duangsues.is_a? SaltedFish
貌似没用 Android API，所以我应该可以在 Python 里试试这个函数
package com.coolapk.market.util用法：以 UUID 为参数调用来生成 Token
object AuthUtils {
external fun getAS(str: String): String
init {
System.loadLibrary("a")
}
}
su
/data/data/com.hipipal.qpy3/files/bin/python-root
from ctypes import *
import ctypes
c=ctypes.CDLL("/sdcard/liba.so")
c.Java_com_coolapk_market_util_AuthUtils_getAS.restype = c_char_p
c.Java_com_coolapk_market_util_AuthUtils_getAS.argtypes = [c_char_p]
c.Java_com_coolapk_market_util_AuthUtils_getAS
sb=create_string_buffer(b'2e0dc2d2-b18f-47f1-a83a-d503922e8656')
c.Java_com_coolapk_market_util_AuthUtils_getAS(sb)
Segmentation fault
#tech #emmm 老李说的没错，我对底层的确非常无知了（
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Emulate code to find computed references (aae)
[x] Analyze consecutive function (aat)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Type matching analysis for all functions (afta)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Emulate code to find computed references (aae)
[x] Analyze consecutive function (aat)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Type matching analysis for all functions (afta)
有价值看的函数：
BD（12 Basic Blocks）
BDL（3 Basic Blocks）
BE（9 Basic Blocks）
BEL（Simple，1 Basic Block）
Java_com_coolapk_market_util_AuthUtils_getAS （restype = const char* argtypes=[const char*]，1 Basic Blocks）
（Called r、BDL、bd、strlen、memecpy、time、sprintf、strcat、BEL、be、me）
r（Simple，4 Basic blocks，called strlen）
me（6 Basic Blocks，called MI、MU、MF）