取值会报错，需要使用 ArrayObject + ByteArray 构建（龙哥指点）

public ArrayObject getByteByte() {
    String[] arg5 = {这里大家自行填充 frida hook 出来的参数即可};

    DvmObject<?>[] dvm = new DvmObject<?>[arg5.length];
    for (int v1 = 0; v1 < arg5.length; ++v1) {
        if (arg5[v1] == null) {
            arg5[v1] = "";
        }
        dvm[v1] = new ByteArray(vm, arg5[v1].getBytes());
    }

    return new ArrayObject(dvm);
}

public void call() {
    String methodId = "nativeGeneratorSig(Ljava/lang/String;[[BLjava/lang/String;Ljava/lang/Object;)Lcom/meitu/secret/SigEntity;";
    DvmClass SigEntity = vm.resolveClass("com/meitu/secret/SigEntity");

    SigEntity.callStaticJniMethodObject(
            emulator, methodId,
            new StringObject(vm, "search/feeds.json"),
            getByteByte(),
            new StringObject(vm, "6184556633574670337"),
            vm.resolveClass("android/content/Context").newObject(null)
    );
}